@heycys/gallery 0.2.1 → 0.2.2

package/browser/shared/extension-manifest.mjs

@@ -0,0 +1,90 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { defaultWorkspace, layoutOf } from "./workspace.mjs";
+import { extensionFolders } from "./extensions.mjs";
+import { isExtensionId } from "./outline-shape.mjs";
+import { sha256, writeAtomic } from "./files.mjs";
+import { withOutlineLock } from "./outline.mjs";
+
+export const extensionDirectory = id => {
+  if (!isExtensionId(id)) throw new Error("扩展 ID 不正确");
+  return path.join(layoutOf(defaultWorkspace()).extensions, id);
+};
+
+export function extensionPath(value) {
+  if (typeof value !== "string" || !value || value.includes("\\") || value.includes(":")) throw new Error("扩展文件必须使用相对路径");
+  const parts = value.split("/");
+  if (parts.some(part => !part || part === "." || part === ".." || /[\x00-\x1f]/.test(part))) throw new Error("扩展文件路径不正确");
+  return parts;
+}
+
+// Resolve every segment, including the extension directory, before serving or running a file.
+export async function extensionFile(folder, name) {
+  const parts = extensionPath(name);
+  if ((await fs.lstat(path.dirname(folder))).isSymbolicLink()) throw new Error("扩展文件不能是符号链接");
+  let file = folder;
+  for (const part of [null, ...parts]) {
+    if (part !== null) file = path.join(file, part);
+    const stat = await fs.lstat(file);
+    if (stat.isSymbolicLink()) throw new Error("扩展文件不能是符号链接");
+  }
+  const [root, real] = await Promise.all([fs.realpath(folder), fs.realpath(file)]);
+  const relative = path.relative(root, real);
+  if (relative.startsWith("..") || path.isAbsolute(relative) || !(await fs.stat(real)).isFile()) throw new Error("扩展文件不在扩展目录内");
+  return real;
+}
+
+export async function readManifest(folder) {
+  const file = await extensionFile(folder, "extension.json");
+  if ((await fs.stat(file)).size > 65536) throw new Error("extension.json 超过 64KB");
+  const text = await fs.readFile(file, "utf8");
+  if (Buffer.byteLength(text) > 65536) throw new Error("extension.json 超过 64KB");
+  const value = JSON.parse(text);
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("extension.json 必须是对象");
+  if (value.id !== undefined && !isExtensionId(value.id)) throw new Error("扩展 ID 不正确");
+  if (value.workbench !== undefined && (!value.workbench || typeof value.workbench !== "object" || Array.isArray(value.workbench))) throw new Error("workbench 必须是对象");
+  for (const name of [value.workbench?.script, value.workbench?.style, value.agent].filter(value => value !== undefined)) await extensionFile(folder, name);
+  if (value.server !== undefined) {
+    const command = value.server?.command;
+    if (!Array.isArray(command) || !command.length || command.length > 32 || command.some(word => typeof word !== "string" || !word || word.includes("\0"))) throw new Error("server.command 必须是非空的参数数组");
+  }
+  return { ...value, revision: sha256(text) };
+}
+
+const configFile = () => path.join(defaultWorkspace(), "gallery.json");
+const configuration = async () => JSON.parse(await fs.readFile(configFile(), "utf8"));
+
+export async function listCapabilities() {
+  const config = await configuration();
+  return Promise.all((await extensionFolders(defaultWorkspace())).map(async ({ id, folder }) => {
+    try {
+      const manifest = await readManifest(folder);
+      const grant = config.extensions?.[id];
+      return { id, folder, manifest, enabled: grant?.enabled === true && grant.revision === manifest.revision,
+        confirmed: grant?.revision === manifest.revision, agent: manifest.agent ? path.join(folder, manifest.agent) : null };
+    } catch (error) {
+      return { id, folder, enabled: false, confirmed: false, manifest: null, error: error.code === "ENOENT" ? null : error.message };
+    }
+  }));
+}
+
+export async function setExtensionEnabled({ id, enabled, revision, confirmed = false }) {
+  const folder = extensionDirectory(id);
+  if (typeof enabled !== "boolean") throw new Error("扩展开关的值不正确");
+  return withOutlineLock(defaultWorkspace(), async () => {
+    const manifest = await readManifest(folder);
+    if (manifest.revision !== revision) throw new Error("扩展刚刚更新，请重新打开设置");
+    const config = await configuration();
+    if (enabled && config.extensions?.[id]?.revision !== revision && !confirmed) throw new Error("请先确认扩展的脚本和后台权限");
+    config.extensions = { ...config.extensions, [id]: { enabled, revision } };
+    await writeAtomic(configFile(), JSON.stringify(config, null, 2) + "\n");
+  });
+}
+
+export async function forgetExtensionGrant(id) {
+  const config = await configuration();
+  if (config.extensions?.[id]) {
+    delete config.extensions[id];
+    await writeAtomic(configFile(), JSON.stringify(config, null, 2) + "\n");
+  }
+}

