@rezti/dsh-rez-suite 0.1.45 → 0.1.47

package/lib/index.js

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import { dirname, join, relative } from "node:path";
-import { REZ_CREDENTIAL_REFS, REZ_DEFAULT_CONNECTIONS, REZ_SYSTEMS, lastMcpStartError, loadRezConnections, mergeConnections, secretConfigured, startMcpWhenSecret, writeManagedCredential } from "@rezti/dsh-rez-sso";
+import { REZ_CREDENTIAL_REFS, REZ_DEFAULT_CONNECTIONS, REZ_SYSTEMS, lastMcpStartError, loadRezConnections, mergeConnections, readManagedCredential, secretConfigured, startMcpWhenSecret, writeManagedCredential } from "@rezti/dsh-rez-sso";
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { DatabaseSync } from "node:sqlite";
 import { fileURLToPath } from "node:url";
@@ -2850,7 +2850,9 @@ defineMethod("transform", [
 * Session cwd is the workspace folder (e.g. ~/.dsh/workspaces/法务助理).
 */
 const LEGAL_ROOM_FOLDER = "法务助理";
+const LAB_ROOM_FOLDER = "实验室";
 const QCC_ROOM_DENY = "企查查仅限法务助理房间使用，请切换到法务助理再查询。";
+const ESPHOME_LAB_ROOM_DENY = "ESPHome 编译仅限实验室房间使用，请切换到实验室再上传 YAML。";
 const QCC_STATUS_ROOM_OFF = "房间未启用";
 const ROOM_SEP = /[/\\]/;
 /** Last path segment of a workspace cwd or folder name. */
@@ -2860,9 +2862,15 @@ function roomFolderFromPath(value) {
 	if (trimmed.length === 0) return void 0;
 	return trimmed.split(ROOM_SEP).filter((part) => part.length > 0).at(-1);
 }
+function isLabRoom(hint) {
+	return roomFolderFromPath(hint) === LAB_ROOM_FOLDER;
+}
 function isLegalAssistantRoom(hint) {
 	return roomFolderFromPath(hint) === LEGAL_ROOM_FOLDER;
 }
+function isEsphomeCompileToolName(name) {
+	return name === "rez_esphome_compile" || /^mcp__esphome(?:-|__|_)/.test(name);
+}
 function isQccToolName(name) {
 	return /^mcp__qcc(?:-|__|_)/.test(name);
 }
@@ -2882,11 +2890,6 @@ function readCwdFromObject(value) {
 function cwdFromExecution(execution) {
 	return readCwdFromObject(execution) ?? readCwdFromObject(execution.session) ?? readCwdFromObject(execution.agent);
 }
-/**
-* Official `ctx.tools.guard` reason. Only Qichacha tools are gated.
-* Must never throw: this guard is global and a throw would block WeChat turns.
-* Missing cwd fails closed — not the legal room.
-*/
 function qccRoomGuard(execution) {
 	if (!isQccToolName(typeof execution?.name === "string" ? execution.name : "")) return void 0;
 	try {
@@ -2896,6 +2899,22 @@ function qccRoomGuard(execution) {
 		return QCC_ROOM_DENY;
 	}
 }
+function esphomeLabRoomGuard(execution) {
+	if (!isEsphomeCompileToolName(typeof execution?.name === "string" ? execution.name : "")) return void 0;
+	try {
+		if (isLabRoom(cwdFromExecution(execution))) return void 0;
+		return ESPHOME_LAB_ROOM_DENY;
+	} catch {
+		return ESPHOME_LAB_ROOM_DENY;
+	}
+}
+/**
+* Official `ctx.tools.guard` reason. Qichacha + ESPHome lab compile are room-gated.
+* Must never throw: this guard is global and a throw would block WeChat turns.
+*/
+function suiteRoomGuard(execution) {
+	return qccRoomGuard(execution) ?? esphomeLabRoomGuard(execution);
+}
 //#endregion
 //#region src/observe-mcp.ts
 /**
@@ -2913,8 +2932,11 @@ const COMPOSED_SERVERS = [
 	"tapd",
 	"gsc",
 	"qcc",
-	"tianyancha"
+	"tianyancha",
+	"esphome"
 ];
+/** Front panel hides these until install/docs are ready. Backend MCP can still start if a secret exists. TAPD 1154488930001001224. */
+const FRONT_HIDDEN_SERVERS = /* @__PURE__ */ new Set(["wechat"]);
 function mcpToolPrefix(server) {
 	if (server === "qcc") return "mcp__qcc-";
 	return "mcp__" + server + "__";
@@ -2981,9 +3003,10 @@ function observeServer(server, input) {
 	};
 }
 function composedServersFor(input) {
-	const servers = input.config.role === "boss" ? COMPOSED_SERVERS : COMPOSED_SERVERS.filter((server) => server !== "tianyancha");
-	if (input.room !== void 0 && !isLegalAssistantRoom(input.room)) return servers.filter((server) => server !== "qcc");
-	return [...servers];
+	let servers = input.config.role === "boss" ? [...COMPOSED_SERVERS] : COMPOSED_SERVERS.filter((server) => server !== "tianyancha");
