@kanyun-ai-infra/band-cli 0.1.1 → 0.2.1

package/dist/{chunk-TQHHHXXU.js → chunk-LGYGWMSY.js}

@@ -442,7 +442,7 @@ var ROLE_PERMISSIONS = [
   "confirm",
   "approve",
   "publish",
-  /** @deprecated 管理权限由服务端的工坊与项目成员管理角色决定（`workshop_members`、`members.role`），这里照常校验但不起作用，`band check` 告警；2.0 起拒绝。 */
+  /** @deprecated 管理权限由服务端的工坊与项目成员管理角色决定（`workshop_members`、`members.role`），这里照常校验但不起作用，`band check` 告警；以后的协议大版本会改成拒绝。 */
   "admin"
 ];
 var RolePermissions = z2.array(z2.enum(ROLE_PERMISSIONS));
@@ -539,7 +539,7 @@ var WorkshopSchema = z2.object({
    * 工坊的缺省 agent（1.11.0），缺省 `rondo`；agent 阶段写了 `agent` 就用阶段的（owner 11-02 启用阶段级 agent，
    * [note](../../../.agents/notes/proposed/architecture/2026-10-27-single-agent-per-flow.md) 的部分取代头）。
    * 写工坊项目里的 agent slug；阶段级 `agent` 覆盖它。`{ hubProject, slug }`（1.18.0）已弃用：1.x 照收并给告警，
-   * 解析出同一个 agent，2.0 起报错。
+   * 解析出同一个 agent，以后的协议大版本会改成报错。
    */
   agent: z2.union([Name, AgentRefSchema]).optional(),
   /**
@@ -555,9 +555,9 @@ var WorkshopSchema = z2.object({
    * 决定 3）。这里只认字段；发布检查与派发在服务端读它。
    */
   userModelKey: z2.enum(["off", "allow", "require"]).optional(),
-  /** 已弃用：工坊只复制、不继承。1.x 照旧合并并给警告，2.0 起报错；`overrides` 同。 */
+  /** 已弃用：工坊只复制、不继承。1.x 照旧合并并给警告，以后的协议大版本会改成报错；`overrides` 同。 */
   extends: z2.string().min(1).optional(),
-  /** 已弃用：迭代方式写在 `repos.<名>.iteration` 上。1.x 只在没写 `repos` 时接受并给警告（不再起作用），2.0 起报错。 */
+  /** 已弃用：迭代方式写在 `repos.<名>.iteration` 上。1.x 只在没写 `repos` 时接受并给警告（不再起作用），以后的协议大版本会改成报错。 */
   iteration: IterationSchema.optional(),
   repos: recordSchema2(Name, RepoSchema).optional(),
   connectors: recordSchema2(Name, WorkshopConnectorSchema).optional(),
@@ -847,17 +847,17 @@ function inferConcept(s, kind, at, warnings) {
     case "human":
       if (s.gate !== void 0) return "check";
       warnings.push(
-        `${at}: human \u9636\u6BB5\u65E2\u6CA1\u5199 produces \u4E5F\u6CA1\u5199\u95E8\u7981\uFF0C\u65E0\u4E8B\u53EF\u505A\uFF1B\u8981\u4EBA\u4EA4\u4E1C\u897F\u5199 produces\uFF08type: collect\uFF09\uFF0C\u8981\u4EBA\u9A8C\u5199\u95E8\u7981\uFF08type: review\uFF09\u30022.0 \u8D77\u62A5\u9519`
+        `${at}: human \u9636\u6BB5\u65E2\u6CA1\u5199 produces \u4E5F\u6CA1\u5199\u95E8\u7981\uFF0C\u65E0\u4E8B\u53EF\u505A\uFF1B\u8981\u4EBA\u4EA4\u4E1C\u897F\u5199 produces\uFF08type: collect\uFF09\uFF0C\u8981\u4EBA\u9A8C\u5199\u95E8\u7981\uFF08type: review\uFF09\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
       );
       return "produce";
     case "agent":
       warnings.push(
-        `${at}: agent \u9636\u6BB5\u6CA1\u5199 produces\uFF0C1.x \u5F53\u4EA7\u51FA\u9636\u6BB5\u5904\u7406\uFF0C\u4EA7\u7269\u7C7B\u578B\u7B49\u4EA4\u4ED8\u65F6\u5B9A\uFF1B\u8865\u4E0A produces\uFF0C\u6216\u5199 type\uFF08\u4EA7\u51FA\u5199 generate\uFF09\u30022.0 \u8D77\u62A5\u9519`
+        `${at}: agent \u9636\u6BB5\u6CA1\u5199 produces\uFF0C\u5F53\u524D\u5F53\u4EA7\u51FA\u9636\u6BB5\u5904\u7406\uFF0C\u4EA7\u7269\u7C7B\u578B\u7B49\u4EA4\u4ED8\u65F6\u5B9A\uFF1B\u8865\u4E0A produces\uFF0C\u6216\u5199 type\uFF08\u4EA7\u51FA\u5199 generate\uFF09\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