package/browser/shared/extensions.mjs

@@ -5,7 +5,7 @@ import { said } from "./i18n/index.mjs";
 import { isExtensionId } from "./outline-shape.mjs";
 import { defaultWorkspace, DOCUMENT_FOLDERS, layoutOf } from "./workspace.mjs";
 import { sameDirectory } from "./preview-server.mjs";
-import { writeAtomic } from "./files.mjs";
+import { sha256, writeAtomic } from "./files.mjs";
 
 // The extensions visible in a workspace (docs/workbench.md "Extension columns"): public columns from
 // the default workspace plus this project's own, a project sidebar.json taking precedence by id. Each a folder
@@ -32,18 +32,12 @@ export async function extensionFolders(root) {
 /** Public columns live in the default workspace; a project's own sidebar.json overrides the same id.
  * Empty local folders do not hide a public column. Keep one source for listing, outline and writes.
  */
-export async function visibleExtensionFolders(root) {
-  const home = defaultWorkspace();
-  const roots = sameDirectory(home, root) ? [root] : [home, root];
-  const found = new Map();
-  for (const owner of roots) {
-    for (const entry of await extensionFolders(owner)) {
-      const file = path.join(entry.folder, SIDEBAR_FILE);
-      const present = await fs.lstat(file).then(() => true, () => false);
-      if (present || !found.has(entry.id)) found.set(entry.id, { ...entry, root: owner, file, present });
-    }
-  }
-  return [...found.values()].sort((a, b) => a.id < b.id ? -1 : 1);
+export async function visibleExtensionFolders() {
+  const root = defaultWorkspace();
+  return Promise.all((await extensionFolders(root)).map(async entry => {
+    const file = path.join(entry.folder, SIDEBAR_FILE);
+    return { ...entry, root, file, present: await fs.lstat(file).then(() => true, () => false) };
+  }));
 }
 
 /** Resolve an id, never a client-supplied directory, to the file this workspace actually shows. */
@@ -81,6 +75,7 @@ export async function readExtension(root, id) {
     return { ...empty, error: said("读不出这个文件：{0}", error.code ?? "error") };
   }
   const read = readSidebarText(text);
+  empty.revision = sha256(text);
   if (read.error) {
     // What can still be said of a file that does not read: its name, when it has one.
     let title = id;
@@ -103,7 +98,7 @@ export async function listExtensions(root, { all = false } = {}) {
   return all ? read : read.filter((extension) => !extension.missing);
 }
 
