@dsh-workbench/core 0.1.18 → 0.2.1

package/dist/host/index.js

@@ -11,9 +11,11 @@ var PREFS_PREFIX = `${API_PREFIX}/prefs`;
 var EVENTS_PATH = "/workbench/events";
 var ACTIONS_PREFIX = `${API_PREFIX}/actions`;
 var PROVISION_PREFIX = `${API_PREFIX}/provision`;
+var PANEL_STATE_PREFIX = `${API_PREFIX}/panel-state`;
 var OPENCLI_PIN = "1.8.8";
 var PANELS_SERVICE = "workbenchPanels";
 var UNITS_SERVICE = "workbenchUnits";
+var PANEL_STATE_SERVICE = "workbenchPanelState";
 var OPENCLI_TIMEOUT_MS = 12e4;
 var WARM_TIMEOUT_MS = 2e4;
 var INSTALL_TIMEOUT_MS = 3e5;
@@ -50,6 +52,11 @@ function parseMarkers(text) {
 	}
 	return refs;
 }
+//#endregion
+//#region ../shared/dist/api/unit.js
+function hasEnvSupply(manifest) {
+	return (manifest.env?.plugins ?? []).length > 0 || (manifest.env?.libs ?? []).length > 0;
+}
 var SUPPORTED_API_VERSIONS = [1];
 var DECLARATION_KEYS = [
 	"apiVersion",
@@ -212,6 +219,267 @@ function parseJsonLoose(text) {
 		}
 	}
 }
+var PANEL_STATE_MAX_TEXT = 2e3;
+var PHASES = [
+	"idle",
+	"loading",
+	"ready",
+	"error"
+];
+function asRecord$10(value) {
+	return typeof value === "object" && value !== null ? value : void 0;
+}
+function textOf$6(value, max) {
+	if (typeof value !== "string") return "";
+	const trimmed = value.trim();
+	return trimmed.length > max ? trimmed.slice(0, max) : trimmed;
+}
+function atOf(value) {
+	if (typeof value !== "number" || !Number.isFinite(value)) return null;
+	if (value < 0) return null;
+	return Math.trunc(value);
+}
+function errorOf(raw) {
+	const record = asRecord$10(raw);
+	if (record === void 0) return void 0;
+	const code = textOf$6(record["code"], 120);
+	const message = textOf$6(record["message"], PANEL_STATE_MAX_TEXT);
+	if (code === "" && message === "") return void 0;
+	return {
+		code: code === "" ? "unknown" : code,
+		message
+	};
+}
+function parseCardsReport(payload) {
+	const record = asRecord$10(payload);
+	if (record === void 0) return {
+		ok: false,
+		message: "请求体要是一个对象"
+	};
+	const workspace = textOf$6(record["workspace"], PANEL_STATE_MAX_TEXT);
+	if (workspace === "") return {
+		ok: false,
+		message: "workspace 不能是空的 —— 面板按工作区存"
+	};
+	const raw = record["cards"];
+	if (!Array.isArray(raw)) return {
+		ok: false,
+		message: "cards 要是一个数组"
+	};
+	const cards = [];
+	for (const item of raw.slice(0, 32)) {
+		const card = asRecord$10(item);
+		if (card === void 0) continue;
+		const unit = textOf$6(card["unit"], 200);
+		const route = textOf$6(card["route"], 400);
+		const phase = textOf$6(card["phase"], 20);
+		const at = atOf(card["at"]);
+		if (unit === "" || route === "" || at === null || !PHASES.includes(phase)) continue;
+		const error = errorOf(card["error"]);
+		cards.push({
+			unit,
+			route,
+			phase,
+			at,
+			...error === void 0 ? {} : { error }
+		});
+	}
+	if (cards.length === 0) return {
+		ok: false,
+		message: "cards 里没有一条能认的（unit / route / phase / at 都要有）"
+	};
+	return {
+		ok: true,
+		value: {
+			workspace,
+			cards
+		}
+	};
+}
+function parseCrashReport(payload) {
+	const record = asRecord$10(payload);
+	if (record === void 0) return {
+		ok: false,
+		message: "请求体要是一个对象"
+	};
+	const workspace = textOf$6(record["workspace"], PANEL_STATE_MAX_TEXT);
+	const unit = textOf$6(record["unit"], 200);
+	const reason = textOf$6(record["reason"], PANEL_STATE_MAX_TEXT);
+	if (workspace === "") return {
+		ok: false,
+		message: "workspace 不能是空的"
+	};
+	if (unit === "") return {
+		ok: false,
+		message: "unit 不能是空的"
+	};
+	if (reason === "") return {
+		ok: false,
+		message: "reason 不能是空的（没有原因的崩溃没法查）"
+	};
+	return {
+		ok: true,
+		value: {
+			workspace,
+			unit,
+			reason,
+			at: atOf(record["at"]) ?? Date.now()
+		}
+	};
+}
+function createPanelStateStore() {
+	const workspaces = /* @__PURE__ */ new Map();
+	function trim(entry, max) {
+		while (entry.size > max) {
+			const oldest = entry.keys().next();
+			if (oldest.done === true) return;
+			entry.delete(oldest.value);
+		}
+	}
+	function workspaceEntryOf(workspace) {
+		const existing = workspaces.get(workspace);
+		if (existing !== void 0) return existing;
+		const created = {
+			at: 0,
+			units: /* @__PURE__ */ new Map()
+		};
+		workspaces.set(workspace, created);
+		trim(workspaces, 64);
+		return created;
+	}
+	function unitEntryOf(entry, unit) {
+		const existing = entry.units.get(unit);
+		if (existing !== void 0) return existing;
+		const created = {
+			at: 0,
+			cards: /* @__PURE__ */ new Map()
+		};
+		entry.units.set(unit, created);
+		return created;
+	}
+	return {
+		cards(report) {
+			const entry = workspaceEntryOf(report.workspace);
+			for (const card of report.cards) {
+				const unit = unitEntryOf(entry, card.unit);
+				unit.cards.delete(card.route);
+				unit.cards.set(card.route, card);
+				trim(unit.cards, 12);
+				if (card.at > unit.at) unit.at = card.at;
+				if (card.at > entry.at) entry.at = card.at;
+			}
+		},
+		crash(report) {
+			const entry = workspaceEntryOf(report.workspace);
+			const unit = unitEntryOf(entry, report.unit);
+			const previous = unit.crash;
+			const counted = previous !== void 0 && previous.reason === report.reason && report.at >= previous.at && report.at - previous.at <= 6e5;
+			unit.crash = {
+				unit: report.unit,
+				reason: report.reason,
+				at: report.at,
+				count: counted ? previous.count + 1 : 1
+			};
+			if (report.at > unit.at) unit.at = report.at;
+			if (report.at > entry.at) entry.at = report.at;
+		},
+		snapshot(workspace) {
+			if (workspace === null) return {
+				workspace: null,
+				at: 0,
+				units: []
+			};
+			const entry = workspaces.get(workspace);
+			if (entry === void 0) return {
+				workspace,
+				at: 0,
+				units: []
+			};
+			const units = [...entry.units.entries()].map(([unit, one]) => {
+				const cards = [...one.cards.values()].sort((a, b) => a.route.localeCompare(b.route));
+				const okAt = cards.reduce((best, card) => card.phase === "ready" && (best === null || card.at > best) ? card.at : best, null);
+				return {
+					unit,
+					at: one.at,
+					okAt,
+					cards,
+					...one.crash === void 0 ? {} : { crash: one.crash }
+				};
+			});
+			units.sort((a, b) => b.at - a.at || a.unit.localeCompare(b.unit));
+			return {
+				workspace,
+				at: entry.at,
+				units
+			};
+		}
+	};
+}
+//#endregion
+//#region ../shared/dist/host/cli-error.js
+function unquote(raw) {
+	const value = raw.trim();
+	if (value.length >= 2 && (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'"))) return value.slice(1, -1);
+	return value;
+}
+function joinBlock(previous, line, fold) {
+	if (previous === "") return line;
+	return fold ? `${previous} ${line}` : `${previous}\n${line}`;
+}
+function parseCliErrorEnvelope(text) {
+	if (text === void 0 || text.trim() === "") return void 0;
+	const lines = text.split("\n");
+	const start = lines.findIndex((line) => /^error:\s*$/.test(line.trim()) || /^error:\s*\S/.test(line.trim()));
+	if (start === -1) return void 0;
+	const scalars = {};
+	let current;
+	let block;
+	const errorIndent = lines[start]?.search(/\S/) ?? 0;
+	for (const line of lines.slice(start + 1)) {
+		if (line.trim() === "") continue;
+		const indent = line.search(/\S/);
+		if (block !== void 0 && indent > block.indent) {
+			scalars[block.key] = joinBlock(scalars[block.key] ?? "", line.trim(), block.fold);
+			continue;
+		}
+		block = void 0;
+		if (indent <= errorIndent) break;
+		const match = /^\s*(code|message|help|exitCode):\s*(.*)$/.exec(line);
+		if (match === null) {
+			if (current !== void 0) scalars[current] = `${scalars[current] ?? ""} ${line.trim()}`.trim();
+			continue;
+		}
+		const [, key, value] = match;
+		if (key === void 0) continue;
+		const raw = (value ?? "").trim();
+		const marker = /^([|>])[0-9]*([+-]?)$/.exec(raw);
+		if (marker !== null) {
+			scalars[key] = "";
+			block = {
+				key,
+				fold: marker[1] === ">",
+				indent
+			};
+			current = key;
+			continue;
+		}
+		scalars[key] = unquote(raw);
+		current = key;
+	}
+	const code = scalars["code"];
+	const message = scalars["message"];
+	if (code === void 0 || code === "") return void 0;
+	const exitCode = scalars["exitCode"];
+	return {
+		code,
+		message: message ?? code,
+		...scalars["help"] === void 0 || scalars["help"] === "" ? {} : { help: scalars["help"] },
+		...exitCode === void 0 || Number.isNaN(Number(exitCode)) ? {} : { exitCode: Number(exitCode) }
+	};
+}
+function helpUrlOf(envelope) {
+	return /https?:\/\/[^\s"'`]+/.exec(envelope.help ?? "")?.[0];
+}
 //#endregion
 //#region ../shared/dist/host/data-root.js
 function dshHome() {
@@ -282,20 +550,20 @@ var PERMISSION_CODES = /* @__PURE__ */ new Set([
 function asRecord$9(value) {
 	return typeof value === "object" && value !== null ? value : void 0;
 }
-function textOf$4(value) {
+function textOf$5(value) {
 	return typeof value === "string" ? value.trim() : "";
 }
 function codeOf(page) {
 	const record = asRecord$9(page);
-	return record === void 0 ? "" : textOf$4(record["code"]);
+	return record === void 0 ? "" : textOf$5(record["code"]);
 }
-function messageOf$1(page) {
+function messageOf$2(page) {
 	const record = asRecord$9(page);
-	return record === void 0 ? "" : textOf$4(record["message"]);
+	return record === void 0 ? "" : textOf$5(record["message"]);
 }
 function hintOf$1(page) {
 	const record = asRecord$9(page);
-	const hint = record === void 0 ? "" : textOf$4(record["hint"]);
+	const hint = record === void 0 ? "" : textOf$5(record["hint"]);
 	return hint === "" ? void 0 : hint;
 }
 function pageFailed(page) {
@@ -484,7 +752,7 @@ async function browserRead(options) {
 		message: "读到了"
 	};
 	const pageCode = codeOf(page) || "read-failed";
-	const message = messageOf$1(page) || `读不到（${pageCode}）`;
+	const message = messageOf$2(page) || `读不到（${pageCode}）`;
 	const blocker = blockerFor(pageCode);
 	if (blocker === "auth-required") return {
 		ok: false,
@@ -526,7 +794,7 @@ var DEFAULT_TEXT_MAX = 200;
 function asRecord$8(value) {
 	return typeof value === "object" && value !== null ? value : void 0;
 }
-function textOf$3(value) {
+function textOf$4(value) {
 	return typeof value === "string" ? value.trim() : "";
 }
 function entriesOf(value) {
@@ -539,8 +807,8 @@ function entriesOf(value) {
 		if (item === void 0) continue;
 		const nth = typeof item["nth"] === "number" ? item["nth"] : entries.length;
 		entries.push({
-			text: textOf$3(item["text"]),
-			tag: textOf$3(item["tag"]),
+			text: textOf$4(item["text"]),
+			tag: textOf$4(item["tag"]),
 			nth
 		});
 	}
@@ -549,7 +817,7 @@ function entriesOf(value) {
 function reasonOf(stdout, stderr) {
 	const parsed = asRecord$8(parseJsonLoose(stdout));
 	const error = parsed === void 0 ? void 0 : asRecord$8(parsed["error"]);
-	const message = error === void 0 ? "" : textOf$3(error["message"]);
+	const message = error === void 0 ? "" : textOf$4(error["message"]);
 	if (message !== "") return message;
 	const lines = (stderr.trim() === "" ? stdout : stderr).split("\n").map((one) => one.trim()).filter((one) => one !== "");
 	return (lines[lines.length - 1] ?? "").slice(-200);
@@ -557,7 +825,7 @@ function reasonOf(stdout, stderr) {
 function hintOf(stdout) {
 	const parsed = asRecord$8(parseJsonLoose(stdout));
 	const error = parsed === void 0 ? void 0 : asRecord$8(parsed["error"]);
-	const hint = error === void 0 ? "" : textOf$3(error["hint"]);
+	const hint = error === void 0 ? "" : textOf$4(error["hint"]);
 	return hint === "" ? void 0 : hint;
 }
 function sameOrigin(left, right) {
@@ -571,7 +839,7 @@ function urlOf(stdout) {
 	const bare = (stdout.split("\n").map((one) => one.trim()).filter((one) => one !== "")[0] ?? "").replace(/^url:\s*/i, "").trim().replace(/^["']+|["']+$/g, "");
 	if (bare.startsWith("{")) {
 		const parsed = asRecord$8(parseJsonLoose(bare));
-		const url = parsed === void 0 ? "" : textOf$3(parsed["url"]);
+		const url = parsed === void 0 ? "" : textOf$4(parsed["url"]);
 		if (url !== "") return url;
 	}
 	return bare;
@@ -796,7 +1064,8 @@ var PROVISION_ACTIONS = [
 	"cancel-install",
 	"update-dependency",
 	"update-plugin",
-	"uninstall-plugin"
+	"uninstall-plugin",
+	"update-workbench"
 ];
 var DEPENDENCY_ACTIONS = ["update-dependency"];
 function isDependencyAction(action) {
@@ -807,6 +1076,7 @@ function provisionTargetOf(action) {
 	if (action === "install-bundle") return "spec";
 	if (action === "remove-bundle") return "name";
 	if (action === "update-plugin" || action === "uninstall-plugin") return "name";
+	if (action === "update-workbench") return "name";
 	if (action === "cancel-install") return "requestId";
 	return "unit";
 }
@@ -820,7 +1090,7 @@ var TARGET_CODE = {
 function asRecord$7(value) {
 	return typeof value === "object" && value !== null ? value : {};
 }
-function stringsOf$2(value) {
+function stringsOf$3(value) {
 	if (!Array.isArray(value)) return void 0;
 	const items = value.filter((item) => typeof item === "string" && item.trim() !== "");
 	return items.length === 0 ? void 0 : items;
@@ -842,6 +1112,10 @@ function requestOf$1(action, value) {
 		action,
 		name: value
 	};
+	if (action === "update-workbench") return {
+		action,
+		name: value
+	};
 	if (action === "cancel-install") return {
 		action,
 		requestId: value
@@ -872,7 +1146,7 @@ function parseProvisionBody(body) {
 		request: requestOf$1(wanted, value.trim())
 	};
 	const registry = typeof raw.registry === "string" && raw.registry.trim() !== "" ? raw.registry.trim() : void 0;
-	const approvedBuilds = stringsOf$2(raw.approvedBuilds);
+	const approvedBuilds = stringsOf$3(raw.approvedBuilds);
 	const requestId = typeof raw.requestId === "string" && raw.requestId.trim() !== "" ? raw.requestId.trim() : void 0;
 	return {
 		ok: true,
@@ -886,6 +1160,7 @@ function parseProvisionBody(body) {
 }
 //#endregion
 //#region ../shared/dist/host/opencli.js
+var FORBIDDEN_CODES = /* @__PURE__ */ new Set(["FORBIDDEN", "PERMISSION_DENIED"]);
 var SITE_SESSION_ARGS = ["--site-session", "persistent"];
 var WorkbenchDataError = class extends Error {
 	code;
@@ -913,6 +1188,102 @@ function opencliCommandLine(command, argv, session = "persistent") {
 		"json"
 	].join(" ");
 }
+function createOpencli(options) {