       );
       return "produce";
     case "external":
       warnings.push(
-        `${at}: external \u9636\u6BB5\u6CA1\u5199 produces\uFF0C1.x \u5F53\u4EA7\u51FA\u9636\u6BB5\u5904\u7406\uFF0C\u4EA7\u7269\u7C7B\u578B\u7B49\u5916\u90E8\u56DE\u8C03\u65F6\u5B9A\uFF1B\u8865\u4E0A produces\uFF0C\u6216\u5199 type\uFF08\u4EA7\u51FA\u5199 generate\uFF0C\u53D1\u5E03\u5199 publish\uFF0C\u68C0\u6D4B\u5199 check\uFF09\u30022.0 \u8D77\u62A5\u9519`
+        `${at}: external \u9636\u6BB5\u6CA1\u5199 produces\uFF0C\u5F53\u524D\u5F53\u4EA7\u51FA\u9636\u6BB5\u5904\u7406\uFF0C\u4EA7\u7269\u7C7B\u578B\u7B49\u5916\u90E8\u56DE\u8C03\u65F6\u5B9A\uFF1B\u8865\u4E0A produces\uFF0C\u6216\u5199 type\uFF08\u4EA7\u51FA\u5199 generate\uFF0C\u53D1\u5E03\u5199 publish\uFF0C\u68C0\u6D4B\u5199 check\uFF09\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
       );
       return "produce";
   }
@@ -1388,12 +1388,12 @@ function compileWorkshop(input, options = {}) {
   checkConnectors(def, options.connectors, issues, warnings);
   if (isPlainObject(input) && (input.extends !== void 0 || input.overrides !== void 0))
     warnings.push(
-      "extends / overrides: \u5DF2\u5F03\u7528\uFF0C\u5DE5\u574A\u53EA\u590D\u5236\u3001\u4E0D\u7EE7\u627F\uFF1B\u8981\u5728\u522B\u7684\u5DE5\u574A\u4E0A\u6539\uFF0C\u5230\u5B83\u7684\u8BE6\u60C5\u9875\u70B9\u300C\u590D\u5236\u4E00\u4EFD\u300D\uFF0C\u4E4B\u540E\u4E24\u8FB9\u5404\u6539\u5404\u7684\u30022.0 \u8D77\u62A5\u9519"
+      "extends / overrides: \u5DF2\u5F03\u7528\uFF0C\u5DE5\u574A\u53EA\u590D\u5236\u3001\u4E0D\u7EE7\u627F\uFF1B\u8981\u5728\u522B\u7684\u5DE5\u574A\u4E0A\u6539\uFF0C\u5230\u5B83\u7684\u8BE6\u60C5\u9875\u70B9\u300C\u590D\u5236\u4E00\u4EFD\u300D\uFF0C\u4E4B\u540E\u4E24\u8FB9\u5404\u6539\u5404\u7684\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519"
     );
   for (const [name, role] of Object.entries(def.roles ?? {}))
     if (permissionsOf(role).includes("admin"))
       warnings.push(
-        `roles.${name}: admin \u6743\u9650\u5DF2\u5F03\u7528\uFF0C\u5199\u4E86\u4E0D\u8D77\u4F5C\u7528\uFF1B\u7BA1\u7406\u6743\u9650\u6539\u7531\u5DE5\u574A\u4E0E\u9879\u76EE\u7684\u7BA1\u7406\u89D2\u8272\u7ED9\uFF08\u5DE5\u574A\u6210\u5458 workshop_members\u3001\u9879\u76EE\u6210\u5458 members.role\uFF09\u30022.0 \u8D77\u62A5\u9519`
+        `roles.${name}: admin \u6743\u9650\u5DF2\u5F03\u7528\uFF0C\u5199\u4E86\u4E0D\u8D77\u4F5C\u7528\uFF1B\u7BA1\u7406\u6743\u9650\u6539\u7531\u5DE5\u574A\u4E0E\u9879\u76EE\u7684\u7BA1\u7406\u89D2\u8272\u7ED9\uFF08\u5DE5\u574A\u6210\u5458 workshop_members\u3001\u9879\u76EE\u6210\u5458 members.role\uFF09\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
       );
   const types = def.artifactTypes ?? {};
   const repos = compileRepos(def, options, issues, warnings);
