@kanyun-ai-infra/band-cli 0.1.0 → 0.2.0

package/dist/{chunk-VVJNG5GV.js → chunk-Q2XJXNVH.js}

@@ -10,7 +10,7 @@ import {
   officialProfilePath,
   resolvePluginRepo,
   workshopNameOf
-} from "./chunk-RAD6MMSL.js";
+} from "./chunk-XPLYTHNX.js";
 import {
   IMPLICIT_STAGE,
   SELF_CONTAINED_EXTENSIONS,
@@ -29,7 +29,7 @@ import {
   rolePermissions,
   selfContainedProblems,
   workshopFileReader
-} from "./chunk-TN7Z3OF6.js";
+} from "./chunk-LGYGWMSY.js";
 
 // src/index.ts
 import { execFileSync } from "child_process";
@@ -310,6 +310,8 @@ function newPlugin(root, name, opts) {
     description: title,
     type: "module",
     peerDependencies: {
+      react: "^19.0.0",
+      "react-dom": "^19.0.0",
       "@kanyun-ai-infra/band-plugin-sdk": `^${BAND_PROTOCOL_VERSION}`,
       [PROJECT]: "*"
     }
@@ -432,6 +434,8 @@ ${t.manifest}`,
         // 不带 --passWithNoTests：收不到测试要红，不吞成绿（band#456）
         scripts: { check: "tsc -p tsconfig.json", test: "vitest run" },
         peerDependencies: {
+          react: "^19.0.0",
+          "react-dom": "^19.0.0",
           "@kanyun-ai-infra/band-plugin-sdk": "workspace:*",
           [PROJECT]: "workspace:*"
         },
@@ -642,7 +646,7 @@ import { parse } from "yaml";
 // package.json
 var package_default = {
   name: "@kanyun-ai-infra/band-cli",
-  version: "0.1.0",
+  version: "0.2.0",
   description: "band \u547D\u4EE4\u884C\uFF1A\u65B0\u5EFA\u3001\u672C\u5730\u8C03\u8BD5\u3001\u6821\u9A8C\u4E0E\u53D1\u5E03 Band \u5DE5\u574A\u548C\u63D2\u4EF6",
   license: "UNLICENSED",
   type: "module",
@@ -657,7 +661,8 @@ var package_default = {
     },
     "./build": {
       types: "./dist/build-plugin.d.ts",
-      import: "./dist/build-plugin.js"
+      import: "./dist/build-plugin.js",
+      default: "./dist/build-plugin.js"
     },
     "./catalog": {
       types: "./dist/plugin-entry.d.ts",
@@ -692,8 +697,8 @@ var package_default = {
     "@kanyun-ai-infra/band-plugin-react": "workspace:^",
     "@kanyun-ai-infra/band-plugin-sdk": "workspace:^",
     "es-module-lexer": "^2.3.2",
-    react: "^18.3.1",
-    "react-dom": "^18.3.1",
+    react: "^19.3.1",
+    "react-dom": "^19.3.1",
     semver: "^7.8.5",
     vite: "^6.0.7",
     yaml: "^2.6.1",
@@ -705,8 +710,8 @@ var package_default = {
     "@kanyun-ai-infra/band-tokens": "workspace:*",
     "@kanyun-ai-infra/band-workshop": "workspace:*",
     "@types/node": "^22.10.0",
-    "@types/react": "^18.3.12",
-    "@types/react-dom": "^18.3.1",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     tsup: "^8.4.0",
     typescript: "5.9.3",
     vitest: "^4.0.17"
@@ -775,7 +780,7 @@ function newPluginRepo(parentDir, packageName, opts) {
       "npx band dev .\uFF1A\u7528 dev/ \u5939\u5177\u5DE5\u574A\u8D77\u9875\u9762\uFF0C\u672C\u4ED3\u5E93\u7684\u63D2\u4EF6\u81EA\u52A8\u88C5\u4E0A",
       "npx band check .\uFF1A\u6821\u9A8C\u63D2\u4EF6\u4E0E\u5939\u5177\u5DE5\u574A\u7684\u88C5\u914D",
       placementHint(opts.template, packageName, name, opts.stage),
-      "\u53D1\u5E03\uFF08band publish --plugin\uFF09\u4E0E CI \u53D1\u5305\u8FD8\u6CA1\u843D\u5730\uFF1A\u73B0\u5728 CI \u6A21\u677F\u53EA\u8DD1 band check"
+      "\u53D1\u5E03\u8FD8\u6CA1\u63A5\u4E0A\uFF08\u63D2\u4EF6\u7531 Band \u6253\u5305\u5206\u53D1\uFF0C\u4E0D\u7ECF npm \u53D1\u5305\uFF09\uFF1A\u73B0\u5728 CI \u6A21\u677F\u53EA\u8DD1 band check"
     ]
   };
 }
@@ -796,9 +801,12 @@ function packageJson(packageName, title) {
     files: ["src", "plugin.yaml", "README.md"],
     scripts: { dev: "band dev .", check: "band check ." },
     peerDependencies: {
+      react: "^19.0.0",
+      "react-dom": "^19.0.0",
       "@kanyun-ai-infra/band-plugin-sdk": `^${BAND_PROTOCOL_VERSION2}`,
       [PROJECT2]: "*"
     },
+    peerDependenciesMeta: { [PROJECT2]: { optional: true } },
     devDependencies: {
       "@kanyun-ai-infra/band-cli": `^${CLI_VERSION}`,
       "@kanyun-ai-infra/band-plugin-sdk": `^${BAND_PROTOCOL_VERSION2}`
@@ -897,7 +905,7 @@ function CI(packageName) {
 # \u8FDB\u884C\u4E2D\uFF0C\u8FD8\u6CA1\u63A5\u4E0A\uFF1A
 #   - \u5355\u6D4B\uFF1B
 #   - \u9632\u6CC4\u9732\u626B\u63CF\uFF1B
-#   - \u6253 v* tag \u65F6\u53D1\u79C1\u6709 cnpm\uFF0C\u5E76\u7528 \`band publish --plugin\` \u767B\u8BB0\u8FDB Band \u63D2\u4EF6\u76EE\u5F55\u3002
+#   - \u53D1\u5E03\uFF1A\u63D2\u4EF6\u7531 Band \u6253\u5305\u3001\u6309\u5185\u5BB9\u54C8\u5E0C\u5B58\u653E\u4E0E\u5206\u53D1\uFF0C\u4E0D\u7ECF npm \u53D1\u5305\uFF1B\u63A5\u4E0A\u4E4B\u524D\u8FD9\u91CC\u53EA\u8DD1 band check\u3002
 stages: [check]
 