-/** Edit only a column's title or the order of its root entries. Called under the workspace lock.
+/** Edit a column's title/root order, remove a root subtree or delete its sidebar.json. Called under the workspace lock.
  * Read the latest source, keep unknown fields and whole subtrees, and refuse stale UI changes.
  * Atomic replacement checks the original text again so an external writer is not silently overwritten.
  */
@@ -113,12 +108,17 @@ export async function editExtension(root, id, change) {
   const stale = () => refused(409, "stale", said("扩展目录刚在别处改过，请重试"));
   if (!isExtensionId(id) || !change || typeof change !== "object") return bad();
   const rename = Object.hasOwn(change, "title");
-  if (rename ? (typeof change.title !== "string" || typeof change.baseTitle !== "string" || change.move !== undefined)
-    : (!change.move || !["before", "after"].includes(change.move.side) || typeof change.move.entry !== "string" || typeof change.move.ref !== "string" || !Array.isArray(change.baseOrder))) return bad();
+  const remove = Object.hasOwn(change, "remove");
+  if ([rename, remove, Object.hasOwn(change, "move")].filter(Boolean).length !== 1) return bad();
+  if (remove ? (change.remove !== "column" && (typeof change.remove?.entry !== "string" || !change.remove.entry)
+      || typeof change.baseFile !== "string" || typeof change.baseRevision !== "string")
+    : rename ? (typeof change.title !== "string" || typeof change.baseTitle !== "string")
+      : (!change.move || !["before", "after"].includes(change.move.side) || typeof change.move.entry !== "string" || typeof change.move.ref !== "string" || !Array.isArray(change.baseOrder))) return bad();
   const name = rename ? change.title.replace(/\s+/g, " ").trim() : null;
   if (rename && (!name || name.length > SIDEBAR_LIMITS.column)) return bad();
   const folder = path.join(layoutOf(root).extensions, id);
   const file = path.join(folder, SIDEBAR_FILE);
+  if (remove && change.baseFile !== file) return stale(); // An override must not redirect a confirmed deletion.
   // Never turn an extension path supplied by the client or a symlink into an arbitrary-file write.
   for (const [target, directory] of [[layoutOf(root).extensions, true], [folder, true], [file, false]]) {
     const stat = await fs.lstat(target).catch(() => null);
@@ -127,6 +127,12 @@ export async function editExtension(root, id, change) {
     if (!directory && stat.size > SIDEBAR_LIMITS.bytes) return refused(409, "extension", said("文件超过 1MB"));
   }
   const source = await fs.readFile(file, "utf8");
+  if (remove && sha256(source) !== change.baseRevision) return stale();
+  if (remove && change.remove === "column") {
+    if ((await fs.readFile(file, "utf8")) !== source) return stale();
+    await fs.unlink(file); // Only the validated sidebar file; the extension's other files stay.
+    return { ok: true, written: true };
+  }
   const read = readSidebarText(source);
   if (read.error) return refused(409, "extension", read.error);
   const value = JSON.parse(source.replace(/^\uFEFF/, ""));
@@ -134,6 +140,10 @@ export async function editExtension(root, id, change) {
     if (read.sidebar.title !== change.baseTitle) return stale();
     if (read.sidebar.title === name) return { ok: true, written: false };
     value.title = name;
+  } else if (remove) {
+    const index = value.entries.findIndex(entry => entry.id === change.remove.entry);
+    if (index < 0) return bad(); // Roots only; a root's entire subtree goes with it.
+    value.entries.splice(index, 1);
   } else {
     const order = value.entries.map(entry => entry.id);
     if (JSON.stringify(order) !== JSON.stringify(change.baseOrder)) return stale();

package/browser/shared/http.mjs

@@ -8,7 +8,7 @@
 // could lay an editable page under a decoy, the reader's clicks and keys then editing the files (the security
 // review of 0.2.0), nor localhost, which may lead to another program on [::1] (no workbench is shown there:
 // src/server/routes.mjs toLoopback).
-export const FRAMED_BY = { "Content-Security-Policy": "frame-ancestors 'self' http://127.0.0.1:*" };
+export const FRAMED_BY = { "Content-Security-Policy": "frame-ancestors 'self'" };
 