@@ -1492,14 +1492,14 @@ function compileWorkshop(input, options = {}) {
         const reservedFor = d.artifactType ? reservedTypeUse(d.artifactType) : void 0;
         if (d.artifactType && d.artifactType !== PASS_ARTIFACT_TYPE && reservedFor !== void 0) {
           warnings.push(
-            `${at}.needs: ${d.stage}:${d.artifactType} \u6307\u5411\u5E73\u53F0\u4FDD\u7559\u540D\uFF08${reservedFor}\uFF09\uFF1B\u7ED9\u5DE5\u574A\u7684\u4EA7\u7269\u7C7B\u578B\u6362\u4E2A\u540D\u5B57\u30022.0 \u8D77\u62A5\u9519`
+            `${at}.needs: ${d.stage}:${d.artifactType} \u6307\u5411\u5E73\u53F0\u4FDD\u7559\u540D\uFF08${reservedFor}\uFF09\uFF1B\u7ED9\u5DE5\u574A\u7684\u4EA7\u7269\u7C7B\u578B\u6362\u4E2A\u540D\u5B57\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
           );
         }
       }
       for (const w of bypasses(stages, st)) warnings.push(`${at}.needs: ${w}`);
       if (st.concept === "check" && st.deps.length === 0) {
         warnings.push(
-          `${at}: \u68C0\u67E5\u9636\u6BB5\u6CA1\u5199 needs\uFF0C\u6CA1\u6709\u4E1C\u897F\u53EF\u9A8C\uFF0C\u4E0D\u51FA\u5019\u9009\u4E5F\u4E0D\u53D1\u4EFB\u52A1\uFF1B\u5199\u4E0A\u8981\u9A8C\u7684\u4E0A\u6E38\u9636\u6BB5\u30022.0 \u8D77\u62A5\u9519`
+          `${at}: \u68C0\u67E5\u9636\u6BB5\u6CA1\u5199 needs\uFF0C\u6CA1\u6709\u4E1C\u897F\u53EF\u9A8C\uFF0C\u4E0D\u51FA\u5019\u9009\u4E5F\u4E0D\u53D1\u4EFB\u52A1\uFF1B\u5199\u4E0A\u8981\u9A8C\u7684\u4E0A\u6E38\u9636\u6BB5\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
         );
       }
       if (st.concept === "check" && st.fanOut !== void 0) {
@@ -1639,7 +1639,7 @@ function compileWorkshop(input, options = {}) {
   warnNonAgentStageAgent(workflows, warnings);
   if (typeof def.agent === "object")
     warnings.push(
-      `agent: { hubProject, slug } \u5199\u6CD5\u5DF2\u5F03\u7528\uFF1B\u5DE5\u574A\u7EA7 agent \u76F4\u63A5\u5199\u5DE5\u574A\u9879\u76EE\u91CC\u7684 agent slug\uFF08agent: ${def.agent.slug}\uFF09\uFF0C\u9636\u6BB5\u7EA7 agent \u8986\u76D6\u5B83\u3002\u6539\u5199\u540E\u8FD9\u4E2A agent \u8981\u5728 agents \u91CC\u58F0\u660E\uFF0C\u4E14\u4E0D\u518D\u6309\u539F hubProject \u6D3E\u53D1\u30022.0 \u8D77\u62A5\u9519`
+      `agent: { hubProject, slug } \u5199\u6CD5\u5DF2\u5F03\u7528\uFF1B\u5DE5\u574A\u7EA7 agent \u76F4\u63A5\u5199\u5DE5\u574A\u9879\u76EE\u91CC\u7684 agent slug\uFF08agent: ${def.agent.slug}\uFF09\uFF0C\u9636\u6BB5\u7EA7 agent \u8986\u76D6\u5B83\u3002\u6539\u5199\u540E\u8FD9\u4E2A agent \u8981\u5728 agents \u91CC\u58F0\u660E\uFF0C\u4E14\u4E0D\u518D\u6309\u539F hubProject \u6D3E\u53D1\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
     );
   const agents = compileAgents(
     def,
@@ -1777,7 +1777,7 @@ function compileRepos(def, options, issues, warnings) {
       issues.push("iteration: \u8FED\u4EE3\u65B9\u5F0F\u5199\u5728 repos.<\u540D>.iteration \u4E0A\uFF0C\u5DE5\u574A\u7EA7\u7684 iteration \u5220\u6389");
     } else {
       warnings.push(