+	const { shell, plugin, logger, command = "opencli", timeoutMs = OPENCLI_TIMEOUT_MS, maxConcurrent = 4 } = options;
+	const inflight = /* @__PURE__ */ new Map();
+	const MAX_CONCURRENT = maxConcurrent;
+	let running = 0;
+	const waiting = [];
+	async function acquire() {
+		if (running < MAX_CONCURRENT) {
+			running += 1;
+			return;
+		}
+		await new Promise((resolve) => waiting.push(resolve));
+	}
+	function release() {
+		const next = waiting.shift();
+		if (next === void 0) running -= 1;
+		else next();
+	}
+	async function runLimited(task) {
+		await acquire();
+		try {
+			return await task();
+		} finally {
+			release();
+		}
+	}
+	async function call(commandLine, workdir) {
+		let result;
+		try {
+			result = await runShell(shell, commandLine, {
+				...workdir === void 0 ? {} : { workdir },
+				timeoutMs
+			});
+		} catch (error) {
+			throw new WorkbenchDataError("cli-exec-failed", `执行 opencli 失败：${String(error)}`, { hint: "确认 opencli 已安装且在 PATH 里（which opencli）。" });
+		}
+		if (result.timedOut) throw new WorkbenchDataError("cli-timeout", `opencli 超过 ${Math.round(timeoutMs / 1e3)} 秒没有返回`, { hint: "无头浏览器可能没起来，重试一次通常就好。" });
+		if (result.exitCode !== 0) {
+			const detail = tailLines(result.stderr || result.stdout, 6);
+			const envelope = parseCliErrorEnvelope(result.stderr) ?? parseCliErrorEnvelope(result.stdout);
+			const url = envelope === void 0 ? void 0 : helpUrlOf(envelope);
+			if (envelope?.code === "AUTH_REQUIRED") throw new WorkbenchDataError("auth-required", envelope.message, {
+				detail,
+				...url === void 0 ? {} : { helpUrl: url }
+			});
+			if (envelope !== void 0 && FORBIDDEN_CODES.has(envelope.code)) throw new WorkbenchDataError("permission-denied", envelope.message, {
+				detail,
+				...url === void 0 ? {} : { helpUrl: url }
+			});
+			if (envelope !== void 0) throw new WorkbenchDataError("cli-command-failed", `${envelope.code}：${envelope.message}`, {
+				detail,
+				...envelope.help === void 0 ? {} : { hint: envelope.help }
+			});
+			throw new WorkbenchDataError("cli-unclassified", `opencli 这条命令没跑通（退出码 ${result.exitCode}），而且没有结构化错误码`, {
+				detail,
+				hint: "多半是插件里没有这条命令（版本旧就会缺），也可能是命令自己失败了：先确认命令存在，再更新插件重试。"
+			});
+		}
+		const parsed = parseJsonLoose(result.stdout);
+		if (parsed === void 0) throw new WorkbenchDataError("cli-bad-output", "opencli 输出不是 JSON", { detail: tailLines(result.stdout, 4) });
+		return parsed;
+	}
+	async function json(args, callOptions = {}) {
+		const { key, workdir } = callOptions;
+		const session = callOptions.session ?? "persistent";
+		const callKey = key ?? args.map((arg) => String(arg)).join(" ");
+		const pending = inflight.get(callKey);
+		if (pending !== void 0) return pending;
+		const commandLine = opencliCommandLine(command, [plugin, ...args], session);
+		const once = async () => {
+			return {
+				value: await call(commandLine, workdir),
+				at: Date.now()
+			};
+		};
+		const task = runLimited(async () => {
+			try {
+				return await once();
+			} catch (error) {
+				if (!(error instanceof WorkbenchDataError) || error.code !== "auth-required") throw error;
+				return await once();
+			}
+		});
+		inflight.set(callKey, task);
+		try {
+			return await task;
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			logger?.warn?.(`[dsh-workbench] opencli 调用失败：${message}`);
+			throw error;
+		} finally {
+			inflight.delete(callKey);
+		}
+	}
+	return { json };
+}
 //#endregion
 //#region ../shared/dist/host/write-result.js
 function writeResultForClient(value, code) {
@@ -1235,6 +1606,42 @@ function registerActions(ctx, resources, wrote) {
 		...wrote === void 0 ? {} : { wrote }
 	});
 }
+function registerPanelState(ctx, store) {
+	return registerPost(ctx, {
+		prefix: PANEL_STATE_PREFIX,
+		what: "面板运行态",
+		refusedCode: "report-refused",
+		resources: [{
+			resource: "cards",
+			handle(payload) {
+				const parsed = parseCardsReport(payload);
+				if (!parsed.ok) return {
+					ok: false,
+					text: parsed.message
+				};
+				store.cards(parsed.value);
+				return {
+					ok: true,
+					at: Date.now()
+				};
+			}
+		}, {
+			resource: "crash",
+			handle(payload) {
+				const parsed = parseCrashReport(payload);
+				if (!parsed.ok) return {
+					ok: false,
+					text: parsed.message
+				};
+				store.crash(parsed.value);
+				return {
+					ok: true,
+					at: Date.now()
+				};
+			}
+		}]
+	});
+}
 //#endregion
 //#region ../shared/dist/host/long-task.js
 var LIVE = /* @__PURE__ */ new Set(["running", "needs-login"]);
@@ -1447,7 +1854,7 @@ var PLUGIN_LEDGER_FILE = "plugins.json";
 function ledgerKeyOf(entry) {
 	return `${entry.opencliHome}\u0000${entry.package}`;
 }
-function textOf$2(value) {
+function textOf$3(value) {
 	if (typeof value !== "string") return void 0;
 	const trimmed = value.trim();
 	return trimmed === "" ? void 0 : trimmed;
@@ -1455,13 +1862,13 @@ function textOf$2(value) {
 function entryOf(value) {
 	if (typeof value !== "object" || value === null) return void 0;
 	const box = value;
-	const opencliHome = textOf$2(box["opencliHome"]);
-	const pkg = textOf$2(box["package"]);
-	const installedAt = textOf$2(box["installedAt"]);
+	const opencliHome = textOf$3(box["opencliHome"]);
+	const pkg = textOf$3(box["package"]);
+	const installedAt = textOf$3(box["installedAt"]);
 	if (opencliHome === void 0 || pkg === void 0 || installedAt === void 0) return void 0;
-	const name = textOf$2(box["name"]);
-	const registry = textOf$2(box["registry"]);
-	const releasedAt = textOf$2(box["releasedAt"]);
+	const name = textOf$3(box["name"]);
+	const registry = textOf$3(box["registry"]);
+	const releasedAt = textOf$3(box["releasedAt"]);
 	return {
 		opencliHome,
 		package: pkg,
@@ -1628,15 +2035,48 @@ function resolvePluginSource(source, env, options = {}) {
 }
 //#endregion
 //#region ../shared/dist/host/tool-approval.js
-function messageOf(error) {
+var APPROVAL_NOTE_ARG = "approval_note";
+var NOTE_SCHEMA = {
+	type: "string",
+	description: "一句话说明你这次想拿它干什么（要点头的那几通会显示在审批屏上）。"
+};
+function withApprovalNote(parameters, options = {}) {
+	const properties = parameters["properties"];
+	if (typeof properties !== "object" || properties === null) return parameters;
+	const map = properties;
+	if ("approval_note" in map) return parameters;
+	const kept = (Array.isArray(parameters["required"]) ? parameters["required"] : []).filter((name) => name !== APPROVAL_NOTE_ARG);
+	const required = options.required === true ? [...kept, APPROVAL_NOTE_ARG] : kept;
+	return {
+		...parameters,
+		properties: {
+			...map,
+			[APPROVAL_NOTE_ARG]: NOTE_SCHEMA
+		},
+		...required.length === 0 ? {} : { required }
+	};
+}
+function approvalNoteOf(call) {
+	const raw = call.arguments;
+	const value = typeof raw === "object" && raw !== null ? raw[APPROVAL_NOTE_ARG] : void 0;
+	if (typeof value !== "string") return void 0;
+	const line = value.replace(/\s+/g, " ").trim();
+	if (line === "") return void 0;
+	return line.length > 160 ? `${line.slice(0, 160)}…` : line;
+}
+function messageOf$1(error) {
 	return error instanceof Error ? error.message : String(error);
 }
-function compose(detail, verdict) {
-	if (detail === void 0 || typeof detail.zh !== "string" || detail.zh.trim() === "") return verdict.fallback;
-	return {
+function compose(detail, verdict, note) {
+	const base = detail === void 0 || typeof detail.zh !== "string" || detail.zh.trim() === "" ? verdict.fallback : {
 		en: `${detail.en} — ${verdict.question.en}`,
 		zh: `${detail.zh} —— ${verdict.question.zh}`
 	};
+	if (note === void 0) return base;
+	return {
+		en: `${base.en} — ${note}`,
+		zh: `${base.zh} —— ${note}`
+	};
 }
 async function approvalFor(call, context = {}) {
 	if (context.writes !== true) return void 0;
@@ -1646,7 +2086,7 @@ async function approvalFor(call, context = {}) {
 	} catch (error) {
 		return {
 			kind: "deny",
-			reason: `问"要不要审批"的时候套件的策略抛了错，已经停下：${messageOf(error)}`
+			reason: `问"要不要审批"的时候套件的策略抛了错，已经停下：${messageOf$1(error)}`
 		};
 	}
 	if (verdict?.kind === "read") return void 0;
@@ -1660,7 +2100,7 @@ async function approvalFor(call, context = {}) {
 	} catch (error) {
 		return {
 			kind: "deny",
-			reason: `拿不到"这次会发生什么"，已经停下：${messageOf(error)}`
+			reason: `拿不到"这次会发生什么"，已经停下：${messageOf$1(error)}`
 		};
 	}
 	if (facts !== void 0 && "blocked" in facts) return {
@@ -1670,7 +2110,7 @@ async function approvalFor(call, context = {}) {
 	return {
 		kind: "ask",
 		reason: verdict.reason,
-		displayReason: compose(facts, verdict)
+		displayReason: compose(facts, verdict, approvalNoteOf(call))
 	};
 }
 //#endregion
@@ -1679,6 +2119,15 @@ function sessionWorkspace(exec) {
 	const cwd = exec?.agent?.session?.header?.cwd;
 	return typeof cwd === "string" && cwd.trim() !== "" ? cwd.trim() : null;
 }
+function textOutput(text) {
+	return [{
+		type: "text",
+		text
+	}];
+}
+function jsonText(value) {
+	return JSON.stringify(value);
+}
 //#endregion
 //#region ../shared/dist/host/value-handoff.js
 function handoffId(entry) {
@@ -2000,7 +2449,7 @@ function profileDirOf(ctx) {
 	const dir = typeof profile?.dir === "string" ? profile.dir.trim() : "";
 	return dir === "" ? null : dir;
 }
-function stringsOf$1(value) {
+function stringsOf$2(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
 function profileManifestOf(profileDir) {
@@ -2014,7 +2463,7 @@ function profileManifestOf(profileDir) {
 function profileModules(profileDir) {
 	const record = profileManifestOf(profileDir);
 	if (record === void 0) return [];
-	const bundles = stringsOf$1(asRecord$5(asRecord$5(record.dsh)?.profile)?.bundles);
+	const bundles = stringsOf$2(asRecord$5(asRecord$5(record.dsh)?.profile)?.bundles);
 	const dependencies = asRecord$5(record.dependencies) ?? {};
 	const names = bundles.length > 0 ? bundles : Object.keys(dependencies);
 	const found = [];
@@ -2025,11 +2474,27 @@ function profileModules(profileDir) {
 			unit: read.unit,
 			version: read.version,
 			...read.registry === void 0 ? {} : { registry: read.registry },
-			local: asText$3(dependencies[read.pkg]).startsWith("link:")
+			local: isLocalDependencySpec(asText$3(dependencies[read.pkg]))
 		});
 	}
 	return found;
 }
+function createDeclarationLookup(profileDir) {
+	let roster;
+	const scan = () => new Map(profileModules(profileDir).map((row) => [row.unit, row.pkg]));
+	return (unit) => {
+		roster ??= scan();
+		let pkg = roster.get(unit);
+		if (pkg === void 0) {
+			roster = scan();
+			pkg = roster.get(unit);
+		}
+		return pkg === void 0 ? void 0 : {
+			pkg,
+			declaration: moduleDeclarationOf(profileDir, pkg)
+		};
+	};
+}
 function registryFromLockfile(profileDir, pkg) {
 	let text;
 	try {
@@ -2070,6 +2535,20 @@ function declarationGaps(profileDir) {
 	}
 	return gaps;
 }
+function declaredPluginCommands(profileDir) {
+	const declared = /* @__PURE__ */ new Map();
+	for (const module of profileModules(profileDir)) {
+		const read = readDeclaration(module.pkg, moduleDeclarationOf(profileDir, module.pkg));
+		for (const need of read.manifest?.env?.plugins ?? []) {
+			const name = need.name.trim();
+			if (name === "") continue;
+			const commands = declared.get(name) ?? /* @__PURE__ */ new Set();
+			for (const command of need.commands ?? []) commands.add(command);
+			declared.set(name, commands);
+		}
+	}
+	return declared;
+}
 function readInstalledModule(profileDir, pkg) {
 	if (profileDir === null || !isPackageName(pkg)) return {
 		kind: "unknown",
@@ -2105,6 +2584,32 @@ function readInstalledModule(profileDir, pkg) {
 		...registry === "" ? {} : { registry }
 	};
 }
+function isLocalDependencySpec(spec) {
+	const trimmed = spec.trim();
+	return trimmed.startsWith("link:") || trimmed.startsWith("file:") || trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith("/");
+}
+function readProfilePackage(profileDir, pkg) {
+	if (profileDir === null || !isPackageName(pkg)) return void 0;
+	let manifest;
+	try {
+		manifest = JSON.parse(fs.readFileSync(path.join(profileDir, "node_modules", pkg, "package.json"), "utf8"));
+	} catch {
+		return;
+	}
+	const record = asRecord$5(manifest);
+	if (record === void 0) return void 0;
+	const version = asText$3(record.version);
+	if (version === "") return void 0;
+	const declaredRegistry = asText$3(asRecord$5(record.publishConfig)?.registry);
+	const registry = declaredRegistry === "" ? registryFromLockfile(profileDir, pkg) : declaredRegistry;
+	const local = isLocalDependencySpec(asText$3((asRecord$5(profileManifestOf(profileDir)?.dependencies) ?? {})[pkg]));
+	return {
+		pkg,
+		version,
+		...registry === "" ? {} : { registry },
+		...local ? { local: true } : {}
+	};
+}
 //#endregion
 //#region src/shared/api/host/profile-registries.ts
 var REGISTRY_MARKER = "# dsh-workbench 写的：这一行的包只在这个源上（dsh 卸载没有源参数，pnpm 得问得到）";
@@ -2350,6 +2855,13 @@ var panelsApproval = (call) => {
 				zh: `agent 想${verb} opencli 插件 ${what}（会改这台机器上装的东西）。允许吗？`
 			});
 		}
+		if (action === "update-workbench") return askOf("workbench_modules update-workbench replaces the workbench itself with the new version from the registry", {
+			en: "it updates the workbench itself on this machine (the panel picks the new version up by itself). Allow?",
+			zh: "会把工作台自己更新到源上的新版（面板会自己换新）。允许吗？"
+		}, {
+			en: "The agent wants to update the workbench itself to the new version from the registry (it changes what is installed on this machine; the panel picks the new version up by itself). Allow?",
+			zh: "agent 想把工作台自己更新到源上的新版（会改这台机器上装的东西，面板会自己换新）。允许吗？"
+		});
 		if (action === "update-dependency") return askOf(`workbench_modules update-dependency ${id ?? ""} upgrades a shared dependency on this machine`, {
 			en: "it upgrades that shared dependency on this machine. Allow?",
 			zh: `会升级共用依赖 ${what}。允许吗？`
@@ -2423,46 +2935,99 @@ var EMPTY_BOARD = {
 };
 var BOARD_TARGETS = ["workspace", "machine"];
 var DEFAULT_BOARD_TARGET = "workspace";
-function resolveScope(query) {
-	const { id, boards } = query;
-	const board = boards.workspace ?? boards.machine;
+function overrideOf(board, id) {
+	if (board === null) return void 0;
+	if (board.hidden.includes(id)) return false;
+	if (board.shown.includes(id)) return true;
+}
+function defaultOf(board, id) {
 	if (board === null) return false;