+	if (input.room !== void 0 && !isLegalAssistantRoom(input.room)) servers = servers.filter((server) => server !== "qcc");
+	if (input.room !== void 0 && !isLabRoom(input.room)) servers = servers.filter((server) => server !== "esphome");
+	return servers.filter((server) => !FRONT_HIDDEN_SERVERS.has(server));
 }
 function observeQccOutsideLegalRoom(input) {
 	if (isEnabled(input.config, "qcc") === false) return observeServer("qcc", input);
@@ -3141,6 +3164,12 @@ function publicConfig(config) {
 				url: connections.tianyancha.url,
 				secretConfigured: secretConfigured("tianyancha"),
 				secretRef: REZ_CREDENTIAL_REFS.tianyancha
+			},
+			esphome: {
+				enabled: connections.esphome.enabled,
+				url: connections.esphome.url,
+				secretConfigured: secretConfigured("esphome"),
+				secretRef: REZ_CREDENTIAL_REFS.esphome
 			}
 		},
 		billing: { ...config.billing }
@@ -7688,6 +7717,128 @@ function toolAbortedBeforeDispatchResult(prior) {
 	};
 }
 //#endregion
+//#region src/esphome-lab.ts
+/**
+* ESPHome lab: official dsh-mcp-client → lab MCP, plus HTTP fallback.
+* Lab server runs official `esphome compile`. Never puts firmware bytes
+* into the model context; the tool returns a click-later download link.
+*/
+const ESPHOME_MCP_URL = "http://127.0.0.1:8100/mcp";
+/** POST /v1/compile 只交 YAML、立刻回链接。真机 `esphome compile` 在后台，最长见实验室 `ESPHOME_COMPILE_TIMEOUT`（默认 20 分钟）。 */
+const ESPHOME_COMPILE_TIMEOUT_MS = 120 * 1e3;
+function esphomeLabUrl() {
+	const url = loadRezConnections().esphome?.url;
+	return typeof url === "string" && url.length > 0 ? url.replace(/\/+$/, "") : ESPHOME_MCP_URL;
+}
+/** MCP is :8100/mcp; click-later HTTP lives on :8099. */
+function esphomeHttpOrigin(mcpUrl = esphomeLabUrl()) {
+	try {
+		const url = new URL(mcpUrl);
+		if (url.port === "8100") url.port = "8099";
+		return url.origin;
+	} catch {
+		return "http://127.0.0.1:8099";
+	}
+}
+function labToken() {
+	const env = process.env.REZ_ESPHOME_TOKEN;
+	if (typeof env === "string" && env.length > 0) return env;
+	return readManagedCredential(REZ_CREDENTIAL_REFS.esphome);
+}
+function bearerAuthorization$2(secret) {
+	const trimmed = secret.trim();
+	if (/^bearer\s+/i.test(trimmed)) return "Bearer " + trimmed.replace(/^bearer\s+/i, "");
+	return "Bearer " + trimmed;
+}
+function esphomeMcpConfig(secret) {
+	return {
+		serverName: "esphome",
+		transport: "streamable-http",
+		url: esphomeLabUrl(),
+		headers: { Authorization: bearerAuthorization$2(secret) },
+		failOnStartupError: false,
+		toolCallTimeoutMs: ESPHOME_COMPILE_TIMEOUT_MS
+	};
+}
+/** Submit YAML; return the click-later link. Does not fetch firmware bytes. */
+async function startEsphomeCompile(input) {
+	const token = labToken();
+	if (token === void 0) throw new Error("未配置 REZ_ESPHOME_TOKEN。设置 → 插件 → ReZ-TI → ESPHome 实验室 填 Token。");
+	const fetchImpl = input.fetchImpl ?? fetch;
+	const controller = new AbortController();
+	const timer = setTimeout(() => {
+		controller.abort();
+	}, ESPHOME_COMPILE_TIMEOUT_MS);
+	try {
+		const response = await fetchImpl(esphomeHttpOrigin() + "/v1/compile", {
+			method: "POST",
+			headers: {
+				authorization: bearerAuthorization$2(token),
+				"content-type": "application/yaml"
+			},
+			body: input.yaml,
+			signal: controller.signal
+		});
+		const compiled = await response.json();
+		if (!response.ok || compiled.ok !== true || typeof compiled.id !== "string") throw new Error(compiled.error ?? "compile HTTP " + response.status);
+		const download = compiled.download ?? compiled.nextcloud ?? compiled.direct ?? esphomeHttpOrigin() + "/v1/jobs/" + compiled.id + "/download";
+		return {
+			jobId: compiled.id,
+			device: compiled.device ?? "device",
+			status: compiled.status ?? "compiling",
+			download,
+			direct: compiled.direct,
+			nextcloud: compiled.nextcloud,
+			size: compiled.size,
+			sha256: compiled.sha256,
+			logTail: compiled.log_tail,
+			error: compiled.error
+		};
