@dsh-workbench/core 1.0.0-beta.1 → 1.0.0

package/scripts/clone-profile.mjs

@@ -1,41 +1,24 @@
 #!/usr/bin/env node
 
-import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { join } from 'node:path';
+import { parseBlocks } from './patch-blocks.mjs';
 
 const home = process.env.DSH_HOME?.trim() || join(homedir(), '.dsh');
 const sourceName = process.env.WB_SOURCE_PROFILE?.trim() || 'web';
 const targetName = process.env.WB_TARGET_PROFILE?.trim() || '';
 const sourceDir = join(home, 'profiles', sourceName);
 const targetDir = join(home, 'profiles', targetName);
-const sourceCandidate = join(home, sourceName);
-const sourcePatchForHome = join(sourceDir, 'cordis.patch.yml');
-const sourcePatchText = existsSync(sourcePatchForHome) ? readText(sourcePatchForHome) : '';
-const sourceHasIsolation = /id:\s*session-persistence-jsonl/.test(sourcePatchText);
-const sourceHome =
-  process.env.WB_SOURCE_HOME?.trim() ||
-  (!sourceHasIsolation
-    ? home
-    : sourcePatchText.includes('DSH_WORKBENCH_HOME') && sourceName !== 'workbench'
-      ? sourceCandidate
-      : join(home, 'workbench'));
-const targetHome = process.env.DSH_WORKBENCH_HOME?.trim() || join(home, targetName);
 const copySettings = process.env.WB_COPY_SETTINGS === '1';
-const copyPlugins = process.env.WB_COPY_PLUGINS === '1';
-const copyProjects = process.env.WB_COPY_PROJECTS === '1';
-const copySessions = process.env.WB_COPY_SESSIONS === '1';
 
 const PROFILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-const ISOLATION_IDS = new Set([
+const SKIPPED_IDS = new Set([
   'session-persistence-jsonl',
   'storage-json',
   'attachment-local',
   'sandbox-policy',
 ]);
-const ASSET_MAX_BYTES = 8 * 1024 * 1024;
-const ASSET_MAX_FILES = 500;
-const ASSET_SKIP = new Set(['node_modules', '.git', '.DS_Store']);
 
 function say(message) {
   process.stdout.write(`→ ${message}\n`);
@@ -56,105 +39,6 @@ function readText(file) {
   return readFileSync(file, 'utf8');
 }
 