 	if (board.hidden.includes(id)) return false;
 	return board.shown.includes(id);
 }
+function resolveScope(query) {
+	const { id, boards } = query;
+	return overrideOf(boards.workspace, id) ?? defaultOf(boards.machine, id);
+}
 function strings(raw) {
 	return Array.isArray(raw) ? raw.filter((item) => typeof item === "string") : [];
 }
 function parseBoard(raw) {
 	if (typeof raw !== "object" || raw === null) return EMPTY_BOARD;
 	const value = raw;
+	const order = strings(value.order);
 	return {
 		shown: strings(value.shown),
-		hidden: strings(value.hidden)
+		hidden: strings(value.hidden),
+		...order.length === 0 ? {} : { order }
 	};
 }
 function parseReleased(raw) {
 	if (typeof raw !== "object" || raw === null) return [];
 	return strings(raw.ids);
 }
-function resolvePanels(manifests, boards) {
-	const ordered = boards.workspace?.shown ?? boards.machine?.shown ?? [];
-	const rank = new Map(ordered.map((id, index) => [id, index]));
-	return manifests.filter((manifest) => manifest.card !== null).map((manifest) => {
+function resolvePanels(manifests, boards, owned = /* @__PURE__ */ new Set()) {
+	const listed = manifests.filter((manifest) => manifest.card !== null || !owned.has(manifest.id));
+	const carded = listed.filter((manifest) => manifest.card !== null);
+	const declared = (manifest) => manifest.card?.order ?? 0;
+	const byDeclared = (a, b) => declared(a) - declared(b) || a.id.localeCompare(b.id);
+	const queued = [...new Set(boards.workspace?.order ?? [])].map((id) => carded.find((manifest) => manifest.id === id)).filter((manifest) => manifest !== void 0).filter((manifest) => resolveScope({
+		id: manifest.id,
+		boards
+	}));
+	const placed = new Set(queued.map((manifest) => manifest.id));
+	const ordered = [...queued, ...carded.filter((manifest) => !placed.has(manifest.id) && resolveScope({
+		id: manifest.id,
+		boards
+	})).sort(byDeclared)];
+	const rank = new Map(ordered.map((manifest, index) => [manifest.id, index]));
+	return listed.map((manifest) => {
+		const hasCard = manifest.card !== null;
 		const on = resolveScope({
 			id: manifest.id,
 			boards
 		});
-		const order = rank.get(manifest.id) ?? ordered.length + (manifest.card?.order ?? 0);
+		const order = hasCard ? rank.get(manifest.id) ?? ordered.length + declared(manifest) : 0;
 		return {
 			id: manifest.id,
 			titleKey: manifest.card?.titleKey ?? manifest.id,
 			order,
 			shown: on,
-			source: on && (boards.workspace?.shown.includes(manifest.id) ?? false) ? "user" : "default",
-			hasCard: true
+			source: overrideOf(boards.workspace, manifest.id) === void 0 ? "default" : "user",
+			hasCard
+		};
+	}).sort((a, b) => {
+		if (a.hasCard !== b.hasCard) return a.hasCard ? -1 : 1;
+		return a.order - b.order || a.id.localeCompare(b.id);
+	});
+}
+var PLUGIN_PANEL_PREFIX = "plugin:";
+function pluginPanelId(pkg) {
+	return `${PLUGIN_PANEL_PREFIX}${pkg}`;
+}
+function resolvePluginPanels(plugins, boards) {
+	const ordered = [...new Set(boards.workspace?.order ?? [])];
+	const rank = new Map(ordered.map((id, index) => [id, index]));
+	const seen = /* @__PURE__ */ new Set();
+	return plugins.map((plugin) => {
+		const id = pluginPanelId(plugin.pkg);
+		return {
+			id,
+			pkg: plugin.pkg,
+			title: plugin.title,
+			...plugin.name === void 0 ? {} : { name: plugin.name },
+			order: rank.get(id) ?? ordered.length,
+			shown: resolveScope({
+				id,
+				boards
+			}),
+			source: overrideOf(boards.workspace, id) === void 0 ? "default" : "user"
 		};
-	}).sort((a, b) => a.order - b.order || a.id.localeCompare(b.id));
+	}).filter((entry) => {
+		if (seen.has(entry.id)) return false;
+		seen.add(entry.id);
+		return true;
+	}).sort((a, b) => a.order - b.order || a.pkg.localeCompare(b.pkg));
 }
 function withoutReleased(released, id) {
 	return released.filter((item) => item !== id);
@@ -2476,16 +3041,22 @@ function added(list, id) {
 function dropped(list, id) {
 	return list.filter((item) => item !== id);
 }
-function withShown(board, id) {
-	return {
+function withShown(board, id, visible) {
+	const next = {
 		shown: added(board.shown, id),
 		hidden: dropped(board.hidden, id)
 	};
+	return visible === void 0 ? next : {
+		...next,
+		order: added(board.order ?? visible, id)
+	};
 }
 function withHidden(board, id) {
+	const order = dropped(board.order ?? [], id);
 	return {
 		shown: dropped(board.shown, id),
-		hidden: added(board.hidden, id)
+		hidden: added(board.hidden, id),
+		...order.length === 0 ? {} : { order }
 	};
 }
 function withoutPanel(board, id) {
@@ -2494,120 +3065,64 @@ function withoutPanel(board, id) {
 		hidden: dropped(board.hidden, id)
 	};
 }
-function withMoved(board, id, index) {
-	const current = [...board.shown];
+function withMoved(board, id, index, visible) {
+	const current = visible.includes(id) ? [...visible] : [...visible, id];
 	const from = current.indexOf(id);
-	const max = from === -1 ? current.length : current.length - 1;
-	const to = Math.max(0, Math.min(max, Math.trunc(index)));
-	if (from === -1) current.splice(to, 0, id);
-	else if (from !== to) current.splice(to, 0, ...current.splice(from, 1));
+	const to = Math.max(0, Math.min(current.length - 1, Math.trunc(index)));
+	if (from !== to) current.splice(to, 0, ...current.splice(from, 1));
 	return {
-		shown: current,
-		hidden: dropped(board.hidden, id)
+		shown: added(board.shown, id),
+		hidden: dropped(board.hidden, id),
+		order: current
 	};
 }
 //#endregion
-//#region src/shared/api/host/diy-facts.ts
-function asExported(dir) {
+//#region src/shared/api/host/opencli-command.ts
+var OPENCLI_PATH_FALLBACK = "opencli";
+function isolatedOpencliPathOf(ctx) {
+	const homePath = ctx.get("dshHomePath");
+	if (typeof homePath !== "function") return null;
 	try {
-		const manifest = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
-		return (typeof manifest.exports === "object" && manifest.exports !== null ? Object.values(manifest.exports) : []).filter((one) => typeof one === "string");
+		return join(homePath("workbench/opencli/bin/opencli"));
 	} catch {
-		return [];
+		return null;
 	}
 }
-function mtimeOf(file) {
+function opencliCommandOf(ctx) {
+	const isolated = isolatedOpencliPathOf(ctx);
+	const fromEnv = process.env.DSH_WORKBENCH_OPENCLI;
+	if (fromEnv !== void 0 && fromEnv !== "") return {
+		command: fromEnv,
+		source: "env",
+		isolated
+	};
+	if (isolated !== null && existsSync(isolated)) return {
+		command: isolated,
+		source: "isolated",
+		isolated
+	};
+	return {
+		command: OPENCLI_PATH_FALLBACK,
+		source: "path",
+		isolated
+	};
+}
+//#endregion
+//#region src/shared/api/host/diy-recon.ts
+var SITE_LIMIT = 6;
+var COMMAND_LIMIT = 12;
+var SHOWN_LIMIT = 6;
+var PLUGIN_PREFIX = "opencli-plugin-";
+function text(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+function stringsOf$1(value) {
+	return Array.isArray(value) ? value.filter((one) => typeof one === "string") : [];
+}
+function manifestCommandsOf(raw) {
+	let parsed;
 	try {
-		return statSync(file).mtimeMs;
-	} catch {
-		return;
-	}
-}
-function newestMtime(dir) {
-	let newest;
-	const walk = (at) => {
-		let entries;
-		try {
-			entries = readdirSync(at, { withFileTypes: true });
-		} catch {
-			return;
-		}
-		for (const entry of entries) {
-			const full = join(at, entry.name);
-			if (entry.isDirectory()) walk(full);
-			else if (entry.isFile()) {
-				const stamp = mtimeOf(full);
-				if (stamp !== void 0 && (newest === void 0 || stamp > newest)) newest = stamp;
-			}
-		}
-	};
-	walk(dir);
-	return newest;
-}
-function moduleBuildFacts(dir) {
-	const artifacts = asExported(dir).map((rel) => ({
-		path: rel,
-		mtime: mtimeOf(join(dir, rel))
-	}));
-	const present = artifacts.filter((one) => one.mtime !== void 0);
-	const oldestBuilt = present.reduce((min, one) => min === void 0 || one.mtime < min ? one.mtime : min, void 0);
-	const newestSource = newestMtime(join(dir, "src"));
-	return {
-		artifacts: artifacts.map((one) => ({
-			path: one.path,
-			at: one.mtime === void 0 ? null : new Date(one.mtime).toISOString()
-		})),
-		builtAll: present.length === artifacts.length && artifacts.length > 0,
-		stale: newestSource !== void 0 && oldestBuilt !== void 0 && newestSource > oldestBuilt
-	};
-}
-//#endregion
-//#region src/shared/api/host/opencli-command.ts
-var OPENCLI_PATH_FALLBACK = "opencli";
-function isolatedOpencliPathOf(ctx) {
-	const homePath = ctx.get("dshHomePath");
-	if (typeof homePath !== "function") return null;
-	try {
-		return join(homePath("workbench/opencli/bin/opencli"));
-	} catch {
-		return null;
-	}
-}
-function opencliCommandOf(ctx) {
-	const isolated = isolatedOpencliPathOf(ctx);
-	const fromEnv = process.env.DSH_WORKBENCH_OPENCLI;
-	if (fromEnv !== void 0 && fromEnv !== "") return {
-		command: fromEnv,
-		source: "env",
-		isolated
-	};
-	if (isolated !== null && existsSync(isolated)) return {
-		command: isolated,
-		source: "isolated",
-		isolated
-	};
-	return {
-		command: OPENCLI_PATH_FALLBACK,
-		source: "path",
-		isolated
-	};
-}
-//#endregion
-//#region src/shared/api/host/diy-recon.ts
-var SITE_LIMIT = 6;
-var COMMAND_LIMIT = 12;
-var SHOWN_LIMIT = 6;
-var PLUGIN_PREFIX = "opencli-plugin-";
-function text(value) {
-	return typeof value === "string" ? value.trim() : "";
-}
-function stringsOf(value) {
-	return Array.isArray(value) ? value.filter((one) => typeof one === "string") : [];
-}
-function manifestCommandsOf(raw) {
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
+		parsed = JSON.parse(raw);
 	} catch {
 		return [];
 	}
@@ -2632,7 +3147,7 @@ function manifestCommandsOf(raw) {
 			strategy: text(row["strategy"]).toLowerCase(),
 			browser: row["browser"] === true,
 			example: text(row["example"]),
-			columns: stringsOf(row["columns"])
+			columns: stringsOf$1(row["columns"])
 		});
 	}
 	return commands;
@@ -2724,7 +3239,7 @@ function reconOf(commands, plugins, keywords) {
 	};
 	return {
 		...withNext,
-		text: textOf$1(withNext)
+		text: textOf$2(withNext)
 	};
 }
 function nextOf(answer) {
@@ -2737,7 +3252,7 @@ function nextOf(answer) {
 	if (plugin !== void 0) return `这台机器另装的插件 ${plugin.name} 里有匹配：opencli ${plugin.name} --help 看全部命令`;
 	return "这台机器上没有现成的 —— 两条路：① 给这个站点写 adapter：opencli skills read opencli-adapter-author；② 只读一次：workbench_diy action=probe（script 读接口 / css 读 DOM）";
 }
-function textOf$1(answer) {
+function textOf$2(answer) {
 	const lines = [];
 	if (answer.sites.length > 0) {
 		lines.push(`opencli 自带这 ${String(answer.sites.length)} 组能力（不用装、不用点头）：`);
@@ -2781,10 +3296,169 @@ function installedPluginsOf(dir = vendorPluginsDir()) {
 	}));
 }
 //#endregion
+//#region src/shared/api/host/diy-facts.ts
+function asExported(dir) {
+	try {
+		const manifest = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+		return (typeof manifest.exports === "object" && manifest.exports !== null ? Object.values(manifest.exports) : []).filter((one) => typeof one === "string");
+	} catch {
+		return [];
+	}
+}
+function mtimeOf(file) {
+	try {
+		return statSync(file).mtimeMs;
+	} catch {
+		return;
+	}
+}
+function newestMtime(dir) {
+	let newest;
+	const walk = (at) => {
+		let entries;
+		try {
+			entries = readdirSync(at, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			const full = join(at, entry.name);
+			if (entry.isDirectory()) walk(full);
+			else if (entry.isFile()) {
+				const stamp = mtimeOf(full);
+				if (stamp !== void 0 && (newest === void 0 || stamp > newest)) newest = stamp;
+			}
+		}
+	};
+	walk(dir);
+	return newest;
+}
+function moduleBuildFacts(dir) {
+	const artifacts = asExported(dir).map((rel) => ({
+		path: rel,
+		mtime: mtimeOf(join(dir, rel))
+	}));
+	const present = artifacts.filter((one) => one.mtime !== void 0);
+	const oldestBuilt = present.reduce((min, one) => min === void 0 || one.mtime < min ? one.mtime : min, void 0);
+	const newestSource = newestMtime(join(dir, "src"));
+	return {
+		artifacts: artifacts.map((one) => ({
+			path: one.path,
+			at: one.mtime === void 0 ? null : new Date(one.mtime).toISOString()
+		})),
+		builtAll: present.length === artifacts.length && artifacts.length > 0,
+		stale: newestSource !== void 0 && oldestBuilt !== void 0 && newestSource > oldestBuilt
+	};
+}
+//#endregion
+//#region src/modules/panels/model/diy-report.ts
+function healthOf(options) {
+	const { registry, unit, installed } = options;
+	const refused = registry?.refusals().find((one) => one.unit === unit);
+	if (refused !== void 0) return {
+		state: "failed",
+		reason: refused.reasons.join("；")
+	};
+	const failed = registry?.failureOf(unit);
+	if (failed !== void 0) return {
+		state: "failed",
+		reason: failed
+	};
+	if (registry?.all().some((one) => one.unit === unit) === true) return { state: "ok" };
+	return {
+		state: "absent",
+		reason: installed ? "工作台还没读到它的声明 —— 新装的模块要重启一次工作台" : "还没装"
+	};
+}
+function healthText(health) {
+	if (health.state === "ok") return "是";
+	if (health.state === "failed") return `不是 —— ${health.reason ?? "(没给原因)"}`;
+	return `还没有（${health.reason ?? "还不知道"}）`;
+}
+function ageText(at, now) {
+	const seconds = Math.max(0, Math.round((now - at) / 1e3));
+	if (seconds < 10) return "刚刚";
+	if (seconds < 60) return `${String(seconds)} 秒前`;
+	const minutes = Math.round(seconds / 60);
+	if (minutes < 60) return `${String(minutes)} 分钟前`;
+	return `${String(Math.round(minutes / 60))} 小时前`;
+}
+function stampOf(at) {
+	return `${new Date(at).toISOString().slice(11, 19)}Z`;
+}
+function readText$1(read, now) {
+	const when = `${stampOf(read.at)} · ${ageText(read.at, now)}`;
+	if (read.phase === "ready") return `${read.route} 读到了（${when}）`;
+	if (read.phase === "loading") return `${read.route} 正在读（${when}）`;
+	if (read.phase === "idle") return `${read.route} 没在取数（${when}）`;
+	const code = read.error?.code ?? "unknown";
+	const message = read.error?.message ?? "";
+	return `${read.route} 读不到（${code}）${message === "" ? "" : `：${message}`}（${when}）`;
+}
+function renderPanel(options) {
+	const { packagesDir, workspace, rows, board, at, now } = options;
+	const head = `工坊：${packagesDir}\n这个工作区：${workspace ?? "(会话不在任何工作区上)"}`;
