@ninkch/dsh-artcraft 0.2.5 → 0.2.7

package/README.md

@@ -25,13 +25,13 @@ This plugin brings that surface into DeepSeek Harness, so an AI agent can *opera
 not just talk about them:
 
 - **In chat** — four agent tools let any Harness session check the toolchain, run CLI commands,
-  send control-channel commands to a running app, and read/write files in a dedicated data root.
+  send control-channel commands to a running app, and do bridged file operations.
 - **In the browser** — a same-origin HTTP API (`/artcraft/api/*`) that any Harness web UI can call,
   no CORS, no keys. It was built for [无限画布 / infinite-canvas](../dsh-infinite_canvas/README.md),
   a node-based AI short-drama storyboard canvas, but any front end can use it.
-- **On disk** — one `dataRoot` per machine where assets, project files and rendered output live,
-  laid out per project (`media/ · craft/ · out/`), so generative pipelines and the desktop apps
-  meet on common ground.
+- **Paths belong to the caller** — this plugin is a bridge and owns no data directory. Files read
+  or written go wherever the caller points: chat invocations default to the current conversation
+  workspace (or any path named in the prompt); the canvas writes under its own project folder.
 
 A typical AI short-drama loop looks like this: generate storyboard frames with a model →
 batch color-grade and sharpen them in PhotoCraft → render an animated title in EffectCraft →
@@ -55,7 +55,8 @@ Every step after "generate" runs through this plugin, headless.
   headless edits          cut · grade · mix      Lottie export
        └───────────────────────┴───────────────────────┘
                                ▼
-              <dataRoot>/<project>/{media, craft, out}
+              caller-decided locations (chat → conversation
+              workspace · canvas → its project folder)
 ```
 
 Everything runs locally. No cloud round-trips, no accounts, no telemetry.
@@ -102,19 +103,19 @@ pnpm install --dir C:/Users/<you>/.dsh/profiles/desktop
 > If your Harness build ships a plugin manager UI that installs from a folder, that works too —
 > it ends up writing exactly the two lines above.
 
-**3. Configure** `artcraft.config.json` next to `index.js` (copy from
-`artcraft.config.json.example`; the file is git-ignored and re-read on every request — no restart
-needed for path changes):
+**3. Configure** `artcraft.config.json` (copy from
+`artcraft.config.json.example`). Recommended location: `C:\Users\<you>\.dsh\artcraft.config.json`
+(persists across plugin updates); placing it next to `index.js` also works (legacy). The file is
+re-read on every request — no restart needed for path changes:
 
 ```jsonc
 {
-  "dataRoot": "D:/craft-workspace",              // where assets & renders live
   "bins": {
     // three accepted forms: a directory (the <name>-cli binary is appended),
     // a full path to the executable, or a bare name looked up on PATH
     "photocraft":  "C:/craft/photocraft-0.6.0-windows-x64-portable",
     "filmcraft":   "C:/craft/filmcraft-0.5.0-windows-x64-portable",
-    "effectcraft": "C:/craft/effectcraft-windows-x64-portable"
+    "effectcraft": "C:/Program Files/EffectCraft"
   },
   "control": { "filmcraft": 9876, "effectcraft": 9877 }
 }
@@ -139,10 +140,10 @@ artcraft_cli  { bin:"photocraft", args:["batch","--actions","demo/craft/grade.js
 
 | Tool | What it does |
 |---|---|
-| `artcraft_status` | Toolchain health check: which CLIs resolved, data root, control ports, running jobs |
+| `artcraft_status` | Toolchain health check: which CLIs resolved, config location, control ports, running jobs |
 | `artcraft_cli` | Run any CLI subcommand synchronously (`photocraft-cli run/batch`, `filmcraft-cli commands`, …) |
 | `artcraft_control` | One command over the JSON control channel of a *running* FilmCraft / EffectCraft |
-| `artcraft_fs` | list / stat / read / write / mkdir inside `dataRoot` (writing `grade.json`, fetching a rendered `.ecproj`, …) |
+| `artcraft_fs` | Bridged file ops — list / stat / read / write / mkdir at caller-decided absolute paths |
 
 ## Driving it from the browser
 
@@ -170,15 +171,16 @@ Full route list:
 | Route | Purpose |
 |---|---|
 | `GET /artcraft/api/status` | Toolchain health (same payload as `artcraft_status`) |
-| `GET /artcraft/api/projects` | Project directories under `dataRoot` |
-| `POST /artcraft/api/fs?action=write&rel=…` | Write a file — raw body (Blob upload) or JSON `{rel, text\|base64}` |
-| `GET /artcraft/api/fs?op=list\|stat\|readtext&rel=…` | Read directories, metadata, small text files |
-| `GET /artcraft/api/file?rel=…` | Download a file — streamed, up to 2 GB |
+| `POST /artcraft/api/fs?action=write&path=…` | Write a file — absolute `path`, raw body (Blob upload) or JSON `{base, rel, text\|base64}` |
+| `GET /artcraft/api/fs?op=list\|stat\|readtext&path=…` | Read directories, metadata, small text files |
+| `GET /artcraft/api/file?path=…` | Download a file — streamed, up to 2 GB |
 | `POST /artcraft/api/job` · `GET ?id=…` · `POST /artcraft/api/job/cancel` | Job lifecycle with output statting and tail logs |
 | `POST /artcraft/api/control` | Synchronous control-channel call |
 
 Uploads are capped at 320 MB per request (Blob direct, no base64 needed for the raw path);
-downloads stream up to 2 GB. Path arguments are always relative to `dataRoot` and confined to it.
+downloads stream up to 2 GB. All path arguments are **absolute** (or `base` absolute directory +
+relative `rel`) — the caller decides where files live: chat calls point at the conversation
+workspace, the canvas points at its project folder.
 
 ## The control channel: drive a running app
 
@@ -259,14 +261,15 @@ a web UI.
   loopback-only and unauthenticated, so nothing else will answer on that port.
 - **A job hangs** — `GET /artcraft/api/job` lists everything with logs; cancel by id. Plugin
   reloads kill all child jobs by design.
-- **Path escape errors** — by design: every filesystem argument must resolve inside `dataRoot`.
+- **"需要绝对路径" errors** — pass absolute paths (chat: the conversation workspace; canvas: the
+  project folder), or a `base` absolute directory + relative `rel`.
 