-if (copySettings && !copyPlugins) {
-  const refs = localPluginRefs();
-  if (refs > 0) {
-    fail(`设置里有 ${refs} 个本地插件文件引用；不能只复制设置不复制插件（会指向不存在的文件）。要么一起复制插件，要么取消设置。`);
-  }
-}
-
-function parseBlocks(text) {
-  const lines = text.split('\n');
-  const starts = [];
-  lines.forEach((line, index) => {
-    if (/^- /.test(line) || line === '-') starts.push(index);
-  });
-  const blocks = [];
-  for (let i = 0; i < starts.length; i += 1) {
-    const from = starts[i];
-    const to = i + 1 < starts.length ? starts[i + 1] : lines.length;
-    let end = to;
-    while (end > from && (lines[end - 1] ?? '').trim() === '') end -= 1;
-    const body = lines.slice(from, end).join('\n');
-    if (body.trim() === '') continue;
-    const first = body.split('\n')[0] ?? '';
-    const id = /^- id:[ \t]*"?([^"\s#]+)/.exec(first)?.[1];
-    const insert = id === undefined && /^- insert:[ \t]*$/.test(first);
-    const nested = body
-      .split('\n')
-      .map((line) => /^[ \t]+-[ \t]*id:[ \t]*"?([^"\s#]+)/.exec(line)?.[1])
-      .filter(Boolean);
-    const key = id !== undefined ? `id:${id}` : insert ? `insert:${nested.join(', ')}` : `block:${String(i)}`;
-    blocks.push({ key, id: id ?? nested.join(', ') ?? key, insert, body });
-  }
-  return blocks;
-}
-
-function namesOf(body) {
-  return body
-    .split('\n')
-    .map((line) => /^[ \t]*-?[ \t]*name:[ \t]*['"]?([^'"\s#]+)/.exec(line)?.[1])
-    .filter((name) => name !== undefined && (name.startsWith('./') || name.startsWith('../') || name.startsWith('file://') || isAbsolute(name)));
-}
-
-function insideProfile(dir, ref) {
-  if (ref.startsWith('file://')) return null;
-  if (!ref.startsWith('./') && !ref.startsWith('../') && !isAbsolute(ref)) return null;
-  const abs = resolve(dir, ref);
-  const rel = relative(dir, abs);
-  if (rel === '' || rel === '..' || rel.startsWith(`..${requireSep()}`) || isAbsolute(rel)) return null;
-  return { rel: rel.split(requireSep()).join('/'), abs };
-}
-
-function requireSep() {
-  return process.platform === 'win32' ? '\\' : '/';
-}
-
-function copyFileAsset(source, target, budget) {
-  const stat = statSync(source);
-  if (stat.isSymbolicLink() || !stat.isFile()) return false;
-  if (stat.size > ASSET_MAX_BYTES) return false;
-  budget.bytes += stat.size;
-  if (budget.bytes > 32 * 1024 * 1024 || budget.files >= ASSET_MAX_FILES) return false;
-  mkdirSync(dirname(target), { recursive: true });
-  cpSync(source, target);
-  budget.files += 1;
-  return true;
-}
-
-function copyDirAsset(source, target, budget) {
-  const walk = (dir) => {
-    for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      if (ASSET_SKIP.has(entry.name)) continue;
-      const abs = join(dir, entry.name);
-      if (entry.isSymbolicLink()) return false;
-      if (entry.isDirectory()) {
-        if (!walk(abs)) return false;
-        continue;
-      }
-      if (!entry.isFile()) continue;
-      const rel = relative(source, abs);
-      if (!copyFileAsset(abs, join(target, rel), budget)) return false;
-    }
-    return true;
-  };
-  return walk(source);
-}
-
-function localPluginRefs() {
-  const sourcePatch = join(sourceDir, 'cordis.patch.yml');
-  if (!existsSync(sourcePatch)) return 0;
-  const seen = new Set();
-  for (const block of parseBlocks(readText(sourcePatch))) {
-    if (!block.insert) continue;
-    for (const ref of namesOf(block.body)) {
-      const located = insideProfile(sourceDir, ref);
-      if (located !== null) seen.add(located.rel);
-    }
-  }
-  return seen.size;
-}
-
 function rewritePaths(body) {
   return body.replace(/(dshHomePath\(\s*['"])workbench(?=[/'"])/g, `$1${targetName}`);
 }
@@ -172,8 +56,13 @@ function copySettingRows() {
   const targetKeys = new Set(parseBlocks(current).map((block) => block.key));
   const copied = [];
   const skipped = [];
+  let plugins = 0;
   for (const block of sourceBlocks) {
-    if (ISOLATION_IDS.has(block.id) || targetKeys.has(block.key)) {
+    if (block.insert) {
+      plugins += 1;
+      continue;
+    }
+    if (SKIPPED_IDS.has(block.id) || targetKeys.has(block.key)) {
       skipped.push(block.id);
       continue;
     }
@@ -183,86 +72,9 @@ function copySettingRows() {
     targetKeys.add(block.key);
     copied.push(block.id);
   }
-  say(`设置行：复制 ${copied.length}，跳过 ${skipped.length}`);
-}
-
-function copyPluginAssets() {
-  const sourcePatch = join(sourceDir, 'cordis.patch.yml');
-  if (!existsSync(sourcePatch)) return;
-  const budget = { bytes: 0, files: 0 };
-  const seen = new Set();
-  let copied = 0;
-  for (const block of parseBlocks(readText(sourcePatch))) {
-    if (!block.insert || ISOLATION_IDS.has(block.id)) continue;
-    for (const ref of namesOf(block.body)) {
-      const located = insideProfile(sourceDir, ref);
-      if (located === null || seen.has(located.rel)) continue;
-      seen.add(located.rel);
-      const source = join(sourceDir, located.rel);
-      const target = join(targetDir, located.rel);
-      if (!existsSync(source)) {
-        say(`缺文件，跳过：${located.rel}`);
-        continue;
-      }
-      const stat = statSync(source);
-      const ok = stat.isDirectory()
-        ? copyDirAsset(source, target, budget)
-        : copyFileAsset(source, target, budget);
-      if (ok) copied += 1;
-      else say(`文件太大或含符号链接，跳过：${located.rel}`);
-    }
-  }
-  say(`本地插件文件：复制 ${copied} 个`);
-}
-
-function copyProjectList() {
-  const source = join(sourceHome, 'storages', 'workspace.json');
-  if (!existsSync(source)) {
-    say('来源没有项目列表，跳过');
-    return;
-  }
-  const target = join(targetHome, 'storages', 'workspace.json');
-  mkdirSync(dirname(target), { recursive: true });
-  cpSync(source, target);
-  say('项目列表：已复制');
-}
-
-function copySessionData() {
-  const source = join(sourceHome, 'sessions');
-  if (!existsSync(source)) {
-    say('来源没有会话记录，跳过');
-    return;
-  }
-  const target = join(targetHome, 'sessions');
-  mkdirSync(dirname(target), { recursive: true });
-  cpSync(source, target, { recursive: true });
-  say('会话记录：已复制');
-  const attachments = join(sourceHome, 'attachments');
-  if (existsSync(attachments)) cpSync(attachments, join(targetHome, 'attachments'), { recursive: true });
-}
-
-function mergeDependencies() {
-  const sourceManifest = JSON.parse(readText(join(sourceDir, 'package.json')));
-  const targetManifest = JSON.parse(readText(join(targetDir, 'package.json')));
-  const sourceDeps = sourceManifest.dependencies ?? {};
-  const targetDeps = targetManifest.dependencies ?? {};
-  const merged = { ...targetDeps };
-  for (const [name, spec] of Object.entries(sourceDeps)) {
-    if (name === '@dsh-workbench/core') continue;
-    if (!Object.hasOwn(merged, name)) merged[name] = spec;
-  }
-  targetManifest.dependencies = merged;
-  const tmp = `${join(targetDir, 'package.json')}.wb-clone`;
-  writeFileSync(tmp, `${JSON.stringify(targetManifest, null, 2)}\n`, 'utf8');
-  renameSync(tmp, join(targetDir, 'package.json'));
-  say(`依赖：并入 ${Object.keys(merged).length - Object.keys(targetDeps).length} 项`);
+  say(`设置行：复制 ${copied.length}，跳过 ${skipped.length}；挂新插件的 ${plugins} 行不同步`);
 }
 