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/** @deprecated use startEsphomeCompile */
+const compileEsphomeFirmware = startEsphomeCompile;
+/** Start for every identity; execution is room-gated to 实验室. */
+function mountEsphomeMcp(ctx, start = startMcpWhenSecret) {
+	let session;
+	let pending = false;
+	let retryTimer;
+	const hasRezSso = () => {
+		const host = ctx;
+		if (typeof host.get !== "function") return true;
+		return host.get("rezSso") !== void 0;
+	};
+	const ensure = () => {
+		(async () => {
+			if (session !== void 0 || pending) return;
+			if (!hasRezSso()) {
+				if (retryTimer === void 0) retryTimer = setTimeout(() => {
+					retryTimer = void 0;
+					ensure();
+				}, 300);
+				return;
+			}
+			pending = true;
+			try {
+				session = await start(ctx, {
+					system: "esphome",
+					label: "ESPHome 实验室",
+					config: esphomeMcpConfig
+				});
+			} catch (error) {
+				const why = error instanceof Error ? error.message : String(error);
+				console.error("[dsh-rez-suite] esphome MCP start failed:", why);
+			} finally {
+				pending = false;
+			}
+		})();
+	};
+	ensure();
+	return ensure;
+}
+//#endregion
 //#region src/tools.ts
 /**
 * Agent-facing suite tools: status, configuration view, connectivity test,
@@ -7799,6 +7950,56 @@ function rezConfigTool(config) {
 		}
 	});
 }
+function rezEsphomeCompileTool() {
+	return defineTool({
+		name: "rez_esphome_compile",
+		description: "Submit ESPHome YAML to the lab (official esphome compile). Returns a download link immediately. Click later: firmware.bin if ok, README.md while compiling or on failure. Only for the 实验室 room. Prefer mcp__esphome__compile when that MCP is connected.",
+		parameters: { yaml: {
+			type: "string",
+			description: "Full ESPHome YAML text (must include esphome.name)."
+		} },
+		output: {
+			schema: {
+				type: "object",
+				properties: {
+					device: {
+						type: "string",
+						required: true
+					},
+					download: {
+						type: "string",
+						required: true
+					},
+					status: {
+						type: "string",
+						required: true
+					},
+					jobId: {
+						type: "string",
+						required: true
+					},
+					nextcloud: { type: "string" },
+					direct: { type: "string" }
+				},
+				additionalProperties: false
+			},
+			render: (_args, value) => text("device: " + (value.device ?? "") + "\nstatus: " + (value.status ?? "") + "\ndownload: " + (value.download ?? ""))
+		},
+		async execute(args) {
+			const yaml = typeof args?.yaml === "string" ? args.yaml.trim() : "";
+			if (yaml.length === 0) throw new Error("yaml is required");
+			const result = await compileEsphomeFirmware({ yaml });
+			return {
+				device: result.device,
+				download: result.download,
+				status: result.status,
+				jobId: result.jobId,
+				nextcloud: result.nextcloud,
+				direct: result.direct
+			};
+		}
+	});
+}
 //#endregion
 //#region src/boss/register.ts
 /**
@@ -7806,6 +8007,8 @@ function rezConfigTool(config) {
 * `workspaceRegistry.create` is idempotent: same canonical path returns the
 * existing record. New records are prepended, so we register in reverse then
 * `insertBefore` to pin 搞钱 → 产品 → 运营 → 人事助理 → 财务助理 → 法务助理
+* （运营身份：设计 → 人事助理 → 财务助理 → 法务助理；
+* 工程师身份：实验室 → 人事助理 → 财务助理 → 法务助理）
 * (微信 stays after that block). `delete` only drops the registry row —
 * directories and session logs stay.
 */
@@ -7881,6 +8084,16 @@ const STAFF_ROOMS = [
 		folder: "法务助理"
 	}
 ];
+/** 运营身份专用。不是全员助理，也不是老板「运营」简报室。 */
+const OPS_ROOMS = [{
+	id: "design",
+	folder: "设计"
+}];
+/** 工程师身份专用。ESPHome YAML → 实验室服务器编译 firmware.bin。 */
+const ENGINEER_ROOMS = [{
+	id: "lab",
+	folder: "实验室"
+}];
 /** User-owned files. Re-seeding never overwrites these. */
 const LIVING_BASENAMES = /* @__PURE__ */ new Set([
 	"USER.md",
@@ -7917,6 +8130,12 @@ function seedBossWorkspaces(options) {
 function seedStaffWorkspaces(options) {
 	return seedRooms(options.destRoot, STAFF_ROOMS, options.templatesRoot ?? defaultStaffTemplatesRoot());
 }
