@kanyun-ai-infra/band-cli 0.1.1 → 0.2.0

package/bundled/official/workshops/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@kanyun-ai-infra/band-workshops",
-  "version": "0.1.9",
+  "version": "0.2.0",
   "description": "工坊目录、工坊详情、新建项目、新建与复制工坊、工坊设置与对话改工坊九个页面",
   "type": "module",
   "exports": {
     ".": "./dist/index.js"
   },
   "peerDependencies": {
-    "@kanyun-ai-infra/band-plugin-sdk": "^1.222.0",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
+    "@kanyun-ai-infra/band-plugin-sdk": "^2.0.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
     "@kanyun-ai-infra/band-shell": "*"
   }
 }

package/bundled/official/workshops/plugin.yaml

@@ -1,4 +1,4 @@
-# 官方插件：工坊目录、工坊详情、新建项目、新建与复制工坊、工坊设置（v8 §7）。往外壳的 pages 贡献九页：/workshops 目录，
+# 官方插件：工坊目录、工坊详情、新建项目、新建工坊与基于已有工坊新建、工坊设置（v8 §7）。往外壳的 pages 贡献九页：/workshops 目录，
 # /w/<工坊>/about 详情（工坊轻应用的「关于工坊」），/w/<工坊>/new 用这个工坊新建项目，/workshops/new 新建工坊，
 # /workshops/<工坊>/copy 复制这个工坊（不放在 /w/ 下：那一层的第二段是项目短名），/w/<工坊>/about/model 工坊设置 ·
 # 模型，/w/<工坊>/about/secrets 工坊设置 · 密钥，/w/<工坊>/new/resume 从「我的模型与凭据」配好回来后接着新建。旧地址写在 aliases，打开时改写成新地址。
@@ -39,7 +39,7 @@ contributes:
   - slot: "@kanyun-ai-infra/band-shell/pages"
     id: copy
     route: /workshops/:workshop/copy
-    title: 复制工坊
+    title: 基于已有工坊新建
     frame: shell
   # 工坊设置 · 模型（建工坊的第 2 步也是这一页）：/w/<工坊>/about/model，比 about 更具体；部署没开代建时页面写明没有这一步
   - slot: "@kanyun-ai-infra/band-shell/pages"

package/bundled/skills/band-plugin/references/code.md

@@ -44,7 +44,7 @@ export default definePlugin({
 
 - `ctx.version`：`current()` 当前版本（可能是 null），`subscribe` 换版本，`list(artifactId)` 一份产物的全部版本（从旧到新），`readFile(path)`、`objectUrl(path)` 读当前版本的文件（可传 `{ versionId }` 读别的版本）。查看器的 `ctx.version` 钉在正在看的版本上，换版本时整个重挂。
 - `ctx.selection`：本项目里插件共享的选中，`get` / `set` / `subscribe`。五种：`{ kind: "artifact", artifactId }`、`{ kind: "entity", entityType, id, artifactId? }`、`{ kind: "timecode", seconds, end?, artifactId?, path? }`、`{ kind: "anchor", anchor }`、`{ kind: "stage", stage }`。`subscribe` 收到 `{ value, source }`，`source === ctx.plugin` 是自己的回声，跳过；不认识的 `kind` 当作与己无关。插件之间联动只靠它，不要互相 import 状态。
-- `ctx.anchors.make(kind, payload, snapshot?)`：在当前版本上造锚点。内置类型直接写；自己注册的写短名，内核补成 `plugin:<包名>/<kind>`。内置类型的 payload 都要带 `label`，内容在文件里的还要带 `path`，多写字段也算不合写法（1.x 只在控制台警告，2.0 起报错；`shot` 现在就抛错）。自己注册的类型也把 `label` 写进 payload：线程里显示的位置文字取它，`AnchorType.label` 现在没人调用。形状：`entity` 是 `{ path, label, entityType, id, hash?, point? }`，`text-range` 是 `{ path, label, quote: { exact, prefix?, suffix? }, pos?, lines? }`，`region` 是 `{ path, label, rect: { x, y, w, h }, page? }`（0–1 比例），`timecode` 是 `{ path, label, seconds, end?, rect? }`，`shot` 是 `{ path: "storyboard.json", label, shotId, takeId? }`。
+- `ctx.anchors.make(kind, payload, snapshot?)`：在当前版本上造锚点。内置类型直接写；自己注册的写短名，内核补成 `plugin:<包名>/<kind>`。内置类型的 payload 都要带 `label`，内容在文件里的还要带 `path`，多写字段也算不合写法（当前只在控制台警告，以后的协议大版本会改成报错；`shot` 现在就抛错）。自己注册的类型也把 `label` 写进 payload：线程里显示的位置文字取它，`AnchorType.label` 现在没人调用。形状：`entity` 是 `{ path, label, entityType, id, hash?, point? }`，`text-range` 是 `{ path, label, quote: { exact, prefix?, suffix? }, pos?, lines? }`，`region` 是 `{ path, label, rect: { x, y, w, h }, page? }`（0–1 比例），`timecode` 是 `{ path, label, seconds, end?, rect? }`，`shot` 是 `{ path: "storyboard.json", label, shotId, takeId? }`。
 - `ctx.threads.list(filter)` 读线程；`ctx.threads.openAt(anchor, { draft, handToAgent, intent })` 请锁定的评论框在锚点上打开（`intent` 只有 `"pick"`：镜头候选上「用这条」，锚点是带 `takeId` 的 `shot`）；`ctx.threads.open(id)` 打开已有线程。插件不能自己建线程。
 - 引用：`ctx.threads.quote(threadId, commentId)` 把一条消息、`ctx.threads.quoteAnchor(anchor)` 把一处位置作为引用放进发送框，都不发送。
 - `ctx.gate.open(stage, key?)` 请批准面板打开；`ctx.stages.list / get / start / rerun / rerunWith` 读写阶段运行。
@@ -55,4 +55,4 @@ export default definePlugin({
 - `ctx.events.subscribe("thread.*", fn)`：按类型或前缀订阅事件。事件名以 `EVENT_TYPES`（`@kanyun-ai-infra/band-plugin-sdk` 导出）为准；关心意见就订 `EVENT_GROUPS.threads`（含评论、改动请求、回合），关心流程就订 `EVENT_GROUPS.stages`，别只订 `thread.*`。
 - 打开停靠位：`(ctx.services.get("@kanyun-ai-infra/band-project/dock") as { open(key: string): void }).open("<包名>/<停靠位 id>")`。工具栏按钮写了 `dock` 的，查看器替你开。
 - `ctx.member`（`can("comment")` 判能不能提意见）、`ctx.params`、`ctx.plugin`（本插件的包名）。
-- 只给官方插件、工坊插件拿到 `undefined` 的：`notify`、`approvalSettings`、`memberSettings`、`visibilitySettings`、`artifactShares`、`version.archiveUrl`、`turns.requestStop`、`project.shared`、`project.notices`、`project.upgrade`、`project.remove`；`app.data.write.workshopArchive` 只给部署方案插件。不要写依赖它们的功能。
+- 只给官方插件、工坊插件拿到 `undefined` 的：`notify`、`approvalSettings`、`memberSettings`、`visibilitySettings`、`artifactShares`、`version.archiveUrl`、`turns.requestStop`、`project.shared`、`project.notices`、`project.upgrade`、`project.remove`；`app.data.write.workshopArchive`、`people`（人员目录）只给部署方案插件。不要写依赖它们的功能。