 mkdirSync(targetDir, { recursive: true });
-mkdirSync(targetHome, { recursive: true });
 if (copySettings) copySettingRows();
-if (copyPlugins) copyPluginAssets();
-mergeDependencies();
-if (copyProjects) copyProjectList();
-if (copySessions) copySessionData();
 say('完成');

package/scripts/create-workbench.mjs

@@ -122,32 +122,22 @@ const nameAnswer = await prompts(
 );
 const name = String(nameAnswer.name).trim();
 
+say('会话、项目、附件跟 web / Desktop 共用一份，不用复制；这里只问设置。');
 const copyAnswer = await prompts(
   {
-    type: 'multiselect',
-    name: 'copy',
-    message: `从 ${source} 复制哪些内容？`,
-    instructions: '空格选择 · 回车确认',
-    choices: [
-      { title: '设置（模型、主题等）', value: 'settings', selected: true },
-      { title: '本地插件文件', value: 'plugins', selected: true },
-      { title: '项目列表', value: 'projects', selected: true },
-      { title: '会话记录（可选，可能很多）', value: 'sessions', selected: false },
-    ],
+    type: 'confirm',
+    name: 'settings',
+    message: `从 ${source} 复制已配好的设置（模型、主题等）？`,
+    initial: true,
   },
   { onCancel },
 );
-const copy = new Set(copyAnswer.copy ?? []);
-if (copy.has('settings') && !copy.has('plugins')) {
-  copy.add('plugins');
-  say('设置行引用的本地插件会一起复制（否则配置会指向不存在的文件）。');
-}
 