 band-check:
@@ -923,7 +931,7 @@ ${title}\uFF1A\u4E00\u4E2A\u72EC\u7ACB\u7684 Band \u63D2\u4EF6\uFF08\u4E0D\u5C5E
 | \`src/index.ts\` | \u5165\u53E3\uFF0C\u9ED8\u8BA4\u5BFC\u51FA \`definePlugin({ surfaces })\` |
 | \`dev/workshop.yaml\` | \u672C\u5730\u5939\u5177\u5DE5\u574A\uFF1A\u6700\u5C0F\u5B9A\u4E49\uFF0C\u53EA\u7ED9 \`band dev\` / \`band check\` \u7528\uFF0C\u4E0D\u53D1\u5E03 |
 | \`dev/fixture.ts\` | \u5939\u5177\uFF1A\u793A\u4F8B\u4EA7\u7269\u3001\u7248\u672C\u4E0E\u6587\u4EF6 |
-| \`.gitlab-ci.yml\` | CI \u6A21\u677F\uFF1A\u73B0\u5728\u8DD1 \`band check\`\uFF1B\u5355\u6D4B\u3001\u53D1\u5305\u4E0E\u767B\u8BB0\u8FDB\u884C\u4E2D |
+| \`.gitlab-ci.yml\` | CI \u6A21\u677F\uFF1A\u73B0\u5728\u8DD1 \`band check\`\uFF1B\u5355\u6D4B\u3001\u9632\u6CC4\u9732\u626B\u63CF\u4E0E\u53D1\u5E03\u8FDB\u884C\u4E2D |
 