-        "iteration: \u5DF2\u5F03\u7528\uFF0C\u4E0D\u518D\u8D77\u4F5C\u7528\uFF08\u5DE5\u574A\u4ED3\u5E93\u4E0D\u653E\u4EA7\u7269\uFF0C\u4E5F\u6CA1\u6709\u9879\u76EE\u5206\u652F\uFF09\uFF1B\u8981\u63D0\u4EA4\u4EE3\u7801\u7684\u4EA7\u7269\u5199\u5230 repos \u58F0\u660E\u7684\u76EE\u6807\u4ED3\u5E93\uFF0Citeration \u5199\u5728 repos.<\u540D> \u4E0A\u30022.0 \u8D77\u62A5\u9519"
+        "iteration: \u5DF2\u5F03\u7528\uFF0C\u4E0D\u518D\u8D77\u4F5C\u7528\uFF08\u5DE5\u574A\u4ED3\u5E93\u4E0D\u653E\u4EA7\u7269\uFF0C\u4E5F\u6CA1\u6709\u9879\u76EE\u5206\u652F\uFF09\uFF1B\u8981\u63D0\u4EA4\u4EE3\u7801\u7684\u4EA7\u7269\u5199\u5230 repos \u58F0\u660E\u7684\u76EE\u6807\u4ED3\u5E93\uFF0Citeration \u5199\u5728 repos.<\u540D> \u4E0A\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519"
       );
     }
   }
@@ -1819,7 +1819,9 @@ function compileRepos(def, options, issues, warnings) {
 function checkSurfaces(def, warnings) {
   const surfaces = def.views?.surfaces;
   if (surfaces === void 0) return;
-  warnings.push("views.surfaces: 1.x \u91CC\u8FD8\u6CA1\u6709\u6E32\u67D3\uFF0C\u5199\u4E86\u4E0D\u8D77\u4F5C\u7528\uFF1B\u5F62\u72B6\u5F85\u5B9A\uFF0C2.0 \u8D77\u6309 schema \u6821\u9A8C");
+  warnings.push(
+    "views.surfaces: \u5F53\u524D\u8FD8\u6CA1\u6709\u6E32\u67D3\uFF0C\u5199\u4E86\u4E0D\u8D77\u4F5C\u7528\uFF1B\u5F62\u72B6\u5F85\u5B9A\uFF0C\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6309 schema \u6821\u9A8C"
+  );
   for (const [name, fields] of Object.entries(surfaces)) {
     const at = `views.surfaces.${name}`;
     if (!/^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(name))
@@ -1877,7 +1879,7 @@ function checkArtifactTypes(def, repos, issues, warnings) {
     const reservedFor = reservedTypeUse(name);
     if (reservedFor !== void 0) {
       warnings.push(
-        `${at}: ${name} \u662F\u5E73\u53F0\u4FDD\u7559\u7684\u4EA7\u7269\u7C7B\u578B\u540D\uFF08${reservedFor}\uFF09\uFF0C\u6362\u4E2A\u540D\u5B57\u30022.0 \u8D77\u62A5\u9519`
+        `${at}: ${name} \u662F\u5E73\u53F0\u4FDD\u7559\u7684\u4EA7\u7269\u7C7B\u578B\u540D\uFF08${reservedFor}\uFF09\uFF0C\u6362\u4E2A\u540D\u5B57\u3002\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
       );
     }
     if (t.role === "process" && t.storage !== void 0 && t.storage !== "store") {
@@ -1901,7 +1903,7 @@ function checkArtifactTypes(def, repos, issues, warnings) {
     }
     if (t.repo === void 0 && t.paths === void 0) {
       warnings.push(
-        `${at}: storage: git \u8981\u5199 repo\uFF08repos \u91CC\u7684\u540D\u5B57\uFF09\u4E0E paths\uFF1B\u6CA1\u5199\u7684\u4EA7\u7269\u6CA1\u6709\u76EE\u6807\u4ED3\u5E93\uFF0C2.0 \u8D77\u62A5\u9519`
+        `${at}: storage: git \u8981\u5199 repo\uFF08repos \u91CC\u7684\u540D\u5B57\uFF09\u4E0E paths\uFF1B\u6CA1\u5199\u7684\u4EA7\u7269\u6CA1\u6709\u76EE\u6807\u4ED3\u5E93\uFF0C\u4EE5\u540E\u7684\u534F\u8BAE\u5927\u7248\u672C\u4F1A\u6539\u6210\u62A5\u9519`
       );
       continue;
     }