 const confirmAnswer = await prompts(
   {
     type: 'confirm',
     name: 'ok',
-    message: `创建 ${name}（来源 ${source}，复制：${[...copy].join('、') || '无'}）？`,
+    message: `创建 ${name}（来源 ${source}，${copyAnswer.settings ? '复制设置' : '不复制设置'}）？`,
     initial: true,
   },
   { onCancel },
@@ -158,9 +148,6 @@ if (!confirmAnswer.ok) {
 }
 
 const args = ['setup', '--from', source, '--profile', name];
-if (copy.has('sessions')) args.push('--with-sessions');
-if (!copy.has('settings')) args.push('--no-settings');
-if (!copy.has('plugins')) args.push('--no-plugins');
-if (!copy.has('projects')) args.push('--no-projects');
+if (!copyAnswer.settings) args.push('--no-settings');
 
 runSetup(args);

package/scripts/patch-blocks.mjs

@@ -0,0 +1,60 @@
+export function parseBlocks(text) {
+  const lines = text.split('\n');
+  const starts = [];
+  lines.forEach((line, index) => {
+    if (/^- /.test(line) || line === '-') starts.push(index);
+  });
+  const blocks = [];
+  for (let i = 0; i < starts.length; i += 1) {
+    const from = starts[i];
+    const to = i + 1 < starts.length ? starts[i + 1] : lines.length;
+    let end = to;
+    while (end > from && (lines[end - 1] ?? '').trim() === '') end -= 1;
+    const body = lines.slice(from, end).join('\n');
+    if (body.trim() === '') continue;
+    const first = body.split('\n')[0] ?? '';
+    const id = /^- id:[ \t]*"?([^"\s#]+)/.exec(first)?.[1];
+    const insert = id === undefined && /^- insert:[ \t]*$/.test(first);
+    const nested = body
+      .split('\n')
+      .map((line) => /^[ \t]+-[ \t]*id:[ \t]*"?([^"\s#]+)/.exec(line)?.[1])
+      .filter(Boolean);
+    const key = id !== undefined ? `id:${id}` : insert ? `insert:${nested.join(', ')}` : `block:${String(i)}`;
+    blocks.push({
+      key,
+      id: id ?? nested.join(', ') ?? key,
+      insert,
+      body,
+      lineStart: from,
+      lineEnd: end,
+    });
+  }
+  return blocks;
+}
+
+export function removeBlocks(text, predicate) {
+  const blocks = parseBlocks(text).filter(predicate);
+  if (blocks.length === 0) return text;
+  const lines = text.split('\n');
+  const drop = new Set();
+  for (const block of blocks) {
+    let end = block.lineEnd;
+    for (let i = block.lineEnd; i < lines.length; i += 1) {
+      if ((lines[i] ?? '').trim() !== '') break;
+      drop.add(i);
+      end = i + 1;
+    }
+    for (let i = block.lineStart; i < end; i += 1) drop.add(i);
+  }
+  const kept = lines.filter((_, index) => !drop.has(index));
+  return `${kept.join('\n').replace(/\s+$/, '')}\n`;
+}
+
+export function appendBlocks(text, body) {
+  const stripped = text
+    .split('\n')
+    .filter((line) => line.trim() !== '[]')
+    .join('\n')
+    .replace(/\s+$/, '');
+  return `${stripped}\n\n${body.replace(/\s+$/, '')}\n`;
+}