+function seedOpsWorkspaces(options) {
+	return seedRooms(options.destRoot, OPS_ROOMS, options.templatesRoot ?? defaultStaffTemplatesRoot());
+}
+function seedEngineerWorkspaces(options) {
+	return seedRooms(options.destRoot, ENGINEER_ROOMS, options.templatesRoot ?? defaultStaffTemplatesRoot());
+}
 function seedRoom(templatesRoot, destRoot, room) {
 	const src = join(templatesRoot, room.id);
 	const dest = join(destRoot, room.folder);
@@ -7983,12 +8202,18 @@ const BOSS_GUIDANCE = [
 	"每个文件夹是独立作战室，官方 dsh 会注入该目录 AGENTS.md。",
 	"若该室仍有 BOOTSTRAP.md：本会话先做短问三拍，沉淀到 PRIORITIES.md / MEMORY.md，然后删除 BOOTSTRAP.md。",
 	"已初始化后：读 PRIORITIES.md + MEMORY.md + 今日/昨日 memory/；老板三室回答固定四行：结论 → 数字（哪家公司、哪段时间）→ 拍板 1～3 件事 → 未执行任何过账/付款/对外发送。",
+	"拍图与品牌规范终审在产品室。运营岗在「设计」房间交待审；你说审批了哪份之后，shot 与 clean 同时写入 RAW（产品图走 SKU 路径，品牌规范/VI 走 Marketing/RAW/Brand/）。不要在运营室做修图。",
 	"微信文件夹仍是收件箱，不要在那边查账、报销或砍 SKU。",
 	"用户用中文就中文、用英文就英文；不要因为工作区文件是中文就强制中文。"
 ].join("");
-const BOSS_ROLE_HINT = "搞钱 / 产品 / 运营仅角色选「老板」时出现。人事 / 财务 / 法务助理所有角色都会登记。";
+const BOSS_ROLE_HINT = "搞钱 / 产品 / 运营仅角色选「老板」时出现。人事 / 财务 / 法务助理所有角色都会登记。设计工作房间仅「运营」身份出现。实验室仅「工程师」身份出现。";
+const ENGINEER_LAB_GUIDANCE = ["当前身份是工程师。侧栏第一间是实验室：对方说板型/功能就自己写 ESPHome YAML，或用回形针/粘贴。调 mcp__esphome__compile（或 rez_esphome_compile）。", "立刻把下载链接发给对方。编译要时间：先点开可能是 README.md，编完刷新就是 firmware.bin；失败也是 README（含日志）。不要把 bin 贴进对话。未开通就说未开通。不要自写编译器，不要自写 Device Builder WebSocket，不要默认 OTA 刷机。"].join("");
+const OPS_DESIGN_GUIDANCE = ["当前身份是运营。侧栏第一间是设计工作房间：产品拍摄图、品牌规范、公司 VI 都在这里交。拍原片或 VI 图用官方 Comfy MCP 只修一次；规范 PDF / 源文件用回形针、不修。员工声明类型、Inbox 待审并转凯文。终审只在老板产品室。", "不要代批、不要直接写 RAW、不要写 Publish、不要做图生场景或白底。搞钱 / 产品 / 运营仅老板身份出现。"].join("");
 function workspaceGuidanceFor(role) {
-	return role === "boss" ? BOSS_GUIDANCE : STAFF_GUIDANCE + BOSS_ROLE_HINT;
+	if (role === "boss") return BOSS_GUIDANCE;
+	if (role === "operations") return STAFF_GUIDANCE + OPS_DESIGN_GUIDANCE;
+	if (role === "engineer") return STAFF_GUIDANCE + ENGINEER_LAB_GUIDANCE;
+	return STAFF_GUIDANCE + BOSS_ROLE_HINT;
 }
 function destRoot(env = process.env) {
 	if (env.REZ_BOSS_WORKSPACES !== void 0 && env.REZ_BOSS_WORKSPACES !== "") return env.REZ_BOSS_WORKSPACES;
@@ -8007,11 +8232,21 @@ function expectedBossRooms(env = process.env) {
 function expectedStaffRooms(env = process.env) {
 	return refsFor(STAFF_ROOMS, env);
 }
+function expectedOpsRooms(env = process.env) {
+	return refsFor(OPS_ROOMS, env);
+}
+function expectedEngineerRooms(env = process.env) {
+	return refsFor(ENGINEER_ROOMS, env);
+}
 async function syncRezWorkspaces(registry, role, env = process.env) {
 	await registerWorkspaces(registry, seedStaffWorkspaces({ destRoot: destRoot(env) }).rooms);
 	if (role === "boss") await registerWorkspaces(registry, seedBossWorkspaces({ destRoot: destRoot(env) }).rooms);
 	else await unregisterWorkspaces(registry, expectedBossRooms(env));
-	await orderWorkspaces(registry, role === "boss" ? [...expectedBossRooms(env), ...expectedStaffRooms(env)] : expectedStaffRooms(env));
+	if (role === "operations") await registerWorkspaces(registry, seedOpsWorkspaces({ destRoot: destRoot(env) }).rooms);
+	else await unregisterWorkspaces(registry, expectedOpsRooms(env));
+	if (role === "engineer") await registerWorkspaces(registry, seedEngineerWorkspaces({ destRoot: destRoot(env) }).rooms);
+	else await unregisterWorkspaces(registry, expectedEngineerRooms(env));
+	await orderWorkspaces(registry, role === "boss" ? [...expectedBossRooms(env), ...expectedStaffRooms(env)] : role === "operations" ? [...expectedOpsRooms(env), ...expectedStaffRooms(env)] : role === "engineer" ? [...expectedEngineerRooms(env), ...expectedStaffRooms(env)] : expectedStaffRooms(env));
 }
 /** Seed/register staff for every role; boss rooms only when role=boss. */
 function mountRezWorkspaces(ctx, getRole) {
@@ -8387,6 +8622,13 @@ const Config = Schema.object({
 		}).default(REZ_DEFAULT_CONNECTIONS.tianyancha ?? {
 			enabled: true,
 			url: "https://mcp.tianyancha.com/mcp"
+		}),
+		esphome: Schema.object({