 // A JSON answer.
 export function sendJson(response, status, body) {

package/browser/shared/i18n/en.mjs

@@ -1,6 +1,46 @@
 // English for Gallery's UI, by the Chinese text the source writes (index.mjs t()), in the order the
 // sources use them. tests/unit/i18n.mjs holds every string to an entry here and every entry to a string.
 export default {
+  "启用扩展「{0}」？": "Enable extension “{0}”?",
+  "此扩展可以在工作台运行脚本；后台程序拥有 Gallery 的本地文件和网络访问权限。仅启用你信任的扩展。": "This extension can run workbench scripts. Its backend has Gallery’s local file and network permissions. Only enable extensions you trust.",
+  "启用": "Enable",
+  "扩展设置保存失败": "Could not save extension settings",
+  "扩展设置已保存。重新打开 Gallery 后生效。": "Extension settings saved. Reopen Gallery to apply them.",
+  "来自默认工作区，所有文档共用。": "From the default workspace, shared by all documents.",
+  "还没有安装扩展。": "No extensions installed yet.",
+  "工作台脚本": "Workbench script",
+  "工作台样式": "Workbench style",
+  "后台程序": "Backend process",
+  "侧栏目录": "Sidebar directory",
+  "扩展列表读取失败": "Could not load extensions",
+  "扩展 {0} 加载失败": "Could not load extension {0}",
+  "扩展正在更新，请稍后再试": "The extension is being updated. Try again shortly.",
+  "扩展后台暂未就绪，请查看扩展日志": "The extension backend is not ready. Check its log.",
+  "扩展后台请求超时": "The extension backend request timed out",
+  "扩展操作失败": "The extension operation failed",
+  "扩展目录不能是符号链接": "The extensions directory cannot be a symbolic link",
+  "扩展超过 100MB 或 10000 个文件": "The extension exceeds 100MB or 10000 files",
+  "安装源不能是符号链接": "The installation source cannot be a symbolic link",
+  "扩展只能包含普通文件和文件夹": "Extensions may contain only regular files and directories",
+  "扩展 ZIP 超过 100MB": "The extension ZIP exceeds 100MB",
+  "ZIP 中没有 extension.json": "The ZIP has no extension.json",
+  "ZIP 的文件必须在同一个扩展文件夹内": "All ZIP files must belong to one extension directory",
+  "ZIP 中存在重名文件": "The ZIP contains duplicate file names",
+  "请选择扩展文件夹或 ZIP": "Choose an extension directory or ZIP",
+  "已安装的扩展不能是符号链接": "An installed extension cannot be a symbolic link",
+  "扩展不能是符号链接": "An extension cannot be a symbolic link",
+  "扩展 ID 不正确": "Invalid extension ID",
+  "扩展文件必须使用相对路径": "Extension files must use relative paths",
+  "扩展文件路径不正确": "Invalid extension file path",
+  "扩展文件不能是符号链接": "Extension files cannot be symbolic links",
+  "扩展文件不在扩展目录内": "The file is not inside the extension directory",
+  "extension.json 超过 64KB": "extension.json exceeds 64KB",
+  "extension.json 必须是对象": "extension.json must be an object",
+  "workbench 必须是对象": "workbench must be an object",
+  "server.command 必须是非空的参数数组": "server.command must be a nonempty array of arguments",
+  "扩展开关的值不正确": "Invalid extension enabled value",
+  "扩展刚刚更新，请重新打开设置": "The extension was updated. Reopen settings.",
+  "请先确认扩展的脚本和后台权限": "Confirm the extension’s script and backend permissions first",
   "扩展目录刚在别处改过，请重试": "The extension directory changed elsewhere. Please try again.",
   "找不到这个扩展": "This extension could not be found",
   "扩展路径不是普通文件或文件夹": "The extension path is not a regular file or directory",
@@ -158,6 +198,12 @@ export default {
   "永久删除「{0}」？": "Delete “{0}” forever?",
   "永久删除回收区中的全部 {0} 项？": "Permanently delete all {0} items in the trash?",
   "删除全部": "Delete all",
+  "删除分栏": "Delete column",
+  "删除页面": "Delete page",
+  "删除分栏「{0}」？": "Delete column “{0}”?",
+  "删除页面「{0}」？": "Delete page “{0}”?",
+  "将从 sidebar.json 删除这个条目及其全部子项，共用此配置的工作区会同步更新。不会删除网站上的原文档，此操作无法撤销。": "Remove this entry and all its children from sidebar.json in every workspace sharing this configuration. The original web documents stay. This cannot be undone.",
+  "将删除此分栏的 sidebar.json，共用此配置的工作区会同步移除分栏。其他文件和网站上的原文档不受影响，此操作无法撤销。": "Delete this column's sidebar.json in every workspace sharing this configuration. Other files and the original web documents stay. This cannot be undone.",
   "这份文档": "this document",
   "删除后无法恢复。": "This can't be undone.",
   "正在导出…": "Exporting…",
@@ -1404,15 +1450,12 @@ export default {
   "网址太长了（最多 2048 个字符）": "The address is too long (2048 characters at most)",
   "名称不能是空的，也不能超过 200 个字": "The name can't be empty or longer than 200 characters",
   "图标只能是表情或图标页签里的图标": "The icon must be an emoji or an icon of the Icons tab",
-  "正在启动它所在工作区的服务…": "Starting the server of its workspace…",
-  "没能打开这份底稿：{0}": "Couldn't open this draft: {0}",
   "正在读取别的工作区…": "Reading the other workspaces…",
   "别处的底稿 · {0}": "Draft from elsewhere · {0}",
   "别处的底稿": "Draft from elsewhere",
   "改的是那篇底稿的标题": "Changes the title of that draft",
   "只改它在这里的显示位置，文件不动": "Changes only where it shows here: no file moves",
   "在文件夹中显示": "Show in folder",
-  "在它的工作区里打开": "Open in its workspace",
   "「{0}」已移至它所在工作区的回收区": "“{0}” moved to the trash of its workspace",
   "副本在它所在的工作区里": "The copy is made in its workspace",
   "导入的页面在它所在的工作区里": "The imported pages are made in its workspace",
@@ -1422,7 +1465,6 @@ export default {
   "找不到底稿：本机登记的两个工作区编号相同": "Draft not found: two registered workspaces share one id",
   "找不到底稿：{0}": "Draft not found: {0}",
   "找不到底稿": "Draft not found",
-  "这份文档在它自己的工作区里，不在这里的侧边栏中": "This document is in its own workspace, not in this sidebar",
   "找不到它所在的工作区": "Its workspace was not found",
   "没有打开文件夹：{0}": "The folder was not opened: {0}",
   "已从文档树移除「{0}」，底稿没有删除": "Removed “{0}” from the sidebar; the draft was not deleted",
@@ -1436,17 +1478,7 @@ export default {
   "会把 {0} 登记成一个工作区（在里面放 gallery.json 和 .gallery/）": "{0} will be registered as a workspace (a gallery.json and a .gallery/ put in it)",
   "没能把它的工作区记进本机的登记表": "Its workspace could not be added to this machine's registry",
   "本机登记的 {0} 个工作区编号相同（{1}），先用 gallery workspaces --forget 去掉其中一个": "{0} registered workspaces share one id ({1}): take one off with gallery workspaces --forget first",
-  "这是当前的工作区": "This is the current workspace",
-  "这个工作区不在本机的登记表里": "This workspace is not on this machine's registry",
-  "本机登记的工作区里有两个用的是同一个编号，先用 gallery workspaces --forget 去掉其中一个": "Two registered workspaces share this id: take one off with gallery workspaces --forget first",
-  "找不到它所在的工作区：它不在本机的登记表里": "Its workspace was not found: it is not on this machine's registry",
-  "找不到它所在的工作区：{0} 不在了": "Its workspace was not found: {0} is gone",
   "找不到这个文件夹": "Folder not found",
-  "它所在工作区的服务没有在运行": "The server of its workspace is not running",
-  "它所在工作区的服务没有回答": "The server of its workspace did not answer",
-  "没能启动它所在工作区的服务：{0}": "The server of its workspace did not start: {0}",
-  "这个命令不能转给别的工作区": "This command can't be passed on to another workspace",
-  "它所在工作区的服务没有给出结果": "The server of its workspace gave no answer",
   // Extension columns (src/shared/extension-sidebar.mjs, extensions.mjs, workbench/app/features/sidebar/SidebarExtension.tsx)
   "这个条目已被扩展移除": "This entry was removed by its extension",
   "条目读不出来：{0}": "Entries can't be read: {0}",
@@ -1532,5 +1564,4 @@ export default {
   "将「{0}」及其子页面复制到「{1}」，原项保留。": "Copy “{0}” and its child pages to “{1}”, keeping the originals.",
   "已复制 {0} 项，原项保留": "Copied {0} items; originals kept",
   "跨工作区请复制，不能只移动目录位置": "Copy items to another workspace instead of moving their tree positions",
-  "自定义块 {0} 缺失或版本冲突，未复制": "Custom block {0} is missing or has a version conflict; nothing was copied",
 };

