@heycys/gallery 0.2.0 → 0.2.2

package/browser/shared/drafts.mjs

@@ -8,20 +8,13 @@ import { findPreviewServer } from "./preview-server.mjs";
 import { idsOf, shownIcon } from "./workspace-columns.mjs";
 import { nameStops, workspaceLabels, workspaceName } from "./workspace-name.mjs";
 import { isWorkspace, readRegistry, workspaceId, workspaceKey } from "./workspace-registry.mjs";
-import { defaultWorkspace, documentFiles, isSlugName, listDocumentSlugs } from "./workspace.mjs";
+import { defaultWorkspace, documentFiles, isSlugName, listDocumentSlugs, readLink } from "./workspace.mjs";
 
-// The drafts of other workspaces in a workspace's sidebar (notes/plans/workspaces-links-plan-2026-11-08.md
-// §2.2, §2.5, §7.2; docs/workbench.md "Drafts of other workspaces"): an entry of the outline written
-// "~<ws id>/<slug>" (./outline-shape.mjs), the workspace's id its path's hash on the machine's registry
-// (./workspace-registry.mjs), the draft its document <root>/<slug>/doc.html there. Only where the sidebar
-// shows it is this workspace's to keep: the draft's folder never moves, and its own workspace's tree is
-// never written (its server shows it as it was). Every registered workspace has a column of its own
-// (./workspace-columns.mjs, ./outline.mjs), "whole" (all its documents) unless the user picked a document
-// of it in 添加其他 Gallery 项目… (POST draft-add) while it had none shown: then it is `picked`, holding that
-// document and those under it alone, and what an Agent makes or opens there later (gallery new, gallery
-// open in another workspace than the default one: joinDefaultTree). The column the user removed is
-// `hidden`; an Agent's gallery new or open there, or the user's pick, shows it again. A draft the user took
-// out of a whole column (从文档树移除) is in its `left`, not filled in again until it is put back here.
+// Registered document folders share the default home's sidebar and outline. A foreign entry is
+// ~<workspace-id>/<slug>; its files, history, trash and exports remain in that folder.
+// Every registered folder contributes its documents. Ordering and hierarchy have one global owner.
+// addDraft/addWorkspace register or reveal a folder through the existing outline operations;
+// joinDefaultTree places documents created by CLI commands in that same tree.
 // A draft whose workspace is not on the registry, two registered folders sharing its id (six hex digits
 // of a hash: a clash is refused, never guessed), or whose folder is gone stays in the tree, shown grey
 // (找不到底稿) until the user removes it. Reads other workspaces' files only; writes this one's outline.
@@ -76,6 +69,8 @@ export async function draftFacts(entry, ids = registeredIds()) {
   const none = { entry, ws, slug, root: null, folder: null, path: null, title: slug, description: "", icon: null };
   if (!found.root) return { ...none, missing: found.refused === "ambiguous" ? "ambiguous" : "workspace" };
   const folder = path.join(found.root, slug);
+  const link = existsSync(documentFiles(folder).html) ? null : await readLink(folder);
+  if (link) return { entry, ws, slug, root: found.root, folder, path: path.join(folder, 'link.json'), title: link.title, description: '', kind: 'link', url: link.url, icon: link.icon, siteIcon: link.siteIcon, missing: null };
   const { files, html, metadata } = await metadataAt(folder);
   const missing = !isWorkspace(found.root) ? "workspace" : !html || metadata?.instructions === true ? "draft" : null;
   // An untitled document says so (its title empty: the workbench names it 未命名文档); one with no doc.json to read, its slug.
@@ -191,7 +186,7 @@ const shownColumn = ({ hidden, ...column }) => column;
  * (documents: a web link of that workspace is none, nor a draft of a third its tree shows, the drafts under
  * one going under the draft above it), those the tree does not hold yet. Its workspace's column is shown
  * again when the user had removed it (hidden). How, `pick` says:
- * - false (an Agent's gallery new or open there: joinDefaultTree, POST draft-join): one the outline holds
+ * - false (an Agent's gallery new or open there: joinDefaultTree, POST draft-add): one the outline holds
  *   (the file, or a whole column as it is read) stays where it is; else (a picked column) under its own
  *   parent's entry when the tree holds that, else last in its workspace's column;
  * - true (the user's pick in 添加其他 Gallery 项目…, `after`: the column whose menu it came from): one shown
@@ -226,6 +221,15 @@ export async function addDraft(treeRoot, draftRoot, slug, { changed = () => {},
       return { parent, column: top === null || top === "" ? DOCS : top.slice(1), under: parent !== null && !isTop(parent) ? parent : null };
     };
     const columnOf = (key) => outline.groups.find((each) => topOf(each.id) === topIn(outline.children, key)) ?? null;
+    if (holds(entry)) {
+      if (pick && fresh) {
+        const column = columnOf(entry);
+        if (column) moveAfter(outline, column.id, after);
+      }
+      if (!writtenAs(outline, stored)) { await writeOutline(treeRoot, outline); changed(); }
+      const existing = !fresh && (pick || storedHolds);
+      return { entry, existing, added: existing ? [] : [entry], shown: false, ...where() };
+    }
     let shown = false;
     let column = outline.groups.find((each) => each.workspace === id) ?? null;
     const put = () => {
@@ -349,23 +353,9 @@ export async function projectChoices(treeRoot, { ids = registeredIds(), stops =
 }
 