package/bundled/skills/band-plugin/references/manifest.md

@@ -13,7 +13,7 @@
   "keywords": ["数据库", "表格"],
   "type": "module",
   "peerDependencies": {
-    "@kanyun-ai-infra/band-plugin-sdk": "^1.0.0",
+    "@kanyun-ai-infra/band-plugin-sdk": "^2.0.0",
     "@kanyun-ai-infra/band-project": "*",
     "@kanyun-ai-infra/band-viewer-web": "*"
   },
@@ -23,7 +23,7 @@
 
 - 包名带作用域，工坊插件用工坊名（`band new plugin` 取工坊仓库的目录名，去掉 `band-` 前缀）；`@kanyun-ai-infra/band-` 前缀只留给官方插件。
 - `description`（一句话说明）与 `keywords` 显示在插件目录里，人和 Rondo 靠它们挑插件，写上。`"private": true` 表示只在本工坊用；工坊插件不发 npm 包。
-- `peerDependencies` 必须有 `@kanyun-ai-infra/band-plugin-sdk`（协议版本，`^1.0.0`）。往谁的插槽贡献、用谁的服务，就把谁写进来；官方插件还没有对外版本号，写 `"*"`。
+- `peerDependencies` 必须有 `@kanyun-ai-infra/band-plugin-sdk`（协议版本，`^2.0.0`）。往谁的插槽贡献、用谁的服务，就把谁写进来；官方插件还没有对外版本号，写 `"*"`。
 
 `plugin.yaml`：Band 的声明，不写 `name`（顶层写了 `name` 的是已废弃的 0.x 清单，`band check` 直接报错）。
 

package/bundled/skills/band-plugin/references/rules.md

@@ -6,6 +6,7 @@
 - **异步要防乱序**：换版本、切环境时旧请求的结果可能晚到。每次加载记一个序号，结果回来时对不上就丢掉；读不到新数据时清空界面，不留旧数据（尤其是带「删除」按钮的表格）。
 - **读不到不抛错**：版本里可能没有你要的文件、JSON 可能坏了。界面显示「这个版本没有……」，锚点解析返回 null。
 - **路径参数要编码**：`ctx.resources.fetch` 的 path 里拼进去的 id 用 `encodeURIComponent`。
+- **选人/选产物、标签、列表筛选、回执用现成组件**：`@kanyun-ai-infra/band-plugin-react` 导出 `Combobox`（可搜索单选/多选，受控 `items`/`value`/`onChange`，`label` 必写）、`TagInput`（字符串数组，回车或逗号确认、粘贴拆开、重复提示）、`FilterMenu` + `filterRows`（按几个单值维度筛，带计数）、`toast()`（一次性回执，只调不挂 `ToastHost`；失败用 `kind: "bad"` 带「重试」）。不要手写下拉搜索、标签输入、临时提示条。设置与表单里的保存反馈不弹 toast。详见用户文档「用 React 写插件」与 Band Design 站「组件」。
 - **样式只用 Band Design token**：页面提供 `--panel`、`--ink`、`--muted`、`--accent`、`--r-lg` 等 CSS 变量，插件里不写死颜色，类名带插件名前缀。琥珀色（`--warn*`）只给部署方案装的插件（锁定插件、应用级页面）用，工坊插件不用。
 - **工坊页面跟工坊最新发布走，项目页跟项目钉住的版本走**：同一工坊里两者可能是不同版本的插件代码。页面里不要假设项目页的面板、服务是同一版；页面只读本工坊的应用数据（`ctx.app.data` 已固定在本工坊，没有 `write`）。路由只写 `/w/:workshop/x/<页面>`，不写 `aliases`、`opens`。
 - **不放凭据**：接口身份由 Band 代理注入，插件代码和仓库里都不出现 token、连接串。

package/bundled/skills/band-plugin/references/testing-publish.md

@@ -32,4 +32,4 @@ bed.dispose();
 
 `band publish <工坊仓库目录> --url <Band 服务地址> --workshop <id>` 先校验并要求工作区干净，用作者的 git 凭据推送远端同名分支（须与工坊发布分支一致），再用 `BAND_TOKEN` 的 Bearer 身份只调一次 POST releases，不调用工坊 GET。`--workshop` 必填，id 从工坊页地址 `/w/<id>` 获取。可 `--no-push` 跳过推送。不要将 token 写进工坊仓库或命令文本；真实服务发布依赖平台 token 功能，缺少鉴权时继续用页面。构建命令与带依赖预设在生产隔离端口未装配前仍关闭。
 