package/browser/shared/media.mjs

@@ -1,3 +1,4 @@
+import { workspaceAddress } from "./workspace-address.mjs";
 // The media of a report, one place for what every system asks about it: the files its media
 // blocks, its page icon and any other reference of its markup keep in the report's folder
 // (assets/<file>), where the preview serves them, and what the editor may upload. Shared by the
@@ -127,7 +128,7 @@ export function referencedFile(value) {
 export const MEDIA_ROUTES = { asset: imageFile, file: assetFile, embed: embedFile };
 
 /** The address the preview serves a file of a report's folder at (`value`: assets/<file>). */
-export const mediaUrl = (route, slug, value) => `/__gallery/edit/${route}/${slug}/${value}`;
+export const mediaUrl = (route, slug, value) => workspaceAddress(`/__gallery/edit/${route}/${slug}/${value}`);
 
 // ---------- what may be uploaded ----------
 

package/browser/shared/outline.mjs

@@ -9,14 +9,8 @@ import { forgetSnapshot, shownWorkspaces, snapshotOf } from "./workspace-columns
 import { defaultWorkspace, layoutOf, listDocumentSlugs, listLinkSlugs, pageSlug } from "./workspace.mjs";
 import { readRegistry, workspaceId, workspaceKey } from "./workspace-registry.mjs";
 