+			enabled: Schema.boolean().default(true),
+			url: Schema.string().default(REZ_DEFAULT_CONNECTIONS.esphome?.url ?? "http://127.0.0.1:8100/mcp")
+		}).default(REZ_DEFAULT_CONNECTIONS.esphome ?? {
+			enabled: true,
+			url: "http://127.0.0.1:8100/mcp"
 		})
 	}).default(REZ_DEFAULT_CONNECTIONS),
 	billing: Schema.object({
@@ -8408,7 +8650,10 @@ const REZ_GUIDANCE_CORE = [
 	"意图用 rez_set_intent（erp/files/chat/home/auto）。审计用 rez_audit。",
 	"涉及资金、对外发送、设备控制、生产写入时先征得用户批准。",
 	"Match the user language: Chinese or English. Do not force 中文 when they write English.",
-	"制度、手册、出差/报销标准、素材路径：打开 Nextcloud Documents/Standards/INDEX.yaml，按 code 取当前 effective_from 最新且未被 replace 的条目，再按相对 uri 打开。引用带路径+生效日。找不到就说「标准文件未归档」，不要用 MEMORY 旧数字。素材文件夹用首次创建标题，不用会变的 Odoo/销售名。"
+	"制度、手册、出差/报销标准、素材路径：打开 Nextcloud Documents/Standards/INDEX.yaml，按 code 取当前 effective_from 最新且未被 replace 的条目，再按相对 uri 打开。引用带路径+生效日。找不到就说「标准文件未归档」，不要用 MEMORY 旧数字。素材文件夹用首次创建标题，不用会变的 Odoo/销售名。",
+	"同事交说明书/规格书：用输入栏回形针上传原 PDF（不要拖进对话——官方只收图；也不要用微信发文件）。不要直接写 Marketing/Publish。先找到该产品对应 TAPD 需求（Wiki 写死的说明书/规格书 TAPD ID；没有则按首次创建标题搜「产品使用说明书」或「技术手册」），把 PDF 放到 Marketing/Inbox/{分类}/{首次创建标题}/manual/ 或 datasheet/（zh.pdf 或 en.pdf），评论该需求、状态改测试中（status_3）、处理人改凯文智能家居。规划中先转到开发中再测试中；已实现要先退回开发中。凯文说审批了哪份（产品、说明书或规格书、中英）之后，再把 Inbox 文件写入 Marketing/Publish 对应路径，TAPD 改已实现。拒绝则改已拒绝、不写 Publish。Wiki 缺 NC RAW、NC Publish、Git products/{slug}/models 与 motion 就说「Wiki 未归档」。这不是一件发布；不要拷下游、不要上渠道。",
+	"同事交拍摄原片：对话里交图即可。先调官方 Comfy MCP 只修一次，得到高精度干净原片；Harness 不做推理，不要自写 WebSocket。这不是图生场景图也不是图生白底图。修完后员工必须声明是什么图（white_bg/scene/label/gallery/packaging，写进 TAPD 评论）；未声明不准进审批。不要直接写 Marketing/RAW。两种都先放到 Marketing/Inbox/{分类}/{首次创建标题}/photo/shot/ 与 photo/clean/。对应 TAPD（Wiki 写死的拍摄图 TAPD ID；没有则按首次创建标题搜「产品拍摄」；还没有则评论 1154488930001001218）改测试中、处理人改凯文智能家居。凯文说审批了哪份之后，shot 与 clean 同时写入 Marketing/RAW 对应路径，TAPD 改已实现。拒绝不写 RAW。不要写 Publish、不要上渠道。现有 photo/ 根目录或产品根目录样板不强制搬家。",
+	"同事交品牌规范或公司 VI：这是公司级，写 Marketing/Brand/，不要写进某个产品 SKU 目录。规范 PDF 和 psd/ai 源文件用回形针；VI 图在对话里交，才调官方 Comfy MCP 只修一次。声明类型（guideline 或 logo/wordmark/icon/color/font/template）后，两种先入 Marketing/Inbox/Brand/guideline/ 或 vi/ 的 shot 与 clean。评论 1154488930001001220，改测试中、处理人凯文智能家居。凯文说审批了哪份之后，shot 与 clean 同时写入 Marketing/RAW/Brand 对应路径。拒绝不写 RAW。不要写 Publish。根上 VI/ 与 MKT/VI 是历史盘，不搬家、不再当正式路径。不要把规范抄进 Standards 正文。"
 ].join("");
 function rezGuidanceFor(role) {
 	return REZ_GUIDANCE_CORE + workspaceGuidanceFor(role);
@@ -8439,14 +8684,19 @@ function apply(ctx, config) {
 	const syncWorkspaces = mountRezWorkspaces(ctx, () => current().role);
 	const syncQcc = mountQccMcp(ctx);
 	const syncTianyancha = mountTianyanchaMcp(ctx, () => current().role);
+	const syncEsphome = mountEsphomeMcp(ctx);
 	const tokens = new TokenManager(joinTokenDb());
 	const host = delegatedHost(ctx, () => current());
 	ctx.effect(() => () => {
 		tokens.close();
 	}, "dsh-rez-suite: ledger view");
 	const toolsHost = ctx.tools;
-	if (typeof toolsHost.guard === "function") ctx.effect(() => toolsHost.guard(qccRoomGuard), "dsh-rez-suite: qcc room guard");
-	const tools = [rezStatusTool(host, () => current()), rezConfigTool(() => current())];
+	if (typeof toolsHost.guard === "function") ctx.effect(() => toolsHost.guard(suiteRoomGuard), "dsh-rez-suite: room guard");
+	const tools = [
+		rezStatusTool(host, () => current()),
+		rezConfigTool(() => current()),
+		rezEsphomeCompileTool()
+	];
 	const routes = makeRoutes({
 		getConfig: () => current(),
 		updateConfig: async (next) => {
@@ -8456,6 +8706,7 @@ function apply(ctx, config) {
 			syncWorkspaces();
 			syncQcc();
 			syncTianyancha();
+			syncEsphome();
 			try {
 				const settings = ctx.get("settings");
 				if (settings?.update !== void 0) await settings.update(REZ_SETTINGS_NAMESPACE, value);
@@ -8515,12 +8766,14 @@ function apply(ctx, config) {
 			syncWorkspaces();
 			syncQcc();
 			syncTianyancha();
+			syncEsphome();
 		},
 		onChange: () => {
 			sync();
 			syncWorkspaces();
 			syncQcc();
 			syncTianyancha();
+			syncEsphome();
 		}
 	});
 	sync();

