@dsh-workbench/core 0.3.11 → 1.0.0-beta.0

package/icon.svg

@@ -1,29 +1,18 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- 占位图标：插件管理卡片与 bundle 详情页使用。
-     图标以图片形式渲染，因此 currentColor 在这里不生效，
-     需要主题自适应时请按亮/暗两套各出一版或改用中性色。 -->
-<svg
-  xmlns="http://www.w3.org/2000/svg"
-  viewBox="0 0 64 64"
-  width="64"
-  height="64"
-  role="img"
-  aria-label="Workbench"
->
-  <rect
-    x="8"
-    y="8"
-    width="48"
-    height="48"
-    rx="12"
-    fill="none"
-    stroke="#6b7280"
-    stroke-width="5"
-  />
-  <path
-    d="M21 24h22M21 32h22M21 40h13"
-    stroke="#6b7280"
-    stroke-width="5"
-    stroke-linecap="round"
-  />
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" fill="none">
+  <defs>
+    <linearGradient id="wb-logo-app" x1="32" y1="4" x2="32" y2="58" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#54ECE7"/>
+      <stop offset="1" stop-color="#658EFF"/>
+    </linearGradient>
+  </defs>
+  <rect width="64" height="64" rx="15" fill="#0F1115"/>
+  <g transform="translate(3.84 3.84) scale(0.88)">
+    <path d="M10 6H54A5 5 0 0 1 59 11V43A5 5 0 0 1 54 48H10A5 5 0 0 1 5 43V11A5 5 0 0 1 10 6Z M12 10H52A3 3 0 0 1 55 13V41A3 3 0 0 1 52 44H12A3 3 0 0 1 9 41V13A3 3 0 0 1 12 10Z" fill="url(#wb-logo-app)" fill-rule="evenodd"/>
+    <rect x="27.5" y="48" width="9" height="4.75" fill="url(#wb-logo-app)"/>
+    <rect x="19" y="52.75" width="26" height="4.75" rx="2.375" fill="url(#wb-logo-app)"/>
+    <g transform="translate(14.6263 10.5853) scale(1.95)">
+      <path d="M8.844 13.742C8.967 12.328 8.45 10.4 8.45 9.65C8.45 8.94 8.88 8.43 9.6 8.43C11.285 8.43 12.106 8.281 12.685 8.104C13.71 7.791 14.585 6.768 15.055 5.945C15.137 5.803 14.99 5.641 14.829 5.671C13.829 5.86 12.828 5.376 11.827 4.978C10.659 4.514 9.491 4.707 8.935 4.876C8.805 4.915 8.658 4.819 8.636 4.686C8.468 3.643 7.405 2.615 5.498 2.238C4.54 2.048 3.748 1.574 3.347 1.202C3.252 1.113 3.088 1.125 3.03 1.242C2.628 2.059 2.168 3.82 5.248 6.115C5.82 6.494 6.31 6.785 6.574 7.637C6.72 8.104 6.157 9.168 6.061 9.368C5.157 11.27 5.089 12.19 4.926 13.742Z" fill="url(#wb-logo-app)"/>
+      <circle cx="6.885" cy="13.742" r="1.95" fill="url(#wb-logo-app)"/>
+    </g>
+  </g>
 </svg>