 ## Security & trust model
 
 The HTTP surface has **no authentication** and rides on the Harness web server, which listens on
 loopback only — treat the port as trusted-local and don't expose it to a network; put a reverse
-proxy with auth in front if you must. Child processes are locked to the three allow-listed
-binaries; file access is locked to `dataRoot`; the control channel only ever dials `127.0.0.1`.
+proxy with auth in front if you must. Child processes are locked to the seven allow-listed
+family CLIs; the control channel only ever dials `127.0.0.1`.
 
 ## Publishing
 
@@ -281,10 +284,10 @@ GitHub: this repository is self-contained; `README.md` is English-first with a
 [简体中文](README.zh-CN.md) companion.
 
 **Releases run through npm Trusted Publishing** (GitHub Actions OIDC — no tokens, no OTP):
-`.github/workflows/publish.yml` fires on `v*` tags **on `main` only** (a guard step rejects tags
-from other branches); the trusted publisher on the npm package points at `NINKCH/dsh-artcraft` /
-`publish.yml`. Release flow and rules live in [RELEASING.md](RELEASING.md) — in short: changes
-land on `dev`, get tested there, and are only merged to `main` and tagged with the maintainer's
+publishing is triggered by **creating a GitHub Release** (tag `vX.Y.Z` matching `package.json`);
+`.github/workflows/publish.yml` verifies the release commit is on `main` and the versions align,
+then publishes. Release flow and rules live in [RELEASING.md](RELEASING.md) — in short: changes
+land on `dev`, get tested there, and are only merged to `main` and released with the maintainer's
 explicit approval.
 
 ## License

package/README.zh-CN.md

@@ -24,12 +24,12 @@ Effects）等。它们有一个大多数桌面软件都不具备的共同基因
 本插件把这套自动化面接进 DeepSeek Harness，让 AI 不只是"谈论"这些软件，而是真的**操作**它们：
 
 - **对话里** —— 四个 Agent 工具，任何 Harness 会话都能检查工具链、执行 CLI 命令、向运行中的
-  App 发控制通道命令、在专属数据目录里读写文件。
+  App 发控制通道命令、做桥接文件操作。
 - **浏览器里** —— 同源 HTTP API（`/artcraft/api/*`），任何 Harness 前端都能直接调用：无 CORS、
   无密钥。它为 [无限画布 / infinite-canvas](../dsh-infinite_canvas/README.md)（节点式 AI 短剧
   分镜画布）而建，但任何前端都可用。
-- **磁盘上** —— 每台机器一个 `dataRoot`，素材、工程文件、渲染产物按项目分区
-  （`media/ · craft/ · out/`），生成式流水线与桌面应用在同一片地基上会合。
+- **路径由调用方决定** —— 本插件只是桥接，不持有数据目录：对话调用默认落在当前对话工作空间
+  （或提示词指定的任意位置）；画布调用则写在自己项目目录下。
 
 典型的 AI 短剧闭环：模型生成分镜图 → PhotoCraft 批量调色锐化 → EffectCraft 渲染动态片头 →
 FilmCraft 剪辑、调色、混音、烧字幕 → 导出 H.264。"生成"之后的每一步都由本插件无头驱动。
@@ -51,7 +51,7 @@ FilmCraft 剪辑、调色、混音、烧字幕 → 导出 H.264。"生成"之后
   （无头）                 混音导出                Lottie 导出
        └───────────────────────┴───────────────────────┘
                                ▼
-              <dataRoot>/<项目>/{media, craft, out}
+              产物位置由调用方决定（对话 → 当前工作空间 · 画布 → 项目目录）
 ```
 
 全流程本地运行：不联网、无账号、无遥测。
@@ -96,17 +96,17 @@ pnpm install --dir C:/Users/<你>/.dsh/profiles/desktop
 
 > 若你的 Harness 版本带有"从文件夹安装插件"的管理界面，用它也行 —— 最终落盘的就是上面两行。
 
-**3. 配置** `index.js` 旁边的 `artcraft.config.json`（从 `artcraft.config.json.example` 复制；
-该文件已 gitignore，且每次请求都会重读 —— 改路径无需重启）：
+**3. 配置** `artcraft.config.json`（从 `artcraft.config.json.example` 复制）。推荐放
+`C:\Users\<你>\.dsh\artcraft.config.json`（持久，更新插件不丢）；放在 `index.js` 旁也可（旧版兼容）。
+文件已 gitignore，且每次请求都会重读 —— 改路径无需重启：
 
 ```jsonc
 {
-  "dataRoot": "D:/craft-workspace",              // 素材与产物的根目录
   "bins": {
     // 三种写法：目录（自动拼接 <名>-cli 可执行文件）、完整 exe 路径、或走 PATH 的裸命令名
     "photocraft":  "C:/craft/photocraft-0.6.0-windows-x64-portable",
     "filmcraft":   "C:/craft/filmcraft-0.5.0-windows-x64-portable",
-    "effectcraft": "C:/craft/effectcraft-windows-x64-portable"
+    "effectcraft": "C:/Program Files/EffectCraft"
   },
   "control": { "filmcraft": 9876, "effectcraft": 9877 }
 }
@@ -129,10 +129,10 @@ artcraft_cli  { bin:"photocraft", args:["batch","--actions","demo/craft/grade.js
 
 | 工具 | 用途 |
 |---|---|
-| `artcraft_status` | 工具体检：CLI 是否找到、数据目录、控制端口、进行中的任务 |
+| `artcraft_status` | 工具体检：CLI 是否找到、配置目录、控制端口、进行中的任务 |
 | `artcraft_cli` | 同步执行任意 CLI 子命令（`photocraft-cli run/batch`、`filmcraft-cli commands` 等） |
 | `artcraft_control` | 向**运行中**的 FilmCraft / EffectCraft 控制通道发一条命令 |
-| `artcraft_fs` | 在 `dataRoot` 内 list / stat / 读 / 写 / 建目录（写 `grade.json`、取回 `.ecproj` 等） |
+| `artcraft_fs` | 桥接文件操作 —— list / stat / 读 / 写 / 建目录，路径由调用方绝对指定 |
 