package/lib/style.css

@@ -415,3 +415,46 @@
   width: 7px;
   height: 7px;
 }
+
+.LOjPTW_changelogDate {
+  font-variant-numeric: tabular-nums;
+  color: var(--dsw-alias-label-tertiary);
+  margin-left: 8px;
+  font-weight: 500;
+}
+
+.LOjPTW_changelogBlock {
+  flex-direction: column;
+  gap: 6px;
+  display: flex;
+}
+
+.LOjPTW_changelogHeading {
+  color: var(--dsw-alias-label-secondary);
+  font-size: 12.5px;
+  font-weight: 600;
+}
+
+.LOjPTW_changelogList {
+  color: var(--dsw-alias-label-primary);
+  flex-direction: column;
+  gap: 6px;
+  margin: 0;
+  padding-left: 18px;
+  font-size: 13px;
+  line-height: 1.55;
+  display: flex;
+}
+
+.LOjPTW_changelogList li + li {
+  margin: 0;
+}
+
+.LOjPTW_changelogCode {
+  background: var(--dsw-alias-bg-layer-3);
+  border: 1px solid var(--dsw-alias-border-l2);
+  word-break: break-all;
+  border-radius: 6px;
+  padding: 1px 6px;
+  font-size: 12px;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rezti/dsh-rez-suite",
-  "description": "ReZ-TI one-package install for DeepSeek Harness. Update with: dsh plugin --profile web add @rezti/dsh-rez-suite@latest",
-  "version": "0.1.45",
+  "description": "ReZ-TI one-package install for DeepSeek Harness. Update with: dsh plugin --profile web add @rezti/dsh-rez-suite@0.1.47",
+  "version": "0.1.47",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -40,12 +40,13 @@
     "@rezti/dsh-rez-gsc": "^0.1.1",
     "@rezti/dsh-rez-ha-bridge": "^0.1.9",
     "@rezti/dsh-rez-intent": "^0.1.5",
-    "@rezti/dsh-rez-nextcloud": "^0.1.10",
+    "@rezti/dsh-rez-nextcloud": "^0.1.11",
     "@rezti/dsh-rez-odoo": "^0.1.9",
-    "@rezti/dsh-rez-sso": "^0.1.13",
+    "@rezti/dsh-rez-sso": "^0.1.14",
     "@rezti/dsh-rez-tapd": "^0.1.1",
     "@rezti/dsh-rez-token-manager": "^0.1.4",
     "@rezti/dsh-rez-wechat": "^0.1.14",
+    "@rezti/dsh-web-file-uploader": "0.2.2",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^4.4.3"
   },
@@ -89,7 +90,8 @@
     "templates/staff/**/*",
     "cordis.patch.yml",
     "README.md",
-    "README.zh.md"
+    "README.zh.md",
+    "CHANGELOG.md"
   ],
   "license": "Apache-2.0",
   "publishConfig": {