-/** Registered workspaces share the default workspace's existing tree. Unregistered/temporary
- * workspaces remain standalone; no registry discovery or copying of document files is needed. */
-export function outlineRoot(root) {
-  const home = defaultWorkspace();
-  return workspaceKey(root) === workspaceKey(home) || readRegistry().workspaces.some(entry => workspaceKey(entry.root) === workspaceKey(root)) ? home : root;
-}
-
-export const sharedOutline = root => workspaceKey(outlineRoot(root)) === workspaceKey(defaultWorkspace());
+/** All document folders share the default workspace’s outline. */
+export const outlineRoot = () => defaultWorkspace();
 
 /** Moving a reference across owners must use the confirmed copy command. */
 export function ownsOutline(root, value) {
@@ -49,7 +43,7 @@ function ownedTree(tree, self) {
 // Registered workspaces project one shared tree, partitioned by file owner. Their former local files
 // only seed new entries; the default workspace stores subsequent order/hierarchy edits. The format
 // below is also the standalone/legacy reader. Its picked/hidden/left rules are not applied to shared
-// trees, which list every registered document and link. Project-only extensions keep local positions.
+// trees, which list every registered document and link. Extensions are read from home alone.
 // The workspace's outline: the sidebar's columns and which entry sits under which, in what order
 // (<workspace>/.gallery/outline.json, docs/workbench.md "Workspace commands"; its shape: ./outline-shape.mjs).
 // The file, version 2:
@@ -179,7 +173,7 @@ async function localOutlineAndFile(root, { others: withOthers = true, shared = f
 
 /** Translate the same tree between the default workspace's ids and a project's local ids.
  * No second ordering is kept: only the current workspace's column is displayed first. */
-function projectTree(value, from, to, { first = false } = {}) {
+function projectTree(value, from, to) {
   if (!value || workspaceKey(from) === workspaceKey(to)) return value;
   const fromId = workspaceId(from), toId = workspaceId(to);
   const own = value.groups.find(group => group.workspace === toId);
@@ -195,34 +189,20 @@ function projectTree(value, from, to, { first = false } = {}) {
     }
     return group;
   });
-  if (first) groups = [...groups.filter(group => group.id === DOCS), ...groups.filter(group => group.id !== DOCS)];
   return { ...value, groups, children: Object.fromEntries(Object.entries(value.children).map(([parent, list]) => [key(parent), list.map(entry)])) };
 }
 
 export async function outlineAndFile(root, { others: withOthers = true } = {}) {
   const home = outlineRoot(root);
-  if (workspaceKey(home) === workspaceKey(root)) return localOutlineAndFile(root, { others: withOthers, shared: sharedOutline(root) });
+  if (workspaceKey(home) === workspaceKey(root)) return localOutlineAndFile(root, { others: withOthers, shared: true });
   // A command may just have created/trashed a local item before placing it in the shared tree.
   forgetSnapshot(root);
   const shared = await localOutlineAndFile(home, { shared: true });
-  let outline = projectTree(shared.outline, home, root, { first: true });
-  // A project's extensions remain private; public ones still come from the default workspace.
-  outline.groups = withExtensions(outline.groups, await extensionColumnIds(root));
-  const publicIds = new Set(await extensionColumnIds(home));
-  const positions = (await readJson(layoutOf(root).outline))?.extensionPositions;
-  for (const position of Array.isArray(positions) ? [...positions].reverse() : []) {
-    const group = outline.groups.find(group => group.id === position.id && group.extension && !publicIds.has(group.extension));
-    if (!group) continue;
-    outline.groups = outline.groups.filter(item => item !== group);
-    const at = outline.groups.findIndex(item => item.id === position.before);
-    outline.groups.splice(at < 0 ? outline.groups.length : at, 0, group);
-  }
-  outline.children = Object.fromEntries(Object.entries(outline.children).filter(([key]) => !isTop(key) || outline.groups.some(group => topOf(group.id) === key)));
-  for (const group of outline.groups) outline.children[topOf(group.id)] ??= [];
+  let outline = projectTree(shared.outline, home, root);
   const ownLinks = await listLinkSlugs(root);
   const others = await otherWorkspaces(root);
   outline = { ...outline, links: ownLinks, drafts: Object.values(outline.children).flat().filter(isForeign), shown: others.map(({ id, root: other, isDefault }) => ({ id, root: other, isDefault })) };
-  return { outline, stored: projectTree(shared.stored, home, root, { first: true }), others };
+  return { outline, stored: projectTree(shared.stored, home, root), others };
 }
 