-`band preview [分支] --workshop <id> [--project <项目 id>]`：把已 push 的分支建成预览快照（只读工坊仓库、不发新版本），带 `--project` 时打印 `?preview=` 的项目链接，只有工坊管理员能打开；token 要 `workshops:preview` scope。预览页的写入会落到真实项目。
+`band preview [分支] --workshop <id> [--project <项目 id>]`：把已 push 的分支建成预览快照（只读工坊仓库、不发新版本），带 `--project` 时打印 `?preview=` 的项目链接，只有工坊管理员能打开；token 要 `workshops:preview` scope。预览页的写入会落到打开的那个项目（试用项目就落在试用项目里）。

package/bundled/skills/band-plugin/templates/panel/package.json

@@ -6,7 +6,7 @@
   "keywords": ["示例"],
   "type": "module",
   "peerDependencies": {
-    "@kanyun-ai-infra/band-plugin-sdk": "^1.0.0",
+    "@kanyun-ai-infra/band-plugin-sdk": "^2.0.0",
     "@kanyun-ai-infra/band-project": "*"
   }
 }

package/dev-host/app.tsx

@@ -34,6 +34,7 @@ import "./host.css";
 import * as dev from "virtual:band-dev";
 import { useEffect, useRef, useState } from "react";
 import { createRoot } from "react-dom/client";
+import { devManagers } from "../src/dev-managers.ts";
 import { DEV_HOST_PLUGIN } from "../src/inspector-plugins.ts";
 import { loadPlugins } from "../src/load-plugins.ts";
 import { Inspector } from "./Inspector.tsx";
@@ -117,11 +118,14 @@ async function boot() {
         }
       : base;
   const fixture = withStageDefs(withArtifacts(dev.fixture));
-  const transport = createFixtureTransport(fixture, {
-    actor: { kind: "human", id: member.id },
-    defaultAgent: dev.agent,
-    resources: dev.resources,
-  });
+  const transport = createFixtureTransport(
+    { ...fixture, managers: devManagers(roleParam, dev.roles, member.id) },
+    {
+      actor: { kind: "human", id: member.id },
+      defaultAgent: dev.agent,
+      resources: dev.resources,
+    },
+  );
 
   // 插件入口并行导入；一个失败只让它进「没加载的插件」
   const official: LoadedPlugin[] = [];

package/dist/bin.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   main
-} from "./chunk-VTAJX7NN.js";
+} from "./chunk-Q2XJXNVH.js";
 import "./chunk-CL3FV65M.js";
-import "./chunk-JWZU3NOD.js";
-import "./chunk-TQHHHXXU.js";
+import "./chunk-XPLYTHNX.js";
+import "./chunk-LGYGWMSY.js";
 
 // src/bin.ts
 process.exitCode = await main(process.argv.slice(2));

package/dist/build-plugin.d.ts

@@ -1,5 +1,5 @@
 export { SHARED_MODULES } from '@kanyun-ai-infra/band-plugin-sdk';
-export { W as WORKSHOP_FORBIDDEN_IMPORTS, c as checkPlugin, a as checkPluginSources } from './workshop-repo-Uq6blxyt.js';
+export { W as WORKSHOP_FORBIDDEN_IMPORTS, c as checkPlugin, a as checkPluginSources } from './workshop-repo-DqoVdcGu.js';
 import '@kanyun-ai-infra/band-contracts';
 import 'zod';
 

package/dist/build-plugin.js

@@ -2,7 +2,7 @@ import {
   WORKSHOP_FORBIDDEN_IMPORTS,
   checkPlugin,
   checkPluginSources
-} from "./chunk-TQHHHXXU.js";
+} from "./chunk-LGYGWMSY.js";
 
 // src/build-plugin.ts
 import { mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync } from "fs";