package/dist/{chunk-JWZU3NOD.js → chunk-XPLYTHNX.js}

@@ -11,7 +11,7 @@ import {
   resolveWorkshopRepo,
   rolePermissions,
   workshopFileRefs
-} from "./chunk-TQHHHXXU.js";
+} from "./chunk-LGYGWMSY.js";
 
 // src/bundled.ts
 import { existsSync } from "fs";

package/dist/{dev-server-SB5FMSVP.js → dev-server-IBR3PKDE.js}

@@ -5,8 +5,8 @@ import {
   bundledDir,
   renderDevModule,
   resolveDevWorkshop
-} from "./chunk-JWZU3NOD.js";
-import "./chunk-TQHHHXXU.js";
+} from "./chunk-XPLYTHNX.js";
+import "./chunk-LGYGWMSY.js";
 
 // src/dev-server.ts
 import { createHash as createHash2 } from "crypto";
@@ -140,15 +140,30 @@ function upstreamKeyGuard(key) {
   return {
     name: "band-upstream-key",
     configureServer(server) {
-      server.middlewares.use((req, res, next) => {
-        if (upstreamKeyMatches(req.headers[UPSTREAM_KEY_HEADER], key)) return next();
+      const deny = (req, res) => {
+        if (req.method === "GET" && req.url === "/") {
+          res.statusCode = 204;
+          res.setHeader("Cache-Control", "no-store");
+          res.end();
+          return;
+        }
         res.statusCode = 403;
         res.setHeader("Content-Type", "text/plain; charset=utf-8");
         res.end("Forbidden");
+      };
+      server.middlewares.use((req, res, next) => {
+        if (upstreamKeyMatches(req.headers[UPSTREAM_KEY_HEADER], key)) return next();
+        deny(req, res);
       });
       const http = server.httpServer;
       if (!http) return;
       const original = http.listeners("upgrade");
+      const originalRequest = http.listeners("request");
+      http.removeAllListeners("request");
+      http.on("request", (req, res) => {
+        if (!upstreamKeyMatches(req.headers[UPSTREAM_KEY_HEADER], key)) return deny(req, res);
+        for (const listener of originalRequest) listener.call(http, req, res);
+      });
       http.removeAllListeners("upgrade");
       http.on("upgrade", (req, socket, head) => {
         if (!upstreamKeyMatches(req.headers[UPSTREAM_KEY_HEADER], key)) return reject(socket);
@@ -179,9 +194,21 @@ function heartbeatPlugin(ms) {
 function bandDevPlugin(root, initial) {
   let ws = initial;
   let server;
+  const seenPackageJsons = /* @__PURE__ */ new Set();
+  const pluginPackageJsons = () => {
+    for (const p of ws.plugins) seenPackageJsons.add(join(dirname(p.manifestPath), "package.json"));
+    for (const path of seenPackageJsons)
+      if (!existsSync(path)) {
+        seenPackageJsons.delete(path);
+        server?.watcher.unwatch(path);
+      }
+    return [...seenPackageJsons];
+  };
+  const isViewPackageJson = (file) => /[\\/]band[\\/]views[\\/][^\\/]+[\\/]package\.json$/.test(file);
   const yamls = () => [