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dsh-workbench/core",
-  "version": "0.3.11",
-  "description": "个人工作台：Agent 工作台外壳（左栏 + 常驻对话 + 自研右侧数据面板）。",
+  "version": "1.0.0-beta.0",
+  "description": "个人工作台：Agent 工作台（左栏 + 常驻对话 + 自研右侧数据面板）。",
   "type": "module",
   "icon": "./icon.svg",
   "exports": {
@@ -14,6 +14,9 @@
       "default": "./client.js"
     },
     "./package.json": "./package.json",
+    "./contract": {
+      "types": "./dist/types/kernel/contract/index.d.ts"
+    },
     "./client/esm": {
       "types": "./dist/types/app/client.d.ts",
       "default": "./dist/client/index.js"
@@ -22,7 +25,6 @@
   "bin": {
     "dsh-workbench": "./bin/dsh-workbench"
   },
-  "//files": "npm 的兜底是 .gitignore —— 而 dist/ 在 .gitignore 里，不显式列出就会**漏掉宿主入口**（exports['.'] 指向它）。发出去之前用 npm pack --dry-run 数一遍 dist/ 有几条。skills/ 是 DIY 模式挂给 agent 的指引（经 skill-filesystem 的 customSkillDirs 挂载），漏了不报错、只是 DIY 的 agent 什么都不知道 —— selfcheck 有一条判据盯着它。scripts/ 下是**随包出货的脚本**：启动器与宿主自举都要跑它们（seed-profile.sh / seed-workshop.sh），漏一个的症状是「仓库里怎么都对、装出去那台静默什么也没做」。",
   "files": [
     "dist",
     "client.js",
@@ -32,18 +34,16 @@
     "profile",
     "skills",
     "preset",
+    "scripts/create-workbench.mjs",
+    "scripts/clone-profile.mjs",
     "scripts/seed-profile.sh",
     "scripts/seed-workshop.sh",
-    "README.md",
-    "docs/HANDOFF.md",
-    "docs/OPERATIONS.md"
+    "README.md"
   ],
   "meta": {
     "title": "Workbench",
     "description": "个人工作台"
   },
-  "//scripts": "包内不跑 check:docs —— 那份文档管理块住在仓库根的 docs/ARCHITECTURE.md，由根 `pnpm run check` 用 --config 指到本包的 arch.config.mjs 校验。check 与 prepublishOnly 都走 -w 跑根那一整套：包内自己串一份会漏掉 lint（react-hooks 那几条规则只在这里跑）、check:docs 与模块工具包的十三条判据 —— 2026-10-16 实测踩到（渲染期写 ref，包内全绿、根上一跑就红）。",
-  "//dsh.bundle.patch": "一份 preset 就是一个补丁层：它 insert 一行 @deepseek-ai/dsh-agent-preset，config.plugins 是整表插件清单。diy.patch.yml 是**生成的**（scripts/gen-diy-preset.mjs，从 dsh 出厂那份 standard.patch.yml 派生），selfcheck 有一条判据盯着它有没有过期。",
   "dsh": {
     "bundle": {
       "patch": [
@@ -62,7 +62,6 @@
       ]
     }
   },
-  "//engines": "DIY 模式（preset/diy.patch.yml）是从 **dsh 出厂那份 standard.patch.yml** 派生的，所以这份外壳只跟着它派生的那一代 dsh 走：dsh 太旧时那个 preset 挂不起来，而 dsh 的模式选择器**只列挂得起来的** ⇒ 用户面前「工作台 DIY 模式」整个不见，一句错都不报（实测 0.2.0-rc.2：缺 dsh-tool-schedule）。这里声明下限，让 dsh 自己的兼容性预检在**装的时候**拒绝（自 0.2.1-alpha.4 起 engines.dsh 优先于 peer）。⚠️ **不写 peerDependencies['@deepseek-ai/dsh']**：pnpm 的 auto-install-peers（v11 连 optional 也装）会把整套 dsh 拖进 profile。旧到不认识 engines.dsh 的 dsh（0.2.0 及更早）由启动器那道硬门禁兜 —— 见 bin/dsh-workbench。判据：selfcheck 的「声明下限 = 验过的 dsh 版本」那条。",
   "engines": {
     "dsh": ">=0.2.1-rc.2"
   },
@@ -75,10 +74,13 @@
     }
   },
   "devDependencies": {
-    "@arch-guard/core": "^0.11.0",
+    "@arch-guard/core": "^0.11.1",
     "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-rc.2",
     "@types/node": "^24.19.0",
+    "@types/proper-lockfile": "^4.1.4",
     "@types/react": "^19.3.0",
+    "@types/which": "^3.0.4",
+    "@types/write-file-atomic": "^4.0.3",
     "@vitest/coverage-v8": "^5.0.2",
     "esbuild": "^0.28.2",
     "react": "^19.3.0",
@@ -86,12 +88,28 @@
     "vite": "^8.3.1",
     "vitest": "^5.0.2"
   },
-  "//publishConfig": "只影响**发布这个包**，不影响别人解析依赖。现在发**公网 npm**（scripts/release.mjs 走 registry.npmjs.org），所以这里只有 access；哪天真要改发内网源，地址写在这一段的 registry 里（release.mjs 会优先读它）。",
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@dsh-workbench/shared": "0.3.11"
+    "dayjs": "^1.11.23",
+    "execa": "^10.2.0",
+    "prompts": "^2.4.2",
+    "proper-lockfile": "^4.1.2",
+    "which": "^7.0.0",
+    "write-file-atomic": "^8.0.0",
+    "@dsh-workbench/shared": "1.0.0-beta.0",
+    "@dsh-workbench/adapters-default": "1.0.0-beta.0"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/novaeth/dsh-workbench.git",
+    "directory": "packages/core"
+  },
+  "homepage": "https://github.com/novaeth/dsh-workbench#readme",
+  "bugs": {
+    "url": "https://github.com/novaeth/dsh-workbench/issues"
   },
   "scripts": {
     "build": "node scripts/build.mjs && node scripts/build-types.mjs",
@@ -106,6 +124,8 @@
     "test": "vitest run",
     "coverage": "vitest run --coverage",
     "dev": "node scripts/dev.mjs",
-    "build:types": "node scripts/build-types.mjs"
+    "dev:desktop": "node scripts/dev.mjs --desktop",
+    "build:types": "node scripts/build-types.mjs",
+    "check:adapter-defaults": "node scripts/check-adapter-defaults.mjs"
   }
 }