 ## 在浏览器里驱动
 
@@ -159,15 +159,15 @@ POST /artcraft/api/job/cancel  { "id":"7f2c…" }
 | 路由 | 用途 |
 |---|---|
 | `GET /artcraft/api/status` | 工具体检（与 `artcraft_status` 同数据） |
-| `GET /artcraft/api/projects` | `dataRoot` 下的项目目录 |
-| `POST /artcraft/api/fs?action=write&rel=…` | 写文件 —— 原始字节流（Blob 直传）或 JSON `{rel, text\|base64}` |
-| `GET /artcraft/api/fs?op=list\|stat\|readtext&rel=…` | 读目录、元数据、小文本 |
-| `GET /artcraft/api/file?rel=…` | 下载文件 —— 流式，上限 2 GB |
+| `POST /artcraft/api/fs?action=write&path=…` | 写文件 —— 绝对 `path`，原始字节流（Blob 直传）或 JSON `{base, rel, text\|base64}` |
+| `GET /artcraft/api/fs?op=list\|stat\|readtext&path=…` | 读目录、元数据、小文本 |
+| `GET /artcraft/api/file?path=…` | 下载文件 —— 流式，上限 2 GB |
 | `POST /artcraft/api/job` · `GET ?id=…` · `POST /artcraft/api/job/cancel` | 任务生命周期，含产物探测与日志尾部 |
 | `POST /artcraft/api/control` | 控制通道同步调用 |
 
 上传单次上限 320 MB（原始路径 Blob 直传，无需 base64）；下载流式上限 2 GB。
-所有路径参数相对 `dataRoot` 且被限制在其中。
+所有路径参数为**绝对路径**（或 `base` 绝对目录 + 相对 `rel`）—— 位置由调用方决定：
+对话调用指向当前工作空间，画布调用指向其项目目录。
 
 ## 控制通道：驱动正在运行的 App
 
@@ -244,13 +244,14 @@ NVENC 硬编）、ProRes、DNxHR，附 EBU R128 响度归一与字幕烧录。
   不会有别的应答者。
 - **任务卡住** —— `GET /artcraft/api/job` 带日志列出全部任务，按 id 取消；插件重载会按设计
   终止所有子任务。
-- **路径越界报错** —— 设计如此：所有文件参数必须落在 `dataRoot` 之内。
+- **"需要绝对路径"报错** —— 传绝对路径即可：对话用当前工作空间下的路径，画布用项目目录下的
+  路径（或 `base` 绝对目录 + 相对 `rel`）。
 
 ## 安全与信任模型
 
 HTTP 面无鉴权，挂在 Harness Web 服务之下（仅回环监听）—— 把端口当本机可信处理，**不要暴露
-到网络**；确需远程请加带鉴权的反向代理。子进程锁定三个白名单可执行文件；文件访问锁定
-`dataRoot`；控制通道只会拨 `127.0.0.1`。
+到网络**；确需远程请加带鉴权的反向代理。子进程锁定 7 个白名单家族 CLI；控制通道只会拨
+`127.0.0.1`。
 
 ## 发布
 
@@ -264,9 +265,9 @@ GitHub 上传本仓库即可：`README.md` 英文优先，附
 [简体中文](README.zh-CN.md) 对照。
 
 **发版走 npm Trusted Publishing**（GitHub Actions OIDC —— 无令牌、无 OTP）：
-`.github/workflows/publish.yml` 仅在 **main 分支**的 `v*` 标签推送时触发（守卫步骤会拒绝其他分支
-的标签）；npm 包侧的可信发布指向 `NINKCH/dsh-artcraft` / `publish.yml`。发版流程与红线见
-[RELEASING.md](RELEASING.md)：改动先进 `dev` 测试，维护者明确批准后才合并 main 并打标签。
+发布由 **GitHub Release** 触发（tag `vX.Y.Z` 与 package.json version 一致）；`.github/workflows/publish.yml`
+会校验发布提交在 main 上且版本对齐，然后自动发布。发版流程与红线见
+[RELEASING.md](RELEASING.md)：改动先进 `dev` 测试，维护者明确批准后才合并 main 并发 Release。
 
 ## 许可
 

package/artcraft.config.json.example

@@ -1,9 +1,12 @@
 {
-  "dataRoot": "D:/craft-workspace",
   "bins": {
-    "photocraft": "C:/craft/photocraft-0.6.0-windows-x64-portable",
-    "filmcraft": "C:/craft/filmcraft-0.5.0-windows-x64-portable",
-    "effectcraft": "C:/craft/effectcraft-0.1.0-windows-x64-portable"
+    "photocraft": "D:/craft/photocraft-0.6.0/photocraft-0.6.0-windows-x64-portable",
+    "vectorcraft": "C:/Program Files/VectorCraft",
+    "filmcraft": "D:/craft/filmcraft-0.5.0/filmcraft-0.5.0-windows-x64-portable",
+    "lightcraft": "C:/Program Files/LightCraft",
+    "pdfcraft": "C:/Program Files/PdfCraft",
+    "effectcraft": "C:/Program Files/EffectCraft",
+    "designcraft": "C:/Program Files/DesignCraft"
   },
   "control": {
     "filmcraft": 9876,

package/client.js

@@ -120,8 +120,8 @@ window.__ModuleLoader__.load({
         statusErr
           ? h('div', { className: 'dshac-muted' }, '未连接：' + statusErr + '（插件可能未注册或 Harness 需要重启）')
           : h('div', null, Object.keys(LABELS).map(binRow),
-              status?.dataRoot ? h('div', { className: 'dshac-row dshac-muted' },
-                '数据目录：', h('span', { className: 'dshac-mono' }, status.dataRoot.path)) : null),
+              status?.config?.path ? h('div', { className: 'dshac-row dshac-muted' },
+                '配置目录：', h('span', { className: 'dshac-mono' }, status.config.path)) : null),
         h('div', { className: 'dshac-row', style: { marginTop: '10px' } },
           h('span', { className: 'dshac-muted' },
             '当前 v' + (status?.version ?? upd?.current ?? '?') +