 // The own column's name before it was 默认文档 or the workspace's (文档, Documents in English), which a
@@ -476,30 +456,10 @@ export function fileOf(value) {
  */
 export async function writeOutline(root, value) {
   const home = outlineRoot(root);
-  if (sharedOutline(root) && !ownsOutline(root, value)) throw Object.assign(new Error("跨工作区请复制，不能只移动目录位置"), { code: "CROSS_WORKSPACE" });
-  if (sharedOutline(root)) value = { ...value, groups: (value.groups ?? [{ id: DOCS }]).map(group => group.id === DOCS || group.workspace || group.extension ? group : { ...group, owner: group.owner ?? workspaceId(root) }) };
+  if (!ownsOutline(root, value)) throw Object.assign(new Error("跨工作区请复制，不能只移动目录位置"), { code: "CROSS_WORKSPACE" });
+  value = { ...value, groups: (value.groups ?? [{ id: DOCS }]).map(group => group.id === DOCS || group.workspace || group.extension ? group : { ...group, owner: group.owner ?? workspaceId(root) }) };
   if (workspaceKey(home) !== workspaceKey(root)) {
-    const current = (await localOutlineAndFile(home)).outline;
-    const translated = projectTree(value, root, home);
-    // The current-column-first projection is presentation only. Keep the shared column order;
-    // deliberate moves of other columns use the relative order submitted by the client.
-    const ownId = workspaceId(root);
-    const at = current.groups.findIndex(group => group.workspace === ownId);
-    const own = translated.groups.find(group => group.workspace === ownId);
-    translated.groups = translated.groups.filter(group => group !== own);
-    if (own) translated.groups.splice(Math.max(0, Math.min(at, translated.groups.length)), 0, own);
-    const publicIds = new Set(await extensionColumnIds(home));
-    const privateGroup = group => group.extension && !publicIds.has(group.extension);
-    const positions = value.groups.filter(privateGroup).map(group => ({ id: group.id, before: value.groups.slice(value.groups.indexOf(group) + 1).find(group => !privateGroup(group))?.id ?? null }));
-    const localFile = layoutOf(root).outline;
-    const local = await readJson(localFile) ?? {};
-    if ((positions.length || local.extensionPositions?.length) && JSON.stringify(positions) !== JSON.stringify(local.extensionPositions)) {
-      await fs.mkdir(path.dirname(localFile), { recursive: true });
-      await writeAtomic(localFile, `${JSON.stringify({ ...local, extensionPositions: positions }, null, 2)}\n`);
-    }
-    translated.groups = translated.groups.filter(group => !group.extension || publicIds.has(group.extension));
-    for (const group of current.groups) if (group.extension && !translated.groups.some(item => item.id === group.id)) translated.groups.push(group);
-    value = translated;
+    value = projectTree(value, root, home);
     root = home;
   }
   const file = layoutOf(root).outline;
@@ -589,7 +549,7 @@ export function moveDocument(root, slug, where) {
   return withOutlineLock(root, async () => {
     const { outline, stored } = await outlineAndFile(root);
     const result = moveIn(outline.children, slug, where);
-    if (result.ok && sharedOutline(root) && !ownsOutline(root, outline)) return { ok: false, reason: "cross-workspace" };
+    if (result.ok && !ownsOutline(root, outline)) return { ok: false, reason: "cross-workspace" };
     const written = result.ok && !writtenAs(outline, stored);
     if (written) await writeOutline(root, outline);
     return { ...result, ...(result.ok ? { written } : {}) };

package/browser/shared/page-address.mjs

@@ -1,4 +1,5 @@
-import { earlierLink, pageLink, pageOfLink } from "./page-links.mjs";
+import { localPath } from "./workspace-address.mjs";
+import { pageLink, pageOfLink } from "./page-links.mjs";
 
 // A document's address, as a link, a paste or the address bar may write it (docs/workbench.md, "A
 // document's addresses"), read in one place: { slug, block }, block null for the page itself. Pure: the
@@ -16,11 +17,8 @@ import { earlierLink, pageLink, pageOfLink } from "./page-links.mjs";
 // one form that needs `links` (pageLinks: a Map of slug to link), for only the list can say which
 // document an id is or whether a name is a slug at all; given, `links` also turns away every slug it
 // does not hold. Without it such an address is none here, and workbenchHash hands it to the workbench,
-// which has the list. pageAddress reads no port, as a link outlives a server; but this computer runs
-// other programs too, and other workspaces, whose folder of one name has one page id, so an address
-// on another port (elsewhere) is a document's only if the list holds it, by its folder name or its
-// link of now (addressOn), or for a folder named doc- and eight characters, the link it had before
-// those eight were its id (shared/page-links.mjs earlierId).
+// which has the list. pageAddress parses a shape; addressOn additionally requires the current
+// service’s port. An address of another port is always external, even when its slug matches.
 