 \u754C\u9762\u51FA\u73B0\u5728${place}\u3002
 
@@ -937,14 +945,13 @@ npx band check .     # \u6821\u9A8C package.json\u3001plugin.yaml \u4E0E\u5939\u
 
 ## \u53D1\u5E03\uFF08\u8FDB\u884C\u4E2D\uFF09
 
-\`band publish --plugin\` \u4E0E\u79C1\u6709 cnpm \u8FD8\u5728\u843D\u5730\uFF1A\u73B0\u5728\u53EA\u80FD\u5728\u672C\u5730\u8C03\u8BD5\u4E0E\u6821\u9A8C\u3002\u843D\u5730\u540E\u6253 \`v*\` tag \u65F6 CI \u53D1\u5305\u5E76\u767B\u8BB0\uFF0C
+\u53D1\u5E03\u8FD8\u6CA1\u63A5\u4E0A\uFF1A\u73B0\u5728\u53EA\u80FD\u5728\u672C\u5730\u8C03\u8BD5\u4E0E\u6821\u9A8C\u3002\u63D2\u4EF6\u7531 Band \u6253\u5305\u3001\u6309\u5185\u5BB9\u54C8\u5E0C\u5B58\u653E\u4E0E\u5206\u53D1\uFF0C\u4E0D\u7ECF npm \u53D1\u5305\uFF0C
 \u9875\u9762\u52A0\u8F7D\u7684\u59CB\u7EC8\u662F Band \u6784\u5EFA\u3001\u6309\u5185\u5BB9\u54C8\u5E0C\u5F52\u6863\u7684\u90A3\u4E00\u4EFD\u3002
 
 ## \u6539\u6210\u81EA\u5DF1\u7684
 
 - \u6807\u9898\u3001\u8BF4\u660E\uFF1A\`package.json\` \u7684 \`description\` \u4E0E \`plugin.yaml\` \u8D21\u732E\u7684 \`title\`\uFF1B
-- \u5939\u5177\uFF1A\`dev/workshop.yaml\` \u7684 \`views\` \u51B3\u5B9A\u63D2\u4EF6\u5728\u9875\u9762\u4E0A\u7684\u4F4D\u7F6E\uFF0C\`dev/fixture.ts\` \u7ED9\u51FA\u7248\u672C\u4E0E\u6587\u4EF6\uFF1B
-- \u53D1\u5E03\u524D\u5728 \`package.json\` \u52A0 \`publishConfig.registry\`\uFF0C\u5199\u56E2\u961F\u5B9E\u9645\u4F7F\u7528\u7684\u79C1\u6709 npm \u6E90\u5730\u5740\u3002
+- \u5939\u5177\uFF1A\`dev/workshop.yaml\` \u7684 \`views\` \u51B3\u5B9A\u63D2\u4EF6\u5728\u9875\u9762\u4E0A\u7684\u4F4D\u7F6E\uFF0C\`dev/fixture.ts\` \u7ED9\u51FA\u7248\u672C\u4E0E\u6587\u4EF6\u3002
 `;
 }
 
@@ -1980,7 +1987,7 @@ async function main(argv) {
     if (cmd === "dev") {
       const { args, flags } = parseArgs(rest, ["port", "host"]);
       const port = flags.port === void 0 ? void 0 : parsePort(flags.port);
-      const { startDevServer } = await import("./dev-server-RAZQ32W7.js");
+      const { startDevServer } = await import("./dev-server-Q7NTJ3QD.js");
       const server = await startDevServer(args[0] ?? ".", {
         ...port !== void 0 ? { port } : {},
         ...flags.host ? { host: flags.host } : {}

package/dist/{chunk-RAD6MMSL.js → chunk-XPLYTHNX.js}

@@ -11,7 +11,7 @@ import {
   resolveWorkshopRepo,
   rolePermissions,
   workshopFileRefs
-} from "./chunk-TN7Z3OF6.js";
+} from "./chunk-LGYGWMSY.js";
 