+	const note = at === 0 ? "\n还没有一条面板运行态上报 —— 面板上一个取数 / 渲染都没发生过：要么这个工作区的面板上没开卡片，要么用户那一页还是刷新前的旧版本（上报要页面刷一次才带上）。" : `\n面板上有 ${String(board.length)} 张卡｜运行态来自用户那一页（最后一次上报 ${stampOf(at)} · ${ageText(at, now)}）`;
+	const body = rows.map((row) => {
+		const title = `—— ${row.unit}${row.name === "" ? "" : `（${row.name}）`} · ${healthText(row.health)}`;
+		const report = row.report;
+		if (report === void 0) return [title, `   没上报：卡片没渲染出来，或者用户那一页还没刷新到带这份补丁的版本`].join("\n");
+		const reads = report.cards.slice(0, 6).map((one) => `   数据 · ${readText$1(one, now)}`);
+		const more = report.cards.length > 6 ? [`   数据 · …还有 ${String(report.cards.length - 6)} 条`] : [];
+		const crash = report.crash === void 0 ? "   崩过：没有" : `   崩过：是 —— ${report.crash.reason}（${stampOf(report.crash.at)} · 共 ${String(report.crash.count)} 次）`;
+		return [
+			title,
+			...reads,
+			...more,
+			crash
+		].join("\n");
+	});
+	return body.length === 0 ? `${head}${note}` : `${head}${note}\n${body.join("\n")}`;
+}
+function statusOf(options) {
+	const { dir, unit, name, installed, known, open, health } = options;
+	const facts = moduleBuildFacts(dir);
+	const next = health.state === "failed" ? `它起不来：${health.reason ?? "(没给原因)"} —— 先把这一条修掉（改模块源码 → build；改了 package.json / cordis.patch.yml 要重启工作台），别去重装` : !installed ? "装：action=install（第一次，会让用户点头一次）" : !known ? "面板还不认得这个单元 —— 重启一次工作台（新装的模块要重启才注册进面板），重启后再 action=open" : !open ? "上板：action=open（只上板，不重装）" : !facts.builtAll ? "还没构建：pnpm exec dsh-wb-module build" : facts.stale ? "源码比产物新：pnpm exec dsh-wb-module build（宿主侧秒级热换；改了 client.js 刷新页面）" : "都在生效：改源码 → build（宿主侧秒级热换；改了 client.js 刷新页面），不要再装一遍";
+	return {
+		unit,
+		name,
+		dir,
+		installed,
+		known,
+		open,
+		artifacts: facts.artifacts,
+		stale: facts.stale,
+		health,
+		next
+	};
+}
+function renderStatus(packagesDir, lines) {
+	if (lines.length === 0) return renderList(packagesDir, []);
+	return `工坊：${packagesDir}\n${lines.map((one) => {
+		const head = `—— ${one.unit}（${one.name}）`;
+		const facts = `   装：${one.installed ? "是" : "没有"} · 面板认得：${one.known ? "是" : "不是"} · 这个项目上开着：${one.open ? "是" : "没有"}`;
+		const artifacts = one.artifacts.length === 0 ? "   产物：没有" : `   产物：${one.artifacts.map((item) => `${item.path}${item.at === null ? "（缺）" : ` ${item.at.slice(11, 19)}Z`}`).join(" · ")} · 源码比产物新：${one.stale ? "是" : "没有"}`;
+		return [
+			head,
+			facts,
+			`   起得来：${healthText(one.health)}`,
+			artifacts,
+			`   下一步：${one.next}`
+		].join("\n");
+	}).join("\n")}`;
+}
+function renderList(packagesDir, modules) {
+	if (modules.length === 0) return `工坊里还没有模块（${packagesDir}）—— 在里面造一个：pnpm exec dsh-wb-module init <名字> --dir <工坊>/packages/module-<名字> --template diy`;
+	const lines = modules.map((one) => `${one.unit} · ${one.installed ? "已装" : "没装"} · ${one.name}` + (one.description === "" ? "" : `\n${" ".repeat(one.unit.length)}      ${one.description}`));
+	const footer = modules.filter((one) => !one.installed).length === 0 ? "都已装过 —— **不要再装**：改源码 + dsh-wb-module build（宿主侧秒级热换；改了 client.js 刷新一下页面）。" : "装：workbench_diy（action=install, unit=<上面那个 unit>）";
+	return `工坊：${packagesDir}\n${lines.join("\n")}\n\n${footer}`;
+}
+//#endregion
 //#region src/modules/panels/model/diy-tools.ts
-var ACTIONS$1 = [
+var ACTIONS$2 = [
 	"list",
 	"status",
+	"panel",
 	"probe",
 	"recon",
 	"install",
@@ -2840,33 +3514,6 @@ function verdictOf$1(change) {
 	const tail = (change.packageResult?.output ?? "").trim().split("\n").slice(-3).join(" | ");
 	return `没装上（${change.errorCode ?? "failed"}）${tail === "" ? "" : `：${tail}`}`;
 }
-function statusOf(options) {
-	const { dir, unit, name, installed, known, open } = options;
-	const facts = moduleBuildFacts(dir);
-	const next = !installed ? "装：action=install（第一次，会让用户点头一次）" : !known ? "面板还不认得这个单元 —— 重启一次工作台（新装的模块要重启才注册进面板），重启后再 action=open" : !open ? "上板：action=open（只上板，不重装）" : !facts.builtAll ? "还没构建：pnpm exec dsh-wb-module build" : facts.stale ? "源码比产物新：pnpm exec dsh-wb-module build（宿主侧秒级热换；改了 client.js 刷新页面）" : "都在生效：改源码 → build（宿主侧秒级热换；改了 client.js 刷新页面），不要再装一遍";
-	return {
-		unit,
-		name,
-		dir,
-		installed,
-		known,
-		open,
-		artifacts: facts.artifacts,
-		stale: facts.stale,
-		next
-	};
-}
-function renderStatus(packagesDir, lines) {
-	if (lines.length === 0) return renderList(packagesDir, []);
-	return `工坊：${packagesDir}\n${lines.map((one) => {
-		return [
-			`—— ${one.unit}（${one.name}）`,
-			`   装：${one.installed ? "是" : "没有"} · 面板认得：${one.known ? "是" : "不是"} · 这个项目上开着：${one.open ? "是" : "没有"}`,
-			one.artifacts.length === 0 ? "   产物：没有" : `   产物：${one.artifacts.map((item) => `${item.path}${item.at === null ? "（缺）" : ` ${item.at.slice(11, 19)}Z`}`).join(" · ")} · 源码比产物新：${one.stale ? "是" : "没有"}`,
-			`   下一步：${one.next}`
-		].join("\n");
-	}).join("\n")}`;
-}
 function renderProbe(out) {
 	if (out.ok) return `读到了 —— 这就是那条读的返回值，把它固化成模块宿主半侧的那一条：\n${(JSON.stringify(out.value, null, 2) ?? "undefined").slice(0, 2e3)}`;
 	const lines = [`没读到（${out.code}）：${out.message}`];
@@ -2887,12 +3534,6 @@ function renderFind(out) {
 	const more = out.entries.length > 20 ? `\n… 还有 ${String(out.entries.length - 20)} 个` : "";
 	return `找到了 ${String(out.count)} 个元素 —— 每行的单元格按换行拼在 text 里；把它固化成模块宿主半侧的那一条（host 的 browserFind + 切格 + 按列序取值）：\n${head.join("\n")}${more}`;
 }
-function renderList(packagesDir, modules) {
-	if (modules.length === 0) return `工坊里还没有模块（${packagesDir}）—— 在里面造一个：pnpm exec dsh-wb-module init <名字> --dir <工坊>/packages/module-<名字> --template diy`;
-	const lines = modules.map((one) => `${one.unit} · ${one.installed ? "已装" : "没装"} · ${one.name}` + (one.description === "" ? "" : `\n${" ".repeat(one.unit.length)}      ${one.description}`));
-	const footer = modules.filter((one) => !one.installed).length === 0 ? "都已装过 —— **不要再装**：改源码 + dsh-wb-module build（宿主侧秒级热换；改了 client.js 刷新一下页面）。" : "装：workbench_diy（action=install, unit=<上面那个 unit>）";
-	return `工坊：${packagesDir}\n${lines.join("\n")}\n\n${footer}`;
-}
 function showOrReason(panels, unit, workspace) {
 	try {
 		panels.show(unit, workspace);
@@ -2912,18 +3553,18 @@ function registerDiyTools(ctx, market, panels) {
 	}
 	const tool = {
 		name: "workbench_diy",
-		description: "看 DIY 工坊里的模块现在走到哪一步，或者把它们装上 / 上板。只认工坊里的模块（不是市场 —— 装别的东西用 workbench_modules）。status 会把五件事一次说清（装了没 / 面板认得没 / 这个项目上开着没 / 产物齐不齐 / 源码是否比产物新）并给出下一步，所以别自己去拼这些状态、也别反复 install。recon 是**先看有没有现成的**：拿一个关键词（站点名 / 系统名 / 域名）去 opencli 自带的那份目录里找，回它有哪些命令、要不要用户的 Chrome 登录；都没有就老实说，并给出\"写 adapter\"或\"探一条读\"两条路。用户不知道 opencli 是什么 —— 这一步别问他，自己查。probe 是**探一条读**：用用户浏览器里现有的登录去读一次，把结果与失败码归一（两拍、重试、平台码映射都在里面），探明之后再把它固化成模块宿主半侧的那一条。两种读法二选一：script（页面里跑一段回 JSON 的脚本，读接口）或 css（给一个选择器，读 DOM 那一行 —— 页面里没有接口时用这个，别写 document.querySelectorAll）。装是这台机器上的持久变更，要用户点头；**一辈子只装一次**：之后改源码只需 dsh-wb-module build（宿主侧秒级热换；改了 client.js 刷新一下页面），不要再调它。",
-		parameters: {
+		description: "看 DIY 工坊里的模块现在走到哪一步，或者把它们装上 / 上板。只认工坊里的模块（不是市场 —— 装别的东西用 workbench_modules）。status 会把六件事一次说清（装了没 / 面板认得没 / 这个项目上开着没 / **起得来没** / 产物齐不齐 / 源码是否比产物新）并给出下一步，所以别自己去拼这些状态、也别反复 install。panel 是**面板上现在究竟是什么样**：这个工作区开了哪几张卡、每张最后是读到了还是读不到（带宿主回的原文）、有没有崩过 —— 用户说\"卡片不对 / 一片空白 / 一直转圈\"就先问它，别靠猜、也别让他截图给你。recon 是**先看有没有现成的**：拿一个关键词（站点名 / 系统名 / 域名）去 opencli 自带的那份目录里找，回它有哪些命令、要不要用户的 Chrome 登录；都没有就老实说，并给出\"写 adapter\"或\"探一条读\"两条路。用户不知道 opencli 是什么 —— 这一步别问他，自己查。probe 是**探一条读**：用用户浏览器里现有的登录去读一次，把结果与失败码归一（两拍、重试、平台码映射都在里面），探明之后再把它固化成模块宿主半侧的那一条。两种读法二选一：script（页面里跑一段回 JSON 的脚本，读接口）或 css（给一个选择器，读 DOM 那一行 —— 页面里没有接口时用这个，别写 document.querySelectorAll）。装是这台机器上的持久变更，要用户点头；**一辈子只装一次**：之后改源码只需 dsh-wb-module build（宿主侧秒级热换；改了 client.js 刷新一下页面），不要再调它。",
+		parameters: withApprovalNote({
 			type: "object",
 			properties: {
 				action: {
 					type: "string",
-					description: "list=工坊里有哪些模块（默认）；status=某个模块现在走到哪一步、下一步做什么；probe=在用户浏览器里探一条读；recon=先查 opencli 现成的能力（自带 adapter / 本机插件）；open=只把它在这个项目上板（不装）；install=装上并上板（第一次、会让用户点头）。",
-					enum: [...ACTIONS$1]
+					description: "list=工坊里有哪些模块（默认）；status=某个模块现在走到哪一步、下一步做什么；panel=这个工作区的面板上现在是什么样（谁读到了 / 谁读不到 / 谁崩过）；probe=在用户浏览器里探一条读；recon=先查 opencli 现成的能力（自带 adapter / 本机插件）；open=只把它在这个项目上板（不装）；install=装上并上板（第一次、会让用户点头）。",
+					enum: [...ACTIONS$2]
 				},
 				unit: {
 					type: "string",
-					description: "status / open / install 填：工坊里那个模块的单元 id（list 会给）。"
+					description: "status / panel / open / install 填：工坊里那个模块的单元 id（list 会给）。"
 				},
 				script: {
 					type: "string",
@@ -2964,7 +3605,7 @@ function registerDiyTools(ctx, market, panels) {
 			},
 			required: ["action"],
 			additionalProperties: false
-		},
+		}, { required: true }),
 		output: {
 			schema: OUTPUT_SCHEMA$2,
 			render: (_args, value) => {
@@ -2978,13 +3619,16 @@ function registerDiyTools(ctx, market, panels) {
 		async execute(raw, exec) {
 			const args = asRecord$3(raw) ?? {};
 			const action = asText$1(args.action) || "list";
-			if (!ACTIONS$1.includes(action)) throw new Error(`不认识的 action：${action}（可用：${ACTIONS$1.join(" / ")}）`);
+			if (!ACTIONS$2.includes(action)) throw new Error(`不认识的 action：${action}（可用：${ACTIONS$2.join(" / ")}）`);
 			const packagesDir = workshopPackagesDir(ctx);
 			if (packagesDir === null) throw new Error("算不出 DIY 工坊在哪（这台机器没给出 dshHomePath）—— 让用户跑一次 dsh-workbench setup");
 			const session = sessionWorkspace(exec);
 			if (!inWorkshopSession(ctx, session)) throw new Error(`这把工具只在 DIY 工坊里用：当前会话不在工坊里（这个会话的工作区 ${session ?? "(不知道)"}）—— 普通项目里装模块用 workbench_modules，工坊的入口是左栏那一行「工作台DIY」`);
 			const workspace = session;
-			const modules = workshopModules(packagesDir, profileModules(profileDirOf(ctx)).map((row) => row.unit));
+			const installed = profileModules(profileDirOf(ctx)).map((row) => row.unit);
+			const modules = workshopModules(packagesDir, installed);
+			const registry = ctx.get(UNITS_SERVICE);
+			const panelState = ctx.get(PANEL_STATE_SERVICE);
 			if (action === "list") return plainJson({
 				workshop: packagesDir,
 				modules,
@@ -3003,7 +3647,12 @@ function registerDiyTools(ctx, market, panels) {
 				name: one.name,
 				installed: one.installed,
 				known: panelEntries.some((entry) => entry.id === one.unit),
-				open: panels.isEnabled(one.unit, workspace)
+				open: panels.isEnabled(one.unit, workspace),
+				health: healthOf({
+					registry,
+					unit: one.unit,
+					installed: one.installed
+				})
 			});
 			if (action === "status") {
 				const wanted = asText$1(args.unit);
@@ -3016,6 +3665,49 @@ function registerDiyTools(ctx, market, panels) {
 					text: renderStatus(packagesDir, rows)
 				});
 			}
+			if (action === "panel") {
+				const snapshot = panelState?.snapshot(workspace) ?? {
+					workspace,
+					at: 0,
+					units: []
+				};
+				const wanted = asText$1(args.unit);
+				const board = panelEntries.filter((entry) => entry.shown && entry.hasCard).map((entry) => entry.id);
+				const nameOf = new Map(modules.map((one) => [one.unit, one.name]));
+				const reported = new Map(snapshot.units.map((one) => [one.unit, one]));
+				const rows = [.../* @__PURE__ */ new Set([
+					...board,
+					...reported.keys(),
+					...nameOf.keys()
+				])].filter((unit) => wanted === "" || unit === wanted).map((unit) => {
+					const report = reported.get(unit);
+					return {
+						unit,
+						name: nameOf.get(unit) ?? "",
+						health: healthOf({
+							registry,
+							unit,
+							installed: installed.includes(unit)
+						}),
+						...report === void 0 ? {} : { report }
+					};
+				});
+				return plainJson({
+					workshop: packagesDir,
+					workspace,
+					board,
+					report: snapshot,
+					panels: rows,
+					text: renderPanel({
+						packagesDir,
+						workspace,
+						rows,
+						board,
+						at: snapshot.at,
+						now: Date.now()
+					})
+				});
+			}
 			if (action === "recon") {
 				const keywords = keywordsOf(asText$1(args.keyword), asText$1(args.url));
 				if (keywords.length === 0) throw new Error("recon 要一个关键词（站点名 / 系统名 / 域名都行）：先拿它去 opencli 自带的那份目录里找有没有现成的能力，别一上来就自己写 adapter；用户不知道 opencli 是什么，这一步别问他。");
@@ -3907,11 +4599,47 @@ function createEnvDropper(options) {
 	};
 }
 //#endregion
+//#region src/modules/panels/model/market-registry.ts
+async function rememberInstalledSource(deps, manager, pkg, registry) {
+	const { registries, logger } = deps;
+	if (registries === void 0 || registry === void 0) return;
+	const scope = scopeOf(pkg);
+	if (scope === null) return;
+	const known = await manager.registries().catch(() => null);
+	if (known !== null && sameRegistry(known.resolved, registry)) return;
+	try {
+		const added = registries.remember([{
+			scope,
+			registry
+		}]);
+		if (added.length > 0) logger?.info?.(`[dsh-workbench] 把 ${added.join("、")} 记进 profile 的 .npmrc（卸载只认 pnpm 的配置）`);
+	} catch (error) {
+		logger?.warn?.(`[dsh-workbench] 记这个 scope 的源失败：${String(error)}`);
+	}
+}
+async function retryAfterRegistryFix(deps, manager, pkg, change) {
+	const { registries, logger } = deps;
+	if (registries === void 0 || !registryFailure(change)) return change;
+	const known = await manager.registries().catch(() => null);
+	const missing = registries.sources().filter((entry) => !sameRegistry(entry.registry, known?.resolved ?? null));
+	if (missing.length === 0) return change;
+	let added;
+	try {
+		added = registries.remember(missing);
+	} catch (error) {
+		logger?.warn?.(`[dsh-workbench] 卸 ${pkg} 撞上源，但补配置失败：${String(error)}`);
+		return change;
+	}
+	if (added.length === 0) return change;
+	logger?.warn?.(`[dsh-workbench] 卸 ${pkg} 撞上源：补 ${added.join("、")} 后重试一次`);
+	return await manager.remove(pkg).catch(() => null) ?? change;
+}
+//#endregion
 //#region src/modules/panels/model/market.ts
 function createMarketService(options) {
-	const { manifests, manifestsNow, probe, shell, logger, onInstalled, onUninstalled, isReleased, bundles, installed, modules, registries, ledger, references } = options;
+	const { manifests, manifestsNow, probe, shell, logger, onInstalled, onUninstalled, isReleased, bundles, installed, modules, workbench, registries, ledger, references } = options;
 	const command = options.command ?? "opencli";
-	const catalog = () => (manifestsNow?.() ?? manifests).filter((manifest) => (manifest.env?.plugins ?? []).length > 0 || (manifest.env?.libs ?? []).length > 0);
+	const catalog = () => manifestsNow?.() ?? manifests;
 	function requireEntry(unit) {
 		const manifest = catalog().find((item) => item.id === unit);