     ws.workshopPath,
     ...ws.plugins.map((p) => p.manifestPath),
+    ...pluginPackageJsons(),
     ...ws.paramsPaths
   ];
   return {
@@ -200,7 +227,8 @@ function bandDevPlugin(root, initial) {
       s.watcher.add(yamls());
       s.watcher.on("all", (_event, file) => {
         if (!file.startsWith(root)) return;
-        if (!file.endsWith(".yaml") && !ws.paramsPaths.includes(file)) return;
+        if (!file.endsWith(".yaml") && !ws.paramsPaths.includes(file) && !pluginPackageJsons().includes(file) && !isViewPackageJson(file))
+          return;
         const mod = s.moduleGraph.getModuleById(RESOLVED);
         if (mod) s.moduleGraph.invalidateModule(mod);
         s.ws.send({ type: "full-reload" });

package/dist/fixture.d.ts

@@ -43,6 +43,17 @@ interface FixtureData {
     stages?: StageRunSummary[];
     gates?: GateState[];
     members?: MemberView[];
+    /**
+     * 项目创建人的用户 id（服务端里创建人就是 owner 角色，天然是管理员）。缺省没有创建人：不从起始身份推，
+     * 否则 `band dev` 这类固定身份的宿主里任何角色都会被当成管理员。`apps/web` 的 `kernelData()` 传
+     * `project.createdBy`，`band dev` 的 dev-host 按 `?role=` 传 `managers`，各自传。
+     */
+    createdBy?: string;
+    /**
+     * 创建人之外的项目管理员（服务端 `members.role` 是 maintainer 的人；dev-host 里按角色参数决定）。
+     * `MemberView.roles` 是业务标签，不是管理角色，不参与。缺省没有管理员。
+     */
+    managers?: string[];
     /** 初始回合状态；缺省没有回合、队列为空。 */
     turn?: TurnState;
     /** 产物列表；缺省按版本里出现过的 artifactId 生成（名字即 id）。 */

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { b as WorkshopRepo, R as ResolvedPlugin, S as SkippedPlugin } from './workshop-repo-Uq6blxyt.js';
-export { W as WORKSHOP_FORBIDDEN_IMPORTS, d as WorkshopRepoError, c as checkPlugin, a as checkPluginSources, p as pluginName, r as readPlugin, e as readProfileLocked, f as resolveOfficialPlugins, g as resolveWorkshopRepo } from './workshop-repo-Uq6blxyt.js';
+import { b as WorkshopRepo, R as ResolvedPlugin, S as SkippedPlugin } from './workshop-repo-DqoVdcGu.js';
+export { W as WORKSHOP_FORBIDDEN_IMPORTS, d as WorkshopRepoError, c as checkPlugin, a as checkPluginSources, p as pluginName, r as readPlugin, e as readProfileLocked, f as resolveOfficialPlugins, g as resolveWorkshopRepo } from './workshop-repo-DqoVdcGu.js';
 import { LockedRole, StageRunSummary, GateState } from '@kanyun-ai-infra/band-plugin-sdk';
 import { PluginEntry } from './plugin-entry.js';
 import '@kanyun-ai-infra/band-contracts';
@@ -33,6 +33,8 @@ interface NewPluginRepoOptions {
     stage?: string;
     /** 界面上的标题，缺省用插件名。 */
     title?: string;
+    /** 用 React 写：入口是 `src/index.tsx`，package.json 带 React 与 `band-plugin-react` 的开发依赖，tsconfig 开 JSX。 */
+    react?: boolean;
 }
 interface NewPluginRepoResult {
     /** 仓库目录（`<父目录>/<名>`）。 */