package/dist/{chunk-TQHHHXXU.js → chunk-LGYGWMSY.js}

@@ -442,7 +442,7 @@ var ROLE_PERMISSIONS = [
   "confirm",
   "approve",
   "publish",
-  /** @deprecated 管理权限由服务端的工坊与项目成员管理角色决定（`workshop_members`、`members.role`），这里照常校验但不起作用，`band check` 告警；2.0 起拒绝。 */
+  /** @deprecated 管理权限由服务端的工坊与项目成员管理角色决定（`workshop_members`、`members.role`），这里照常校验但不起作用，`band check` 告警；以后的协议大版本会改成拒绝。 */
   "admin"
 ];
 var RolePermissions = z2.array(z2.enum(ROLE_PERMISSIONS));
@@ -539,7 +539,7 @@ var WorkshopSchema = z2.object({
    * 工坊的缺省 agent（1.11.0），缺省 `rondo`；agent 阶段写了 `agent` 就用阶段的（owner 11-02 启用阶段级 agent，
    * [note](../../../.agents/notes/proposed/architecture/2026-10-27-single-agent-per-flow.md) 的部分取代头）。
    * 写工坊项目里的 agent slug；阶段级 `agent` 覆盖它。`{ hubProject, slug }`（1.18.0）已弃用：1.x 照收并给告警，
-   * 解析出同一个 agent，2.0 起报错。
+   * 解析出同一个 agent，以后的协议大版本会改成报错。
    */
   agent: z2.union([Name, AgentRefSchema]).optional(),
   /**
@@ -555,9 +555,9 @@ var WorkshopSchema = z2.object({
    * 决定 3）。这里只认字段；发布检查与派发在服务端读它。
    */
   userModelKey: z2.enum(["off", "allow", "require"]).optional(),
-  /** 已弃用：工坊只复制、不继承。1.x 照旧合并并给警告，2.0 起报错；`overrides` 同。 */
+  /** 已弃用：工坊只复制、不继承。1.x 照旧合并并给警告，以后的协议大版本会改成报错；`overrides` 同。 */
   extends: z2.string().min(1).optional(),
-  /** 已弃用：迭代方式写在 `repos.<名>.iteration` 上。1.x 只在没写 `repos` 时接受并给警告（不再起作用），2.0 起报错。 */
+  /** 已弃用：迭代方式写在 `repos.<名>.iteration` 上。1.x 只在没写 `repos` 时接受并给警告（不再起作用），以后的协议大版本会改成报错。 */
   iteration: IterationSchema.optional(),
   repos: recordSchema2(Name, RepoSchema).optional(),
   connectors: recordSchema2(Name, WorkshopConnectorSchema).optional(),
@@ -847,17 +847,17 @@ function inferConcept(s, kind, at, warnings) {
     case "human":
       if (s.gate !== void 0) return "check";
       warnings.push(
-        `${at}: human \u9636\u6BB5\u65E2\u6CA1\u5199 produces \u4E5F\u6CA1\u5199\u95E8\u7981\uFF0C\u65E0\u4E8B\u53EF\u505A\uFF1B\u8981\u4EBA\u4EA4\u4E1C\u897F\u5199 produces\uFF08type: collect\uFF09\uFF0C\u8981\u4EBA\u9A8C\u5199\u95E8\u7981\uFF08type: review\uFF09\u30022.0 \u8D77\u62A5\u9519`
+        `${at}: human \u9636\u6BB5\u65E2\u6CA1\u5199 produces \u4E5F\u6CA1\u5199\u95E8\u7981\uFF0C\u65E0\u4E8B\u53EF\u505A\uFF1B\u8981\u4EBA\u4EA4\u4E1C\u897F\u5199 produces\uFF08type: collect\uFF09\uFF0C\u8981\u4EBA\u9A8C\u5199\u95E8\u7981\uFF08type: review\uFF09\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
       );
       return "produce";
     case "agent":
       warnings.push(
-        `${at}: agent \u9636\u6BB5\u6CA1\u5199 produces\uFF0C1.x \u5F53\u4EA7\u51FA\u9636\u6BB5\u5904\u7406\uFF0C\u4EA7\u7269\u7C7B\u578B\u7B49\u4EA4\u4ED8\u65F6\u5B9A\uFF1B\u8865\u4E0A produces\uFF0C\u6216\u5199 type\uFF08\u4EA7\u51FA\u5199 generate\uFF09\u30022.0 \u8D77\u62A5\u9519`
+        `${at}: agent \u9636\u6BB5\u6CA1\u5199 produces\uFF0C\u5F53\u524D\u5F53\u4EA7\u51FA\u9636\u6BB5\u5904\u7406\uFF0C\u4EA7\u7269\u7C7B\u578B\u7B49\u4EA4\u4ED8\u65F6\u5B9A\uFF1B\u8865\u4E0A produces\uFF0C\u6216\u5199 type\uFF08\u4EA7\u51FA\u5199 generate\uFF09\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
       );
       return "produce";
     case "external":
       warnings.push(
-        `${at}: external \u9636\u6BB5\u6CA1\u5199 produces\uFF0C1.x \u5F53\u4EA7\u51FA\u9636\u6BB5\u5904\u7406\uFF0C\u4EA7\u7269\u7C7B\u578B\u7B49\u5916\u90E8\u56DE\u8C03\u65F6\u5B9A\uFF1B\u8865\u4E0A produces\uFF0C\u6216\u5199 type\uFF08\u4EA7\u51FA\u5199 generate\uFF0C\u53D1\u5E03\u5199 publish\uFF0C\u68C0\u6D4B\u5199 check\uFF09\u30022.0 \u8D77\u62A5\u9519`
+        `${at}: external \u9636\u6BB5\u6CA1\u5199 produces\uFF0C\u5F53\u524D\u5F53\u4EA7\u51FA\u9636\u6BB5\u5904\u7406\uFF0C\u4EA7\u7269\u7C7B\u578B\u7B49\u5916\u90E8\u56DE\u8C03\u65F6\u5B9A\uFF1B\u8865\u4E0A produces\uFF0C\u6216\u5199 type\uFF08\u4EA7\u51FA\u5199 generate\uFF0C\u53D1\u5E03\u5199 publish\uFF0C\u68C0\u6D4B\u5199 check\uFF09\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