 		if (manifest === void 0) throw new Error(`市场里没有这个模块：${unit}（可安装：${catalog().map((item) => item.id).join(", ") || "（空）"}）`);
@@ -4054,44 +4782,16 @@ function createMarketService(options) {
 			};
 		}
 	}
-	async function rememberInstalledSource(manager, pkg, registry) {
-		if (registries === void 0 || registry === void 0) return;
-		const scope = scopeOf(pkg);
-		if (scope === null) return;
-		const known = await manager.registries().catch(() => null);
-		if (known !== null && sameRegistry(known.resolved, registry)) return;
-		try {
-			const added = registries.remember([{
-				scope,
-				registry
-			}]);
-			if (added.length > 0) logger?.info?.(`[dsh-workbench] 把 ${added.join("、")} 记进 profile 的 .npmrc（卸载只认 pnpm 的配置）`);
-		} catch (error) {
-			logger?.warn?.(`[dsh-workbench] 记这个 scope 的源失败：${String(error)}`);
-		}
-	}
-	async function retryAfterRegistryFix(manager, pkg, change) {
-		if (registries === void 0 || !registryFailure(change)) return change;
-		const known = await manager.registries().catch(() => null);
-		const missing = registries.sources().filter((entry) => !sameRegistry(entry.registry, known?.resolved ?? null));
-		if (missing.length === 0) return change;
-		let added;
-		try {
-			added = registries.remember(missing);
-		} catch (error) {
-			logger?.warn?.(`[dsh-workbench] 卸 ${pkg} 撞上源，但补配置失败：${String(error)}`);
-			return change;
-		}
-		if (added.length === 0) return change;
-		logger?.warn?.(`[dsh-workbench] 卸 ${pkg} 撞上源：补 ${added.join("、")} 后重试一次`);
-		return await manager.remove(pkg).catch(() => null) ?? change;
-	}
+	const registryFix = {
+		...registries === void 0 ? {} : { registries },
+		...logger === void 0 ? {} : { logger }
+	};
 	function routeDeps(manager) {
 		return {
 			manager,
 			command,
 			runAll,
-			rememberSource: rememberInstalledSource,
+			rememberSource: (manager, pkg, registry) => rememberInstalledSource(registryFix, manager, pkg, registry),
 			supplyAfter,
 			...shell === void 0 ? {} : { shell },
 			...installed === void 0 ? {} : { installed },
@@ -4237,7 +4937,7 @@ function createMarketService(options) {
 			const before = unit === void 0 ? void 0 : await capabilityOf(unit, true);
 			const first = await manager.remove(pkg);
 			if (first === null) throw new Error("插件管理器回的卸载结果看不懂。");
-			const change = await retryAfterRegistryFix(manager, pkg, first);
+			const change = await retryAfterRegistryFix(registryFix, manager, pkg, first);
 			if (change.application !== "applied" || unit === void 0) return {
 				change,
 				keptFor: []
@@ -4273,6 +4973,24 @@ function createMarketService(options) {
 			await service.update(unit).catch(() => void 0);
 			return outcome;
 		},
+		async updateWorkbench(pkg) {
+			const target = pkg.trim() === "" ? PLUGIN_ID : pkg.trim();
+			if (target !== "@dsh-workbench/core") throw new Error(`这条路只更新工作台自己那一份（${PLUGIN_ID}）：${target}`);
+			const read = workbench?.(target);
+			if (read === void 0) throw new Error(`读不到 profile 里装的 ${target} —— 没法判断装的是哪一份，更新做不了。`);
+			if (read.local === true) throw new Error("这份工作台是从本仓装进来的（开发副本），不从源上更新。");
+			const registry = read.registry;
+			const latest = shell === void 0 || registry === void 0 ? void 0 : await latestVersion({
+				shell,
+				name: read.pkg,
+				registry,
+				force: true
+			});
+			const spec = latest === void 0 ? `${read.pkg}@latest` : `${read.pkg}@${latest}`;
+			const outcome = await installDshBundle(routeDeps(requireBundles()), spec, { ...registry === void 0 ? {} : { registry } });
+			logger?.info?.(`[dsh-workbench] 已更新工作台 ${read.version} → ${latest ?? "最新版"}`);
+			return outcome;
+		},
 		async updatePlugin(pkg) {
 			const outcome = await plugins.update(pkg);
 			await reprobePlugin(pkg, outcome.name);
@@ -4337,6 +5055,11 @@ async function dispatchMarket(market, request) {
 		action: "cancel-install",
 		cancellation: await market.cancelInstall(request.requestId ?? "")
 	};
+	if (request.action === "update-workbench") return {
+		ok: true,
+		action: "update-workbench",
+		change: (await market.updateWorkbench(request.name ?? "")).change
+	};
 	if (request.action === "update-plugin") {
 		await market.updatePlugin(request.name ?? "");
 		return {
@@ -4431,12 +5154,16 @@ function describePluginUninstall(pkg, outcome) {
 	if (outcome.removed) return `已卸载 opencli 插件 ${pkg}：没人再用它，文件也删了。`;
 	return `已从「你装的插件」里去掉 ${pkg}。${outcome.kept === void 0 ? "" : pluginKeptText(outcome.kept)}`;
 }
+function describeWorkbenchUpdate(change) {
+	if (change.application === "failed" || change.application === "cancelled") return `没成功：${change.errorCode ?? change.application}`;
+	return change.application === "restart-required" ? "工作台更新到新版了 —— 这一版要重启一次 dsh 才生效（重启由用户来，别自己重启）。" : "工作台更新到新版了 —— 客户端与宿主自己换上，不用重启。";
+}
 function usersOf(shared, names) {
 	const hit = shared.find((item) => names.some((name) => name !== void 0 && name !== "" && item.id === `plugin:${name}`));
 	if (hit === void 0 || hit.usedBy.length === 0) return "";
 	return `它被 ${hit.usedBy.join("、")} 用着（动的是它们的供给，它们的状态跟着重探了一遍）`;
 }
-var ACTIONS = [
+var ACTIONS$1 = [
 	"list",
 	"install",
 	"update",
@@ -4444,7 +5171,8 @@ var ACTIONS = [
 	"install-bundle",
 	"update-dependency",
 	"update-plugin",
-	"uninstall-plugin"
+	"uninstall-plugin",
+	"update-workbench"
 ];
 function registerMarketTools(ctx, market) {
 	const tools = ctx.get("tools");
@@ -4454,14 +5182,14 @@ function registerMarketTools(ctx, market) {
 	}
 	const tool = {
 		name: "workbench_modules",
-		description: "看 / 装 / 升 / 卸工作台的面板模块，以及用户自己装的 opencli 插件。install-bundle 按 spec（包名，可带版本；git / tarball / 本地路径也行）把模块包装进 profile —— 装完会连带装它声明的 opencli 插件；其余 action 按模块 id 动它要的外部供给；update-plugin / uninstall-plugin 按包名或插件名动用户装的那份插件。卸载只动工作台运行时，不影响终端那套；共用依赖只有升级。",
-		parameters: {
+		description: "看 / 装 / 升 / 卸工作台的面板模块，以及用户自己装的 opencli 插件。install-bundle 按 spec（包名，可带版本；git / tarball / 本地路径也行）把模块包装进 profile —— 装完会连带装它声明的 opencli 插件；其余 action 按模块 id 动它要的外部供给；update-workbench 把工作台自己更新到源上的新版（客户端与宿主一般会自己换上；真要重启时结果里会说，重启由用户来，别自己重启）。卸载只动工作台运行时，不影响终端那套；共用依赖只有升级。",
+		parameters: withApprovalNote({
 			type: "object",
 			properties: {
 				action: {
 					type: "string",
-					description: "install-bundle=按 spec 装模块包（要 spec），update-dependency=升级共用依赖（要 id），update-plugin / uninstall-plugin=动用户自己装的 opencli 插件（要 plugin），其余=对模块（要 id）。",
-					enum: [...ACTIONS]
+					description: "install-bundle=按 spec 装模块包（要 spec），update-dependency=升级共用依赖（要 id），update-plugin / uninstall-plugin=动用户自己装的 opencli 插件（要 plugin），update-workbench=把工作台自己更新到新版（不用别的参数），其余=对模块（要 id）。",
+					enum: [...ACTIONS$1]
 				},
 				id: {
 					type: "string",
@@ -4482,7 +5210,7 @@ function registerMarketTools(ctx, market) {
 			},
 			required: ["action"],
 			additionalProperties: false
-		},
+		}, { required: true }),
 		output: {
 			schema: OUTPUT_SCHEMA$1,
 			render: (_args, value) => {
@@ -4495,7 +5223,7 @@ function registerMarketTools(ctx, market) {
 		},
 		async execute(args) {
 			const action = args?.action ?? "list";
-			if (!ACTIONS.includes(action)) throw new Error(`不认识的 action：${action}（可用：${ACTIONS.join(" / ")}）`);
+			if (!ACTIONS$1.includes(action)) throw new Error(`不认识的 action：${action}（可用：${ACTIONS$1.join(" / ")}）`);
 			if (action === "list") {
 				const { modules, shared } = await market.list();
 				return {
@@ -4516,6 +5244,13 @@ function registerMarketTools(ctx, market) {
 					text: describeInstall(spec, outcome.module, outcome.supply, outcome.change)
 				};
 			}
+			if (action === "update-workbench") {
+				const outcome = await market.updateWorkbench("");
+				return {
+					change: outcome.change,
+					text: describeWorkbenchUpdate(outcome.change)
+				};
+			}
 			if (action === "update-plugin" || action === "uninstall-plugin") {
 				const plugin = args?.plugin?.trim() ?? "";
 				if (plugin === "") throw new Error(`${action} 需要一个 plugin：opencli 插件的包名或插件名 —— 就是市场「已安装 opencli 插件」那一段里的名字。`);
@@ -4566,53 +5301,70 @@ function registerMarketTools(ctx, market) {
 //#endregion
 //#region src/modules/panels/model/prefs.ts
 var PANELS_PREF_RESOURCE = "panels";
+var ACTIONS = [
+	"show",
+	"hide",
+	"move",
+	"reset",
+	"follow"
+];
 function parsePanelsPrefAction(payload) {
-	if (typeof payload !== "object" || payload === null) throw new Error("偏好写需要一个对象：{ action, id?, index?, path? }");
+	if (typeof payload !== "object" || payload === null) throw new Error("偏好写需要一个对象：{ action, id?, index?, path?, scope? }");
 	const value = payload;
 	const action = value.action;
-	if (action !== "show" && action !== "hide" && action !== "enable" && action !== "disable" && action !== "move" && action !== "reset") throw new Error(`不认识的 action：${String(action)}（可用：show / hide / enable / disable / move / reset）`);
+	if (typeof action !== "string" || !ACTIONS.includes(action)) throw new Error(`不认识的 action：${String(action)}（可用：${ACTIONS.join(" / ")}）`);
+	if (value.scope !== void 0 && value.scope !== "machine" && value.scope !== "workspace") throw new Error(`不认识的 scope：${String(value.scope)}（可用：workspace / machine）`);
 	return {
 		action,
 		...typeof value.id === "string" ? { id: value.id } : {},
 		...typeof value.index === "number" ? { index: value.index } : {},
-		...typeof value.path === "string" ? { path: value.path } : {}
+		...typeof value.path === "string" ? { path: value.path } : {},
+		...value.scope === void 0 ? {} : { scope: value.scope }
 	};
 }
 function applyPanelsPref(panels, payload) {
 	const action = parsePanelsPrefAction(payload);
 	const path = action.path ?? null;
+	const scope = action.scope ?? "workspace";
+	if (action.action === "follow") {
+		if (scope === "machine") throw new Error("机器级默认板没有\"回到跟随\"一说：它就是那份默认本身（要回到的是\"没配过\"）。");
+		return {
+			ok: true,
+			units: action.id === void 0 ? panels.follow(path) : panels.follow(path, action.id)
+		};
+	}
 	if (action.action === "reset") return {
 		ok: true,
-		units: panels.reset(path)
+		units: panels.reset(path, scope)
 	};
 	if (action.id === void 0) throw new Error(`${action.action} 需要一个 id（当前套件：${panels.list(path).map((entry) => entry.id).join(", ")}）`);
 	if (action.action === "show") return {
 		ok: true,
-		units: panels.show(action.id, path)
+		units: panels.show(action.id, path, scope)
 	};
 	if (action.action === "hide") return {
 		ok: true,
-		units: panels.hide(action.id, path)
+		units: panels.hide(action.id, path, scope)
 	};
 	return {
 		ok: true,
-		units: panels.move(action.id, action.index ?? 0, path)
+		units: panels.move(action.id, action.index ?? 0, path, scope)
 	};
 }
 //#endregion
 //#region src/modules/panels/model/handoff.ts
 var PANELS_FACT = "panels";
 var CAPABILITY_FACT = "capability";
-function textOf(value) {
+function textOf$1(value) {
 	return typeof value === "string" ? value.trim() : "";
 }
 function actionOf(call) {
-	return textOf(call.args["action"]) || "list";
+	return textOf$1(call.args["action"]) || "list";
 }
 function requestOf(call) {
 	const action = actionOf(call);
 	if (!PROVISION_ACTIONS.includes(action)) return void 0;
-	const target = textOf(call.args["unit"]) || textOf(call.args["id"]);
+	const target = textOf$1(call.args["unit"]) || textOf$1(call.args["id"]);
 	if (target === "") return void 0;
 	const wanted = action;
 	return isDependencyAction(wanted) ? {
@@ -4624,7 +5376,7 @@ function requestOf(call) {
 	};
 }
 function panelsHandoffEntry(target = {}) {
-	const path = textOf(target.path);
+	const path = textOf$1(target.path);
 	return path === "" ? void 0 : {
 		fact: PANELS_FACT,
 		key: `path:${path}`
@@ -4635,6 +5387,7 @@ function panelsFactsOf(call, manifests) {
 	if (call.source === "workbench_diy" && actionOf(call) === "list") return [PANELS_FACT];
 	if (call.source !== "workbench_modules" && call.source !== "workbench_diy") return void 0;
 	if (actionOf(call) === "list") return [PANELS_FACT, CAPABILITY_FACT];
+	if (actionOf(call) === "update-workbench") return [PANELS_FACT, CAPABILITY_FACT];
 	const request = requestOf(call);
 	if (request === void 0) return void 0;
 	return [
@@ -4668,9 +5421,11 @@ function createPanelsService(options) {
 		return readBoard(folder) ?? EMPTY_BOARD;
 	}
 	function writeBoard(folder, next) {
+		const order = next.order ?? [];
 		folder.write(PANELS_FILE, {
 			shown: next.shown,
-			hidden: next.hidden
+			hidden: next.hidden,
+			...order.length === 0 ? {} : { order }
 		});
 	}
 	function boardsOf(workspace) {
@@ -4701,6 +5456,9 @@ function createPanelsService(options) {
 		if (next.length === 0) machine.remove(RELEASED_FILE);
 		else machine.write(RELEASED_FILE, { ids: next });
 	}
+	function ownedSet() {
+		return new Set(owned?.() ?? []);
+	}
 	function notify() {
 		for (const listener of [...listeners]) try {
 			listener();
@@ -4711,7 +5469,7 @@ function createPanelsService(options) {
 	function withPersisted(folder, next, key) {
 		writeBoard(folder, next);
 		notify();
-		return resolvePanels(manifests(), boardsOf(key));
+		return resolvePanels(manifests(), boardsOf(key), ownedSet());
 	}
 	function takeBackReleased(id) {
 		const current = readReleased();
@@ -4722,18 +5480,31 @@ function createPanelsService(options) {
 		const all = manifests();
 		if (!all.some((manifest) => manifest.id === id)) throw new Error(`没有这个套件：${id}（可用：${all.map((manifest) => manifest.id).join(", ")}）`);
 	}
+	function pluginRefs() {
+		return options.plugins?.() ?? [];
+	}
+	function pluginIds() {
+		return new Set(pluginRefs().map((plugin) => pluginPanelId(plugin.pkg)));
+	}
 	function requireSwitchable(id) {
+		if (pluginIds().has(id)) return;
 		requireKnown(id);
-		if (!manifests().some((manifest) => manifest.id === id && manifest.card !== null)) throw new Error(`${id} 没有卡片，不能收起（它是把别的套件放回来的入口）`);
+		if (manifests().find((item) => item.id === id)?.card === null && ownedSet().has(id)) throw new Error(`${id} 没有卡片，不能收起（它是把别的套件放回来的入口）`);
 	}
 	function requireWorkspace(workspace) {
 		const key = workspace?.trim() ?? "";
 		if (key === "") throw new Error("这个会话不属于任何工作区：面板按工作区存，先打开或新建一个工作区");
 		return key;
 	}
+	function visibleOrder(workspace) {
+		return resolvePanels(manifests(), boardsOf(workspace), ownedSet()).filter((entry) => entry.shown && entry.hasCard).map((entry) => entry.id);
+	}
 	return {
 		list(workspace, target) {