package/preset/diy.patch.yml

@@ -1,5 +1,5 @@
 # Agent preset workbench-diy：DIY 模式。**这个文件是生成的**，别手改 ——
-# 改 packages/workbench/scripts/gen-diy-preset.mjs 再重跑它。
+# 改 packages/core/scripts/gen-diy-preset.mjs 再重跑它。
 #
 # 它从 dsh 出厂那份 standard.patch.yml 派生（整表 plugins 归 dsh 管，手抄会漂），
 # 只叠加三处差分：DIY skill 目录、tool-cordis、plugin-manager 打开。

package/profile/isolation.patch.yml

@@ -8,10 +8,10 @@
 # 两个 profile 共用同一份会话历史。工作台要提供自己的定制工具，等于一个
 # 独立的 agent 环境，共享会话没有意义 —— 这三行把数据分开。
 #
-# 隔离后：
-#   会话      ~/.dsh/workbench/sessions/
-#   工作区    ~/.dsh/workbench/storages/        （workspace 走 storage-domain）
-#   附件      ~/.dsh/workbench/attachments/v1/
+# 隔离后（默认 profile；新 profile 由 DSH_WORKBENCH_HOME 指到自己的根）：
+#   会话      $DSH_HOME/workbench/sessions/
+#   工作区    $DSH_HOME/workbench/storages/        （workspace 走 storage-domain）
+#   附件      $DSH_HOME/workbench/attachments/v1/
 # 有意不隔离：
 #   凭据      ~/.dsh/.credentials.yaml          （两边共用同一把 API key）
 #
@@ -22,17 +22,17 @@
 - id: session-persistence-jsonl
   name: '@deepseek-ai/dsh-session-persistence-jsonl'
   config:
-    root: !!js dshHomePath('workbench/sessions')
+    root: !!js (process.env.DSH_WORKBENCH_HOME ?? dshHomePath('workbench')) + '/sessions'
 