 
-/** The environment variable that keeps gallery new and gallery open from putting their draft in the default workspace's sidebar (the tests set it). */
-export const NO_DEFAULT_TREE = "GALLERY_NO_DEFAULT_TREE";
-const set = (value) => !["", "0", undefined].includes(value);
-
-/**
- * gallery new and gallery open in a workspace other than the default one (src/shared/workspace.mjs
- * defaultWorkspace): draft `slug` of workspace `root` put in the default workspace's sidebar (addDraft,
- * with the drafts under it), through the default workspace's server when one runs (POST
- * /__gallery/workspace/draft-join: in its queue, its workbench told at once), else here under the
- * outline's lock. Null where it is not done: NO_DEFAULT_TREE set, `root` the default workspace, no
- * default workspace there yet (nothing is made for it), or `root` not on the registry under its id (a
- * workspace in the system's temporary folder, or a clash of ids: an entry would name none). Else
- * addDraft's answer with `home` (the default workspace) and `names`: { column: the name of the column
- * it is in, under: the title of the draft it is under, or null }; or { failed: why } (nothing written).
- */
+/** Put a project document in home's shared outline through the single service's draft-add
+ * command when running, otherwise through the same outline lock offline. */
 export async function joinDefaultTree(root, slug, { env = process.env } = {}) {
-  if (set(env[NO_DEFAULT_TREE])) return null;
   const home = defaultWorkspace({ env });
   if (workspaceKey(home) === workspaceKey(root) || !isWorkspace(home)) return null;
   const ids = registeredIds();
@@ -373,8 +363,17 @@ export async function joinDefaultTree(root, slug, { env = process.env } = {}) {
   if (!found.root || workspaceKey(found.root) !== workspaceKey(root)) return null;
   let done = null;
   try {
-    const server = await findPreviewServer({ reportsDirectory: home });
-    if (server) done = await joinThrough(server, root, slug);
+    const server = await findPreviewServer();
+    if (server) {
+      const origin = `http://127.0.0.1:${server.port}`;
+      const response = await fetch(`${origin}/__gallery/workspace/draft-add`, {
+        method: "POST", headers: { "Content-Type": "application/json", Origin: origin, "X-Gallery-Token": server.token },
+        body: JSON.stringify({ path: path.join(root, slug) }), signal: AbortSignal.timeout(30000),
+      });
+      const answer = await response.json();
+      if (!answer.ok) throw new Error(answer.message ?? "Could not register the document");
+      done = answer;
+    }
     done ??= await addDraft(home, root, slug);
   } catch (error) {
     return { failed: error.message, home };
@@ -382,23 +381,6 @@ export async function joinDefaultTree(root, slug, { env = process.env } = {}) {
   return { ...done, home, names: await placeNames(home, done, ids) };
 }
 
-// POST draft-join to the default workspace's server; null when no server of it takes it (gone, or an older Gallery's).
-async function joinThrough(server, root, slug) {
-  const host = `127.0.0.1:${server.port}`;
-  try {
-    const response = await fetch(`http://${host}/__gallery/workspace/draft-join`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Origin: `http://${host}`, "X-Gallery-Token": server.token },
-      body: JSON.stringify({ root, slug }),
-      signal: AbortSignal.timeout(30000),
-    });
-    const answer = await response.json().catch(() => null);
-    return answer?.ok === true && typeof answer.entry === "string" ? answer : null;
-  } catch {
-    return null;
-  }
-}
-
 // The names a line says of where a draft went: its column's (the user's title, else its workspace's
 // name, else 默认文档, the default workspace's own column, or 链接) and the title of the draft or document it is under.
 async function placeNames(home, { column, under }, ids) {
@@ -425,7 +407,7 @@ export function joinedLine(joined) {
   if (joined.failed) return `${where}：没有加进去（${joined.failed}）`;
   if (joined.existing) return `${where}里已经有它（${joined.names.under ? `在「${joined.names.under}」下面` : `「${joined.names.column}」栏`}）`;
   const more = joined.added.length > 1 ? `，连同它下面的 ${joined.added.length - 1} 篇` : "";
-  return `${where}：已加进${joined.names.under ? `「${joined.names.under}」下面` : `「${joined.names.column}」栏`}${more}（拖动只改那里的显示位置，文件不动）`;
+  return `${where}：已加进${joined.names.under ? `「${joined.names.under}」下面` : `「${joined.names.column}」栏`}${more}（工作区内排序全局同步，文件位置不变）`;
 }
 