 // src/bundled.ts
 import { existsSync } from "fs";

package/dist/{dev-server-RAZQ32W7.js → dev-server-Q7NTJ3QD.js}

@@ -5,15 +5,17 @@ import {
   bundledDir,
   renderDevModule,
   resolveDevWorkshop
-} from "./chunk-RAD6MMSL.js";
-import "./chunk-TN7Z3OF6.js";
+} from "./chunk-XPLYTHNX.js";
+import "./chunk-LGYGWMSY.js";
 
 // src/dev-server.ts
-import { createHash } from "crypto";
-import { existsSync, readFileSync } from "fs";
+import { createHash as createHash2 } from "crypto";
+import { existsSync, readFileSync, readdirSync } from "fs";
 import { tmpdir } from "os";
 import { dirname, join, sep } from "path";
 import { fileURLToPath } from "url";
+import { SHARED_MODULES } from "@kanyun-ai-infra/band-plugin-sdk";
+import { initSync, parse } from "es-module-lexer";
 import { createServer as createServer2, searchForWorkspaceRoot } from "vite";
 
 // src/browser-port.mjs
@@ -113,10 +115,82 @@ async function selectBrowserPort(bind, release) {
   throw new Error("\u8FDE\u7EED 100 \u6B21\u672A\u5206\u914D\u5230\u6D4F\u89C8\u5668\u5B89\u5168\u7AEF\u53E3");
 }
 