 - id: storage-json
   name: '@deepseek-ai/dsh-storage-json'
   config:
-    root: !!js dshHomePath('workbench/storages')
+    root: !!js (process.env.DSH_WORKBENCH_HOME ?? dshHomePath('workbench')) + '/storages'
 
 - id: attachment-local
   name: '@deepseek-ai/dsh-attachment-local'
   config:
-    dshHome: !!js dshHomePath('workbench')
+    dshHome: !!js process.env.DSH_WORKBENCH_HOME ?? dshHomePath('workbench')
 
 # 可写根：**无会话**的插件命令（市场装模块、自举跑的那几条）回落到它。
 #
@@ -43,4 +43,4 @@
 - id: sandbox-policy
   config:
     mode: !!js process.env.DSH_PERMISSION_MODE ?? 'workspace-write'
-    workspaceRoot: !!js dshHomePath('workbench')
+    workspaceRoot: !!js process.env.DSH_WORKBENCH_HOME ?? dshHomePath('workbench')

package/profile/sandbox.patch.yml

@@ -5,7 +5,7 @@
 # 插件发起的调用**没有会话**，于是回落到部署策略；dsh-base 出厂那一条写的是
 # `workspaceRoot: !!js process.cwd()` —— 而安装目标是 `$DSH_HOME/workbench/...`，
 # 不在启动目录下面，沙箱拒写（实测 EPERM：mkdir ~/.npm/_cacache、mkdir
-# $DSH_HOME/workbench/...，见 .scratch/agent-issues/spec.md 第 10.3 节）。
+# $DSH_HOME/workbench/...，见 内部设计记录 第 10.3 节）。
 # 症状：自动安装死在第一步，界面只能退化成"让用户去终端抄一条命令" ——
 # 终端没有沙箱，抄过去反而能跑，于是这个缺口一直看不出来。
 #
@@ -23,4 +23,4 @@
 - id: sandbox-policy
   config:
     mode: !!js process.env.DSH_PERMISSION_MODE ?? 'workspace-write'
-    workspaceRoot: !!js dshHomePath('workbench')
+    workspaceRoot: !!js process.env.DSH_WORKBENCH_HOME ?? dshHomePath('workbench')