package/scripts/seed-profile.sh

@@ -2,13 +2,13 @@
 #
 # 一次性引导：从 shipped 的 web 模板创建 workbench profile，
 # 继承 web 的 **bundle 清单**（这台机器上装了哪些 bundle），
-# 再加上会话 / 存储 / 附件的隔离层。
+# 补上可写根那一行，并把会话 / 项目 / 附件指回跟 web 共用的数据根。
 #
 # **设置不在这里继承**（这里曾经把 web 的 cordis.patch.yml 快照一份过来）：
-# 工作台自己的 patch 是唯一真相，想搬 web 的哪几行由用户走「设置 → 配置同步」。
+# 工作台自己的 patch 是唯一真相，想同步 web 的哪几行由用户走「设置 → 配置同步」。
 # 为什么这么分（安装 vs 设置）、为什么不再是自动的：内部设计记录
 #
-# 幂等 / 可续跑：profile 已存在就跳过创建，隔离层已存在就跳过追加
+# 幂等 / 可续跑：profile 已存在就跳过创建，数据根已经是共用的就什么都不写
 # —— 重复运行不会覆盖任何东西。
 # 安全：全程只**读** web 的 profile 目录，只**写** workbench 自己的目录。
 #
@@ -37,7 +37,6 @@ GIT_TOP="$(git -C "$REPO_DIR" rev-parse --show-toplevel 2>/dev/null || true)"
 if [ -n "$GIT_TOP" ] && ! git -C "$REPO_DIR" ls-files --error-unmatch package.json >/dev/null 2>&1; then
   GIT_TOP=""
 fi
-ISOLATION="$REPO_DIR/profile/isolation.patch.yml"
 
 # `verify.sh` 留在**仓库根**（它证明的是"dsh web 未被动过 / 组合树差异 / 数据分家"，
 # 与包边界无关），所以不能按 $REPO_DIR 拼。装成安装包（没有 git 工作树）时它不存在，
@@ -100,7 +99,6 @@ HAS_SOURCE=0
 if [ -f "$SRC_PROFILE/package.json" ]; then
   HAS_SOURCE=1
 fi
-[ -f "$ISOLATION" ] || die "找不到 $ISOLATION"
 
 DST_PATCH="$DST_PROFILE/cordis.patch.yml"
 
@@ -178,24 +176,13 @@ console.log("→ profile 里那条 link: 指的是我这份装出来的副本（
 '
 fi
 
-# ── 第 3 步：追加会话 / 存储 / 附件隔离层 ───────────────────────────────
-if grep -q 'id: session-persistence-jsonl' "$DST_PATCH"; then
-  echo "→ 隔离层已存在，跳过"
-else
-  # dsh 生成的 profile patch 是「三行横幅注释 + 一个空数组 []」。空数组本身是一个**完整的
-  # YAML 文档**，往后直接接一个序列，解析就会在最外层报
-  # "end of the stream or a document separator is expected"，profile 直接起不来
-  # （实测 dsh 0.2.1-alpha.3：setup 出来的 profile 报这条，去掉那行 [] 才起）。
-  # 所以追加之前先把那行单独的 [] 拿掉；本来就没有（或已经是序列）时这一步什么都不做。
-  if grep -qx '\[\]' "$DST_PATCH"; then
-    grep -vx '\[\]' "$DST_PATCH" >"$DST_PATCH.tmp" && mv "$DST_PATCH.tmp" "$DST_PATCH"
-    echo "→ 模板 patch 里的空数组 [] 已让位（否则接不上隔离层）"
-  fi
-  printf '\n' >>"$DST_PATCH"
-  cat "$ISOLATION" >>"$DST_PATCH"
-  echo "→ 已追加隔离层（sessions / storages / attachments 分家）"
-  rm -f "$DST_PATCH.tmp"
-fi
+# ── 第 3 步：数据根跟 web 共用 + 可写根那一行 ───────────────────────────
+#
+# 会话 / 项目 / 附件不再按 profile 分家：跟 `dsh web` 和 Desktop 一样只分 profile，
+# 数据都在 `$DSH_HOME` 下（旧实例的那三行隔离补丁与旧数据由 share-data-root.mjs 收回来）。
+# 每一步都幂等：已经是共用数据根的 profile 一个字节都不写。
+WORKBENCH_PROFILE="$PROFILE" DSH_HOME="$DSH_HOME" DSH_WORKBENCH_HOME="$WORKBENCH_HOME" \
+  node "$REPO_DIR/scripts/share-data-root.mjs" || die "整理数据根失败（见上一行）"
 