+// src/upstream-key.ts
+import { createHash, timingSafeEqual } from "crypto";
+var UPSTREAM_KEY_HEADER = "x-band-upstream-key";
+var UPSTREAM_KEY_ENV = "BAND_DEV_UPSTREAM_KEY";
+function upstreamKeyFromEnv(env = process.env) {
+  const value = env[UPSTREAM_KEY_ENV];
+  if (value === void 0) return void 0;
+  if (value === "") throw new Error(`${UPSTREAM_KEY_ENV} \u8BBE\u6210\u4E86\u7A7A\u4E32\uFF1A\u8981\u4E48\u4E0D\u8BBE\uFF0C\u8981\u4E48\u7ED9\u4E00\u4E2A\u5BC6\u94A5`);
+  return value;
+}
+var digest = (v) => createHash("sha256").update(v).digest();
+function upstreamKeyMatches(header, key) {
+  if (typeof header !== "string") return false;
+  return timingSafeEqual(digest(header), digest(key));
+}
+function reject(socket) {
+  socket.end(
+    "HTTP/1.1 403 Forbidden\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: 9\r\nConnection: close\r\n\r\nForbidden"
+  );
+}
+function upstreamKeyGuard(key) {
+  if (key === "") throw new Error("\u4E0A\u6E38\u5BC6\u94A5\u4E0D\u80FD\u662F\u7A7A\u4E32");
+  return {
+    name: "band-upstream-key",
+    configureServer(server) {
+      const deny = (req, res) => {
+        if (req.method === "GET" && req.url === "/") {
+          res.statusCode = 204;
+          res.setHeader("Cache-Control", "no-store");
+          res.end();
+          return;
+        }
+        res.statusCode = 403;
+        res.setHeader("Content-Type", "text/plain; charset=utf-8");
+        res.end("Forbidden");
+      };
+      server.middlewares.use((req, res, next) => {
+        if (upstreamKeyMatches(req.headers[UPSTREAM_KEY_HEADER], key)) return next();
+        deny(req, res);
+      });
+      const http = server.httpServer;
+      if (!http) return;
+      const original = http.listeners("upgrade");
+      const originalRequest = http.listeners("request");
+      http.removeAllListeners("request");
+      http.on("request", (req, res) => {
+        if (!upstreamKeyMatches(req.headers[UPSTREAM_KEY_HEADER], key)) return deny(req, res);
+        for (const listener of originalRequest) listener.call(http, req, res);
+      });
+      http.removeAllListeners("upgrade");
+      http.on("upgrade", (req, socket, head) => {
+        if (!upstreamKeyMatches(req.headers[UPSTREAM_KEY_HEADER], key)) return reject(socket);
+        for (const listener of original) listener.call(http, req, socket, head);
+      });
+    }
+  };
+}
+
 // src/dev-server.ts
 var VIRTUAL = "virtual:band-dev";
 var RESOLVED = `\0${VIRTUAL}`;
 var DEV_HOST_DIR = fileURLToPath(new URL("../dev-host/", import.meta.url));
+function heartbeatPlugin(ms) {
+  return {
+    name: "band-heartbeat",
+    configureServer(server) {
+      if (ms <= 0) return;
+      const timer = setInterval(
+        () => server.ws.send({ type: "custom", event: "band:heartbeat" }),
+        ms
+      );
+      timer.unref();
+      server.httpServer?.once("close", () => clearInterval(timer));
+    }
+  };
+}
 function bandDevPlugin(root, initial) {
   let ws = initial;
   let server;
@@ -174,14 +248,14 @@ function packageJsonOf(name) {
       );
   }
 }
-function bundledPrebundle() {
-  const out = [
+function bundledPrebundle(dir = bundledDir()) {
+  const out = /* @__PURE__ */ new Set([
     "react",
     "react/jsx-runtime",
     "react/jsx-dev-runtime",
     "react-dom",
     "react-dom/client"
-  ];
+  ]);
   for (const name of [
     "@kanyun-ai-infra/band-contracts",
     "@kanyun-ai-infra/band-plugin-sdk",
@@ -191,10 +265,31 @@ function bundledPrebundle() {
     for (const [sub, target] of Object.entries(pkg.exports ?? {})) {
       const file = typeof target === "string" ? target : target.import;
       if (sub.includes("*") || !file?.endsWith(".js")) continue;
-      out.push(sub === "." ? name : `${name}/${sub.slice(2)}`);
+      out.add(sub === "." ? name : `${name}/${sub.slice(2)}`);
     }
   }
-  return out;
+  if (dir)
+    for (const s of sharedImportsIn([join(dir, "official"), join(dir, "kernel")])) out.add(s);
+  return [...out];
+}
+function sharedImportsIn(dirs) {
+  initSync();
+  const found = /* @__PURE__ */ new Set();
+  const shared = (spec) => SHARED_MODULES.some((m) => spec === m || spec.startsWith(`${m}/`));
+  const walk = (d) => {
+    if (!existsSync(d)) return;
+    for (const e of readdirSync(d, { withFileTypes: true })) {
+      const f = join(d, e.name);
+      if (e.isDirectory()) {
+        if (e.name !== "node_modules") walk(f);
+      } else if (e.name.endsWith(".js")) {
+        const [imports] = parse(readFileSync(f, "utf8"), f);
+        for (const i of imports) if (i.n && shared(i.n)) found.add(i.n);
+      }
+    }
+  };
+  for (const d of dirs) walk(d);
+  return [...found].sort();
 }
 function allowedRoots(workshopRoot) {
   const roots = [searchForWorkspaceRoot(DEV_HOST_DIR), workshopRoot];
@@ -205,6 +300,7 @@ function allowedRoots(workshopRoot) {
 }
 async function startDevServer(root, opts = {}) {
   const workshop = resolveDevWorkshop(root);
+  const upstreamKey = opts.upstreamKey ?? upstreamKeyFromEnv();
   let nextPort = opts.port ?? 5310;
   if (nextPort !== 0 && !isBrowserPortSafe(nextPort))
     throw new Error(`\u7AEF\u53E3 ${nextPort} \u88AB\u6D4F\u89C8\u5668\u5C01\u7981\uFF0C\u8BF7\u9009\u62E9\u5176\u4ED6\u7AEF\u53E3`);
@@ -214,11 +310,16 @@ async function startDevServer(root, opts = {}) {
     cacheDir: opts.cacheDir ?? join(
       tmpdir(),
       "band-dev",
-      createHash("sha256").update(workshop.root).digest("hex").slice(0, 12)
+      createHash2("sha256").update(workshop.root).digest("hex").slice(0, 12)
     ),
     logLevel: opts.logLevel ?? "info",
     clearScreen: false,
-    plugins: [bandDevPlugin(workshop.root, workshop)],
+    // 密钥守卫排第一：它的中间件要先于一切（含 Vite 自己的）
+    plugins: [
+      ...upstreamKey === void 0 ? [] : [upstreamKeyGuard(upstreamKey)],
+      heartbeatPlugin(opts.heartbeatMs ?? 6e4),
+      bandDevPlugin(workshop.root, workshop)
+    ],
     esbuild: { jsx: "automatic" },
     resolve: {
       alias: bundledAliases(),
@@ -233,6 +334,9 @@ async function startDevServer(root, opts = {}) {
       strictPort: false,
       // 插件导入失败由页面列进「没加载的插件」，其余照常；全屏报错层会把整页挡住（缺口 #14）
       hmr: { overlay: false },
+      // 设了上游密钥时请求带的是沙箱 ingress 的域名（`<前缀>-<沙箱标识>.<基础域>`），Vite 的 Host 检查会按 403 拒掉；
+      // 这时门是密钥头，不是 Host（没设密钥的本机运行照旧用 Vite 缺省）。
+      ...upstreamKey === void 0 ? {} : { allowedHosts: true },
       fs: { allow: allowedRoots(workshop.root) }
     }
   });
@@ -268,5 +372,6 @@ export {
   DEV_HOST_DIR,
   bundledAliases,
   bundledPrebundle,
+  sharedImportsIn,
   startDevServer
 };