package/scripts/clone-profile.mjs

@@ -0,0 +1,268 @@
+#!/usr/bin/env node
+
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+
+const home = process.env.DSH_HOME?.trim() || join(homedir(), '.dsh');
+const sourceName = process.env.WB_SOURCE_PROFILE?.trim() || 'web';
+const targetName = process.env.WB_TARGET_PROFILE?.trim() || '';
+const sourceDir = join(home, 'profiles', sourceName);
+const targetDir = join(home, 'profiles', targetName);
+const sourceCandidate = join(home, sourceName);
+const sourcePatchForHome = join(sourceDir, 'cordis.patch.yml');
+const sourcePatchText = existsSync(sourcePatchForHome) ? readText(sourcePatchForHome) : '';
+const sourceHasIsolation = /id:\s*session-persistence-jsonl/.test(sourcePatchText);
+const sourceHome =
+  process.env.WB_SOURCE_HOME?.trim() ||
+  (!sourceHasIsolation
+    ? home
+    : sourcePatchText.includes('DSH_WORKBENCH_HOME') && sourceName !== 'workbench'
+      ? sourceCandidate
+      : join(home, 'workbench'));
+const targetHome = process.env.DSH_WORKBENCH_HOME?.trim() || join(home, targetName);
+const copySettings = process.env.WB_COPY_SETTINGS === '1';
+const copyPlugins = process.env.WB_COPY_PLUGINS === '1';
+const copyProjects = process.env.WB_COPY_PROJECTS === '1';
+const copySessions = process.env.WB_COPY_SESSIONS === '1';
+
+const PROFILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const ISOLATION_IDS = new Set([
+  'session-persistence-jsonl',
+  'storage-json',
+  'attachment-local',
+  'sandbox-policy',
+]);
+const ASSET_MAX_BYTES = 8 * 1024 * 1024;
+const ASSET_MAX_FILES = 500;
+const ASSET_SKIP = new Set(['node_modules', '.git', '.DS_Store']);
+
+function say(message) {
+  process.stdout.write(`→ ${message}\n`);
+}
+
+function fail(message) {
+  process.stderr.write(`clone-profile: ${message}\n`);
+  process.exit(1);
+}
+
+if (!PROFILE_NAME.test(sourceName)) fail(`来源 profile 名不合法：${sourceName}`);
+if (!PROFILE_NAME.test(targetName)) fail(`目标 profile 名不合法：${targetName}`);
+if (sourceName === targetName) fail('来源和目标不能是同一个 profile');
+if (!existsSync(join(sourceDir, 'package.json'))) fail(`没有来源 profile：${sourceDir}`);
+if (!existsSync(targetDir)) fail(`目标 profile 还没建好：${targetDir}`);
+
+function readText(file) {
+  return readFileSync(file, 'utf8');
+}
+
+if (copySettings && !copyPlugins) {
+  const refs = localPluginRefs();
+  if (refs > 0) {
+    fail(`设置里有 ${refs} 个本地插件文件引用；不能只复制设置不复制插件（会指向不存在的文件）。要么一起复制插件，要么取消设置。`);
+  }
+}
+
+function parseBlocks(text) {
+  const lines = text.split('\n');
+  const starts = [];
+  lines.forEach((line, index) => {
+    if (/^- /.test(line) || line === '-') starts.push(index);
+  });
+  const blocks = [];
+  for (let i = 0; i < starts.length; i += 1) {
+    const from = starts[i];
+    const to = i + 1 < starts.length ? starts[i + 1] : lines.length;
+    let end = to;
+    while (end > from && (lines[end - 1] ?? '').trim() === '') end -= 1;
+    const body = lines.slice(from, end).join('\n');
+    if (body.trim() === '') continue;
+    const first = body.split('\n')[0] ?? '';
+    const id = /^- id:[ \t]*"?([^"\s#]+)/.exec(first)?.[1];
+    const insert = id === undefined && /^- insert:[ \t]*$/.test(first);
+    const nested = body
+      .split('\n')
+      .map((line) => /^[ \t]+-[ \t]*id:[ \t]*"?([^"\s#]+)/.exec(line)?.[1])