 /** Whether a gallery.json at `folder` would be another program's or not readable (what draft-add refuses to make a workspace of). */

package/browser/shared/emoji/icon-value.mjs

@@ -1,3 +1,4 @@
+import { workspaceAddress } from "../workspace-address.mjs";
 import { iconImageFile } from "../media.mjs";
 
 // A page's icon (the kit's "icon" component): what its value may be, its markup in a report and
@@ -68,17 +69,17 @@ export function iconMarkup(value, id = "") {
  * @param {string | null} [slug]
  * @param {{ tab?: boolean }} [options]
  */
-export const iconUrl = (value, slug = null, { tab = false } = {}) => `/__gallery/edit/icon?${new URLSearchParams({ value, ...(slug ? { slug } : {}), ...(tab ? { tab: "1" } : {}) })}`;
+export const iconUrl = (value, slug = null, { tab = false } = {}) => workspaceAddress(`/__gallery/edit/icon?${new URLSearchParams({ value, ...(slug ? { slug } : {}), ...(tab ? { tab: "1" } : {}) })}`);
 
 const [TAB_LIGHT, TAB_DARK] = ICON_COLOR_VALUES.gray;
 /**
  * The browser tab's image of a page with no icon (the workbench's and the preview page's): the page
- * the workbench's tree shows for one (its "page" icon, components/icons.ts: Lucide's file-text,
+ * the workbench's tree shows for one (its "page" icon, components/icons.ts: Lucide's plain file outline,
  * FinHarness's 文档), its box cropped to `1 1 22 22` so it fills the tab as an emoji does, in the tab
  * glyphs' gray, light or dark as the system is. An image, never none: a tab given no image, or one that does not
  * load, keeps the one it showed (Chrome), so a page with no icon opened after one with one showed that one's.
  */
-export const DEFAULT_TAB_ICON = `data:image/svg+xml,${encodeURIComponent(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="1 1 22 22" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round"><style>svg{color:${TAB_LIGHT}}@media (prefers-color-scheme:dark){svg{color:${TAB_DARK}}}</style><path d="M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z"/><path d="M14 2v5a1 1 0 0 0 1 1h5"/><path d="M10 9H8"/><path d="M16 13H8"/><path d="M16 17H8"/></svg>`)}`;
+export const DEFAULT_TAB_ICON = `data:image/svg+xml,${encodeURIComponent(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="1 1 22 22" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round"><style>svg{color:${TAB_LIGHT}}@media (prefers-color-scheme:dark){svg{color:${TAB_DARK}}}</style><path d="M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z"/><path d="M14 2v5a1 1 0 0 0 1 1h5"/></svg>`)}`;
 
 /** The value of an icon's element as the file (or a page) has it, or null. */
 export function iconValueOf(html) {