package/dist/fixture.d.ts

@@ -43,6 +43,17 @@ interface FixtureData {
     stages?: StageRunSummary[];
     gates?: GateState[];
     members?: MemberView[];
+    /**
+     * 项目创建人的用户 id（服务端里创建人就是 owner 角色，天然是管理员）。缺省没有创建人：不从起始身份推，
+     * 否则 `band dev` 这类固定身份的宿主里任何角色都会被当成管理员。`apps/web` 的 `kernelData()` 传
+     * `project.createdBy`，`band dev` 的 dev-host 按 `?role=` 传 `managers`，各自传。
+     */
+    createdBy?: string;
+    /**
+     * 创建人之外的项目管理员（服务端 `members.role` 是 maintainer 的人；dev-host 里按角色参数决定）。
+     * `MemberView.roles` 是业务标签，不是管理角色，不参与。缺省没有管理员。
+     */
+    managers?: string[];
     /** 初始回合状态；缺省没有回合、队列为空。 */
     turn?: TurnState;
     /** 产物列表；缺省按版本里出现过的 artifactId 生成（名字即 id）。 */

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { b as WorkshopRepo, R as ResolvedPlugin, S as SkippedPlugin } from './workshop-repo-CO6YMDee.js';
-export { W as WORKSHOP_FORBIDDEN_IMPORTS, d as WorkshopRepoError, c as checkPlugin, a as checkPluginSources, p as pluginName, r as readPlugin, e as readProfileLocked, f as resolveOfficialPlugins, g as resolveWorkshopRepo } from './workshop-repo-CO6YMDee.js';
+import { b as WorkshopRepo, R as ResolvedPlugin, S as SkippedPlugin } from './workshop-repo-DqoVdcGu.js';
+export { W as WORKSHOP_FORBIDDEN_IMPORTS, d as WorkshopRepoError, c as checkPlugin, a as checkPluginSources, p as pluginName, r as readPlugin, e as readProfileLocked, f as resolveOfficialPlugins, g as resolveWorkshopRepo } from './workshop-repo-DqoVdcGu.js';
 import { LockedRole, StageRunSummary, GateState } from '@kanyun-ai-infra/band-plugin-sdk';
 import { PluginEntry } from './plugin-entry.js';
 import '@kanyun-ai-infra/band-contracts';