+      .filter(Boolean);
+    const key = id !== undefined ? `id:${id}` : insert ? `insert:${nested.join(', ')}` : `block:${String(i)}`;
+    blocks.push({ key, id: id ?? nested.join(', ') ?? key, insert, body });
+  }
+  return blocks;
+}
+
+function namesOf(body) {
+  return body
+    .split('\n')
+    .map((line) => /^[ \t]*-?[ \t]*name:[ \t]*['"]?([^'"\s#]+)/.exec(line)?.[1])
+    .filter((name) => name !== undefined && (name.startsWith('./') || name.startsWith('../') || name.startsWith('file://') || isAbsolute(name)));
+}
+
+function insideProfile(dir, ref) {
+  if (ref.startsWith('file://')) return null;
+  if (!ref.startsWith('./') && !ref.startsWith('../') && !isAbsolute(ref)) return null;
+  const abs = resolve(dir, ref);
+  const rel = relative(dir, abs);
+  if (rel === '' || rel === '..' || rel.startsWith(`..${requireSep()}`) || isAbsolute(rel)) return null;
+  return { rel: rel.split(requireSep()).join('/'), abs };
+}
+
+function requireSep() {
+  return process.platform === 'win32' ? '\\' : '/';
+}
+
+function copyFileAsset(source, target, budget) {
+  const stat = statSync(source);
+  if (stat.isSymbolicLink() || !stat.isFile()) return false;
+  if (stat.size > ASSET_MAX_BYTES) return false;
+  budget.bytes += stat.size;
+  if (budget.bytes > 32 * 1024 * 1024 || budget.files >= ASSET_MAX_FILES) return false;
+  mkdirSync(dirname(target), { recursive: true });
+  cpSync(source, target);
+  budget.files += 1;
+  return true;
+}
+
+function copyDirAsset(source, target, budget) {
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (ASSET_SKIP.has(entry.name)) continue;
+      const abs = join(dir, entry.name);
+      if (entry.isSymbolicLink()) return false;
+      if (entry.isDirectory()) {
+        if (!walk(abs)) return false;
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const rel = relative(source, abs);
+      if (!copyFileAsset(abs, join(target, rel), budget)) return false;
+    }
+    return true;
+  };
+  return walk(source);
+}
+
+function localPluginRefs() {
+  const sourcePatch = join(sourceDir, 'cordis.patch.yml');
+  if (!existsSync(sourcePatch)) return 0;
+  const seen = new Set();
+  for (const block of parseBlocks(readText(sourcePatch))) {
+    if (!block.insert) continue;
+    for (const ref of namesOf(block.body)) {
+      const located = insideProfile(sourceDir, ref);
+      if (located !== null) seen.add(located.rel);
+    }
+  }
+  return seen.size;
+}
+
+function rewritePaths(body) {
+  return body.replace(/(dshHomePath\(\s*['"])workbench(?=[/'"])/g, `$1${targetName}`);
+}
+
+function copySettingRows() {
+  const sourcePatch = join(sourceDir, 'cordis.patch.yml');
+  const targetPatch = join(targetDir, 'cordis.patch.yml');
+  if (!existsSync(sourcePatch)) {
+    say('来源没有 cordis.patch.yml，跳过设置复制');
+    return;
+  }
+  const sourceBlocks = parseBlocks(readText(sourcePatch));
+  const initial = existsSync(targetPatch) ? readText(targetPatch) : '';
+  let current = initial.replace(/^\s*\[\]\s*$/m, '');
+  const targetKeys = new Set(parseBlocks(current).map((block) => block.key));
+  const copied = [];
+  const skipped = [];
+  for (const block of sourceBlocks) {
+    if (ISOLATION_IDS.has(block.id) || targetKeys.has(block.key)) {
+      skipped.push(block.id);
+      continue;