package/browser/shared/extension-manifest.mjs

@@ -0,0 +1,90 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { defaultWorkspace, layoutOf } from "./workspace.mjs";
+import { extensionFolders } from "./extensions.mjs";
+import { isExtensionId } from "./outline-shape.mjs";
+import { sha256, writeAtomic } from "./files.mjs";
+import { withOutlineLock } from "./outline.mjs";
+
+export const extensionDirectory = id => {
+  if (!isExtensionId(id)) throw new Error("扩展 ID 不正确");
+  return path.join(layoutOf(defaultWorkspace()).extensions, id);
+};
+
+export function extensionPath(value) {
+  if (typeof value !== "string" || !value || value.includes("\\") || value.includes(":")) throw new Error("扩展文件必须使用相对路径");
+  const parts = value.split("/");
+  if (parts.some(part => !part || part === "." || part === ".." || /[\x00-\x1f]/.test(part))) throw new Error("扩展文件路径不正确");
+  return parts;
+}
+
+// Resolve every segment, including the extension directory, before serving or running a file.
+export async function extensionFile(folder, name) {
+  const parts = extensionPath(name);
+  if ((await fs.lstat(path.dirname(folder))).isSymbolicLink()) throw new Error("扩展文件不能是符号链接");
+  let file = folder;
+  for (const part of [null, ...parts]) {
+    if (part !== null) file = path.join(file, part);
+    const stat = await fs.lstat(file);
+    if (stat.isSymbolicLink()) throw new Error("扩展文件不能是符号链接");
+  }
+  const [root, real] = await Promise.all([fs.realpath(folder), fs.realpath(file)]);
+  const relative = path.relative(root, real);
+  if (relative.startsWith("..") || path.isAbsolute(relative) || !(await fs.stat(real)).isFile()) throw new Error("扩展文件不在扩展目录内");
+  return real;
+}
+
+export async function readManifest(folder) {
+  const file = await extensionFile(folder, "extension.json");
+  if ((await fs.stat(file)).size > 65536) throw new Error("extension.json 超过 64KB");
+  const text = await fs.readFile(file, "utf8");
+  if (Buffer.byteLength(text) > 65536) throw new Error("extension.json 超过 64KB");
+  const value = JSON.parse(text);
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("extension.json 必须是对象");
+  if (value.id !== undefined && !isExtensionId(value.id)) throw new Error("扩展 ID 不正确");
+  if (value.workbench !== undefined && (!value.workbench || typeof value.workbench !== "object" || Array.isArray(value.workbench))) throw new Error("workbench 必须是对象");
+  for (const name of [value.workbench?.script, value.workbench?.style, value.agent].filter(value => value !== undefined)) await extensionFile(folder, name);
+  if (value.server !== undefined) {
+    const command = value.server?.command;
+    if (!Array.isArray(command) || !command.length || command.length > 32 || command.some(word => typeof word !== "string" || !word || word.includes("\0"))) throw new Error("server.command 必须是非空的参数数组");
+  }
+  return { ...value, revision: sha256(text) };
+}
+
+const configFile = () => path.join(defaultWorkspace(), "gallery.json");
+const configuration = async () => JSON.parse(await fs.readFile(configFile(), "utf8"));
+
+export async function listCapabilities() {
+  const config = await configuration();
+  return Promise.all((await extensionFolders(defaultWorkspace())).map(async ({ id, folder }) => {
+    try {
+      const manifest = await readManifest(folder);
+      const grant = config.extensions?.[id];
+      return { id, folder, manifest, enabled: grant?.enabled === true && grant.revision === manifest.revision,
+        confirmed: grant?.revision === manifest.revision, agent: manifest.agent ? path.join(folder, manifest.agent) : null };
+    } catch (error) {
+      return { id, folder, enabled: false, confirmed: false, manifest: null, error: error.code === "ENOENT" ? null : error.message };
+    }
+  }));
+}
+
+export async function setExtensionEnabled({ id, enabled, revision, confirmed = false }) {
+  const folder = extensionDirectory(id);
+  if (typeof enabled !== "boolean") throw new Error("扩展开关的值不正确");
+  return withOutlineLock(defaultWorkspace(), async () => {
+    const manifest = await readManifest(folder);
+    if (manifest.revision !== revision) throw new Error("扩展刚刚更新，请重新打开设置");
+    const config = await configuration();
+    if (enabled && config.extensions?.[id]?.revision !== revision && !confirmed) throw new Error("请先确认扩展的脚本和后台权限");
+    config.extensions = { ...config.extensions, [id]: { enabled, revision } };
+    await writeAtomic(configFile(), JSON.stringify(config, null, 2) + "\n");
+  });
+}
+
+export async function forgetExtensionGrant(id) {
+  const config = await configuration();
+  if (config.extensions?.[id]) {
+    delete config.extensions[id];
+    await writeAtomic(configFile(), JSON.stringify(config, null, 2) + "\n");
+  }
+}

package/browser/shared/extensions.mjs

@@ -3,9 +3,12 @@ import path from "node:path";
 import { SIDEBAR_FILE, SIDEBAR_LIMITS, readSidebarText } from "./extension-sidebar.mjs";
 import { said } from "./i18n/index.mjs";
 import { isExtensionId } from "./outline-shape.mjs";
-import { DOCUMENT_FOLDERS, layoutOf } from "./workspace.mjs";
+import { defaultWorkspace, DOCUMENT_FOLDERS, layoutOf } from "./workspace.mjs";
+import { sameDirectory } from "./preview-server.mjs";
+import { sha256, writeAtomic } from "./files.mjs";
 
-// The extensions of a workspace (docs/workbench.md "Extension columns"): each a folder
+// The extensions visible in a workspace (docs/workbench.md "Extension columns"): public columns from
+// the default workspace plus this project's own, a project sidebar.json taking precedence by id. Each a folder
 // <workspace>/extensions/<id>/ whose sidebar.json (./extension-sidebar.mjs) gives a column of the sidebar
 // its entries; what else the folder holds (the extension's own server, its code) is none of Gallery's.
 // Read from disk each time it is asked (the workbench's list, the outline's columns, gallery extension):
@@ -26,10 +29,26 @@ export async function extensionFolders(root) {
     .sort((a, b) => (a.id < b.id ? -1 : 1));
 }
 
+/** Public columns live in the default workspace; a project's own sidebar.json overrides the same id.
+ * Empty local folders do not hide a public column. Keep one source for listing, outline and writes.
+ */
+export async function visibleExtensionFolders() {
+  const root = defaultWorkspace();
+  return Promise.all((await extensionFolders(root)).map(async entry => {
+    const file = path.join(entry.folder, SIDEBAR_FILE);
+    return { ...entry, root, file, present: await fs.lstat(file).then(() => true, () => false) };
+  }));
+}
+
+/** Resolve an id, never a client-supplied directory, to the file this workspace actually shows. */
+export async function extensionSource(root, id) {
+  if (!isExtensionId(id)) return null;
+  return (await visibleExtensionFolders(root)).find(entry => entry.id === id) ?? null;
+}
+
 /** The ids of the extensions that have a sidebar.json (the columns the sidebar has), sorted. */
 export async function extensionColumnIds(root) {
-  const found = await Promise.all((await extensionFolders(root)).map(async ({ id, folder }) => ((await fs.stat(path.join(folder, SIDEBAR_FILE)).then(() => true, () => false)) ? id : null)));
-  return found.filter(Boolean);
+  return (await visibleExtensionFolders(root)).filter(entry => entry.present).map(entry => entry.id);
 }
 