-			return resolvePanels(manifests(), target === "machine" ? boardsOf(null) : boardsOf(workspace));
+			return resolvePanels(manifests(), target === "machine" ? boardsOf(null) : boardsOf(workspace), ownedSet());
+		},
+		listPlugins(workspace, target) {
+			return resolvePluginPanels(pluginRefs(), target === "machine" ? boardsOf(null) : boardsOf(workspace));
 		},
 		boards(workspace) {
 			return boardsOf(workspace);
@@ -4775,7 +5546,7 @@ function createPanelsService(options) {
 			requireSwitchable(id);
 			const { folder, key } = targetOf(target ?? "workspace", workspace);
 			takeBackReleased(id);
-			return withPersisted(folder, withShown(boardIn(folder), id), key);
+			return withPersisted(folder, withShown(boardIn(folder), id, key === null ? void 0 : visibleOrder(key)), key);
 		},
 		hide(id, workspace, target) {
 			requireSwitchable(id);
@@ -4784,14 +5555,34 @@ function createPanelsService(options) {
 		},
 		move(id, index, workspace, target) {
 			requireSwitchable(id);
-			const { folder, key } = targetOf(target ?? "workspace", workspace);
+			const scope = target ?? "workspace";
+			if (scope === "machine") throw new Error("机器级默认板没有顺序这一说：它只回答\"默认开哪几行\"。顺序是每个工作区自己的 —— 要排顺序就用默认作用域的那一次 move（或面板里拖动）。");
+			const { folder, key } = targetOf(scope, workspace);
 			const current = boardIn(folder);
 			if (!current.shown.includes(id)) takeBackReleased(id);
-			return withPersisted(folder, withMoved(current, id, index), key);
+			return withPersisted(folder, withMoved(current, id, index, visibleOrder(key)), key);
 		},
 		reset(workspace, target) {
 			const { folder, key } = targetOf(target ?? "workspace", workspace);
 			return withPersisted(folder, EMPTY_BOARD, key);
+		},
+		changedBy() {
+			const counts = /* @__PURE__ */ new Map();
+			for (const folder of store.scan(PANELS_MODULE_ID)) {
+				const board = readBoard(folder);
+				if (board === null) continue;
+				for (const id of /* @__PURE__ */ new Set([...board.shown, ...board.hidden])) counts.set(id, (counts.get(id) ?? 0) + 1);
+			}
+			return counts;
+		},
+		follow(workspace, id) {
+			const { folder, key } = targetOf("workspace", workspace);
+			if (id === void 0) {
+				folder.remove(PANELS_FILE);
+				notify();
+				return resolvePanels(manifests(), boardsOf(key), ownedSet());
+			}
+			return withPersisted(folder, withoutPanel(boardIn(folder), id), key);
 		}
 	};
 }
@@ -4802,13 +5593,15 @@ function panelRoutes(panels, values) {
 		const path = param(search, "path") ?? null;
 		const entry = panelsHandoffEntry(path === null ? {} : { path });
 		const handed = entry === void 0 ? void 0 : values?.take(entry);
-		if (handed !== void 0) return {
-			ok: true,
-			units: handed.value
-		};
+		const defaults = [...panels.list(null, "machine").filter((unit) => unit.shown).map((unit) => unit.id), ...panels.listPlugins(null, "machine").filter((plugin) => plugin.shown).map((plugin) => plugin.id)];
+		const own = panels.boards(path).workspace !== null;
 		return {
 			ok: true,
-			units: panels.list(path)
+			units: handed === void 0 ? panels.list(path) : handed.value,
+			plugins: panels.listPlugins(path),
+			defaults,
+			own,
+			changed: Object.fromEntries(panels.changedBy())
 		};
 	} };
 }
@@ -4867,6 +5660,18 @@ function createPluginLedger(options) {
 	};
 }
 //#endregion
+//#region src/modules/panels/model/plugin-panel.ts
+function pluginPanelRefs(ledger) {
+	return ledger.list().map((entry) => {
+		const name = pluginNameOf(entry);
+		return {
+			pkg: entry.package,
+			title: name ?? entry.package,
+			...name === void 0 ? {} : { name }
+		};
+	});
+}
+//#endregion
 //#region src/shared/api/installed-plugins.ts
 var INSTALLED_PLUGINS_ROUTE = "panels/plugins";
 //#endregion
@@ -4956,38 +5761,39 @@ function registerPanelTools(ctx, panels, values) {
 	}
 	const tool = {
 		name: "workbench_panels",
-		description: "看或调右侧面板：启用哪些套件、什么顺序。启用/收起 = 卡片与 agent 工具一起上下线（别的项目不受影响，不删数据）。收起是\"这个工作区明确不要它\"，连那些在机器级默认板上开着的套件也照样在这个工作区收起来，之后 show 能放回来。默认只动当前工作区（scope=workspace）；scope=machine 动的是\"机器级默认板\" —— 机器级默认板只是还没配过的工作区的默认值，已经自己配过的工作区保持自己的选择，不会被它改。在那份板上 hide = 明确写下\"不要它\"，这一笔比名单更管用：名单里还列着它也算不要，没配过的工作区因此看不到它；show 会把这笔划掉、把它放回去。",
-		parameters: {
+		description: "看或调右侧面板：启用哪些套件、什么顺序。启用/收起 = 卡片与 agent 工具一起上下线（别的项目不受影响，不删数据）。收起是\"这个工作区明确不要它\"，连那些在机器级默认板上开着的套件也照样在这个工作区收起来，之后 show 能放回来。顺序只属于工作区：没排过的按各模块自己声明的次序（开着的在前、关着的跟在后面）；show 或 move 过就以那次为准。机器级默认板只回答\"默认开哪几行\"，没有顺序这一说。scope=machine 动的是\"机器级默认板\" —— 它只是还没配过的工作区的默认值，已经自己配过的工作区保持自己的选择，不会被它改。在那份板上 hide = 明确写下\"不要它\"，这一笔比名单更管用：名单里还列着它也算不要，没提过它的工作区因此看不到它；show 会把这笔划掉、把它放回去。本工作区那份板只记**改过的那几行**（逐行覆盖）：没提到的行跟着机器级默认板走，所以那份板以后改了，没改过的工作区会跟着变。",
+		parameters: withApprovalNote({
 			type: "object",
 			properties: {
 				action: {
 					type: "string",
-					description: "show=这个工作区要它（之前收起的也放回来）；hide=这个工作区明确不要它（卡片与工具一起下线，默认在机器上也开着的套件同样收起，别的项目不受影响）；move=调顺序；reset=这个工作区不再有自己的选择（之前收起、启用的都忘掉；它从此明确\"什么都不要\"，机器级默认板也管不到它，要哪一块用 show 放回来）。",
+					description: "show=这个工作区要它（之前收起的也放回来）；hide=这个工作区明确不要它（卡片与工具一起下线，默认在机器上也开着的套件同样收起，别的项目不受影响）；move=调这个工作区的顺序（新开一行时它排在最后）；reset=清掉这个工作区改过的那些行（改完就全部回到跟着机器级默认板走）；follow=把某一行放回跟随（带 id = 只放回那一行；不带 id = 全部放回）。",
 					enum: [
 						"list",
 						"show",
 						"hide",
 						"move",
-						"reset"
+						"reset",
+						"follow"
 					]
 				},
 				id: {
 					type: "string",
-					description: "show / hide / move 必填，如 coding-issues。"
+					description: "show / hide / move 必填；follow 可选（带 id = 只把那一行放回跟随）。"
 				},
 				index: {
 					type: "integer",
-					description: "move 的位置，0 基（0=最上面）。"
+					description: "move 的位置，0 基（数的是当前开着的那几行）。"
 				},
 				scope: {
 					type: "string",
-					description: "workspace（默认）=只动当前工作区；machine=动机器级默认板，那是还没配过的工作区的默认值 —— 已经自己配过的工作区保持自己的选择，不受它影响。",
+					description: "workspace（默认）=只动当前工作区；machine=动机器级默认板，那是还没配过的工作区的默认值 —— 已经自己配过的工作区保持自己的选择，不受它影响。机器级板没有顺序这一说（move 会报错）。",
 					enum: ["workspace", "machine"]
 				}
 			},
 			required: ["action"],
 			additionalProperties: false
-		},
+		}, { required: true }),
 		output: {
 			schema: OUTPUT_SCHEMA,
 			render: (_args, value) => {
@@ -5009,8 +5815,9 @@ function registerPanelTools(ctx, panels, values) {
 				"show",
 				"hide",
 				"move",
-				"reset"
-			].includes(action)) throw new Error(`不认识的 action：${action}（可用：list / show / hide / move / reset）`);
+				"reset",
+				"follow"
+			].includes(action)) throw new Error(`不认识的 action：${action}（可用：list / show / hide / move / reset / follow）`);
 			if (action === "list") {
 				const units = list();
 				if (scope === "workspace") {
@@ -5022,11 +5829,19 @@ function registerPanelTools(ctx, panels, values) {
 					text: render(units, workspace, scope)
 				};
 			}
+			if (action === "follow") {
+				if (scope === "machine") throw new Error("机器级默认板没有\"放回跟随\"一说：它就是那份默认本身，直接 show / hide 写它。");
+				const units = panels.follow(workspace, id);
+				return {
+					units,
+					text: id === void 0 ? `这个工作区改过的行全部清掉 —— 每一行都回到跟着机器级默认板走（那份板以后改了，这里跟着变）。\n${render(units, workspace, scope)}` : `${id} 放回跟随 —— 它不再由这个工作区定，改跟机器级默认板走。\n${render(units, workspace, scope)}`
+				};
+			}
 			if (action === "reset") {
 				const units = panels.reset(workspace, scope);
 				return {
 					units,
-					text: scope === "machine" ? `机器级默认板已清空（是"配成空"，不是"没配过"）——还没配过的工作区从此默认什么都不开。${MACHINE_CAVEAT}\n${render(units, workspace, scope)}` : `这个工作区不再有自己的面板选择（之前收起、启用的都忘掉了；它从此明确"什么都不要"—— 机器级默认板也管不到它，要哪一块用 show 放回来）。\n${render(units, workspace, scope)}`
+					text: scope === "machine" ? `机器级默认板已清空 —— 从今往后，没在这一行改过的工作区默认什么都不开。${MACHINE_CAVEAT}\n${render(units, workspace, scope)}` : `这个工作区改过的行已全部清掉 —— 每一行都回到跟着机器级默认板走。\n${render(units, workspace, scope)}`
 				};
 			}
 			if (id === void 0) throw new Error(`${action} 需要一个 id（例如 coding-issues）。当前套件：${list().map((entry) => entry.id).join(", ")}`);
@@ -5058,29 +5873,37 @@ function registerPanelTools(ctx, panels, values) {
 var OWNED = [{
 	unit: panelsUnit.id,
 	manifest: panelsUnit,
-	mount({ ctx, logger, manifests, ownedUnits, opencliCommand, probe, store, values }) {
+	mount({ ctx, logger, manifests, ownedUnits, installable, opencliCommand, probe, store, values }) {
+		const ledger = createPluginLedger({
+			store,
+			home: isolatedHome()
+		});
 		const panels = createPanelsService({
 			manifests,
 			store,
 			owned: ownedUnits,
+			plugins: () => pluginPanelRefs(ledger),
 			logger
 		});
 		ctx.provide(PANELS_SERVICE, panels);
 		const profileDir = profileDirOf(ctx);
 		const shell = ctx.get("shell");
-		const ledger = createPluginLedger({
-			store,
-			home: isolatedHome()
-		});
+		const moduleManifests = () => {
+			const list = manifests();
+			if (installable === void 0) return list.filter(hasEnvSupply);
+			const ids = new Set(installable());
+			return list.filter((manifest) => ids.has(manifest.id));
+		};
 		const market = createMarketService({
-			manifests: manifests(),
-			manifestsNow: manifests,
+			manifests: moduleManifests(),
+			manifestsNow: moduleManifests,
 			...probe === void 0 ? {} : { probe },
 			shell,
 			...opencliCommand === void 0 ? {} : { command: opencliCommand },
 			bundles: readBundleManager(ctx),
 			installed: (pkg) => readInstalledModule(profileDir, pkg),
 			modules: () => profileModules(profileDir),
+			workbench: (pkg) => readProfilePackage(profileDir, pkg),
 			registries: createRegistryNotebook(profileDir),
 			ledger,
 			references: () => {
@@ -5460,6 +6283,24 @@ function bundleRegistriesHandler(ctx) {
 	};
 }
 var refusalLog = /* @__PURE__ */ new Map();
+async function workbenchVersion(input) {
+	const read = readProfilePackage(input.dir, PLUGIN_ID);
+	if (read === void 0) return void 0;
+	const registry = read.registry ?? input.fallback;
+	const queried = read.local === true || input.shell === void 0 || registry === void 0 ? void 0 : await latestVersion({
+		shell: input.shell,
+		name: read.pkg,
+		registry,
+		force: input.force
+	});
+	const latest = queried !== void 0 && isNewerVersion(queried, read.version) ? queried : void 0;
+	return {
+		pkg: read.pkg,
+		installed: read.version,
+		...latest === void 0 ? {} : { latest },
+		...read.local === true ? { local: true } : {}
+	};
+}
 function moduleVersionsHandler(ctx, shell) {
 	return async (search) => {
 		const manager = readBundleManager(ctx);
@@ -5472,36 +6313,44 @@ function moduleVersionsHandler(ctx, shell) {
 		const refusals = new Map((ctx.get("workbenchUnits")?.refusals() ?? []).filter((one) => one.unit !== "").map((one) => [one.unit, one.reasons]));
 		const force = param(search, "force") === "1";
 		const fallback = (await manager.registries())?.resolved ?? void 0;
+		const modules = await Promise.all(found.map(async (module) => {
+			const registry = module.registry ?? fallback;
+			const latest = shell === void 0 || registry === void 0 ? void 0 : await latestVersion({
+				shell,
+				name: module.pkg,
+				registry,
+				force
+			});
+			const raw = moduleDeclarationOf(dir, module.pkg);
+			const declared = raw === void 0 ? [] : declarationProblemsOf(module.pkg, raw);
+			const refused = refusals.get(module.unit) ?? (declared.length === 0 ? void 0 : declared);
+			if (refused === void 0) refusalLog.delete(module.pkg);
+			else {
+				const line = refused.join("；");
+				if (refusalLog.get(module.pkg) !== line) {
+					refusalLog.set(module.pkg, line);
+					ctx.logger?.warn?.(`[dsh-workbench] ${module.pkg} 装上了但用不了：${line}`);
+				}
+			}
+			return {
+				unit: module.unit,
+				pkg: module.pkg,
+				installed: module.version,
+				...latest === void 0 ? {} : { latest },
+				...module.local === true ? { local: true } : {},
+				...refused === void 0 ? {} : { refused }
+			};
+		}));
+		const workbench = await workbenchVersion({
+			dir,
+			shell,
+			fallback,
+			force
+		});
 		return {
 			ok: true,
-			modules: await Promise.all(found.map(async (module) => {
-				const registry = module.registry ?? fallback;
-				const latest = shell === void 0 || registry === void 0 ? void 0 : await latestVersion({
-					shell,
-					name: module.pkg,
-					registry,
-					force
-				});
-				const raw = moduleDeclarationOf(dir, module.pkg);
-				const declared = raw === void 0 ? [] : declarationProblemsOf(module.pkg, raw);
-				const refused = refusals.get(module.unit) ?? (declared.length === 0 ? void 0 : declared);
-				if (refused === void 0) refusalLog.delete(module.pkg);
-				else {
-					const line = refused.join("；");
-					if (refusalLog.get(module.pkg) !== line) {
-						refusalLog.set(module.pkg, line);
-						ctx.logger?.warn?.(`[dsh-workbench] ${module.pkg} 装上了但用不了：${line}`);
-					}
-				}
-				return {
-					unit: module.unit,
-					pkg: module.pkg,
-					installed: module.version,
-					...latest === void 0 ? {} : { latest },
-					...module.local === true ? { local: true } : {},
-					...refused === void 0 ? {} : { refused }
-				};
-			}))
+			modules,
+			...workbench === void 0 ? {} : { workbench }
 		};
 	};
 }
@@ -5528,15 +6377,26 @@ async function declarationRefusal(spec, inspection, ctx, manager) {
 	});
 	return refusedInspection(declarationRefusalOf(inspection.name, raw));
 }
-async function packageRefusal(spec, inspection, ctx, manager) {
-	if (inspection.status !== "accepted") return void 0;
+async function packageOverride(spec, inspection, ctx, manager, asked) {
 	const shell = ctx.get("shell");
-	const registry = typeof inspection.registry === "string" ? inspection.registry : (await manager.registries())?.resolved ?? void 0;
-	return (await packageRouteOf({
+	const registry = (inspection.status === "accepted" && typeof inspection.registry === "string" ? inspection.registry : void 0) ?? (typeof asked === "string" ? asked : (await manager.registries())?.resolved ?? void 0);
+	const route = await packageRouteOf({
 		spec,
 		...shell === void 0 ? {} : { shell },
 		...registry === void 0 ? {} : { registry }
-	}))?.kind === "neither" ? {
+	});
+	if (route?.kind === "opencli-plugin") {
+		if (inspection.status !== "refused") return void 0;
+		const ref = splitNpmSpec(spec);
+		return {
+			status: "plugin",
+			pkg: route.pkg ?? ref?.name ?? spec.trim(),
+			registry: registry ?? null,
+			...route.pluginName === void 0 ? {} : { pluginName: route.pluginName },
+			...ref?.version === void 0 ? {} : { version: ref.version }
+		};
+	}