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   officialPluginCatalog,
   renderOfficialCatalog,
   writeOfficialCatalog
-} from "./chunk-VTAJX7NN.js";
+} from "./chunk-FGPWXAOA.js";
 import "./chunk-CL3FV65M.js";
 import {
   DevSetupError,
@@ -18,7 +18,7 @@ import {
   renderDevModule,
   resolveDevWorkshop,
   resolvePluginRepo
-} from "./chunk-JWZU3NOD.js";
+} from "./chunk-XPLYTHNX.js";
 import {
   WORKSHOP_FORBIDDEN_IMPORTS,
   WorkshopRepoError,
@@ -29,7 +29,7 @@ import {
   readProfileLocked,
   resolveOfficialPlugins,
   resolveWorkshopRepo
-} from "./chunk-TQHHHXXU.js";
+} from "./chunk-LGYGWMSY.js";
 export {
   DevSetupError,
   NewPluginError,

package/dist/vite.d.ts

@@ -1,6 +1,6 @@
 import { LockedRole } from '@kanyun-ai-infra/band-plugin-sdk';
 import { Plugin } from 'vite';
-import { b as WorkshopRepo, R as ResolvedPlugin, S as SkippedPlugin } from './workshop-repo-Uq6blxyt.js';
+import { b as WorkshopRepo, R as ResolvedPlugin, S as SkippedPlugin } from './workshop-repo-DqoVdcGu.js';
 import '@kanyun-ai-infra/band-contracts';
 import 'zod';
 

package/dist/vite.js

@@ -4,12 +4,12 @@ import {
 import {
   officialPluginsDir,
   officialProfilePath
-} from "./chunk-JWZU3NOD.js";
+} from "./chunk-XPLYTHNX.js";
 import {
   readProfileLocked,
   resolveOfficialPlugins,
   resolveWorkshopRepo
-} from "./chunk-TQHHHXXU.js";
+} from "./chunk-LGYGWMSY.js";
 
 // src/vite.ts
 import { existsSync } from "fs";