 /**
@@ -56,6 +75,7 @@ export async function readExtension(root, id) {
     return { ...empty, error: said("读不出这个文件：{0}", error.code ?? "error") };
   }
   const read = readSidebarText(text);
+  empty.revision = sha256(text);
   if (read.error) {
     // What can still be said of a file that does not read: its name, when it has one.
     let title = id;
@@ -69,11 +89,77 @@ export async function readExtension(root, id) {
 }
 
 /**
- * The extensions of workspace `root`, by id: those with a sidebar.json (the sidebar's columns), or with `all`
+ * The extensions visible in workspace `root`, by id: those with a sidebar.json (the sidebar's columns), or with `all`
  * every folder that may be one (gallery extension list). Each as readExtension says it.
  */
 export async function listExtensions(root, { all = false } = {}) {
-  const folders = await extensionFolders(root);
-  const read = await Promise.all(folders.map(({ id }) => readExtension(root, id)));
+  const folders = await visibleExtensionFolders(root);
+  const read = await Promise.all(folders.map(({ id, root: owner }) => readExtension(owner, id)));
   return all ? read : read.filter((extension) => !extension.missing);
 }
+
+/** Edit a column's title/root order, remove a root subtree or delete its sidebar.json. Called under the workspace lock.
+ * Read the latest source, keep unknown fields and whole subtrees, and refuse stale UI changes.
+ * Atomic replacement checks the original text again so an external writer is not silently overwritten.
+ */
+export async function editExtension(root, id, change) {
+  const refused = (status, reason, error) => ({ ok: false, status, reason, error });
+  const bad = () => refused(400, "body", said("请求格式不对"));
+  const stale = () => refused(409, "stale", said("扩展目录刚在别处改过，请重试"));
+  if (!isExtensionId(id) || !change || typeof change !== "object") return bad();
+  const rename = Object.hasOwn(change, "title");
+  const remove = Object.hasOwn(change, "remove");
+  if ([rename, remove, Object.hasOwn(change, "move")].filter(Boolean).length !== 1) return bad();
+  if (remove ? (change.remove !== "column" && (typeof change.remove?.entry !== "string" || !change.remove.entry)
+      || typeof change.baseFile !== "string" || typeof change.baseRevision !== "string")
+    : rename ? (typeof change.title !== "string" || typeof change.baseTitle !== "string")
+      : (!change.move || !["before", "after"].includes(change.move.side) || typeof change.move.entry !== "string" || typeof change.move.ref !== "string" || !Array.isArray(change.baseOrder))) return bad();
+  const name = rename ? change.title.replace(/\s+/g, " ").trim() : null;
+  if (rename && (!name || name.length > SIDEBAR_LIMITS.column)) return bad();
+  const folder = path.join(layoutOf(root).extensions, id);
+  const file = path.join(folder, SIDEBAR_FILE);
+  if (remove && change.baseFile !== file) return stale(); // An override must not redirect a confirmed deletion.
+  // Never turn an extension path supplied by the client or a symlink into an arbitrary-file write.
+  for (const [target, directory] of [[layoutOf(root).extensions, true], [folder, true], [file, false]]) {
+    const stat = await fs.lstat(target).catch(() => null);
+    if (!stat) return refused(404, "missing", said("找不到这个扩展"));
+    if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile())) return refused(409, "path", said("扩展路径不是普通文件或文件夹"));
+    if (!directory && stat.size > SIDEBAR_LIMITS.bytes) return refused(409, "extension", said("文件超过 1MB"));
+  }
+  const source = await fs.readFile(file, "utf8");
+  if (remove && sha256(source) !== change.baseRevision) return stale();
+  if (remove && change.remove === "column") {
+    if ((await fs.readFile(file, "utf8")) !== source) return stale();
+    await fs.unlink(file); // Only the validated sidebar file; the extension's other files stay.
+    return { ok: true, written: true };
+  }
+  const read = readSidebarText(source);
+  if (read.error) return refused(409, "extension", read.error);
+  const value = JSON.parse(source.replace(/^\uFEFF/, ""));
+  if (rename) {
+    if (read.sidebar.title !== change.baseTitle) return stale();
+    if (read.sidebar.title === name) return { ok: true, written: false };
+    value.title = name;
+  } else if (remove) {
+    const index = value.entries.findIndex(entry => entry.id === change.remove.entry);
+    if (index < 0) return bad(); // Roots only; a root's entire subtree goes with it.
+    value.entries.splice(index, 1);
+  } else {
+    const order = value.entries.map(entry => entry.id);
+    if (JSON.stringify(order) !== JSON.stringify(change.baseOrder)) return stale();
+    const from = order.indexOf(change.move.entry), to = order.indexOf(change.move.ref);
+    if (from < 0 || to < 0) return bad(); // Root entries only, in this file; no nesting or cross-column move.
+    if (from === to) return { ok: true, written: false };
+    const [entry] = value.entries.splice(from, 1);
+    const at = value.entries.findIndex(entry => entry.id === change.move.ref);
+    value.entries.splice(at + (change.move.side === "after" ? 1 : 0), 0, entry);
+    if (JSON.stringify(order) === JSON.stringify(value.entries.map(entry => entry.id))) return { ok: true, written: false };
+  }
+  const indent = source.match(/\n([ \t]+)"/)?.[1] ?? 2;
+  let next = JSON.stringify(value, null, indent) + "\n";
+  if (source.includes("\r\n")) next = next.replaceAll("\n", "\r\n");
+  if (source.startsWith("\uFEFF")) next = "\uFEFF" + next;
+  if (Buffer.byteLength(next) > SIDEBAR_LIMITS.bytes) return refused(409, "extension", said("文件超过 1MB"));
+  if (!(await writeAtomic(file, next, { expect: source }))) return stale();
+  return { ok: true, written: true };
+}