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   officialPluginCatalog,
   renderOfficialCatalog,
   writeOfficialCatalog
-} from "./chunk-VVJNG5GV.js";
+} from "./chunk-Q2XJXNVH.js";
 import "./chunk-CL3FV65M.js";
 import {
   DevSetupError,
@@ -18,7 +18,7 @@ import {
   renderDevModule,
   resolveDevWorkshop,
   resolvePluginRepo
-} from "./chunk-RAD6MMSL.js";
+} from "./chunk-XPLYTHNX.js";
 import {
   WORKSHOP_FORBIDDEN_IMPORTS,
   WorkshopRepoError,
@@ -29,7 +29,7 @@ import {
   readProfileLocked,
   resolveOfficialPlugins,
   resolveWorkshopRepo
-} from "./chunk-TN7Z3OF6.js";
+} from "./chunk-LGYGWMSY.js";
 export {
   DevSetupError,
   NewPluginError,

package/dist/vite.d.ts

@@ -1,6 +1,6 @@
 import { LockedRole } from '@kanyun-ai-infra/band-plugin-sdk';
 import { Plugin } from 'vite';
-import { b as WorkshopRepo, R as ResolvedPlugin, S as SkippedPlugin } from './workshop-repo-CO6YMDee.js';
+import { b as WorkshopRepo, R as ResolvedPlugin, S as SkippedPlugin } from './workshop-repo-DqoVdcGu.js';
 import '@kanyun-ai-infra/band-contracts';
 import 'zod';
 

package/dist/vite.js

@@ -4,12 +4,12 @@ import {
 import {
   officialPluginsDir,
   officialProfilePath
-} from "./chunk-RAD6MMSL.js";
+} from "./chunk-XPLYTHNX.js";
 import {
   readProfileLocked,
   resolveOfficialPlugins,
   resolveWorkshopRepo
-} from "./chunk-TN7Z3OF6.js";
+} from "./chunk-LGYGWMSY.js";
 
 // src/vite.ts
 import { existsSync } from "fs";

package/dist/{workshop-repo-CO6YMDee.d.ts → workshop-repo-DqoVdcGu.d.ts}

@@ -38,10 +38,10 @@ interface PayloadSchema {
 declare const StageSchema: z.ZodObject<{
     kind: z.ZodOptional<z.ZodEnum<{
         external: "external";
-        human: "human";
         agent: "agent";
-        workflow: "workflow";
+        human: "human";
         job: "job";
+        workflow: "workflow";
     }>>;
     type: z.ZodOptional<z.ZodEnum<{
         generate: "generate";
@@ -194,13 +194,13 @@ declare const WorkshopSchema: z.ZodObject<{
     }>>>;
     connectors: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodObject<{
         scope: z.ZodEnum<{
-            workshop: "workshop";
             personal: "personal";
+            workshop: "workshop";
             deployment: "deployment";
         }>;
         inTurn: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>, Record<string, {
-        scope: "workshop" | "personal" | "deployment";
+        scope: "personal" | "workshop" | "deployment";
         inTurn?: string[] | undefined;
     }>>>;
     overrides: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodUnknown>, Record<string, unknown>>>;
@@ -216,9 +216,9 @@ declare const WorkshopSchema: z.ZodObject<{
             process: "process";
         }>>;
         storage: z.ZodOptional<z.ZodEnum<{
+            external: "external";
             git: "git";
             store: "store";
-            external: "external";
         }>>;
         exports: z.ZodOptional<z.ZodArray<z.ZodEnum<{
             pdf: "pdf";
@@ -265,10 +265,10 @@ declare const WorkshopSchema: z.ZodObject<{
         stages: z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodObject<{
             kind: z.ZodOptional<z.ZodEnum<{
                 external: "external";
-                human: "human";
                 agent: "agent";
-                workflow: "workflow";
+                human: "human";
                 job: "job";
+                workflow: "workflow";
             }>>;
             type: z.ZodOptional<z.ZodEnum<{
                 generate: "generate";
@@ -516,14 +516,14 @@ declare const WorkshopSchema: z.ZodObject<{
         }>>>;
         surfaces: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>, Record<string, string[]>>>;
         statusLabels: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodEnum<{
+            failed: "failed";
             blocked: "blocked";
             ready: "ready";
             in_progress: "in_progress";
             in_review: "in_review";
             approved: "approved";
             stale: "stale";
-            failed: "failed";
-        }> & z.core.$partial, z.ZodString>, Partial<Record<"blocked" | "ready" | "in_progress" | "in_review" | "approved" | "stale" | "failed", string>>>>;
+        }> & z.core.$partial, z.ZodString>, Partial<Record<"failed" | "blocked" | "ready" | "in_progress" | "in_review" | "approved" | "stale", string>>>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 type WorkshopDef = z.infer<typeof WorkshopSchema>;
@@ -600,7 +600,7 @@ interface CompiledWorkshop {
     agents: Record<string, CompiledAgent>;
     /** 进行中的流程实例钉住这个哈希；新版工坊只影响新项目。 */
     workshopHash: string;
-    /** 1.x 仍接受、2.0 起报错的写法；`band check` 原样打印，不算失败。 */
+    /** 当前仍接受、以后的协议大版本会改成报错的写法；`band check` 原样打印，不算失败。 */
     warnings: string[];
 }
 interface CompileOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kanyun-ai-infra/band-cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "band 命令行：新建、本地调试、校验与发布 Band 工坊和插件",
   "license": "UNLICENSED",
   "type": "module",
@@ -15,7 +15,8 @@
     },
     "./build": {
       "types": "./dist/build-plugin.d.ts",
-      "import": "./dist/build-plugin.js"
+      "import": "./dist/build-plugin.js",
+      "default": "./dist/build-plugin.js"
     },
     "./catalog": {
       "types": "./dist/plugin-entry.d.ts",
@@ -33,6 +34,8 @@
   "files": [
     "dist",
     "dev-host",
+    "src/dev-managers.ts",
+    "src/inspector-plugins.ts",
     "src/load-plugins.ts",
     "bundled"
   ],
@@ -40,12 +43,12 @@
     "node": ">=22.19"
   },
   "dependencies": {
-    "@kanyun-ai-infra/band-contracts": "^0.1.1",
-    "@kanyun-ai-infra/band-plugin-react": "^0.1.1",
-    "@kanyun-ai-infra/band-plugin-sdk": "^1.213.0",
+    "@kanyun-ai-infra/band-contracts": "^0.1.3",
+    "@kanyun-ai-infra/band-plugin-react": "^0.2.0",
+    "@kanyun-ai-infra/band-plugin-sdk": "^2.0.0",
     "es-module-lexer": "^2.3.2",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "semver": "^7.8.5",
     "vite": "^6.0.7",
     "yaml": "^2.6.1",