package/src/boss/mount.ts

@@ -9,7 +9,7 @@ import {
   type RoomRef,
   type WorkspaceRegistrar,
 } from './register.ts'
-import { BOSS_ROOMS, STAFF_ROOMS, seedBossWorkspaces, seedStaffWorkspaces } from './seed.ts'
+import { BOSS_ROOMS, ENGINEER_ROOMS, OPS_ROOMS, STAFF_ROOMS, seedBossWorkspaces, seedEngineerWorkspaces, seedOpsWorkspaces, seedStaffWorkspaces } from './seed.ts'
 
 export const STAFF_GUIDANCE = [
   '侧栏已登记人事助理 / 财务助理 / 法务助理。装完、选身份后自动出现，不必手动「添加工作区」、也不必拖排序。',
@@ -23,14 +23,28 @@ export const BOSS_GUIDANCE = [
   '每个文件夹是独立作战室，官方 dsh 会注入该目录 AGENTS.md。',
   '若该室仍有 BOOTSTRAP.md：本会话先做短问三拍，沉淀到 PRIORITIES.md / MEMORY.md，然后删除 BOOTSTRAP.md。',
   '已初始化后：读 PRIORITIES.md + MEMORY.md + 今日/昨日 memory/；老板三室回答固定四行：结论 → 数字（哪家公司、哪段时间）→ 拍板 1～3 件事 → 未执行任何过账/付款/对外发送。',
+  '拍图与品牌规范终审在产品室。运营岗在「设计」房间交待审；你说审批了哪份之后，shot 与 clean 同时写入 RAW（产品图走 SKU 路径，品牌规范/VI 走 Marketing/RAW/Brand/）。不要在运营室做修图。',
   '微信文件夹仍是收件箱，不要在那边查账、报销或砍 SKU。',
   '用户用中文就中文、用英文就英文；不要因为工作区文件是中文就强制中文。',
 ].join('')
 
-export const BOSS_ROLE_HINT = '搞钱 / 产品 / 运营仅角色选「老板」时出现。人事 / 财务 / 法务助理所有角色都会登记。'
+export const BOSS_ROLE_HINT = '搞钱 / 产品 / 运营仅角色选「老板」时出现。人事 / 财务 / 法务助理所有角色都会登记。设计工作房间仅「运营」身份出现。实验室仅「工程师」身份出现。'
+
+export const ENGINEER_LAB_GUIDANCE = [
+  '当前身份是工程师。侧栏第一间是实验室：对方说板型/功能就自己写 ESPHome YAML，或用回形针/粘贴。调 mcp__esphome__compile（或 rez_esphome_compile）。',
+  '立刻把下载链接发给对方。编译要时间：先点开可能是 README.md，编完刷新就是 firmware.bin；失败也是 README（含日志）。不要把 bin 贴进对话。未开通就说未开通。不要自写编译器，不要自写 Device Builder WebSocket，不要默认 OTA 刷机。',
+].join('')
+
+export const OPS_DESIGN_GUIDANCE = [
+  '当前身份是运营。侧栏第一间是设计工作房间：产品拍摄图、品牌规范、公司 VI 都在这里交。拍原片或 VI 图用官方 Comfy MCP 只修一次；规范 PDF / 源文件用回形针、不修。员工声明类型、Inbox 待审并转凯文。终审只在老板产品室。',
+  '不要代批、不要直接写 RAW、不要写 Publish、不要做图生场景或白底。搞钱 / 产品 / 运营仅老板身份出现。',
+].join('')
 
 export function workspaceGuidanceFor(role: RezRoleId): string {
-  return role === 'boss' ? BOSS_GUIDANCE : STAFF_GUIDANCE + BOSS_ROLE_HINT
+  if (role === 'boss') return BOSS_GUIDANCE
+  if (role === 'operations') return STAFF_GUIDANCE + OPS_DESIGN_GUIDANCE
+  if (role === 'engineer') return STAFF_GUIDANCE + ENGINEER_LAB_GUIDANCE
+  return STAFF_GUIDANCE + BOSS_ROLE_HINT
 }
 