package/browser/shared/http.mjs

@@ -8,7 +8,7 @@
 // could lay an editable page under a decoy, the reader's clicks and keys then editing the files (the security
 // review of 0.2.0), nor localhost, which may lead to another program on [::1] (no workbench is shown there:
 // src/server/routes.mjs toLoopback).
-export const FRAMED_BY = { "Content-Security-Policy": "frame-ancestors 'self' http://127.0.0.1:*" };
+export const FRAMED_BY = { "Content-Security-Policy": "frame-ancestors 'self'" };
 
 // A JSON answer.
 export function sendJson(response, status, body) {

package/browser/shared/i18n/en.mjs

@@ -1,6 +1,49 @@
 // English for Gallery's UI, by the Chinese text the source writes (index.mjs t()), in the order the
 // sources use them. tests/unit/i18n.mjs holds every string to an entry here and every entry to a string.
 export default {
+  "启用扩展「{0}」？": "Enable extension “{0}”?",
+  "此扩展可以在工作台运行脚本；后台程序拥有 Gallery 的本地文件和网络访问权限。仅启用你信任的扩展。": "This extension can run workbench scripts. Its backend has Gallery’s local file and network permissions. Only enable extensions you trust.",
+  "启用": "Enable",
+  "扩展设置保存失败": "Could not save extension settings",
+  "扩展设置已保存。重新打开 Gallery 后生效。": "Extension settings saved. Reopen Gallery to apply them.",
+  "来自默认工作区，所有文档共用。": "From the default workspace, shared by all documents.",
+  "还没有安装扩展。": "No extensions installed yet.",
+  "工作台脚本": "Workbench script",
+  "工作台样式": "Workbench style",
+  "后台程序": "Backend process",
+  "侧栏目录": "Sidebar directory",
+  "扩展列表读取失败": "Could not load extensions",
+  "扩展 {0} 加载失败": "Could not load extension {0}",
+  "扩展正在更新，请稍后再试": "The extension is being updated. Try again shortly.",
+  "扩展后台暂未就绪，请查看扩展日志": "The extension backend is not ready. Check its log.",
+  "扩展后台请求超时": "The extension backend request timed out",
+  "扩展操作失败": "The extension operation failed",
+  "扩展目录不能是符号链接": "The extensions directory cannot be a symbolic link",
+  "扩展超过 100MB 或 10000 个文件": "The extension exceeds 100MB or 10000 files",
+  "安装源不能是符号链接": "The installation source cannot be a symbolic link",
+  "扩展只能包含普通文件和文件夹": "Extensions may contain only regular files and directories",
+  "扩展 ZIP 超过 100MB": "The extension ZIP exceeds 100MB",
+  "ZIP 中没有 extension.json": "The ZIP has no extension.json",
+  "ZIP 的文件必须在同一个扩展文件夹内": "All ZIP files must belong to one extension directory",
+  "ZIP 中存在重名文件": "The ZIP contains duplicate file names",
+  "请选择扩展文件夹或 ZIP": "Choose an extension directory or ZIP",
+  "已安装的扩展不能是符号链接": "An installed extension cannot be a symbolic link",
+  "扩展不能是符号链接": "An extension cannot be a symbolic link",
+  "扩展 ID 不正确": "Invalid extension ID",
+  "扩展文件必须使用相对路径": "Extension files must use relative paths",
+  "扩展文件路径不正确": "Invalid extension file path",
+  "扩展文件不能是符号链接": "Extension files cannot be symbolic links",
+  "扩展文件不在扩展目录内": "The file is not inside the extension directory",
+  "extension.json 超过 64KB": "extension.json exceeds 64KB",
+  "extension.json 必须是对象": "extension.json must be an object",
+  "workbench 必须是对象": "workbench must be an object",
+  "server.command 必须是非空的参数数组": "server.command must be a nonempty array of arguments",
+  "扩展开关的值不正确": "Invalid extension enabled value",
+  "扩展刚刚更新，请重新打开设置": "The extension was updated. Reopen settings.",
+  "请先确认扩展的脚本和后台权限": "Confirm the extension’s script and backend permissions first",
+  "扩展目录刚在别处改过，请重试": "The extension directory changed elsewhere. Please try again.",
+  "找不到这个扩展": "This extension could not be found",
+  "扩展路径不是普通文件或文件夹": "The extension path is not a regular file or directory",
   "正在读取文档…": "Loading documents…",
   "没有连上本地服务": "Not connected to the local service",
   "重试": "Retry",
@@ -153,6 +196,14 @@ export default {
   "撤销": "Undo",
   "已恢复「{0}」": "Restored “{0}”",
   "永久删除「{0}」？": "Delete “{0}” forever?",
+  "永久删除回收区中的全部 {0} 项？": "Permanently delete all {0} items in the trash?",
+  "删除全部": "Delete all",
+  "删除分栏": "Delete column",
+  "删除页面": "Delete page",
+  "删除分栏「{0}」？": "Delete column “{0}”?",