+    }
+    const body = rewritePaths(block.body);
+    current = `${current.replace(/\s+$/, '')}\n\n${body}\n`;
+    writeFileSync(targetPatch, current, 'utf8');
+    targetKeys.add(block.key);
+    copied.push(block.id);
+  }
+  say(`设置行：复制 ${copied.length}，跳过 ${skipped.length}`);
+}
+
+function copyPluginAssets() {
+  const sourcePatch = join(sourceDir, 'cordis.patch.yml');
+  if (!existsSync(sourcePatch)) return;
+  const budget = { bytes: 0, files: 0 };
+  const seen = new Set();
+  let copied = 0;
+  for (const block of parseBlocks(readText(sourcePatch))) {
+    if (!block.insert || ISOLATION_IDS.has(block.id)) continue;
+    for (const ref of namesOf(block.body)) {
+      const located = insideProfile(sourceDir, ref);
+      if (located === null || seen.has(located.rel)) continue;
+      seen.add(located.rel);
+      const source = join(sourceDir, located.rel);
+      const target = join(targetDir, located.rel);
+      if (!existsSync(source)) {
+        say(`缺文件，跳过：${located.rel}`);
+        continue;
+      }
+      const stat = statSync(source);
+      const ok = stat.isDirectory()
+        ? copyDirAsset(source, target, budget)
+        : copyFileAsset(source, target, budget);
+      if (ok) copied += 1;
+      else say(`文件太大或含符号链接，跳过：${located.rel}`);
+    }
+  }
+  say(`本地插件文件：复制 ${copied} 个`);
+}
+
+function copyProjectList() {
+  const source = join(sourceHome, 'storages', 'workspace.json');
+  if (!existsSync(source)) {
+    say('来源没有项目列表，跳过');
+    return;
+  }
+  const target = join(targetHome, 'storages', 'workspace.json');
+  mkdirSync(dirname(target), { recursive: true });
+  cpSync(source, target);
+  say('项目列表：已复制');
+}
+
+function copySessionData() {
+  const source = join(sourceHome, 'sessions');
+  if (!existsSync(source)) {
+    say('来源没有会话记录，跳过');
+    return;
+  }
+  const target = join(targetHome, 'sessions');
+  mkdirSync(dirname(target), { recursive: true });
+  cpSync(source, target, { recursive: true });
+  say('会话记录：已复制');
+  const attachments = join(sourceHome, 'attachments');
+  if (existsSync(attachments)) cpSync(attachments, join(targetHome, 'attachments'), { recursive: true });
+}
+
+function mergeDependencies() {
+  const sourceManifest = JSON.parse(readText(join(sourceDir, 'package.json')));
+  const targetManifest = JSON.parse(readText(join(targetDir, 'package.json')));
+  const sourceDeps = sourceManifest.dependencies ?? {};
+  const targetDeps = targetManifest.dependencies ?? {};
+  const merged = { ...targetDeps };
+  for (const [name, spec] of Object.entries(sourceDeps)) {
+    if (name === '@dsh-workbench/core') continue;
+    if (!Object.hasOwn(merged, name)) merged[name] = spec;
+  }
+  targetManifest.dependencies = merged;
+  const tmp = `${join(targetDir, 'package.json')}.wb-clone`;
+  writeFileSync(tmp, `${JSON.stringify(targetManifest, null, 2)}\n`, 'utf8');
+  renameSync(tmp, join(targetDir, 'package.json'));
+  say(`依赖：并入 ${Object.keys(merged).length - Object.keys(targetDeps).length} 项`);
+}
+
+mkdirSync(targetDir, { recursive: true });
+mkdirSync(targetHome, { recursive: true });
+if (copySettings) copySettingRows();
+if (copyPlugins) copyPluginAssets();
+mergeDependencies();
+if (copyProjects) copyProjectList();
+if (copySessions) copySessionData();
+say('完成');