 /** @deprecated use workspaceGuidanceFor */
@@ -57,6 +71,14 @@ export function expectedStaffRooms(env: NodeJS.ProcessEnv = process.env): RoomRe
   return refsFor(STAFF_ROOMS, env)
 }
 
+export function expectedOpsRooms(env: NodeJS.ProcessEnv = process.env): RoomRef[] {
+  return refsFor(OPS_ROOMS, env)
+}
+
+export function expectedEngineerRooms(env: NodeJS.ProcessEnv = process.env): RoomRef[] {
+  return refsFor(ENGINEER_ROOMS, env)
+}
+
 export async function syncRezWorkspaces(
   registry: WorkspaceRegistrar,
   role: RezRoleId,
@@ -72,9 +94,27 @@ export async function syncRezWorkspaces(
     await unregisterWorkspaces(registry, expectedBossRooms(env))
   }
 
+  if (role === 'operations') {
+    const ops = seedOpsWorkspaces({ destRoot: destRoot(env) })
+    await registerWorkspaces(registry, ops.rooms)
+  } else {
+    await unregisterWorkspaces(registry, expectedOpsRooms(env))
+  }
+
+  if (role === 'engineer') {
+    const engineer = seedEngineerWorkspaces({ destRoot: destRoot(env) })
+    await registerWorkspaces(registry, engineer.rooms)
+  } else {
+    await unregisterWorkspaces(registry, expectedEngineerRooms(env))
+  }
+
   const visible = role === 'boss'
     ? [...expectedBossRooms(env), ...expectedStaffRooms(env)]
-    : expectedStaffRooms(env)
+    : role === 'operations'
+      ? [...expectedOpsRooms(env), ...expectedStaffRooms(env)]
+      : role === 'engineer'
+        ? [...expectedEngineerRooms(env), ...expectedStaffRooms(env)]
+        : expectedStaffRooms(env)
   await orderWorkspaces(registry, visible)
 }
 

package/src/boss/register.ts

@@ -3,6 +3,8 @@
  * `workspaceRegistry.create` is idempotent: same canonical path returns the
  * existing record. New records are prepended, so we register in reverse then
  * `insertBefore` to pin 搞钱 → 产品 → 运营 → 人事助理 → 财务助理 → 法务助理
+ * （运营身份：设计 → 人事助理 → 财务助理 → 法务助理；
+ * 工程师身份：实验室 → 人事助理 → 财务助理 → 法务助理）
  * (微信 stays after that block). `delete` only drops the registry row —
  * directories and session logs stay.
  */

package/src/boss/seed.ts

@@ -14,9 +14,21 @@ export const STAFF_ROOMS = [
   { id: 'legal', folder: '法务助理' },
 ] as const
 
+/** 运营身份专用。不是全员助理，也不是老板「运营」简报室。 */
+export const OPS_ROOMS = [
+  { id: 'design', folder: '设计' },
+] as const
+
+/** 工程师身份专用。ESPHome YAML → 实验室服务器编译 firmware.bin。 */
+export const ENGINEER_ROOMS = [
+  { id: 'lab', folder: '实验室' },
+] as const
+
 export type BossRoomId = (typeof BOSS_ROOMS)[number]['id']
 export type StaffRoomId = (typeof STAFF_ROOMS)[number]['id']
-export type RoomId = BossRoomId | StaffRoomId
+export type OpsRoomId = (typeof OPS_ROOMS)[number]['id']
+export type EngineerRoomId = (typeof ENGINEER_ROOMS)[number]['id']
+export type RoomId = BossRoomId | StaffRoomId | OpsRoomId | EngineerRoomId
 export type RoomSpec = { id: string; folder: string }
 
 /** User-owned files. Re-seeding never overwrites these. */
@@ -96,6 +108,22 @@ export function seedStaffWorkspaces(options: SeedOptions): SeedResult {
   )
 }
 
+export function seedOpsWorkspaces(options: SeedOptions): SeedResult {
+  return seedRooms(
+    options.destRoot,
+    OPS_ROOMS,
+    options.templatesRoot ?? defaultStaffTemplatesRoot(),
+  )
+}
+
+export function seedEngineerWorkspaces(options: SeedOptions): SeedResult {
+  return seedRooms(
+    options.destRoot,
+    ENGINEER_ROOMS,
+    options.templatesRoot ?? defaultStaffTemplatesRoot(),
+  )
+}
+
 function seedRoom(templatesRoot: string, destRoot: string, room: RoomSpec): SeedRoomResult {
   const src = join(templatesRoot, room.id)
   const dest = join(destRoot, room.folder)