package/index.js

@@ -1,15 +1,20 @@
 /**
  * @ninkch/dsh-artcraft — DeepSeek Harness 插件（Host 半侧）
  *
- * 把 ArtCraft 家族的自动化接口封装成两种形态：
+ * 本插件只是【桥接】：把 ArtCraft 家族软件的自动化接口转接给 Harness，不持有任何数据目录。
+ * 结果文件的位置由调用方决定 ——
+ *   对话调用：当前对话工作空间下的绝对路径（或提示词指定的任意位置）
+ *   画布调用：画布项目目录下的绝对路径（哪个项目使用就放哪个项目下）
+ *
+ * 两种形态：
  *   1) Agent Tools（对话内直接驱动）:
- *        artcraft_status  —— 检查三个 CLI 是否可用、数据目录、控制通道配置
- *        artcraft_cli     —— 运行 photocraft-cli / filmcraft-cli / effectcraft-cli 任意命令
+ *        artcraft_status  —— 检查 7 个家族 CLI 是否可用、配置目录、控制通道配置
+ *        artcraft_cli     —— 运行 7 个家族 CLI 任意命令（cwd / 文件参数由调用方给绝对路径）
  *        artcraft_control —— 向运行中的 FilmCraft/EffectCraft JSON 控制通道发一条命令
- *        artcraft_fs      —— 在 dataRoot 内读写文件（准备 actions.json / 取回产物）
+ *        artcraft_fs      —— 桥接文件操作（list/stat/readtext/write/mkdir，绝对路径）
+ *        artcraft_update  —— 插件自身更新（检查/应用）
  *   2) HTTP API（同源 /artcraft/api/*，供无限画布等前端调用，无 CORS 问题）:
  *        GET  /artcraft/api/status     环境自检
- *        GET  /artcraft/api/projects   列出 dataRoot 下的项目目录
  *        GET  /artcraft/api/fs         list / stat / readtext
  *        POST /artcraft/api/fs         write（JSON base64/text 或原始字节流）
  *        GET  /artcraft/api/file       下载产物（流式，raw 或 text）
@@ -19,12 +24,10 @@
  *        POST /artcraft/api/control    控制通道同步调用（engine.execute / ui.*）
  *
  * 安全约定：
- *   - 所有文件操作限制在 dataRoot 内（拒绝 .. 越界与绝对路径外逃）；
- *   - 子进程只允许三个白名单键（photocraft/filmcraft/effectcraft），
- *     具体可执行文件由 artcraft.config.json 指定；
+ *   - 子进程只允许 7 个白名单键（家族 CLI），具体可执行文件由 artcraft.config.json 指定；
  *   - 控制通道只连 127.0.0.1，与 ArtCraft 官方协议一致（App 需以 --control 启动；
  *     PhotoCraft 的控制通道为鉴权模式，本插件不代理，故仅支持 filmcraft/effectcraft）；
- *   - 本插件与 infinite-canvas 零代码耦合，仅通过 HTTP + 磁盘目录约定协作。
+ *   - 本插件与 infinite-canvas 零代码耦合，仅通过 HTTP + 调用方给定路径协作。
  *
  * 信任模型：HTTP API 无鉴权，随 DSH Web GUI 仅监听回环；不要把 GUI 端口暴露到局域网。
  */
@@ -39,7 +42,7 @@ import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 
 const NAME = 'artcraft';
-const VERSION = '0.2.4';
+const VERSION = '0.2.7';
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 
 const BINS = ['photocraft', 'vectorcraft', 'filmcraft', 'lightcraft', 'pdfcraft', 'effectcraft', 'designcraft'];
@@ -55,7 +58,6 @@ const LINE_CAP = 4000;                       // 单行截断
 const KEEP_JOBS = 64;                        // 已结束任务保留条数
 
 const DEFAULT_CONFIG = {
-  dataRoot: path.join(os.homedir(), 'craft-workspace'),
   bins: {
     photocraft: 'photocraft-cli',
     vectorcraft: 'vectorcraft-cli',
@@ -72,44 +74,68 @@ const DEFAULT_CONFIG = {
 
 async function loadConfig() {
   const cfg = {
-    dataRoot: DEFAULT_CONFIG.dataRoot,
     bins: { ...DEFAULT_CONFIG.bins },
     control: { ...DEFAULT_PORTS },
+    configPath: null, // 实际生效的配置文件（供界面显示"配置目录"）
   };
-  try {
-    const user = JSON.parse(await fs.readFile(path.join(HERE, 'artcraft.config.json'), 'utf8'));
-    if (user && typeof user.dataRoot === 'string' && user.dataRoot) cfg.dataRoot = user.dataRoot;
-    if (user && user.bins) {
-      for (const k of BINS) {
-        if (typeof user.bins[k] === 'string' && user.bins[k]) cfg.bins[k] = user.bins[k];
+  // 配置查找顺序：~/.dsh（持久，推荐 —— 更新替换包目录也不丢）→ 包目录（旧版兼容）
+  const candidates = [
+    path.join(os.homedir(), '.dsh', 'artcraft.config.json'),
+    path.join(HERE, 'artcraft.config.json'),
+  ];
+  for (const candidate of candidates) {
+    try {
+      const user = JSON.parse(await fs.readFile(candidate, 'utf8'));
+      if (user && user.bins) {
+        for (const k of BINS) {
+          if (typeof user.bins[k] === 'string' && user.bins[k]) cfg.bins[k] = user.bins[k];
+        }
       }
-    }
-    if (user && user.control) {
-      for (const k of Object.keys(DEFAULT_PORTS)) {
-        const p = Number(user.control[k]);
-        if (Number.isInteger(p) && p > 0 && p < 65536) cfg.control[k] = p;
+      if (user && user.control) {
+        for (const k of Object.keys(DEFAULT_PORTS)) {
+          const p = Number(user.control[k]);
+          if (Number.isInteger(p) && p > 0 && p < 65536) cfg.control[k] = p;
+        }
       }
-    }
-  } catch { /* 无配置文件时用默认值 */ }
+      cfg.configPath = candidate;
+      break; // 第一个可解析的配置生效
+    } catch { /* 该候选不存在/非法 → 试下一个 */ }
+  }
   return cfg;
 }
 
 /* ============================ 路径与进程 ============================ */
 
-/** 把 rel 解析为 dataRoot 内的绝对路径，拒绝越界 */
-function resolveSafeRel(dataRoot, rel) {
-  const root = path.resolve(String(dataRoot));
-  const p = path.resolve(root, String(rel ?? '.'));
-  if (p !== root && !p.startsWith(root + path.sep)) {
-    throw new Error(`路径越界（必须在数据目录内）: ${rel}`);
+/**
+ * 桥接语义：路径由调用方决定（本插件只是桥梁，不设数据目录）——
+ *   对话调用：当前对话工作空间下的绝对路径（或提示词指定的任意位置）
+ *   画布调用：画布项目目录下的绝对路径
+ * 支持 ~ 展开；也接受 base(绝对目录) + rel(相对) 组合，方便批量调用。
+ */
+function resolveCallerPath(p) {
+  let s = String(p ?? '').trim();
+  if (!s) throw new Error('缺少路径参数');
+  if (s === '~' || s.startsWith('~/') || s.startsWith('~\\')) s = path.join(os.homedir(), s.slice(1));
+  const abs = path.resolve(s);
+  if (!path.isAbsolute(abs)) {
+    throw new Error('需要绝对路径 —— 对话调用传当前工作空间下的绝对路径，画布传项目目录下的绝对路径（或用 base + 相对路径组合）');
   }
-  return p;
+  return abs;
 }
 