       );
       return "produce";
   }
@@ -1388,12 +1388,12 @@ function compileWorkshop(input, options = {}) {
   checkConnectors(def, options.connectors, issues, warnings);
   if (isPlainObject(input) && (input.extends !== void 0 || input.overrides !== void 0))
     warnings.push(
-      "extends / overrides: \u5DF2\u5F03\u7528\uFF0C\u5DE5\u574A\u53EA\u590D\u5236\u3001\u4E0D\u7EE7\u627F\uFF1B\u8981\u5728\u522B\u7684\u5DE5\u574A\u4E0A\u6539\uFF0C\u5230\u5B83\u7684\u8BE6\u60C5\u9875\u70B9\u300C\u590D\u5236\u4E00\u4EFD\u300D\uFF0C\u4E4B\u540E\u4E24\u8FB9\u5404\u6539\u5404\u7684\u30022.0 \u8D77\u62A5\u9519"
+      "extends / overrides: \u5DF2\u5F03\u7528\uFF0C\u5DE5\u574A\u53EA\u590D\u5236\u3001\u4E0D\u7EE7\u627F\uFF1B\u8981\u5728\u522B\u7684\u5DE5\u574A\u4E0A\u6539\uFF0C\u5230\u5B83\u7684\u8BE6\u60C5\u9875\u70B9\u300C\u590D\u5236\u4E00\u4EFD\u300D\uFF0C\u4E4B\u540E\u4E24\u8FB9\u5404\u6539\u5404\u7684\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519"
     );
   for (const [name, role] of Object.entries(def.roles ?? {}))
     if (permissionsOf(role).includes("admin"))
       warnings.push(
-        `roles.${name}: admin \u6743\u9650\u5DF2\u5F03\u7528\uFF0C\u5199\u4E86\u4E0D\u8D77\u4F5C\u7528\uFF1B\u7BA1\u7406\u6743\u9650\u6539\u7531\u5DE5\u574A\u4E0E\u9879\u76EE\u7684\u7BA1\u7406\u89D2\u8272\u7ED9\uFF08\u5DE5\u574A\u6210\u5458 workshop_members\u3001\u9879\u76EE\u6210\u5458 members.role\uFF09\u30022.0 \u8D77\u62A5\u9519`
+        `roles.${name}: admin \u6743\u9650\u5DF2\u5F03\u7528\uFF0C\u5199\u4E86\u4E0D\u8D77\u4F5C\u7528\uFF1B\u7BA1\u7406\u6743\u9650\u6539\u7531\u5DE5\u574A\u4E0E\u9879\u76EE\u7684\u7BA1\u7406\u89D2\u8272\u7ED9\uFF08\u5DE5\u574A\u6210\u5458 workshop_members\u3001\u9879\u76EE\u6210\u5458 members.role\uFF09\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
       );
   const types = def.artifactTypes ?? {};
   const repos = compileRepos(def, options, issues, warnings);
@@ -1492,14 +1492,14 @@ function compileWorkshop(input, options = {}) {
         const reservedFor = d.artifactType ? reservedTypeUse(d.artifactType) : void 0;
         if (d.artifactType && d.artifactType !== PASS_ARTIFACT_TYPE && reservedFor !== void 0) {
           warnings.push(
-            `${at}.needs: ${d.stage}:${d.artifactType} \u6307\u5411\u5E73\u53F0\u4FDD\u7559\u540D\uFF08${reservedFor}\uFF09\uFF1B\u7ED9\u5DE5\u574A\u7684\u4EA7\u7269\u7C7B\u578B\u6362\u4E2A\u540D\u5B57\u30022.0 \u8D77\u62A5\u9519`
+            `${at}.needs: ${d.stage}:${d.artifactType} \u6307\u5411\u5E73\u53F0\u4FDD\u7559\u540D\uFF08${reservedFor}\uFF09\uFF1B\u7ED9\u5DE5\u574A\u7684\u4EA7\u7269\u7C7B\u578B\u6362\u4E2A\u540D\u5B57\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
           );
         }
       }
       for (const w of bypasses(stages, st)) warnings.push(`${at}.needs: ${w}`);
       if (st.concept === "check" && st.deps.length === 0) {
         warnings.push(
-          `${at}: \u68C0\u67E5\u9636\u6BB5\u6CA1\u5199 needs\uFF0C\u6CA1\u6709\u4E1C\u897F\u53EF\u9A8C\uFF0C\u4E0D\u51FA\u5019\u9009\u4E5F\u4E0D\u53D1\u4EFB\u52A1\uFF1B\u5199\u4E0A\u8981\u9A8C\u7684\u4E0A\u6E38\u9636\u6BB5\u30022.0 \u8D77\u62A5\u9519`
+          `${at}: \u68C0\u67E5\u9636\u6BB5\u6CA1\u5199 needs\uFF0C\u6CA1\u6709\u4E1C\u897F\u53EF\u9A8C\uFF0C\u4E0D\u51FA\u5019\u9009\u4E5F\u4E0D\u53D1\u4EFB\u52A1\uFF1B\u5199\u4E0A\u8981\u9A8C\u7684\u4E0A\u6E38\u9636\u6BB5\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
         );
       }
       if (st.concept === "check" && st.fanOut !== void 0) {
@@ -1639,7 +1639,7 @@ function compileWorkshop(input, options = {}) {
   warnNonAgentStageAgent(workflows, warnings);
   if (typeof def.agent === "object")
     warnings.push(