+	return route?.kind === "neither" && inspection.status === "accepted" ? {
 		status: "refused",
 		problem: "not-a-module-or-plugin",
 		reason: refusalReason()
@@ -5560,7 +6420,8 @@ function bundleInspectHandler(ctx) {
 				message: "这个 profile 里没有插件管理器，装不了模块。"
 			}
 		};
-		const inspection = await manager.inspect(spec, registryOf(search));
+		const asked = registryOf(search);
+		const inspection = await manager.inspect(spec, asked);
 		if (inspection === null) return {
 			ok: false,
 			error: {
@@ -5570,7 +6431,7 @@ function bundleInspectHandler(ctx) {
 		};
 		return {
 			ok: true,
-			inspection: await packageRefusal(spec, inspection, ctx, manager) ?? await declarationRefusal(spec, inspection, ctx, manager) ?? inspection
+			inspection: await packageOverride(spec, inspection, ctx, manager, asked) ?? await declarationRefusal(spec, inspection, ctx, manager) ?? inspection
 		};
 	};
 }
@@ -6275,6 +7136,28 @@ function withRunsRoute(result, unit) {
 		}
 	};
 }
+function notedRegistry(registry, writesOf) {
+	return { register(definition) {
+		if (!writesOf(definition.name)) return registry.register(definition);
+		const noted = withApprovalNote(definition.parameters, { required: true });
+		return registry.register(noted === definition.parameters ? definition : {
+			...definition,
+			parameters: noted
+		});
+	} };
+}
+function scopedMountCtx(ctx, registry, writesOf) {
+	const tools = notedRegistry(registry, writesOf);
+	const get = (name) => {
+		const value = ctx.get(name);
+		return name === "tools" && value !== void 0 ? tools : value;
+	};
+	return new Proxy(ctx, { get(target, key) {
+		if (key === "get") return get;
+		const value = Reflect.get(target, key, target);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
 function failureReasonOf(error) {
 	if (error instanceof Error) return error.message;
 	return typeof error === "string" ? error : String(error);
@@ -6418,6 +7301,9 @@ function mountUnits(units, deps) {
 			continue;
 		}
 		const unit = host.manifest.id;
+		const tools = deps.ctx.get("tools");
+		const writes = toolUnits(deps.manifests());
+		const mountCtx = tools === void 0 ? deps.ctx : scopedMountCtx(deps.ctx, tools, (name) => writes.get(name)?.writes === true);
 		const longTasks = deps.longTasks === void 0 ? void 0 : createLongTaskHost({
 			scope: deps.longTasks.scope,
 			unit,
@@ -6427,10 +7313,11 @@ function mountUnits(units, deps) {
 		try {
 			result = host.face.mount({
 				manifest: host.manifest,
-				ctx: deps.ctx,
+				ctx: mountCtx,
 				logger: deps.logger,
 				manifests: deps.manifests,
 				ownedUnits,
+				...deps.installable === void 0 ? {} : { installable: deps.installable },
 				...deps.opencliCommand === void 0 ? {} : { opencliCommand: deps.opencliCommand },
 				...deps.probe === void 0 ? {} : { probe: deps.probe },
 				...deps.values === void 0 ? {} : { values: deps.values },
@@ -6495,13 +7382,19 @@ function mountUnits(units, deps) {
 }
 //#endregion
 //#region src/shared/api/host/unit-registry.ts
+function installableUnitsOf(registry) {
+	return registry.all().filter((host) => host.source.kind === "package").map((host) => host.unit);
+}
 function sourceLabel(source) {
-	return source.kind === "owned" ? "外壳自己" : source.pkg;
+	if (source.kind === "owned") return "外壳自己";
+	if (source.kind === "plugin") return "按已装 opencli 插件合成";
+	return source.pkg;
 }
 function createUnitRegistry(options) {
 	const refusals = [];
 	const hosts = [];
 	const byUnit = /* @__PURE__ */ new Map();
+	const failures = /* @__PURE__ */ new Map();
 	const listeners = /* @__PURE__ */ new Set();
 	function notify() {
 		for (const listener of listeners) listener();
@@ -6556,6 +7449,14 @@ function createUnitRegistry(options) {
 				source: { kind: "owned" }
 			});
 		},
+		registerPlugin(face) {
+			return add({
+				unit: face.manifest.id,
+				manifest: face.manifest,
+				face,
+				source: { kind: "plugin" }
+			});
+		},
 		all: () => hosts,
 		owned: () => hosts.filter((host) => host.source.kind === "owned").map((host) => host.unit),
 		refusals: () => refusals,
@@ -6563,7 +7464,14 @@ function createUnitRegistry(options) {
 		subscribe(listener) {
 			listeners.add(listener);
 			return () => listeners.delete(listener);
-		}
+		},
+		fail(unit, reason) {
+			failures.set(unit, reason);
+		},
+		recovered(unit) {
+			failures.delete(unit);
+		},
+		failureOf: (unit) => failures.get(unit)
 	};
 }
 //#endregion
@@ -6581,6 +7489,564 @@ function bindRosterFacts(options) {
 	});
 }
 //#endregion
+//#region src/shared/api/host/plugin-catalog.ts
+function recordOf(value) {
+	return typeof value === "object" && value !== null ? value : void 0;
+}
+function textOf(value) {
+	return typeof value === "string" ? value : "";
+}
+function stringsOf(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function argsOf(raw) {
+	if (!Array.isArray(raw)) return [];
+	return raw.flatMap((item) => {
+		const record = recordOf(item);
+		if (record === void 0) return [];
+		const name = textOf(record["name"]).trim();
+		if (name === "") return [];
+		const fallback = record["default"];
+		return [{
+			name,
+			type: textOf(record["type"]) || "string",
+			required: record["required"] === true,
+			positional: record["positional"] === true,
+			valueRequired: record["valueRequired"] === true,
+			choices: stringsOf(record["choices"]),
+			...fallback === void 0 || fallback === null ? {} : { defaultValue: fallback },
+			help: textOf(record["help"])
+		}];
+	});
+}
+function parsePluginRows(stdout) {
+	const parsed = parseJsonLoose(stdout);
+	if (!Array.isArray(parsed)) return void 0;
+	const rows = [];
+	for (const item of parsed) {
+		const record = recordOf(item);
+		if (record === void 0) return void 0;
+		const name = textOf(record["name"]).trim();
+		if (name === "") return void 0;
+		rows.push({
+			name,
+			version: textOf(record["version"]),
+			commands: stringsOf(record["commands"])
+		});
+	}
+	return rows;
+}
+function parseCommandRows(stdout) {
+	const parsed = parseJsonLoose(stdout);
+	if (!Array.isArray(parsed)) return void 0;
+	const rows = [];
+	for (const item of parsed) {
+		const record = recordOf(item);
+		if (record === void 0) return void 0;
+		const site = textOf(record["site"]).trim();
+		const name = textOf(record["name"]).trim();
+		if (site === "" || name === "") return void 0;
+		rows.push({
+			site,
+			name,
+			description: textOf(record["description"]),
+			access: textOf(record["access"]),
+			...textOf(record["domain"]) === "" ? {} : { domain: textOf(record["domain"]) },
+			args: argsOf(record["args"])
+		});
+	}
+	return rows;
+}
+function commandOf(plugin, row) {
+	return {
+		plugin,
+		name: row.name,
+		description: row.description,
+		access: row.access,
+		args: row.args
+	};
+}
+function attributeCommands(plugins, rows) {
+	const bySite = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const site = bySite.get(row.site) ?? /* @__PURE__ */ new Map();
+		site.set(row.name, row);
+		bySite.set(row.site, site);
+	}
+	const sets = [];
+	const problems = [];
+	if (plugins.length > 0 && rows.length === 0) problems.push(`opencli 报了 ${String(plugins.length)} 个插件，但命令面（opencli list -f json）里一条命令都没有 —— 两份清单对不上`);
+	for (const plugin of plugins) {
+		const found = bySite.get(plugin.name) ?? /* @__PURE__ */ new Map();
+		if (found.size === 0) {
+			problems.push(`「${plugin.name}」在 opencli 插件清单里，但命令面里没有一条 site=${plugin.name} 的命令 —— 归属不了，它这次不合成工具`);
+			continue;
+		}
+		const declared = plugin.commands.length > 0 ? plugin.commands : [...found.keys()];
+		const missing = declared.filter((name) => !found.has(name));
+		if (missing.length > 0) problems.push(`「${plugin.name}」自己的清单里有 ${String(missing.length)} 条命令在命令面里找不到：${missing.join("、")}（插件版本旧或命令面没更新）`);
+		const commands = declared.flatMap((name) => {
+			const row = found.get(name);
+			return row === void 0 ? [] : [commandOf(plugin.name, row)];
+		});
+		if (commands.length === 0) {
+			problems.push(`「${plugin.name}」没有任何一条能归属的命令 —— 它这次不合成工具`);
+			continue;
+		}
+		sets.push({
+			plugin: plugin.name,
+			version: plugin.version,
+			commands
+		});
+	}
+	return {
+		sets,
+		problems
+	};
+}
+function fingerprintOf(plugins) {
+	return plugins.map((plugin) => `${plugin.name}@${plugin.version}:${[...plugin.commands].sort().join(",")}`).sort().join("|");
+}
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function createPluginCatalog(options) {
+	const timeoutMs = options.timeoutMs ?? 12e4;
+	let current = {
+		ok: false,
+		at: 0,
+		sets: [],
+		problems: ["还没探过 opencli 的插件命令面"]
+	};
+	let heavy;
+	async function read(line) {
+		const shell = options.shell;
+		if (shell === void 0) return {
+			ok: false,
+			problem: "没有执行缝（shell 服务不可用），探不了这个命令面"
+		};
+		try {
+			const result = await runShell(shell, line, { timeoutMs });
+			if (result.timedOut) return {
+				ok: false,
+				problem: `${line} 超过 ${String(Math.round(timeoutMs / 1e3))} 秒没返回`
+			};
+			if (result.exitCode !== 0) {
+				const tail = result.stderr.trim() || result.stdout.trim();
+				return {
+					ok: false,
+					problem: `${line} 退出码 ${String(result.exitCode)}${tail === "" ? "" : `：${tail.split("\n").slice(-3).join(" ")}`}`
+				};
+			}
+			return {
+				ok: true,
+				stdout: result.stdout
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				problem: `${line} 没跑起来：${messageOf(error)}`
+			};
+		}
+	}
+	function fail(problem) {
+		current = {
+			ok: false,
+			at: Date.now(),
+			sets: current.sets,
+			problems: [problem]
+		};
+		return current;
+	}
+	async function refresh(callOptions = {}) {
+		const pluginsRun = await read(`${options.command} plugin list -f json`);
+		if (!pluginsRun.ok) return fail(pluginsRun.problem);
+		const plugins = parsePluginRows(pluginsRun.stdout);
+		if (plugins === void 0) return fail("opencli plugin list -f json 的输出读不懂（不是带 name 的 JSON 数组）");
+		const fingerprint = fingerprintOf(plugins);
+		if (!callOptions.force && heavy !== void 0 && heavy.fingerprint === fingerprint) {
+			current = {
+				ok: true,
+				at: Date.now(),
+				sets: heavy.sets,
+				problems: heavy.problems
+			};
+			return current;
+		}
+		const commandsRun = await read(`${options.command} list -f json`);
+		if (!commandsRun.ok) return fail(commandsRun.problem);
+		const rows = parseCommandRows(commandsRun.stdout);
+		if (rows === void 0) return fail("opencli list -f json 的输出读不懂（不是带 site / name 的 JSON 数组）");
+		const attributed = attributeCommands(plugins, rows);
+		heavy = {
+			fingerprint,
+			sets: attributed.sets,
+			problems: attributed.problems
+		};
+		current = {
+			ok: true,
+			at: Date.now(),
+			sets: attributed.sets,
+			problems: attributed.problems
+		};
+		return current;
+	}
+	return {
+		refresh,
+		snapshot: () => current
+	};
+}
+//#endregion
+//#region src/shared/api/host/plugin-login-hint.ts
+var NOT_LOGGED_IN = /未登录|请先登录|not logged in/i;
+function propertyOf$1(error, key) {
+	return typeof error === "object" && error !== null ? error[key] : void 0;
+}
+function helpUrlOfError(error) {
+	const raw = propertyOf$1(error, "helpUrl");
+	if (typeof raw !== "string") return void 0;
+	const trimmed = raw.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
+function isAuthFailure(error, message) {
+	if (NOT_LOGGED_IN.test(message)) return true;
+	return propertyOf$1(error, "code") === "auth-required";
+}
+function loginUrlOfDomain(domain) {
+	const bare = (domain ?? "").trim().replace(/\/+$/, "");
+	if (bare === "" || bare.includes("*")) return void 0;
+	return /^https?:\/\//.test(bare) ? bare : `https://${bare}/login`;
+}
+function pluginLoginHint(error, domain) {
+	const message = error instanceof Error ? error.message : String(error);
+	if (!isAuthFailure(error, message)) return message;
+	const url = helpUrlOfError(error) ?? loginUrlOfDomain(domain);
+	if (url !== void 0) return `${message}\n在 opencli 那扇浏览器窗里打开 ${url} 登一次，然后重试。`;
+	return `${message}\n在 opencli 那扇浏览器窗里登录这个站点（插件没给出具体地址，工作台拼不出来）—— 或跑一次工作台的体检/预热，然后重试。`;
+}
+//#endregion
+//#region src/shared/api/host/plugin-tools.ts
+var SCHEMA_TYPE = {
+	int: "integer",
+	integer: "integer",
+	number: "number",
+	float: "number",
+	bool: "boolean",
+	boolean: "boolean",
+	string: "string"
+};
+var KEY_ARG_LIMIT = 3;
+function pluginToolName(plugin, command) {
+	return `${plugin}_${command}`.toLowerCase().replace(/[^a-z0-9_]+/g, "_").replace(/_{2,}/g, "_").replace(/^_+|_+$/g, "");
+}
+function schemaTypeOf(arg) {
+	return SCHEMA_TYPE[arg.type.toLowerCase()] ?? "string";
+}
+function propertyOf(arg) {
+	const type = schemaTypeOf(arg);
+	const enumValues = arg.choices.length > 0 ? arg.choices.map((choice) => choice) : void 0;
+	return {
+		type,
+		...arg.help.trim() === "" ? {} : { description: arg.help.trim() },
+		...enumValues === void 0 ? {} : { enum: enumValues },
+		...arg.defaultValue === void 0 ? {} : { default: arg.defaultValue }
+	};
+}
+function pluginToolParameters(command) {
+	const properties = {};
+	for (const arg of command.args) properties[arg.name] = propertyOf(arg);
+	const required = command.args.filter((arg) => arg.required).map((arg) => arg.name);
+	const schema = {
+		type: "object",
+		properties,
+		...required.length === 0 ? {} : { required },
+		additionalProperties: false
+	};
+	return pluginToolWrites(command) ? withApprovalNote(schema, { required: true }) : schema;
+}
+function pluginToolDescription(command) {
+	const described = command.description.trim();
+	return described === "" ? `${command.plugin} ${command.name}（opencli 命令）` : described;
+}
+function pluginToolWrites(command) {
+	return command.access !== "read";
+}
+function valuesOf(raw) {
+	return typeof raw === "object" && raw !== null ? raw : {};
+}
+function pluginToolArgv(command, raw) {
+	const values = valuesOf(raw);
+	const argv = [];
+	for (const arg of command.args) {
+		if (!arg.positional) continue;
+		const value = values[arg.name];
+		if (value === void 0 || value === null) continue;
+		argv.push(String(value));
+	}
+	for (const arg of command.args) {
+		if (arg.positional) continue;
+		const value = values[arg.name];
+		if (value === void 0 || value === null) continue;
+		if (typeof value === "boolean") argv.push(`--${arg.name}`, value ? "true" : "false");