-async function ensureDirSafe(cfg, rel) {
-  const p = resolveSafeRel(cfg.dataRoot, rel ?? '.');
-  await fs.mkdir(p, { recursive: true });
-  return p;
+function resolveBaseRel(base, rel) {
+  if (base) {
+    const b = resolveCallerPath(base);
+    if (rel == null || String(rel) === '') return b;
+    return path.resolve(b, String(rel));
+  }
+  return resolveCallerPath(rel);
+}
+
+async function ensureDir(p) {
+  const abs = resolveCallerPath(p);
+  await fs.mkdir(abs, { recursive: true });
+  return abs;
 }
 
 function cliNameFor(key) {
@@ -258,15 +284,27 @@ function controlCall(port, method, params, { timeoutMs = 30_000 } = {}) {
 
 const jobs = new Map(); // id -> job
 
-async function statOutputs(cfg, outputs) {
+/**
+ * 桥接语义：产物路径由调用方给定 ——
+ *   绝对路径直接使用；也可传 cwd（绝对目录）让 outputs 以它为基准。
+ */
+async function statOutputs(outputs, cwd) {
   const out = [];
+  const base = cwd ? resolveCallerPath(cwd) : null;
   for (const item of outputs ?? []) {
-    const rel = String(item.rel ?? item);
+    const spec = String(item.rel ?? item.path ?? item);
+    let abs;
+    try {
+      abs = base ? path.resolve(base, spec) : resolveCallerPath(spec);
+    } catch {
+      out.push({ rel: spec, exists: false, dir: false, size: null, mtime: null });
+      continue;
+    }
     try {
-      const st = await fs.stat(resolveSafeRel(cfg.dataRoot, rel));
-      out.push({ rel, exists: true, dir: st.isDirectory(), size: st.size, mtime: st.mtimeMs });
+      const st = await fs.stat(abs);
+      out.push({ rel: spec, path: abs, exists: true, dir: st.isDirectory(), size: st.size, mtime: st.mtimeMs });
     } catch {
-      out.push({ rel, exists: false, dir: false, size: null, mtime: null });
+      out.push({ rel: spec, path: abs, exists: false, dir: false, size: null, mtime: null });
     }
   }
   return out;
@@ -301,18 +339,19 @@ function pruneJobs() {
   }
 }
 
-async function startJob(cfg, { bin, args, cwdRel, outputs, timeoutMs }) {
+async function startJob(cfg, { bin, args, cwd, outputs, timeoutMs }) {
   if (!BINS.includes(bin)) throw new Error(`bin 必须是 ${BINS.join(' | ')} 之一`);
   if (args != null && !Array.isArray(args)) throw new Error('args 必须是字符串数组');
   const exe = await resolveBin(cfg, bin);
-  const cwd = await ensureDirSafe(cfg, cwdRel ?? '.');
+  // 桥接语义：cwd 由调用方给绝对路径（对话=工作空间下的目录，画布=项目目录）；不传则继承 Host 进程
+  const cwdAbs = cwd ? await ensureDir(cwd) : null;
   const id = crypto.randomUUID();
   const job = {
     id,
     bin,
     exe,
     args: (args ?? []).map(String),
-    cwd,
+    cwd: cwdAbs,
     status: 'running',
     code: null,
     signal: null,
@@ -320,11 +359,11 @@ async function startJob(cfg, { bin, args, cwdRel, outputs, timeoutMs }) {
     endedAt: null,
     stdout: [],
     stderr: [],
-    outputs: (outputs ?? []).map((rel) => ({ rel: String(rel) })),
+    outputs: (outputs ?? []).map((o) => ({ rel: String(o.rel ?? o.path ?? o) })),
     child: null,
     timer: null,
   };
-  const child = spawn(job.exe, job.args, { cwd, windowsHide: true });
+  const child = spawn(job.exe, job.args, { cwd: cwdAbs ?? undefined, windowsHide: true });
   job.child = child;
   child.stdout?.setEncoding('utf8');
   child.stderr?.setEncoding('utf8');
@@ -376,13 +415,13 @@ async function statusInfo(cfg, meta) {
     }
     bins[key] = { configured: cfg.bins[key], exe, found, note };
   }
-  let dataRoot = { path: cfg.dataRoot, exists: false };
-  try { dataRoot.exists = (await fs.stat(cfg.dataRoot)).isDirectory(); } catch { /* 不存在 */ }
+  let configPath = null;
+  try { configPath = cfg.configPath && (await fs.stat(cfg.configPath)).isFile() ? cfg.configPath : null; } catch { /* 不存在 */ }
   return {
     plugin: NAME,
     version: VERSION,
     platform: process.platform,
-    dataRoot,
+    config: { path: configPath, found: !!configPath },
     bins,
     control: cfg.control,
     jobs: {
@@ -501,7 +540,7 @@ async function fetchLatestVersion() {
     if (res.status === 404) return { latest: null, note: 'npm 上还没有这个包' };
     if (!res.ok) throw new Error('registry 返回 ' + res.status);
     const j = await res.json();
-    return { latest: j.version ?? null };
+    return { latest: j.version ?? null, tarball: j.dist?.tarball ?? null, integrity: j.dist?.integrity ?? null };
   } catch (e) {
     return { latest: null, note: '查询 npm 失败: ' + String(e?.cause?.message || e?.message || e) };
   }
@@ -523,29 +562,10 @@ async function updateCheck() {
   };
 }
 