+  "删除页面「{0}」？": "Delete page “{0}”?",
+  "将从 sidebar.json 删除这个条目及其全部子项，共用此配置的工作区会同步更新。不会删除网站上的原文档，此操作无法撤销。": "Remove this entry and all its children from sidebar.json in every workspace sharing this configuration. The original web documents stay. This cannot be undone.",
+  "将删除此分栏的 sidebar.json，共用此配置的工作区会同步移除分栏。其他文件和网站上的原文档不受影响，此操作无法撤销。": "Delete this column's sidebar.json in every workspace sharing this configuration. Other files and the original web documents stay. This cannot be undone.",
   "这份文档": "this document",
   "删除后无法恢复。": "This can't be undone.",
   "正在导出…": "Exporting…",
@@ -1399,15 +1450,12 @@ export default {
   "网址太长了（最多 2048 个字符）": "The address is too long (2048 characters at most)",
   "名称不能是空的，也不能超过 200 个字": "The name can't be empty or longer than 200 characters",
   "图标只能是表情或图标页签里的图标": "The icon must be an emoji or an icon of the Icons tab",
-  "正在启动它所在工作区的服务…": "Starting the server of its workspace…",
-  "没能打开这份底稿：{0}": "Couldn't open this draft: {0}",
   "正在读取别的工作区…": "Reading the other workspaces…",
   "别处的底稿 · {0}": "Draft from elsewhere · {0}",
   "别处的底稿": "Draft from elsewhere",
   "改的是那篇底稿的标题": "Changes the title of that draft",
   "只改它在这里的显示位置，文件不动": "Changes only where it shows here: no file moves",
   "在文件夹中显示": "Show in folder",
-  "在它的工作区里打开": "Open in its workspace",
   "「{0}」已移至它所在工作区的回收区": "“{0}” moved to the trash of its workspace",
   "副本在它所在的工作区里": "The copy is made in its workspace",
   "导入的页面在它所在的工作区里": "The imported pages are made in its workspace",
@@ -1417,7 +1465,6 @@ export default {
   "找不到底稿：本机登记的两个工作区编号相同": "Draft not found: two registered workspaces share one id",
   "找不到底稿：{0}": "Draft not found: {0}",
   "找不到底稿": "Draft not found",
-  "这份文档在它自己的工作区里，不在这里的侧边栏中": "This document is in its own workspace, not in this sidebar",
   "找不到它所在的工作区": "Its workspace was not found",
   "没有打开文件夹：{0}": "The folder was not opened: {0}",
   "已从文档树移除「{0}」，底稿没有删除": "Removed “{0}” from the sidebar; the draft was not deleted",
@@ -1431,17 +1478,7 @@ export default {
   "会把 {0} 登记成一个工作区（在里面放 gallery.json 和 .gallery/）": "{0} will be registered as a workspace (a gallery.json and a .gallery/ put in it)",
   "没能把它的工作区记进本机的登记表": "Its workspace could not be added to this machine's registry",
   "本机登记的 {0} 个工作区编号相同（{1}），先用 gallery workspaces --forget 去掉其中一个": "{0} registered workspaces share one id ({1}): take one off with gallery workspaces --forget first",
-  "这是当前的工作区": "This is the current workspace",
-  "这个工作区不在本机的登记表里": "This workspace is not on this machine's registry",
-  "本机登记的工作区里有两个用的是同一个编号，先用 gallery workspaces --forget 去掉其中一个": "Two registered workspaces share this id: take one off with gallery workspaces --forget first",
-  "找不到它所在的工作区：它不在本机的登记表里": "Its workspace was not found: it is not on this machine's registry",
-  "找不到它所在的工作区：{0} 不在了": "Its workspace was not found: {0} is gone",
   "找不到这个文件夹": "Folder not found",
-  "它所在工作区的服务没有在运行": "The server of its workspace is not running",
-  "它所在工作区的服务没有回答": "The server of its workspace did not answer",
-  "没能启动它所在工作区的服务：{0}": "The server of its workspace did not start: {0}",
-  "这个命令不能转给别的工作区": "This command can't be passed on to another workspace",
-  "它所在工作区的服务没有给出结果": "The server of its workspace gave no answer",
   // Extension columns (src/shared/extension-sidebar.mjs, extensions.mjs, workbench/app/features/sidebar/SidebarExtension.tsx)
   "这个条目已被扩展移除": "This entry was removed by its extension",
   "条目读不出来：{0}": "Entries can't be read: {0}",
@@ -1523,4 +1560,8 @@ export default {
   "选的文件不是 zip": "The file chosen is not a zip",
   "没有这个块包": "No such block pack",
   "粘贴块包的文件夹或 zip 的路径": "Paste the path of the pack's folder or zip",
+  "复制到另一个工作区？": "Copy to another workspace?",
+  "将「{0}」及其子页面复制到「{1}」，原项保留。": "Copy “{0}” and its child pages to “{1}”, keeping the originals.",
+  "已复制 {0} 项，原项保留": "Copied {0} items; originals kept",
+  "跨工作区请复制，不能只移动目录位置": "Copy items to another workspace instead of moving their tree positions",
 };