 # ── 第 4 步：建 DIY 工坊 ────────────────────────────────────────────────
 #
@@ -215,11 +202,11 @@ fi
 
 cat <<EOF
 
-profile '$DST_PROFILE' 的骨架好了（bundle 清单 + 会话/存储/附件隔离层）。
+profile '$DST_PROFILE' 的骨架好了（bundle 清单 + 可写根；会话 / 项目 / 附件跟 web 共用）。
 
-设置与本地插件按创建时的勾选从 $SRC_PROFILE_NAME 继承；直接跑 setup 时只继承
-bundle 清单，想要 web 那边的模型供应商 / 搜索源 / MCP，起工作台后去
-「设置 → 配置同步」按行勾（读的是那个 profile 的 cordis.patch.yml；搬完重启生效）。
+设置按创建时的勾选从 $SRC_PROFILE_NAME 继承（只同步改已有插件的行；挂新插件的行不同步）；
+直接跑 setup 时只继承 bundle 清单，想要 web 那边的模型供应商 / 搜索源 / MCP，起工作台后去
+「设置 → 配置同步」按行勾（读的是那个 profile 的 cordis.patch.yml；同步完重启生效）。
 
 装 bundle —— 两条**等价**的路，任选一条（都走 dsh 的 runPluginCommand，装完会
 把 bundle 登记进 profile 清单）：