-async function findRuntimeTools() {
-  const isWin = process.platform === 'win32';
-  const pnCmd = isWin ? 'pnpm.cmd' : 'pnpm';
-  const probe = await runProcess(pnCmd, ['--version'], { timeoutMs: 20000 });
-  if (probe.ok) return { pnpmCmd: pnCmd };
-  try {
-    const rtRoot = path.join(os.homedir(), '.dsh', 'dsh-runtimes');
-    const entries = await fs.readdir(rtRoot, { withFileTypes: true });
-    for (const e of entries) {
-      if (!e.isDirectory()) continue;
-      const pnpmMjs = path.join(rtRoot, e.name, 'dependencies', 'pnpm', 'bin', 'pnpm.mjs');
-      const nodeExe = path.join(rtRoot, e.name, 'dependencies', 'node', 'bin', isWin ? 'node.exe' : 'node');
-      if ((await fileExists(pnpmMjs)) && (await fileExists(nodeExe))) {
-        return { nodeExe, pnpmMjs };
-      }
-    }
-  } catch { /* ignore */ }
-  return {};
-}
-
 async function updateApply() {
   const info = await detectInstall();
-  const { latest } = await fetchLatestVersion();
+  const meta = await fetchLatestVersion();
+  const latest = meta.latest;
   if (!latest) throw new Error('npm 上没有可用的发布版本');
   if (!semverGt(latest, VERSION)) return { ok: true, message: `已是最新（${VERSION}）`, needRestart: false };
 
@@ -557,19 +577,56 @@ async function updateApply() {
     return { ok: r.ok, output: (r.stdout + '\n' + r.stderr).trim(), needRestart: r.ok, latest };
   }
 
-  // npm 安装模式
-  if (!info.profileDir) throw new Error('未定位到 Harness profile 目录，无法自动更新');
-  const tools = await findRuntimeTools();
-  let cmd, args;
-  if (tools.pnpmCmd) {
-    cmd = tools.pnpmCmd; args = ['add', `${PKG_NAME}@latest`, '--dir', info.profileDir, '--registry=https://registry.npmjs.org'];
-  } else if (tools.pnpmMjs) {
-    cmd = tools.nodeExe; args = [tools.pnpmMjs, 'add', `${PKG_NAME}@latest`, '--dir', info.profileDir, '--registry=https://registry.npmjs.org'];
-  } else {
-    throw new Error('未找到 pnpm（PATH 与 ~/.dsh/dsh-runtimes 均未命中），请手动在 profile 目录执行 pnpm add');
+  // npm 安装模式：直下官方 tarball → sha512 校验 → 原子换目录。
+  // 不经 pnpm 解析器 —— 规避供应链年龄门槛 / link 依赖联动 / 镜像同步延迟。
+  if (!meta.tarball || !meta.integrity) throw new Error('registry 元数据缺少 tarball/integrity，无法安全更新');
+  const here = info.here;
+  const tmp = path.join(os.tmpdir(), 'artcraft-up-' + crypto.randomUUID());
+  await fs.mkdir(tmp, { recursive: true });
+  try {
+    const tgzPath = path.join(tmp, 'pkg.tgz');
+    const res = await fetch(meta.tarball, { signal: AbortSignal.timeout(180000) });
+    if (!res.ok) throw new Error('下载 tarball 失败: HTTP ' + res.status);
+    const buf = Buffer.from(await res.arrayBuffer());
+    if (buf.length > 64 * 1024 * 1024) throw new Error('tarball 超过 64MB 上限，已终止');
+    const digest = crypto.createHash('sha512').update(buf).digest('base64');
+    if (digest !== String(meta.integrity).replace(/^sha512-/, '')) {
+      throw new Error('sha512 校验失败 —— 下载内容与 registry 元数据不符，已终止');
+    }
+    await fs.writeFile(tgzPath, buf);
+    const extract = await runProcess('tar', ['-xzf', tgzPath, '-C', tmp], { timeoutMs: 60000 });
+    if (!extract.ok) throw new Error('解压失败: ' + (extract.stderr || '系统 tar 不可用'));
+    const extractedPkg = JSON.parse(await fs.readFile(path.join(tmp, 'package', 'package.json'), 'utf8'));
+    if (extractedPkg.name !== PKG_NAME || extractedPkg.version !== latest) {
+      throw new Error(`tarball 内容与预期不符（${extractedPkg.name}@${extractedPkg.version}）`);
+    }
+    // 原子换目录：rename 失败（跨卷等）时回退为整目录复制
+    const backup = here + '.old-' + Date.now();
+    try {
+      await fs.rename(here, backup).catch(() => { throw new Error('rename-busy'); });
+      await fs.rename(path.join(tmp, 'package'), here).catch(async () => {
+        await fs.cp(path.join(tmp, 'package'), here, { recursive: true, force: true });
+      });
+      await fs.rm(backup, { recursive: true, force: true }).catch(() => {});
+    } catch {
+      // 兜底：直接覆盖复制（不影响运行中的进程 —— 旧模块已在内存）
+      await fs.cp(path.join(tmp, 'package'), here, { recursive: true, force: true });
+    }
+    // 同步 profile package.json 的版本规格，防止未来 pnpm install 回滚
+    if (info.profileDir) {
+      try {
+        const pjPath = path.join(info.profileDir, 'package.json');
+        const pj = JSON.parse(await fs.readFile(pjPath, 'utf8'));
+        if (pj.dependencies && pj.dependencies[PKG_NAME] !== undefined) {
+          pj.dependencies[PKG_NAME] = latest;
+          await fs.writeFile(pjPath, JSON.stringify(pj, null, 2) + '\n');
+        }
+      } catch { /* 非关键 */ }
+    }
+    return { ok: true, output: `已更新到 v${latest}（sha512 校验通过，tarball 直装）`, needRestart: true, latest };
+  } finally {
+    await fs.rm(tmp, { recursive: true, force: true }).catch(() => {});
   }
-  const r = await runProcess(cmd, args, { cwd: info.profileDir, timeoutMs: 300000, shell: !!tools.pnpmCmd });
-  return { ok: r.ok, output: (r.stdout + '\n' + r.stderr).trim(), needRestart: r.ok, latest };
 }
 
 /* ============================ 插件入口 ============================ */
@@ -606,7 +663,7 @@ export function apply(ctx) {
 