package/src/dev-managers.ts

@@ -0,0 +1,16 @@
+/**
+ * band dev 的 dev-host 里谁算项目管理员（夹具 `FixtureData.managers`）。
+ *
+ * 与线上同构：只有 owner / maintainer 管项目。不带 `?role=`（或角色不在工坊里）是默认开发身份，按管理员看；
+ * 选了工坊里的业务角色（`?role=teacher` 这类）就是非管理员，预览得到非管理员视图。业务角色不是管理角色。
+ * 不从起始身份推创建人：dev-host 的身份恒为 `dev`，推出来会让任何角色都变成管理员。
+ */
+export function devManagers(
+  roleParam: string | null,
+  workshopRoles: readonly string[],
+  memberId: string,
+): string[] {
+  const picked = roleParam !== null && workshopRoles.includes(roleParam);
+  const manages = !picked || roleParam === "owner" || roleParam === "maintainer";
+  return manages ? [memberId] : [];
+}

package/src/inspector-plugins.ts

@@ -0,0 +1,18 @@
+import type { AssembledPlugin } from "@kanyun-ai-infra/band-plugin-sdk";
+
+/**
+ * `band dev` 宿主自己在运行时里的身份：不贡献任何东西，只为拿一份项目作用域的 ctx。装配里它的 origin 是
+ * official，但它不是官方插件，「夹具」栏不列它。
+ */
+export const DEV_HOST_PLUGIN = "@kanyun-ai-infra/band-dev-host";
+
+/** 「夹具」栏的插件一行：作者自己的插件展开列，官方插件折起来；宿主自己不列。 */
+export function splitInspectorPlugins<P extends Pick<AssembledPlugin, "name" | "origin">>(
+  plugins: P[],
+): { own: P[]; official: P[] } {
+  const listed = plugins.filter((p) => p.name !== DEV_HOST_PLUGIN);
+  return {
+    own: listed.filter((p) => p.origin !== "official"),
+    official: listed.filter((p) => p.origin === "official"),
+  };
+}