+		else if (Array.isArray(value)) argv.push(`--${arg.name}`, value.map((item) => String(item)).join(","));
+		else argv.push(`--${arg.name}`, String(value));
+	}
+	return argv;
+}
+function pluginKeyArgs(command, raw) {
+	const values = valuesOf(raw);
+	const ordered = [...command.args.filter((arg) => arg.required), ...command.args.filter((arg) => !arg.required)];
+	const parts = [];
+	for (const arg of ordered) {
+		const value = values[arg.name];
+		if (value === void 0 || value === null || value === "") continue;
+		parts.push(`${arg.name}=${String(value)}`);
+		if (parts.length === KEY_ARG_LIMIT) break;
+	}
+	return parts.length === 0 ? "没有带参数" : parts.join("、");
+}
+function pluginApprovalQuestion(command, raw) {
+	const key = pluginKeyArgs(command, raw);
+	return {
+		zh: `允许执行 ${command.plugin} 的 ${command.name}（${key}）吗？`,
+		en: `Run ${command.plugin} ${command.name} (${key})?`
+	};
+}
+function pluginApprovalFor(command) {
+	const denied = command.access === "read";
+	return (call) => {
+		if (denied) return { kind: "read" };
+		const question = pluginApprovalQuestion(command, call.arguments);
+		return {
+			kind: "ask",
+			reason: command.access === "write" ? `${command.plugin} ${command.name} 在 opencli 里标着 write` : `${command.plugin} ${command.name} 没有拿到 access（fail-safe：按写处理）`,
+			question,
+			fallback: question
+		};
+	};
+}
+//#endregion
+//#region src/shared/api/host/plugin-units.ts
+var TOOL_OUTPUT_SCHEMA = {
+	type: "object",
+	properties: {},
+	additionalProperties: true
+};
+function signatureOf(version, commands) {
+	return [version, ...commands.map((command) => `${command.name}:${command.access}:${command.args.map((arg) => `${arg.name}${arg.required ? "!" : ""}`).join("+")}`)].join("|");
+}
+function toolsOf(plugin, commands, taken) {
+	const tools = [];
+	const problems = [];
+	const claimed = /* @__PURE__ */ new Set();
+	for (const command of commands) {
+		const name = pluginToolName(plugin, command.name);
+		if (taken.has(name) || claimed.has(name)) {
+			problems.push(`工具名 ${name}（${plugin} ${command.name}）已经被占着 —— 这条命令这次不合成（先来的那份说了算）`);
+			continue;
+		}
+		claimed.add(name);
+		tools.push({
+			name,
+			command
+		});
+	}
+	return {
+		tools,
+		problems
+	};
+}
+function planOf(options, registered) {
+	const sets = new Map(options.catalog.snapshot().sets.map((set) => [set.plugin, set]));
+	const mine = new Set([...registered.values()].flatMap((item) => item.tools));
+	const taken = new Set([...options.toolNames?.() ?? []].filter((name) => !mine.has(name)));
+	const units = [];
+	const rows = [];
+	const problems = [];
+	for (const row of options.rows()) {
+		const plugin = row.name?.trim() ?? "";
+		if (plugin === "") {
+			problems.push(`面板上的插件行 ${row.id}（${row.pkg}）没有 opencli 插件名 —— 认不出它，这次不给它合成工具`);
+			continue;
+		}
+		const set = sets.get(plugin);
+		if (set === void 0) {
+			problems.push(`已装插件「${plugin}」在 opencli 的插件清单 / 命令面里找不到 —— 归属不了，这次不给它合成工具`);
+			continue;
+		}
+		sets.delete(plugin);
+		const declared = options.declared(plugin);
+		const overlapped = set.commands.filter((command) => declared.has(command.name));
+		if (overlapped.length > 0) problems.push(`「${plugin}」有 ${overlapped.length} 条命令由已装模块自己提供（${overlapped.map((command) => command.name).join("、")}）—— 通用桥不重复合成`);
+		const commands = set.commands.filter((command) => !declared.has(command.name));
+		const built = toolsOf(plugin, commands, taken);
+		problems.push(...built.problems);
+		for (const tool of built.tools) taken.add(tool.name);
+		if (built.tools.length === 0 && commands.length === set.commands.length) problems.push(`「${plugin}」的命令一条都没能合成工具`);
+		rows.push({
+			plugin,
+			pkg: row.pkg,
+			version: set.version,
+			commands: set.commands.length,
+			synthesized: built.tools.length,
+			tools: built.tools.map((tool) => tool.name)
+		});
+		if (built.tools.length === 0) continue;
+		units.push({
+			id: row.id,
+			plugin,
+			pkg: row.pkg,
+			version: set.version,
+			signature: signatureOf(set.version, commands),
+			commands,
+			tools: built.tools
+		});
+	}
+	for (const set of sets.values()) problems.push(`opencli 里装着「${set.plugin}」（${String(set.commands.length)} 条命令），但它不在插件台账里（不是从市场装的）—— 面板上没有它的开关，它的命令这次不进工具面`);
+	return {
+		units,
+		rows,
+		problems
+	};
+}
+function faceOf(unit, opencliFor) {
+	const byTool = new Map(unit.tools.map((tool) => [tool.name, tool.command]));
+	const manifest = {
+		id: unit.id,
+		card: null,
+		tools: unit.tools.map((tool) => ({
+			name: tool.name,
+			writes: pluginToolWrites(tool.command)
+		})),
+		host: { inject: [] }
+	};
+	return {
+		unit: unit.id,
+		manifest,
+		mount(deps) {
+			const tools = deps.ctx.get("tools");
+			if (tools === void 0) {
+				deps.logger?.info?.(`[dsh-workbench] 没有 tools 服务，跳过 ${unit.plugin} 的命令工具注册`);
+				return {
+					routes: {},
+					registerTools: () => []
+				};
+			}
+			const opencli = opencliFor(unit.plugin);
+			const definitions = unit.tools.map((tool) => ({
+				name: tool.name,
+				description: pluginToolDescription(tool.command),
+				parameters: pluginToolParameters(tool.command),
+				output: {
+					schema: TOOL_OUTPUT_SCHEMA,
+					render: (_args, value) => textOutput(jsonText(value))
+				},
+				async execute(raw, exec) {
+					const workspace = sessionWorkspace(exec);
+					try {
+						return (await opencli.json([tool.command.name, ...pluginToolArgv(tool.command, raw)], workspace === null ? {} : { workdir: workspace })).value;
+					} catch (error) {
+						throw new Error(pluginLoginHint(error, tool.command.domain), { cause: error });
+					}
+				}
+			}));
+			return {
+				routes: {},
+				factsOf: () => [],
+				registerTools: () => definitions.map((definition) => tools.register(definition)),
+				needsApproval: (call) => {
+					const command = call.name === void 0 ? void 0 : byTool.get(call.name);
+					return command === void 0 ? void 0 : pluginApprovalFor(command)(call);
+				}
+			};
+		}
+	};
+}
+function reconcile(registered, units, options) {
+	const wanted = new Map(units.map((unit) => [unit.id, unit]));
+	for (const [id, item] of [...registered]) {
+		const next = wanted.get(id);
+		if (next !== void 0 && next.signature === item.signature) continue;
+		item.drop();
+		registered.delete(id);
+	}
+	for (const unit of units) {
+		if (registered.has(unit.id)) continue;
+		registered.set(unit.id, {
+			signature: unit.signature,
+			tools: unit.tools.map((tool) => tool.name),
+			drop: options.registry.registerPlugin(faceOf(unit, options.opencliFor))
+		});
+	}
+}
+function createPluginUnits(options) {
+	const registered = /* @__PURE__ */ new Map();
+	let report = {
+		ok: false,
+		at: 0,
+		plugins: [],
+		problems: ["还没探过 opencli 的插件命令面"]
+	};
+	let inflight;
+	let lastTouch = 0;
+	let warned = "";
+	function warn(problems) {
+		const text = [...problems].sort().join("\n");
+		if (text === "" || text === warned) return;
+		warned = text;
+		options.logger?.warn?.(`[dsh-workbench] opencli 插件命令面：\n${text}`);
+	}
+	async function run(force) {
+		const probed = await options.catalog.refresh(force ? { force: true } : {});
+		if (!probed.ok) {
+			const problems = [...probed.problems, "这次探测没成功：上面这些插件行的工具面维持在上一份（不是\"这些插件没有命令\"）"];
+			report = {
+				ok: false,
+				at: Date.now(),
+				plugins: report.plugins,
+				problems
+			};
+			warn(problems);
+			return report;
+		}
+		const plan = planOf(options, registered);
+		reconcile(registered, plan.units, options);
+		report = {
+			ok: true,
+			at: Date.now(),
+			plugins: plan.rows,
+			problems: plan.problems
+		};
+		warn(plan.problems);
+		return report;
+	}
+	function refresh(callOptions = {}) {
+		if (inflight !== void 0) return inflight;
+		const task = run(callOptions.force === true).finally(() => {
+			inflight = void 0;
+		});
+		inflight = task;
+		return task;
+	}
+	return {
+		refresh,
+		touch() {
+			const now = Date.now();
+			if (inflight !== void 0) return;
+			if (now - lastTouch < 3e4) return;
+			lastTouch = now;
+			refresh().catch((error) => {
+				options.logger?.warn?.(`[dsh-workbench] 探 opencli 插件命令面时抛了错：${String(error)}`);
+			});
+		},
+		report: () => report,
+		dispose() {
+			for (const item of registered.values()) item.drop();
+			registered.clear();
+		}
+	};
+}
+//#endregion
 //#region src/shared/api/host/tool-scope.ts
 function agentOf(value) {
 	return typeof value === "object" && value !== null ? value : void 0;
@@ -6696,6 +8162,7 @@ function seedWorkbenchRuntime(ctx) {
 function apply(ctx) {
 	const facts = createFactLog();
 	const values = createValueHandoff();
+	const panelState = createPanelStateStore();
 	seedWorkbenchRuntime(ctx);
 	const opencli = opencliCommandOf(ctx);
 	const routes = {
@@ -6708,23 +8175,17 @@ function apply(ctx) {
 	};
 	const renderers = /* @__PURE__ */ new Map();
 	const shell = ctx.get("shell");
-	let roster;
 	const profileDir = profileDirOf(ctx);
 	const units = createUnitRegistry({
-		declarationOf: (unit) => {
-			if (roster === void 0) roster = new Map(profileModules(profileDir).map((row) => [row.unit, row.pkg]));
-			const pkg = roster.get(unit);
-			return pkg === void 0 ? void 0 : {
-				pkg,
-				declaration: moduleDeclarationOf(profileDir, pkg)
-			};
-		},
+		declarationOf: createDeclarationLookup(profileDir),
 		logger: ctx.logger
 	});
 	ctx.provide(UNITS_SERVICE, units);
+	ctx.provide(PANEL_STATE_SERVICE, panelState);
 	routes[UNIT_MANIFESTS_ROUTE] = () => ({
 		ok: true,
-		manifests: units.manifests()
+		manifests: units.manifests(),
+		installable: installableUnitsOf(units)
 	});
 	assembleHostUnits(units);
 	ctx.inject(["workspaceRegistry"], (scoped) => {
@@ -6767,6 +8228,23 @@ function apply(ctx) {
 		deniedTools: (workspace) => deniedNow(workspace),
 		logger: ctx.logger
 	});
+	const pluginTools = shell === void 0 ? void 0 : createPluginUnits({
+		registry: units,
+		catalog: createPluginCatalog({
+			shell,
+			command: opencli.command
+		}),
+		rows: () => ctx.get("workbenchPanels")?.listPlugins(null) ?? [],
+		declared: (plugin) => declaredPluginCommands(profileDir).get(plugin) ?? /* @__PURE__ */ new Set(),
+		opencliFor: (plugin) => createOpencli({
+			shell,
+			plugin,
+			command: opencli.command,
+			logger: ctx.logger
+		}),
+		toolNames: () => new Set(unitsOfTool().keys()),
+		logger: ctx.logger
+	});
 	const mounted = /* @__PURE__ */ new Map();
 	const mountFailures = /* @__PURE__ */ new Map();
 	const factsOfMap = /* @__PURE__ */ new Map();
@@ -6781,6 +8259,7 @@ function apply(ctx) {
 		if (item === void 0) return;
 		mounted.delete(id);
 		mountFailures.delete(id);
+		units.recovered(id);
 		for (const dispose of item.toolDisposers) dispose?.();
 		item.gateOff?.();
 		item.plan.disposeLongTasks();
@@ -6799,6 +8278,7 @@ function apply(ctx) {
 				logger: ctx.logger,
 				manifests: liveManifests,
 				ownedUnits: () => units.owned(),
+				installable: () => installableUnitsOf(units),
 				store,
 				opencliCommand: opencli.command,
 				probe: (unit, options) => probeOne(unit, options?.force ?? false),
@@ -6813,6 +8293,7 @@ function apply(ctx) {
 				reason: failureReasonOf(error),
 				host
 			});
+			units.fail(id, failureReasonOf(error));
 			ctx.logger?.warn?.(`[dsh-workbench] ${id} 套件起不来（装配期）：${failureReasonOf(error)}`);
 			return;
 		}
@@ -6845,6 +8326,7 @@ function apply(ctx) {
 				gateOff: one.gate?.subscribe(() => toolScope.reapply())
 			});
 			mountFailures.delete(id);
+			units.recovered(id);
 		} catch (error) {
 			for (const route of added) delete routes[route];
 			for (const kind of one.contextRenderers.keys()) renderers.delete(kind);
@@ -6856,6 +8338,7 @@ function apply(ctx) {
 				reason: failureReasonOf(error),
 				host
 			});
+			units.fail(id, failureReasonOf(error));
 			ctx.logger?.warn?.(`[dsh-workbench] ${id} 套件起不来（注册期）：${failureReasonOf(error)}`);
 		}
 	}
@@ -6880,7 +8363,10 @@ function apply(ctx) {
 	function sync() {
 		const present = new Set(units.all().map((one) => one.unit));
 		for (const id of [...mounted.keys()]) if (!present.has(id)) unmountUnit(id);
-		for (const id of [...mountFailures.keys()]) if (!present.has(id)) mountFailures.delete(id);
+		for (const id of [...mountFailures.keys()]) if (!present.has(id)) {
+			mountFailures.delete(id);
+			units.recovered(id);
+		}
 		for (const host of units.all()) {
 			if (mounted.has(host.unit)) continue;
 			const already = mountFailures.get(host.unit);
@@ -6920,6 +8406,23 @@ function apply(ctx) {
 		});
 	}
 	sync();
+	if (pluginTools !== void 0) {
+		const health = routes.health;
+		routes.health = async (search) => ({
+			...await health?.(search),
+			pluginTools: pluginTools.report()
+		});
+		ctx.effect(() => {
+			pluginTools.refresh().catch((error) => {
+				warn(ctx, `探 opencli 插件的命令面时抛了错：${String(error)}`);
+			});
+			return () => pluginTools.dispose();
+		}, `${PLUGIN_ID}: 已装且上板的 opencli 插件各合成一个单元（工具面照旧由面板那道闸收窄）`);
+		ctx.effect(() => {
+			const off = ctx.get(PANELS_SERVICE)?.subscribe?.(() => pluginTools.touch());
+			return () => off?.();
+		}, `${PLUGIN_ID}: 面板配置一动就重探插件命令面（装上 / 收起都在那一条链上）`);
+	}
 	ctx.effect(() => () => {
 		for (const id of [...mounted.keys()]) unmountUnit(id);
 		for (const dispose of undoPost) dispose?.();
@@ -6949,11 +8452,15 @@ function apply(ctx) {
 		return () => off?.();
 	}, `${PLUGIN_ID}: 事实归属（读工具与写工具同一处声明）`);
 	ctx.effect(() => {
-		const off = ctx.on?.("agent/created", (payload) => toolScope.apply(payload?.agent));
+		const off = ctx.on?.("agent/created", (payload) => {
+			toolScope.apply(payload?.agent);
+			pluginTools?.touch();
+		});
 		return () => off?.();
 	}, `${PLUGIN_ID}: agent 的工具面按工作区收窄（创建时）`);
 	ctx.effect(() => {
 		const off = ctx.on?.("system-prompt/assemble", async (_assembly, context, next) => {
+			pluginTools?.touch();
 			const resolved = await next();
 			return toolScope.narrow(resolved, context?.scope);
 		});
@@ -7006,6 +8513,7 @@ function apply(ctx) {
 		return () => off?.();
 	}, `${PLUGIN_ID}: 对话引用注入`);
 	ctx.effect(() => registerFactStream(ctx, facts), `${PLUGIN_ID}: 变更流`);
+	ctx.effect(() => registerPanelState(ctx, panelState), `${PLUGIN_ID}: 面板运行态上报（浏览器半侧报自己的取数与渲染收尾）`);
 	ctx.effect(() => registerApi(ctx, routes), `${PLUGIN_ID}: HTTP 投影`);
 }
 //#endregion