     attempt({
       name: 'artcraft_status',
-      description: '检查 ArtCraft 工具链（photocraft/filmcraft/effectcraft CLI）是否可用，报告数据目录、控制通道端口与任务状态。',
+      description: '检查 ArtCraft 家族 7 个 CLI 是否可用，报告配置目录、控制通道端口与任务状态。本插件只是桥接，产物路径由调用方决定。',
       schema: { type: 'object', properties: {}, additionalProperties: false },
       async execute() {
         const cfg = await loadConfig();
@@ -622,7 +679,7 @@ export function apply(ctx) {
         properties: {
           bin: { type: 'string', enum: [...BINS], description: '工具键' },
           args: { type: 'array', items: { type: 'string' }, description: '命令行参数（不含程序名）' },
-          cwdRel: { type: 'string', description: '工作目录，相对 dataRoot' },
+          cwd: { type: 'string', description: '工作目录（绝对路径，可选）：对话=当前工作空间下的目录，画布=项目目录；不传则继承 Host 进程' },
           timeoutMs: { type: 'number', description: '超时毫秒，默认 900000' },
         },
         required: ['bin', 'args'],
@@ -632,7 +689,7 @@ export function apply(ctx) {
         const cfg = await loadConfig();
         if (args.args != null && !Array.isArray(args.args)) throw new Error('args 必须是字符串数组');
         const exe = await resolveBin(cfg, String(args.bin));
-        const cwd = await ensureDirSafe(cfg, args.cwdRel ?? '.');
+        const cwd = args.cwd ? await ensureDir(args.cwd) : null;
         const r = await runProcess(exe, args.args ?? [], { cwd, timeoutMs: args.timeoutMs });
         return { bin: args.bin, exe, cwd, ...r };
       },
@@ -663,56 +720,57 @@ export function apply(ctx) {
 
     attempt({
       name: 'artcraft_fs',
-      description: '在 craft 数据目录（dataRoot）内进行文件操作：list / stat / readtext / write / mkdir。所有路径相对 dataRoot，禁止越界。',
+      description: '桥接文件操作：list / stat / readtext / write / mkdir。路径由调用方决定 —— 对话调用传当前工作空间下的绝对路径，画布调用传项目目录下的绝对路径（或 base + rel 组合）。',
       schema: {
         type: 'object',
         properties: {
           op: { type: 'string', enum: ['list', 'stat', 'readtext', 'write', 'mkdir'] },
-          rel: { type: 'string', description: '相对 dataRoot 的路径' },
+          path: { type: 'string', description: '绝对路径（或 ~/ 展开）' },
+          base: { type: 'string', description: '可选：绝对基准目录，rel 相对它解析' },
+          rel: { type: 'string', description: '可选：相对 base 的路径（需同时给 base）' },
           text: { type: 'string', description: 'op=write 时的文本内容' },
           base64: { type: 'string', description: 'op=write 时的二进制内容（base64）' },
         },
-        required: ['op', 'rel'],
+        required: ['op'],
         additionalProperties: false,
       },
       async execute(args) {
-        const cfg = await loadConfig();
-        const rel = String(args.rel ?? '');
         const op = String(args.op);
+        const P = () => resolveBaseRel(args.base, args.path ?? args.rel);
         if (op === 'list') {
-          const dir = resolveSafeRel(cfg.dataRoot, rel || '.');
+          const dir = P();
           const entries = await fs.readdir(dir, { withFileTypes: true });
           const out = [];
           for (const ent of entries) {
             const st = await fs.stat(path.join(dir, ent.name)).catch(() => null);
             out.push({ name: ent.name, dir: ent.isDirectory(), size: st?.size ?? null, mtime: st?.mtimeMs ?? null });
           }
-          return { rel, entries: out };
+          return { path: dir, entries: out };
         }
         if (op === 'stat') {
-          const st = await fs.stat(resolveSafeRel(cfg.dataRoot, rel));
-          return { rel, size: st.size, mtime: st.mtimeMs, dir: st.isDirectory() };
+          const st = await fs.stat(P());
+          return { path: P(), size: st.size, mtime: st.mtimeMs, dir: st.isDirectory() };
         }
         if (op === 'readtext') {
-          const p = resolveSafeRel(cfg.dataRoot, rel);
+          const p = P();
           const st = await fs.stat(p);
           if (st.size > TEXT_CAP) throw new Error('文件超过 16MB，请用 GET /artcraft/api/file 取回');
           const buf = await fs.readFile(p);
-          return { rel, text: buf.toString('utf8') };
+          return { path: p, text: buf.toString('utf8') };
         }
         if (op === 'mkdir') {
-          const p = await ensureDirSafe(cfg, rel);
-          return { rel, path: p };
+          const p = await ensureDir(P());
+          return { path: p };
         }
         if (op === 'write') {
-          const p = resolveSafeRel(cfg.dataRoot, rel);
+          const p = P();
           await fs.mkdir(path.dirname(p), { recursive: true });
           let data;
           if (typeof args.base64 === 'string') data = Buffer.from(args.base64, 'base64');
           else if (typeof args.text === 'string') data = Buffer.from(args.text, 'utf8');
           else throw new Error('write 需要 text 或 base64');
           await fs.writeFile(p, data);
-          return { rel, size: data.length };
+          return { path: p, size: data.length };
         }
         throw new Error(`未知 op: ${op}`);
       },
@@ -720,7 +778,7 @@ export function apply(ctx) {
 
     attempt({
       name: 'artcraft_update',
-      description: '检查/应用 @ninkch/dsh-artcraft 插件自身的更新：action=check 对比本地与 npm latest；action=apply 执行更新（git pull 或 pnpm add，按安装形态自动选择），完成后需重启 Harness 生效。',
+      description: '检查/应用 @ninkch/dsh-artcraft 插件自身的更新：action=check 对比本地与 npm latest；action=apply 执行更新（git pull 或官方 tarball 直装 + sha512 校验，按安装形态自动选择），完成后需重启 Harness 生效。',
       schema: {
         type: 'object',
         properties: {
@@ -748,48 +806,34 @@ export function apply(ctx) {
         sendJson(res, 200, await statusInfo(cfg, { registered: [...toolNames], errors: [...toolErrors] }));
       }),
 