package/browser/shared/media.mjs

@@ -1,3 +1,4 @@
+import { workspaceAddress } from "./workspace-address.mjs";
 // The media of a report, one place for what every system asks about it: the files its media
 // blocks, its page icon and any other reference of its markup keep in the report's folder
 // (assets/<file>), where the preview serves them, and what the editor may upload. Shared by the
@@ -127,7 +128,7 @@ export function referencedFile(value) {
 export const MEDIA_ROUTES = { asset: imageFile, file: assetFile, embed: embedFile };
 
 /** The address the preview serves a file of a report's folder at (`value`: assets/<file>). */
-export const mediaUrl = (route, slug, value) => `/__gallery/edit/${route}/${slug}/${value}`;
+export const mediaUrl = (route, slug, value) => workspaceAddress(`/__gallery/edit/${route}/${slug}/${value}`);
 
 // ---------- what may be uploaded ----------
 

package/browser/shared/outline-shape.mjs

@@ -55,6 +55,10 @@ export const groupOfTop = (key) => (key === "" ? DOCS : key.slice(1));
 /** Whether `entry` names a draft of another workspace. */
 export const isForeign = (entry) => entry.startsWith("~");
 
+/** File ownership is independent of which workspace's window is open. */
+export const entryWorkspace = (entry, self) => /^~(ws-[0-9a-f]{6})\//.exec(entry)?.[1] ?? self;
+export const columnWorkspaceId = (column, self) => column?.extension ? null : column?.workspace ?? column?.owner ?? self;
+
 const tidy = (value) => (typeof value === "string" ? value.replace(/\s+/g, " ").trim() : "");
 
 /** A whole column's `left` as it is kept: the slugs once each, 1000 at most; none when there are none. */
@@ -80,6 +84,7 @@ export function groupOf(value) {
     ...(title ? { title } : {}),
     ...(GROUP_ROLES.includes(role) && id !== DOCS ? { role } : {}),
     ...(isWorkspaceColumn ? { workspace } : {}),
+    ...(typeof value.owner === "string" && /^ws-[0-9a-f]{6}$/.test(value.owner) && !isWorkspaceColumn && id !== DOCS ? { owner: value.owner } : {}),
     // A workspace's column alone is picked or hidden (the user's columns and 链接 are removed, never hidden).
     ...(isWorkspaceColumn && value.picked === true ? { picked: true } : {}),
     ...(isWorkspaceColumn && value.hidden === true ? { hidden: true } : {}),
@@ -98,6 +103,7 @@ export function validGroups(groups) {
     if (value.title !== undefined && (typeof value.title !== "string" || tidy(value.title).length > GROUP_LIMITS.title)) return false;
     if (value.role !== undefined && !GROUP_ROLES.includes(value.role)) return false;
     if (value.extension !== undefined && group.extension !== value.extension) return false;
+    if (value.owner !== undefined && group.owner !== value.owner) return false;
     if (value.left !== undefined && (!Array.isArray(value.left) || value.left.length > GROUP_LIMITS.left || !value.left.every((slug) => typeof slug === "string" && slugPattern.test(slug)))) return false;
     ids.add(group.id);
   }