 const SLUG = "[a-z0-9]+(?:-[a-z0-9]+)*"; // shared/workspace.mjs slugPattern, which needs Node
 const FILE = "(?:doc|report)\\.html";
@@ -71,7 +69,7 @@ export function pageAddress(text, links = null) {
   if (inFile) return known(inFile[1], decoded(inFile[2] ?? ""));
   const url = ownAddress(address);
   if (!url) return null;
-  const path = PAGE.exec(url.pathname) ?? OWN_FILE.exec(url.pathname);
+  const path = PAGE.exec(localPath(url.pathname)) ?? OWN_FILE.exec(localPath(url.pathname));
   if (path) return known(path[1], decoded(url.hash.slice(1)));
   return url.pathname === "/" && url.hash.length > 1 ? hashAddress(decoded(url.hash.slice(1)), links) : null;
 }
@@ -87,19 +85,14 @@ export function workbenchHash(text) {
 
 /**
  * The document and block `text` names of those in `links` (a Map, or null with no list) as read on the
- * server of `origin`, as pageAddress reads it; but a workbench's address on another port says what it
- * is by its words, the folder name or the link the document has now, for the same id there may be
- * another workspace's page. With no `origin`, as a file is read, every port is another.
+ * server of `origin`, as pageAddress reads it. Another port is always external; with no origin
+ * supplied, no running service’s port is inferred from matching titles or folder names.
  * @param {string} text
  * @param {Map<string, string> | null} links
  * @param {string} [origin]
  */
 export function addressOn(text, links, origin = "http://127.0.0.1") {
-  const place = pageAddress(text, links);
-  const name = place && elsewhere(text, origin) ? workbenchHash(text)?.split("/")[0] : undefined;
-  if (name === undefined || links.has(name)) return place;
-  const link = links.get(place.slug);
-  return link === name || earlierLink(place.slug, link) === name ? place : null;
+  return elsewhere(text, origin) ? null : pageAddress(text, links);
 }
 
 /** Whether `text` is an address of a document of this workspace, as far as can be told with no list. */

package/browser/shared/paths.mjs

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { serviceLocation } from "./service-location.mjs";
 import { findWorkspace, layoutOf } from "./workspace.mjs";
 
 // Where everything is on disk, for every system, in two kinds: the workspace's (the user's documents
@@ -42,7 +43,7 @@ export const qaDirectory = workspace.qa; // gallery qa's pictures of what it fla
 export const backupsDirectory = workspace.backups; // documents as they were before a migration (add-block-ids.mjs)
 export const editStateDirectory = workspace.state; // the editor's token, snapshots, recent versions…
 // What a server a command started says while it runs (it runs on after that command).
-export const previewLogFile = workspace.serverLog;
+export const previewLogFile = serviceLocation().serverLog;
 
 // Gallery's own files, which a command never writes (a global install may be read-only): the shared
 // kit and the starter, what the preview serves, what the checks and the import read. In the release

package/browser/shared/preferences.mjs

@@ -1,3 +1,4 @@
+import { documentKey } from "./workspace-address.mjs";
 // The reader's preferences of Gallery's UI (the workbench's 设置): switches (and a width) kept in localStorage,
 // which the workbench and every report page share (one origin), so the page editor follows a change
 // at once (the storage event reaches every other page of the origin). Each has its default (off, but for
@@ -88,7 +89,7 @@ function openSlugs() {
 
 /** Whether report `slug` has its outline on (off until it is switched on there). */
 export function outlineOpen(slug) {
-  return typeof slug === "string" && slug !== "" && openSlugs().includes(slug);
+  return typeof slug === "string" && slug !== "" && openSlugs().includes(documentKey(slug));
 }
 
 /**
@@ -96,6 +97,7 @@ export function outlineOpen(slug) {
  * reports, the one switched on longest ago let go); off, it is taken out.
  */
 export function setOutlineOpen(slug, on) {
+  slug = documentKey(slug);
   if (typeof slug !== "string" || slug === "") return;
   try {
     const slugs = openSlugs().filter((one) => one !== slug);