package/scripts/create-workbench.mjs

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+
+import { spawnSync } from 'node:child_process';
+import { existsSync, readdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import prompts from 'prompts';
+
+const PKG_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+const HOME = process.env.DSH_HOME?.trim() || join(homedir(), '.dsh');
+const PROFILES_DIR = join(HOME, 'profiles');
+const PROFILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+
+function say(message) {
+  process.stdout.write(`${message}\n`);
+}
+
+function fail(message) {
+  process.stderr.write(`create-workbench: ${message}\n`);
+  process.exit(1);
+}
+
+function onCancel() {
+  process.stdout.write('\n已取消。\n');
+  process.exit(130);
+}
+
+function listProfiles() {
+  try {
+    return readdirSync(PROFILES_DIR, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory() && existsSync(join(PROFILES_DIR, entry.name, 'package.json')))
+      .map((entry) => entry.name)
+      .sort((a, b) => a.localeCompare(b));
+  } catch {
+    return [];
+  }
+}
+
+function uniqueName(base) {
+  if (!existsSync(join(PROFILES_DIR, base))) return base;
+  for (let index = 2; index < 1000; index += 1) {
+    const candidate = `${base}${index}`;
+    if (!existsSync(join(PROFILES_DIR, candidate))) return candidate;
+  }
+  fail('找不到可用的新名字，请手动输入一个。');
+}
+
+function nameProblem(value, source, profiles) {
+  const name = value.trim();
+  if (name === '') return '名字不能为空';
+  if (!PROFILE_NAME.test(name)) return '只用字母、数字、点、下划线或短横线，且以字母或数字开头';
+  if (name === source) return '不能和来源 profile 同名';
+  if (profiles.includes(name) || existsSync(join(PROFILES_DIR, name))) return `已经有 profile：${name}`;
+  return null;
+}
+
+function runSetup(args) {
+  const child = spawnSync('bash', [join(PKG_ROOT, 'bin', 'dsh-workbench'), ...args], { stdio: 'inherit' });
+  if (child.error !== undefined) fail(child.error.message);
+  process.exit(child.status ?? 1);
+}
+
+if (!process.stdin.isTTY || !process.stdout.isTTY) {
+  fail('这里需要交互终端。脚本或 CI 里请用：setup --from web --profile <名字>');
+}
+
+const profiles = listProfiles();
+
+if (profiles.length === 0) {
+  say('这台机器还没有 profile；用 dsh 出厂的 web 模板建一个空工作台。');
+  const nameAnswer = await prompts(
+    {
+      type: 'text',
+      name: 'name',
+      message: '新工作台叫什么？',
+      initial: uniqueName('workbench'),
+      validate: (value) => nameProblem(String(value), '', profiles) ?? true,
+    },
+    { onCancel },
+  );
+  const name = String(nameAnswer.name).trim();
+  const confirmAnswer = await prompts(
+    {
+      type: 'confirm',
+      name: 'ok',
+      message: `创建 ${name}（dsh 出厂 web 模板，不复制设置）？`,
+      initial: true,
+    },
+    { onCancel },
+  );
+  if (!confirmAnswer.ok) {
+    say('已取消。');
+    process.exit(0);
+  }
+  runSetup(['setup', '--profile', name]);
+}
+
+const defaultSource = profiles.includes('web') ? 'web' : profiles[0];
+const sourceAnswer = await prompts(
+  {
+    type: 'select',
+    name: 'source',
+    message: '用哪个 profile 当模板？',
+    choices: profiles.map((name) => ({ title: name, value: name })),
+    initial: Math.max(0, profiles.indexOf(defaultSource)),
+  },
+  { onCancel },
+);
+const source = sourceAnswer.source;
+
+const defaultName = 'workbench';
+const nameAnswer = await prompts(
+  {
+    type: 'text',
+    name: 'name',
+    message: '新工作台叫什么？',
+    initial: defaultName,
+    validate: (value) => nameProblem(String(value), source, profiles) ?? true,
+  },
+  { onCancel },
+);
+const name = String(nameAnswer.name).trim();
+
+const copyAnswer = await prompts(
+  {
+    type: 'multiselect',
+    name: 'copy',
+    message: `从 ${source} 复制哪些内容？`,
+    instructions: '空格选择 · 回车确认',
+    choices: [
+      { title: '设置（模型、主题等）', value: 'settings', selected: true },
+      { title: '本地插件文件', value: 'plugins', selected: true },
+      { title: '项目列表', value: 'projects', selected: true },
+      { title: '会话记录（可选，可能很多）', value: 'sessions', selected: false },
+    ],
+  },
+  { onCancel },
+);
+const copy = new Set(copyAnswer.copy ?? []);
+if (copy.has('settings') && !copy.has('plugins')) {
+  copy.add('plugins');
+  say('设置行引用的本地插件会一起复制（否则配置会指向不存在的文件）。');
+}
+
+const confirmAnswer = await prompts(
+  {
+    type: 'confirm',
+    name: 'ok',
+    message: `创建 ${name}（来源 ${source}，复制：${[...copy].join('、') || '无'}）？`,
+    initial: true,
+  },
+  { onCancel },
+);
+if (!confirmAnswer.ok) {
+  say('已取消。');
+  process.exit(0);
+}
+
+const args = ['setup', '--from', source, '--profile', name];
+if (copy.has('sessions')) args.push('--with-sessions');
+if (!copy.has('settings')) args.push('--no-settings');
+if (!copy.has('plugins')) args.push('--no-plugins');
+if (!copy.has('projects')) args.push('--no-projects');
+
+runSetup(args);