-      makeRoute(`/${NAME}/api/projects`, async (req, res) => {
-        const cfg = await loadConfig();
-        await fs.mkdir(cfg.dataRoot, { recursive: true });
-        const entries = await fs.readdir(cfg.dataRoot, { withFileTypes: true });
-        const projects = [];
-        for (const ent of entries) {
-          if (!ent.isDirectory()) continue;
-          const st = await fs.stat(path.join(cfg.dataRoot, ent.name)).catch(() => null);
-          projects.push({ name: ent.name, mtime: st?.mtimeMs ?? null });
-        }
-        projects.sort((a, b) => (b.mtime ?? 0) - (a.mtime ?? 0));
-        sendJson(res, 200, { dataRoot: cfg.dataRoot, projects });
-      }),
-
       makeRoute(`/${NAME}/api/fs`, async (req, res) => {
-        const cfg = await loadConfig();
         const url = new URL(req.url, 'http://x');
+        const base = url.searchParams.get('base'); // 可选：绝对基准目录（画布=项目目录，对话=工作空间下目录）
+        const P = () => resolveBaseRel(base, url.searchParams.get('path') ?? url.searchParams.get('rel'));
         if (req.method === 'GET') {
           const op = url.searchParams.get('op') ?? 'list';
-          const rel = url.searchParams.get('rel') ?? '.';
           if (op === 'list') {
-            const dir = resolveSafeRel(cfg.dataRoot, rel);
+            const dir = P();
             const entries = await fs.readdir(dir, { withFileTypes: true });
             const out = [];
             for (const ent of entries) {
               const st = await fs.stat(path.join(dir, ent.name)).catch(() => null);
               out.push({ name: ent.name, dir: ent.isDirectory(), size: st?.size ?? null, mtime: st?.mtimeMs ?? null });
             }
-            sendJson(res, 200, { rel, entries: out });
+            sendJson(res, 200, { path: dir, entries: out });
             return;
           }
           if (op === 'stat') {
-            const st = await fs.stat(resolveSafeRel(cfg.dataRoot, rel));
-            sendJson(res, 200, { rel, size: st.size, mtime: st.mtimeMs, dir: st.isDirectory() });
+            const st = await fs.stat(P());
+            sendJson(res, 200, { path: P(), size: st.size, mtime: st.mtimeMs, dir: st.isDirectory() });
             return;
           }
           if (op === 'readtext') {
-            const p = resolveSafeRel(cfg.dataRoot, rel);
+            const p = P();
             const st = await fs.stat(p);
             if (st.size > TEXT_CAP) throw new Error('文件超过 16MB，请改用 GET /artcraft/api/file');
             const buf = await fs.readFile(p);
-            sendJson(res, 200, { rel, text: buf.toString('utf8') });
+            sendJson(res, 200, { path: p, text: buf.toString('utf8') });
             return;
           }
           throw new Error(`未知 op: ${op}`);
@@ -798,47 +842,43 @@ export function apply(ctx) {
           const action = url.searchParams.get('action') ?? 'write';
           if (action === 'mkdir') {
             const body = await readJson(req);
-            const p = await ensureDirSafe(cfg, body.rel ?? url.searchParams.get('rel'));
+            const p = await ensureDir(resolveBaseRel(body.base ?? url.searchParams.get('base'), body.path ?? body.rel ?? url.searchParams.get('rel')));
             sendJson(res, 200, { ok: true, path: p });
             return;
           }
-          // write：JSON {rel, base64|text} 或原始字节流（rel 走查询串）
+          // write：JSON {path 或 base+rel, base64|text} 或原始字节流（路径走查询串）
           const isJson = String(req.headers['content-type'] ?? '').includes('json');
-          let rel;
+          let target;
           let data;
           if (isJson) {
             const body = await readJson(req, WRITE_CAP);
-            rel = String(body.rel ?? url.searchParams.get('rel') ?? '');
             if (typeof body.base64 === 'string') data = Buffer.from(body.base64.replace(/\s+/g, ''), 'base64');
             else if (typeof body.text === 'string') data = Buffer.from(body.text, 'utf8');
             else throw new Error('write 需要 base64 或 text 字段');
+            target = resolveBaseRel(body.base ?? url.searchParams.get('base'), body.path ?? body.rel ?? url.searchParams.get('rel'));
           } else {
-            rel = String(url.searchParams.get('rel') ?? '');
             data = await readBody(req, WRITE_CAP);
+            target = resolveBaseRel(url.searchParams.get('base'), url.searchParams.get('path') ?? url.searchParams.get('rel'));
           }
-          if (!rel) throw new Error('缺少 rel');
-          const p = resolveSafeRel(cfg.dataRoot, rel);
-          await fs.mkdir(path.dirname(p), { recursive: true });
-          await fs.writeFile(p, data);
-          sendJson(res, 200, { ok: true, rel, size: data.length });
+          await fs.mkdir(path.dirname(target), { recursive: true });
+          await fs.writeFile(target, data);
+          sendJson(res, 200, { ok: true, path: target, size: data.length });
           return;
         }
         throw new Error('仅支持 GET/POST');
       }),
 
       makeRoute(`/${NAME}/api/file`, async (req, res) => {
-        const cfg = await loadConfig();
         if (req.method !== 'GET') throw new Error('仅支持 GET');
         const url = new URL(req.url, 'http://x');
-        const rel = String(url.searchParams.get('rel') ?? '');
-        const p = resolveSafeRel(cfg.dataRoot, rel);
+        const p = resolveBaseRel(url.searchParams.get('base'), url.searchParams.get('path') ?? url.searchParams.get('rel'));
         const st = await fs.stat(p);
         if (!st.isFile()) throw new Error('不是常规文件');
         if (st.size > READ_CAP) throw new Error(`文件超过读取上限（${Math.round(READ_CAP / 1048576)}MB）`);
         if (url.searchParams.get('as') === 'text') {
           if (st.size > TEXT_CAP) throw new Error('文本模式上限 16MB，请直接下载原始文件');
           const buf = await fs.readFile(p);
-          sendJson(res, 200, { rel, text: buf.toString('utf8') });
+          sendJson(res, 200, { path: p, text: buf.toString('utf8') });
           return;
         }
         // 流式传输：产物可能是几百 MB 的视频，不整读进内存
@@ -856,13 +896,13 @@ export function apply(ctx) {
           if (id) {
             const job = jobs.get(id);
             if (!job) throw new Error('任务不存在或已被回收');
-            job.outputs = await statOutputs(cfg, job.outputs);
+            job.outputs = await statOutputs(job.outputs, job.cwd);
             sendJson(res, 200, jobSnapshot(job, tail));
             return;
           }
           const list = [];
           for (const job of [...jobs.values()].reverse()) {
-            job.outputs = await statOutputs(cfg, job.outputs);
+            job.outputs = await statOutputs(job.outputs, job.cwd);
             list.push(jobSnapshot(job, 5));
           }
           sendJson(res, 200, { jobs: list });

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@ninkch/dsh-artcraft",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "type": "module",
-  "description": "Drive the open-source ArtCraft studio apps (PhotoCraft / FilmCraft / EffectCraft) from DeepSeek Harness — agent tools, a same-origin HTTP API, and plugins-page status with self-update.",
+  "description": "Drive the open-source ArtCraft studio apps (PhotoCraft / FilmCraft / EffectCraft) from DeepSeek Harness ? agent tools, a same-origin HTTP API, and plugins-page status with self-update.",
   "keywords": [
     "deepseek-harness",
     "dsh-plugin",