-      `agent: { hubProject, slug } \u5199\u6CD5\u5DF2\u5F03\u7528\uFF1B\u5DE5\u574A\u7EA7 agent \u76F4\u63A5\u5199\u5DE5\u574A\u9879\u76EE\u91CC\u7684 agent slug\uFF08agent: ${def.agent.slug}\uFF09\uFF0C\u9636\u6BB5\u7EA7 agent \u8986\u76D6\u5B83\u3002\u6539\u5199\u540E\u8FD9\u4E2A agent \u8981\u5728 agents \u91CC\u58F0\u660E\uFF0C\u4E14\u4E0D\u518D\u6309\u539F hubProject \u6D3E\u53D1\u30022.0 \u8D77\u62A5\u9519`
+      `agent: { hubProject, slug } \u5199\u6CD5\u5DF2\u5F03\u7528\uFF1B\u5DE5\u574A\u7EA7 agent \u76F4\u63A5\u5199\u5DE5\u574A\u9879\u76EE\u91CC\u7684 agent slug\uFF08agent: ${def.agent.slug}\uFF09\uFF0C\u9636\u6BB5\u7EA7 agent \u8986\u76D6\u5B83\u3002\u6539\u5199\u540E\u8FD9\u4E2A agent \u8981\u5728 agents \u91CC\u58F0\u660E\uFF0C\u4E14\u4E0D\u518D\u6309\u539F hubProject \u6D3E\u53D1\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
     );
   const agents = compileAgents(
     def,
@@ -1777,7 +1777,7 @@ function compileRepos(def, options, issues, warnings) {
       issues.push("iteration: \u8FED\u4EE3\u65B9\u5F0F\u5199\u5728 repos.<\u540D>.iteration \u4E0A\uFF0C\u5DE5\u574A\u7EA7\u7684 iteration \u5220\u6389");
     } else {
       warnings.push(
-        "iteration: \u5DF2\u5F03\u7528\uFF0C\u4E0D\u518D\u8D77\u4F5C\u7528\uFF08\u5DE5\u574A\u4ED3\u5E93\u4E0D\u653E\u4EA7\u7269\uFF0C\u4E5F\u6CA1\u6709\u9879\u76EE\u5206\u652F\uFF09\uFF1B\u8981\u63D0\u4EA4\u4EE3\u7801\u7684\u4EA7\u7269\u5199\u5230 repos \u58F0\u660E\u7684\u76EE\u6807\u4ED3\u5E93\uFF0Citeration \u5199\u5728 repos.<\u540D> \u4E0A\u30022.0 \u8D77\u62A5\u9519"
+        "iteration: \u5DF2\u5F03\u7528\uFF0C\u4E0D\u518D\u8D77\u4F5C\u7528\uFF08\u5DE5\u574A\u4ED3\u5E93\u4E0D\u653E\u4EA7\u7269\uFF0C\u4E5F\u6CA1\u6709\u9879\u76EE\u5206\u652F\uFF09\uFF1B\u8981\u63D0\u4EA4\u4EE3\u7801\u7684\u4EA7\u7269\u5199\u5230 repos \u58F0\u660E\u7684\u76EE\u6807\u4ED3\u5E93\uFF0Citeration \u5199\u5728 repos.<\u540D> \u4E0A\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519"
       );
     }
   }
@@ -1819,7 +1819,9 @@ function compileRepos(def, options, issues, warnings) {
 function checkSurfaces(def, warnings) {
   const surfaces = def.views?.surfaces;
   if (surfaces === void 0) return;
-  warnings.push("views.surfaces: 1.x \u91CC\u8FD8\u6CA1\u6709\u6E32\u67D3\uFF0C\u5199\u4E86\u4E0D\u8D77\u4F5C\u7528\uFF1B\u5F62\u72B6\u5F85\u5B9A\uFF0C2.0 \u8D77\u6309 schema \u6821\u9A8C");
+  warnings.push(
+    "views.surfaces: \u5F53\u524D\u8FD8\u6CA1\u6709\u6E32\u67D3\uFF0C\u5199\u4E86\u4E0D\u8D77\u4F5C\u7528\uFF1B\u5F62\u72B6\u5F85\u5B9A\uFF0C\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6309 schema \u6821\u9A8C"
+  );
   for (const [name, fields] of Object.entries(surfaces)) {
     const at = `views.surfaces.${name}`;
     if (!/^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(name))
@@ -1877,7 +1879,7 @@ function checkArtifactTypes(def, repos, issues, warnings) {
     const reservedFor = reservedTypeUse(name);
     if (reservedFor !== void 0) {
       warnings.push(
-        `${at}: ${name} \u662F\u5E73\u53F0\u4FDD\u7559\u7684\u4EA7\u7269\u7C7B\u578B\u540D\uFF08${reservedFor}\uFF09\uFF0C\u6362\u4E2A\u540D\u5B57\u30022.0 \u8D77\u62A5\u9519`
+        `${at}: ${name} \u662F\u5E73\u53F0\u4FDD\u7559\u7684\u4EA7\u7269\u7C7B\u578B\u540D\uFF08${reservedFor}\uFF09\uFF0C\u6362\u4E2A\u540D\u5B57\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
       );
     }
     if (t.role === "process" && t.storage !== void 0 && t.storage !== "store") {
@@ -1901,7 +1903,7 @@ function checkArtifactTypes(def, repos, issues, warnings) {
     }
     if (t.repo === void 0 && t.paths === void 0) {
       warnings.push(
-        `${at}: storage: git \u8981\u5199 repo\uFF08repos \u91CC\u7684\u540D\u5B57\uFF09\u4E0E paths\uFF1B\u6CA1\u5199\u7684\u4EA7\u7269\u6CA1\u6709\u76EE\u6807\u4ED3\u5E93\uFF0C2.0 \u8D77\u62A5\u9519`
+        `${at}: storage: git \u8981\u5199 repo\uFF08repos \u91CC\u7684\u540D\u5B57\uFF09\u4E0E paths\uFF1B\u6CA1\u5199\u7684\u4EA7\u7269\u6CA1\u6709\u76EE\u6807\u4ED3\u5E93\uFF0C\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
       );
       continue;
     }