package/scripts/share-data-root.mjs

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+
+import {
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { appendBlocks, parseBlocks, removeBlocks } from './patch-blocks.mjs';
+
+const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = dirname(SCRIPT_DIR);
+const HOME = process.env.DSH_HOME?.trim() || join(homedir(), '.dsh');
+const PROFILE = process.env.WORKBENCH_PROFILE?.trim() || 'workbench';
+const PROFILE_DIR = join(HOME, 'profiles', PROFILE);
+const RUNTIME_ROOT = process.env.DSH_WORKBENCH_HOME?.trim() || join(HOME, PROFILE);
+const PATCH_PATH = join(PROFILE_DIR, 'cordis.patch.yml');
+const SANDBOX_PATCH = join(PKG_ROOT, 'profile', 'sandbox.patch.yml');
+const MARKER = join(RUNTIME_ROOT, '.data-root-shared');
+
+const DATA_ROOT_IDS = new Set(['session-persistence-jsonl', 'storage-json', 'attachment-local']);
+const OWN_ROOT = /DSH_WORKBENCH_HOME|dshHomePath\(\s*['"]workbench/;
+
+function say(message) {
+  process.stdout.write(`→ ${message}\n`);
+}
+
+function warn(message) {
+  process.stderr.write(`dsh-workbench: ${message}\n`);
+}
+
+function readText(file) {
+  try {
+    return readFileSync(file, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+function writeAtomic(file, text) {
+  const tmp = `${file}.tmp`;
+  writeFileSync(tmp, text, 'utf8');
+  renameSync(tmp, file);
+}
+
+function mergeTree(from, to, skip = new Set()) {
+  let stat;
+  try {
+    stat = statSync(from);
+  } catch {
+    return 0;
+  }
+  if (!stat.isDirectory()) return 0;
+  mkdirSync(to, { recursive: true });
+  let count = 0;
+  for (const entry of readdirSync(from, { withFileTypes: true })) {
+    if (entry.name === '.DS_Store' || skip.has(entry.name)) continue;
+    const source = join(from, entry.name);
+    const target = join(to, entry.name);
+    if (entry.isDirectory()) {
+      count += mergeTree(source, target);
+    } else if (entry.isFile() && !existsSync(target)) {
+      copyFileSync(source, target);
+      count += 1;
+    }
+  }
+  return count;
+}
+
+function unionList(left, right) {
+  return [...new Set([...(Array.isArray(left) ? left : []), ...(Array.isArray(right) ? right : [])])];
+}
+
+function mergeWorkspaceList(sourceFile, targetFile) {
+  let source;
+  try {
+    source = JSON.parse(readFileSync(sourceFile, 'utf8'));
+  } catch {
+    return 0;
+  }
+  if (source?.unit?.name !== 'workspace') return 0;
+  if (!existsSync(targetFile)) {
+    mkdirSync(dirname(targetFile), { recursive: true });
+    copyFileSync(sourceFile, targetFile);
+    return 1;
+  }
+  let target;
+  try {
+    target = JSON.parse(readFileSync(targetFile, 'utf8'));
+  } catch {
+    warn(`${targetFile} 读不出来，这次没并项目列表。`);
+    return 0;
+  }
+  if (target?.unit?.name !== 'workspace') return 0;
+  const sourceTable = source.tables?.workspaces ?? {};
+  const targetTable = target.tables?.workspaces ?? {};
+  const byPath = new Map();
+  for (const entry of Object.values(targetTable)) {
+    if (typeof entry?.path === 'string') byPath.set(entry.path, entry);
+  }
+  let added = 0;
+  for (const [id, entry] of Object.entries(sourceTable)) {
+    if (typeof entry?.path !== 'string') continue;
+    const hit = byPath.get(entry.path);
+    if (hit === undefined) {
+      targetTable[id] = entry;
+      byPath.set(entry.path, entry);
+      added += 1;
+      continue;
+    }
+    hit.sessionIds = unionList(hit.sessionIds, entry.sessionIds);
+    if (typeof entry.updatedAt === 'string' && (typeof hit.updatedAt !== 'string' || entry.updatedAt > hit.updatedAt)) {
+      hit.updatedAt = entry.updatedAt;
+    }
+  }
+  target.tables = { ...(target.tables ?? {}), workspaces: targetTable };
+  const global = target.global ?? {};
+  const sourceGlobal = source.global ?? {};
+  const known = new Set(Array.isArray(global.workspaceIds) ? global.workspaceIds : []);
+  for (const id of Array.isArray(sourceGlobal.workspaceIds) ? sourceGlobal.workspaceIds : []) known.add(id);
+  target.global = {
+    ...global,
+    workspaceIds: [...known],
+    archivedSessionIds: unionList(global.archivedSessionIds, sourceGlobal.archivedSessionIds),
+    pinnedSessionIds: unionList(global.pinnedSessionIds, sourceGlobal.pinnedSessionIds),
+  };
+  writeAtomic(targetFile, `${JSON.stringify(target, null, 2)}\n`);
+  return added;
+}
+
+function mergeDataRoot() {
+  if (resolve(RUNTIME_ROOT) === resolve(HOME)) return;
+  if (existsSync(MARKER)) return;
+  const sourceStorages = join(RUNTIME_ROOT, 'storages');
+  let count = 0;
+  try {
+    count += mergeWorkspaceList(join(sourceStorages, 'workspace.json'), join(HOME, 'storages', 'workspace.json'));
+    count += mergeTree(join(RUNTIME_ROOT, 'sessions'), join(HOME, 'sessions'));
+    count += mergeTree(join(RUNTIME_ROOT, 'attachments'), join(HOME, 'attachments'));
+    count += mergeTree(sourceStorages, join(HOME, 'storages'), new Set(['workspace.json']));
+  } catch (error) {
+    warn(`并回 ${HOME} 时出错，下次启动再试：${error instanceof Error ? error.message : String(error)}`);
+    return;
+  }
+  mkdirSync(dirname(MARKER), { recursive: true });
+  writeFileSync(
+    MARKER,
+    `${JSON.stringify({ at: new Date().toISOString(), from: RUNTIME_ROOT, to: HOME }, null, 2)}\n`,
+    'utf8',
+  );
+  if (count > 0) say(`已把 ${RUNTIME_ROOT} 里的会话 / 项目 / 附件并回 ${HOME}（${count} 个文件，旧目录保留）。`);
+}
+
+function stripIsolationHeader(text, blockStart) {
+  const lines = text.split('\n');
+  let marker = -1;
+  for (let i = blockStart - 1; i >= 0; i -= 1) {
+    const line = lines[i] ?? '';
+    if (/^#.*会话\s*\/\s*存储隔离层/.test(line)) {
+      marker = i;
+      break;
+    }
+    if (line.trim() !== '' && !line.startsWith('#')) break;
+  }
+  if (marker === -1) return text;
+  lines.splice(marker, blockStart - marker);
+  return lines.join('\n');
+}
+
+const profileManifest = join(PROFILE_DIR, 'package.json');
+if (!existsSync(profileManifest)) process.exit(0);
+
+let patch = readText(PATCH_PATH);
+if (patch === null) process.exit(0);
+
+const legacy = parseBlocks(patch).filter((block) => DATA_ROOT_IDS.has(block.id));
+const ours = legacy.filter((block) => OWN_ROOT.test(block.body));
+const custom = legacy.filter((block) => !OWN_ROOT.test(block.body));
+if (ours.length > 0) {
+  const first = Math.min(...ours.map((block) => block.lineStart));
+  patch = stripIsolationHeader(patch, first);
+  patch = removeBlocks(patch, (block) => DATA_ROOT_IDS.has(block.id) && OWN_ROOT.test(block.body));
+  writeAtomic(PATCH_PATH, patch);
+  say(`数据根改回共用：从 ${PROFILE} 的 profile 里去掉 ${ours.map((block) => block.id).join(' / ')}。`);
+}
+
+const hasSandbox = parseBlocks(patch).some((block) => block.id === 'sandbox-policy');
+if (!hasSandbox) {
+  const sandbox = readText(SANDBOX_PATCH);
+  const row = sandbox === null ? undefined : parseBlocks(sandbox).find((block) => block.id === 'sandbox-policy');
+  if (row !== undefined) {
+    patch = appendBlocks(patch, row.body);
+    writeAtomic(PATCH_PATH, patch);
+  }
+}
+
+if (custom.length > 0) {
+  warn(
+    `${PROFILE} 的会话 / 存储根是你自己改过的（${custom.map((block) => block.id).join(' / ')}）—— 这次不动它，也不并数据。`,
+  );
+  process.exit(0);
+}
+
+mergeDataRoot();