package/dist/{workshop-repo-Uq6blxyt.d.ts → workshop-repo-DqoVdcGu.d.ts}

@@ -37,9 +37,9 @@ interface PayloadSchema {
 }
 declare const StageSchema: z.ZodObject<{
     kind: z.ZodOptional<z.ZodEnum<{
-        human: "human";
         external: "external";
         agent: "agent";
+        human: "human";
         job: "job";
         workflow: "workflow";
     }>>;
@@ -194,13 +194,13 @@ declare const WorkshopSchema: z.ZodObject<{
     }>>>;
     connectors: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodObject<{
         scope: z.ZodEnum<{
-            workshop: "workshop";
             personal: "personal";
+            workshop: "workshop";
             deployment: "deployment";
         }>;
         inTurn: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>, Record<string, {
-        scope: "workshop" | "personal" | "deployment";
+        scope: "personal" | "workshop" | "deployment";
         inTurn?: string[] | undefined;
     }>>>;
     overrides: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodUnknown>, Record<string, unknown>>>;
@@ -264,9 +264,9 @@ declare const WorkshopSchema: z.ZodObject<{
     workflows: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodObject<{
         stages: z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodObject<{
             kind: z.ZodOptional<z.ZodEnum<{
-                human: "human";
                 external: "external";
                 agent: "agent";
+                human: "human";
                 job: "job";
                 workflow: "workflow";
             }>>;
@@ -517,13 +517,13 @@ declare const WorkshopSchema: z.ZodObject<{
         surfaces: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>, Record<string, string[]>>>;
         statusLabels: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodEnum<{
             failed: "failed";
-            ready: "ready";
-            approved: "approved";
-            stale: "stale";
             blocked: "blocked";
+            ready: "ready";
             in_progress: "in_progress";
             in_review: "in_review";
-        }> & z.core.$partial, z.ZodString>, Partial<Record<"failed" | "ready" | "approved" | "stale" | "blocked" | "in_progress" | "in_review", string>>>>;
+            approved: "approved";
+            stale: "stale";
+        }> & z.core.$partial, z.ZodString>, Partial<Record<"failed" | "blocked" | "ready" | "in_progress" | "in_review" | "approved" | "stale", string>>>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 type WorkshopDef = z.infer<typeof WorkshopSchema>;
@@ -600,7 +600,7 @@ interface CompiledWorkshop {
     agents: Record<string, CompiledAgent>;
     /** 进行中的流程实例钉住这个哈希；新版工坊只影响新项目。 */
     workshopHash: string;
-    /** 1.x 仍接受、2.0 起报错的写法；`band check` 原样打印，不算失败。 */
+    /** 当前仍接受、以后的协议大版本会改成报错的写法；`band check` 原样打印，不算失败。 */
     warnings: string[];
 }
 interface CompileOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kanyun-ai-infra/band-cli",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "band 命令行：新建、本地调试、校验与发布 Band 工坊和插件",
   "license": "UNLICENSED",
   "type": "module",
@@ -15,7 +15,8 @@
     },
     "./build": {
       "types": "./dist/build-plugin.d.ts",
-      "import": "./dist/build-plugin.js"
+      "import": "./dist/build-plugin.js",
+      "default": "./dist/build-plugin.js"
     },
     "./catalog": {
       "types": "./dist/plugin-entry.d.ts",
@@ -33,6 +34,8 @@
   "files": [
     "dist",
     "dev-host",
+    "src/dev-managers.ts",
+    "src/inspector-default.ts",
     "src/inspector-plugins.ts",
     "src/load-plugins.ts",
     "bundled"
@@ -41,12 +44,12 @@
     "node": ">=22.19"
   },
   "dependencies": {
-    "@kanyun-ai-infra/band-contracts": "^0.1.2",
-    "@kanyun-ai-infra/band-plugin-react": "^0.1.2",
-    "@kanyun-ai-infra/band-plugin-sdk": "^1.222.0",
+    "@kanyun-ai-infra/band-contracts": "^0.1.4",
+    "@kanyun-ai-infra/band-plugin-react": "^0.2.1",
+    "@kanyun-ai-infra/band-plugin-sdk": "^2.1.0",
     "es-module-lexer": "^2.3.2",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "semver": "^7.8.5",
     "vite": "^6.0.7",
     "yaml": "^2.6.1",

package/src/dev-managers.ts

@@ -0,0 +1,16 @@
+/**
+ * band dev 的 dev-host 里谁算项目管理员（夹具 `FixtureData.managers`）。
+ *
+ * 与线上同构：只有 owner / maintainer 管项目。不带 `?role=`（或角色不在工坊里）是默认开发身份，按管理员看；
+ * 选了工坊里的业务角色（`?role=teacher` 这类）就是非管理员，预览得到非管理员视图。业务角色不是管理角色。
+ * 不从起始身份推创建人：dev-host 的身份恒为 `dev`，推出来会让任何角色都变成管理员。
+ */
+export function devManagers(
+  roleParam: string | null,
+  workshopRoles: readonly string[],
+  memberId: string,
+): string[] {
+  const picked = roleParam !== null && workshopRoles.includes(roleParam);
+  const manages = !picked || roleParam === "owner" || roleParam === "maintainer";
+  return manages ? [memberId] : [];
+}

package/src/inspector-default.ts

@@ -0,0 +1,9 @@
+/**
+ * `band dev` 右边「夹具」栏默认展开的最小视口宽度（像素）：不到这个宽度项目页的右栏会被夹具栏挤得显示不全，
+ * 默认收起，作者点「夹具」按钮展开。quickstart 写的「不到 1600 像素右栏显示不全」是同一个数。
+ */
+export const INSPECTOR_OPEN_MIN_WIDTH = 1600;
+
+export function inspectorOpenByDefault(viewportWidth: number): boolean {
+  return viewportWidth >= INSPECTOR_OPEN_MIN_WIDTH;
+}