package/dist/{chunk-VTAJX7NN.js → chunk-Q2XJXNVH.js}

@@ -10,7 +10,7 @@ import {
   officialProfilePath,
   resolvePluginRepo,
   workshopNameOf
-} from "./chunk-JWZU3NOD.js";
+} from "./chunk-XPLYTHNX.js";
 import {
   IMPLICIT_STAGE,
   SELF_CONTAINED_EXTENSIONS,
@@ -29,7 +29,7 @@ import {
   rolePermissions,
   selfContainedProblems,
   workshopFileReader
-} from "./chunk-TQHHHXXU.js";
+} from "./chunk-LGYGWMSY.js";
 
 // src/index.ts
 import { execFileSync } from "child_process";
@@ -310,6 +310,8 @@ function newPlugin(root, name, opts) {
     description: title,
     type: "module",
     peerDependencies: {
+      react: "^19.0.0",
+      "react-dom": "^19.0.0",
       "@kanyun-ai-infra/band-plugin-sdk": `^${BAND_PROTOCOL_VERSION}`,
       [PROJECT]: "*"
     }
@@ -432,6 +434,8 @@ ${t.manifest}`,
         // 不带 --passWithNoTests：收不到测试要红，不吞成绿（band#456）
         scripts: { check: "tsc -p tsconfig.json", test: "vitest run" },
         peerDependencies: {
+          react: "^19.0.0",
+          "react-dom": "^19.0.0",
           "@kanyun-ai-infra/band-plugin-sdk": "workspace:*",
           [PROJECT]: "workspace:*"
         },
@@ -642,7 +646,7 @@ import { parse } from "yaml";
 // package.json
 var package_default = {
   name: "@kanyun-ai-infra/band-cli",
-  version: "0.1.1",
+  version: "0.2.0",
   description: "band \u547D\u4EE4\u884C\uFF1A\u65B0\u5EFA\u3001\u672C\u5730\u8C03\u8BD5\u3001\u6821\u9A8C\u4E0E\u53D1\u5E03 Band \u5DE5\u574A\u548C\u63D2\u4EF6",
   license: "UNLICENSED",
   type: "module",
@@ -657,7 +661,8 @@ var package_default = {
     },
     "./build": {
       types: "./dist/build-plugin.d.ts",
-      import: "./dist/build-plugin.js"
+      import: "./dist/build-plugin.js",
+      default: "./dist/build-plugin.js"
     },
     "./catalog": {
       types: "./dist/plugin-entry.d.ts",
@@ -692,8 +697,8 @@ var package_default = {
     "@kanyun-ai-infra/band-plugin-react": "workspace:^",
     "@kanyun-ai-infra/band-plugin-sdk": "workspace:^",
     "es-module-lexer": "^2.3.2",
-    react: "^18.3.1",
-    "react-dom": "^18.3.1",
+    react: "^19.3.1",
+    "react-dom": "^19.3.1",
     semver: "^7.8.5",
     vite: "^6.0.7",
     yaml: "^2.6.1",
@@ -705,8 +710,8 @@ var package_default = {
     "@kanyun-ai-infra/band-tokens": "workspace:*",
     "@kanyun-ai-infra/band-workshop": "workspace:*",
     "@types/node": "^22.10.0",
-    "@types/react": "^18.3.12",
-    "@types/react-dom": "^18.3.1",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     tsup: "^8.4.0",
     typescript: "5.9.3",
     vitest: "^4.0.17"
@@ -796,6 +801,8 @@ function packageJson(packageName, title) {
     files: ["src", "plugin.yaml", "README.md"],
     scripts: { dev: "band dev .", check: "band check ." },
     peerDependencies: {
+      react: "^19.0.0",
+      "react-dom": "^19.0.0",
       "@kanyun-ai-infra/band-plugin-sdk": `^${BAND_PROTOCOL_VERSION2}`,
       [PROJECT2]: "*"
     },
@@ -1980,7 +1987,7 @@ async function main(argv) {
     if (cmd === "dev") {
       const { args, flags } = parseArgs(rest, ["port", "host"]);
       const port = flags.port === void 0 ? void 0 : parsePort(flags.port);
-      const { startDevServer } = await import("./dev-server-SB5FMSVP.js");
+      const { startDevServer } = await import("./dev-server-Q7NTJ3QD.js");
       const server = await startDevServer(args[0] ?? ".", {
         ...port !== void 0 ? { port } : {},
         ...flags.host ? { host: flags.host } : {}

package/dist/{chunk-JWZU3NOD.js → chunk-XPLYTHNX.js}

@@ -11,7 +11,7 @@ import {
   resolveWorkshopRepo,
   rolePermissions,
   workshopFileRefs
-} from "./chunk-TQHHHXXU.js";
+} from "./chunk-LGYGWMSY.js";
 
 // src/bundled.ts
 import { existsSync } from "fs";

package/dist/{dev-server-SB5FMSVP.js → dev-server-Q7NTJ3QD.js}

@@ -5,8 +5,8 @@ import {
   bundledDir,
   renderDevModule,
   resolveDevWorkshop
-} from "./chunk-JWZU3NOD.js";
-import "./chunk-TQHHHXXU.js";
+} from "./chunk-XPLYTHNX.js";
+import "./chunk-LGYGWMSY.js";
 
 // src/dev-server.ts
 import { createHash as createHash2 } from "crypto";
@@ -140,15 +140,30 @@ function upstreamKeyGuard(key) {
   return {
     name: "band-upstream-key",
     configureServer(server) {
-      server.middlewares.use((req, res, next) => {
-        if (upstreamKeyMatches(req.headers[UPSTREAM_KEY_HEADER], key)) return next();
+      const deny = (req, res) => {
+        if (req.method === "GET" && req.url === "/") {
+          res.statusCode = 204;
+          res.setHeader("Cache-Control", "no-store");
+          res.end();
+          return;
+        }
         res.statusCode = 403;
         res.setHeader("Content-Type", "text/plain; charset=utf-8");
         res.end("Forbidden");
+      };
+      server.middlewares.use((req, res, next) => {
+        if (upstreamKeyMatches(req.headers[UPSTREAM_KEY_HEADER], key)) return next();
+        deny(req, res);
       });
       const http = server.httpServer;
       if (!http) return;
       const original = http.listeners("upgrade");
+      const originalRequest = http.listeners("request");
+      http.removeAllListeners("request");
+      http.on("request", (req, res) => {
+        if (!upstreamKeyMatches(req.headers[UPSTREAM_KEY_HEADER], key)) return deny(req, res);
+        for (const listener of originalRequest) listener.call(http, req, res);
+      });
       http.removeAllListeners("upgrade");
       http.on("upgrade", (req, socket, head) => {
         if (!upstreamKeyMatches(req.headers[UPSTREAM_KEY_HEADER], key)) return reject(socket);

package/dist/fixture.d.ts

@@ -43,6 +43,17 @@ interface FixtureData {
     stages?: StageRunSummary[];
     gates?: GateState[];
     members?: MemberView[];
+    /**
+     * 项目创建人的用户 id（服务端里创建人就是 owner 角色，天然是管理员）。缺省没有创建人：不从起始身份推，
+     * 否则 `band dev` 这类固定身份的宿主里任何角色都会被当成管理员。`apps/web` 的 `kernelData()` 传
+     * `project.createdBy`，`band dev` 的 dev-host 按 `?role=` 传 `managers`，各自传。
+     */
+    createdBy?: string;
+    /**
+     * 创建人之外的项目管理员（服务端 `members.role` 是 maintainer 的人；dev-host 里按角色参数决定）。
+     * `MemberView.roles` 是业务标签，不是管理角色，不参与。缺省没有管理员。
+     */
+    managers?: string[];
     /** 初始回合状态；缺省没有回合、队列为空。 */
     turn?: TurnState;
     /** 产物列表；缺省按版本里出现过的 artifactId 生成（名字即 id）。 */