package/skills/workbench-module-diy/FAMILY.md

@@ -7,7 +7,7 @@
 
 | 要做什么 | 用 |
 |---|---|
-| 认路、装没装、起不起得来 | `_status`（`unit` 可省）；它的「下一步」就是下一件事 |
+| 认路、装没装、起不起得来 | `_status`（`unit` 可省）；它的「下一步」就是下一件事；带 `unit` 时 text 末尾多一条「发布出口：…」 |
 | 卡片空白 / 崩了 / 读不到 | `_panel` |
 | 找 opencli 命令、看命令形状 | `_recon` → `_spec`（`--help -f json` 原样） |
 | kit 有什么 / 令牌叫什么 | `_components`（`bucket` / `name` 取声明；`scope: tokens` 现读 `--dsw-*` / `--wb-*`） |
@@ -45,8 +45,6 @@
 
 ## 4 发布
 
-只在用户明确说「帮我发布」后调。它一次做完预检 → 全门禁 → 按出口发布 → 发后核包，审批一次。
-发布前先 `_changelog` 把这一版写进 `CHANGELOG.md`：没有这一版的记录，`_publish` 会拦下。
-审批屏会把这一版的更新日志按 markdown 展示给用户。
-需要用户接管时返回 `needsUser: { step, text, command? }` 而不抛异常：把 `text` 说给用户、给命令，
-等「好了」再跑；不向用户要 token，不展示 `package.json`。
+只在用户明确说「帮我发布」后调；先 `_changelog` 把这一版写进 `CHANGELOG.md`。
+出口、署名、标题、安装命令由工具与审批屏处理，不用问、不用补。
+需要用户接管时返回 `needsUser: { step, text, command? }`：把 `text` 说给用户，等「好了」再跑；不向用户要 token。