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { b as WorkshopRepo, R as ResolvedPlugin, S as SkippedPlugin } from './workshop-repo-Uq6blxyt.js';
-export { W as WORKSHOP_FORBIDDEN_IMPORTS, d as WorkshopRepoError, c as checkPlugin, a as checkPluginSources, p as pluginName, r as readPlugin, e as readProfileLocked, f as resolveOfficialPlugins, g as resolveWorkshopRepo } from './workshop-repo-Uq6blxyt.js';
+import { b as WorkshopRepo, R as ResolvedPlugin, S as SkippedPlugin } from './workshop-repo-DqoVdcGu.js';
+export { W as WORKSHOP_FORBIDDEN_IMPORTS, d as WorkshopRepoError, c as checkPlugin, a as checkPluginSources, p as pluginName, r as readPlugin, e as readProfileLocked, f as resolveOfficialPlugins, g as resolveWorkshopRepo } from './workshop-repo-DqoVdcGu.js';
 import { LockedRole, StageRunSummary, GateState } from '@kanyun-ai-infra/band-plugin-sdk';
 import { PluginEntry } from './plugin-entry.js';
 import '@kanyun-ai-infra/band-contracts';

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   officialPluginCatalog,
   renderOfficialCatalog,
   writeOfficialCatalog
-} from "./chunk-VTAJX7NN.js";
+} from "./chunk-Q2XJXNVH.js";
 import "./chunk-CL3FV65M.js";
 import {
   DevSetupError,
@@ -18,7 +18,7 @@ import {
   renderDevModule,
   resolveDevWorkshop,
   resolvePluginRepo
-} from "./chunk-JWZU3NOD.js";
+} from "./chunk-XPLYTHNX.js";
 import {
   WORKSHOP_FORBIDDEN_IMPORTS,
   WorkshopRepoError,
@@ -29,7 +29,7 @@ import {
   readProfileLocked,
   resolveOfficialPlugins,
   resolveWorkshopRepo
-} from "./chunk-TQHHHXXU.js";
+} from "./chunk-LGYGWMSY.js";
 export {
   DevSetupError,
   NewPluginError,

package/dist/vite.d.ts

@@ -1,6 +1,6 @@
 import { LockedRole } from '@kanyun-ai-infra/band-plugin-sdk';
 import { Plugin } from 'vite';
-import { b as WorkshopRepo, R as ResolvedPlugin, S as SkippedPlugin } from './workshop-repo-Uq6blxyt.js';
+import { b as WorkshopRepo, R as ResolvedPlugin, S as SkippedPlugin } from './workshop-repo-DqoVdcGu.js';
 import '@kanyun-ai-infra/band-contracts';
 import 'zod';
 

package/dist/vite.js

@@ -4,12 +4,12 @@ import {
 import {
   officialPluginsDir,
   officialProfilePath
-} from "./chunk-JWZU3NOD.js";
+} from "./chunk-XPLYTHNX.js";
 import {
   readProfileLocked,
   resolveOfficialPlugins,
   resolveWorkshopRepo
-} from "./chunk-TQHHHXXU.js";
+} from "./chunk-LGYGWMSY.js";
 
 // src/vite.ts
 import { existsSync } from "fs";

package/dist/{workshop-repo-Uq6blxyt.d.ts → workshop-repo-DqoVdcGu.d.ts}

@@ -37,9 +37,9 @@ interface PayloadSchema {
 }
 declare const StageSchema: z.ZodObject<{
     kind: z.ZodOptional<z.ZodEnum<{
-        human: "human";
         external: "external";
         agent: "agent";
+        human: "human";
         job: "job";
         workflow: "workflow";
     }>>;
@@ -194,13 +194,13 @@ declare const WorkshopSchema: z.ZodObject<{
     }>>>;
     connectors: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodObject<{
         scope: z.ZodEnum<{
-            workshop: "workshop";
             personal: "personal";
+            workshop: "workshop";
             deployment: "deployment";
         }>;
         inTurn: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>, Record<string, {
-        scope: "workshop" | "personal" | "deployment";
+        scope: "personal" | "workshop" | "deployment";
         inTurn?: string[] | undefined;
     }>>>;
     overrides: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodUnknown>, Record<string, unknown>>>;
@@ -264,9 +264,9 @@ declare const WorkshopSchema: z.ZodObject<{
     workflows: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodObject<{
         stages: z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodObject<{
             kind: z.ZodOptional<z.ZodEnum<{
-                human: "human";
                 external: "external";
                 agent: "agent";
+                human: "human";
                 job: "job";
                 workflow: "workflow";
             }>>;
@@ -517,13 +517,13 @@ declare const WorkshopSchema: z.ZodObject<{
         surfaces: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>, Record<string, string[]>>>;
         statusLabels: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodEnum<{
             failed: "failed";
-            ready: "ready";
-            approved: "approved";
-            stale: "stale";
             blocked: "blocked";
+            ready: "ready";
             in_progress: "in_progress";
             in_review: "in_review";
-        }> & z.core.$partial, z.ZodString>, Partial<Record<"failed" | "ready" | "approved" | "stale" | "blocked" | "in_progress" | "in_review", string>>>>;
+            approved: "approved";
+            stale: "stale";
+        }> & z.core.$partial, z.ZodString>, Partial<Record<"failed" | "blocked" | "ready" | "in_progress" | "in_review" | "approved" | "stale", string>>>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 type WorkshopDef = z.infer<typeof WorkshopSchema>;
@@ -600,7 +600,7 @@ interface CompiledWorkshop {
     agents: Record<string, CompiledAgent>;
     /** 进行中的流程实例钉住这个哈希；新版工坊只影响新项目。 */
     workshopHash: string;
-    /** 1.x 仍接受、2.0 起报错的写法；`band check` 原样打印，不算失败。 */
+    /** 当前仍接受、以后的协议大版本会改成报错的写法；`band check` 原样打印，不算失败。 */
     warnings: string[];
 }
 interface CompileOptions {