@xmanrui/dsh-im 0.3.0 → 0.5.0

package/plugin-src/host/channels/qq/production.mjs

@@ -8,6 +8,12 @@ import { QqController } from '../../../../src/channels/qq/qq-controller.mjs';
 import { QqRuntime } from '../../../../src/channels/qq/qq-runtime.mjs';
 import { QqQrAuth } from '../../../../src/channels/qq/qr-auth.mjs';
 import { QqStateStore } from '../../../../src/channels/qq/state-store.mjs';
+import {
+  BotWorkspaceStore,
+  createBotWorkspaceScope,
+  createWorkspaceAwareController,
+  observeBotWorkspaceRemovals,
+} from '../../../../src/channels/shared/bot-workspace-store.mjs';
 import { createConnectionSupervisor } from './connection-supervisor.mjs';
 
 function harnessOrigin(webServer, configured) {
@@ -25,6 +31,7 @@ function pluginPaths(config) {
   return {
     config: resolve(config.configPath ?? join(root, 'config.json')),
     bots: resolve(config.botsDir ?? join(root, 'bots')),
+    workspaces: resolve(config.workspacesPath ?? join(root, 'workspaces.json')),
   };
 }
 
@@ -42,6 +49,16 @@ export async function createProductionController(ctx, config = {}, internals = {
   const logger = typeof ctx.logger === 'function' ? ctx.logger('dsh-im:qq') : (ctx.logger ?? console);
   const paths = pluginPaths(config);
   const configStore = await new ConfigStore(paths.config).load();
+  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
+  const workspaces = internals.workspaces
+    ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
+  const configuredBots = configStore.list();
+  await workspaces.reconcile(configuredBots.map((bot) => bot.botId));
+  await Promise.all(configuredBots.map((bot) => workspaces.ensure(bot.botId)));
+  const observedConfigStore = typeof configStore.remove === 'function'
+    ? observeBotWorkspaceRemovals(configStore, { workspaces })
+    : configStore;
   const qrAuth = internals.qrAuth ?? new QrAuth({ source: config.qrSource ?? 'deepseek-harness' });
   const stateStores = new Map();
   const statePath = (botId) => resolve(paths.bots, botId, 'state.json');
@@ -55,41 +72,50 @@ export async function createProductionController(ctx, config = {}, internals = {
   };
   const harness = new Harness({
     baseUrl: harnessOrigin(ctx.webServer, config.harnessBaseUrl),
-    workspace: resolve(config.workspace ?? process.cwd()),
+    workspace: defaultWorkspace,
     agentPreset: config.agentPreset ?? 'standard',
     autostart: false,
     dshBin: config.dshBin ?? 'dsh',
   });
-  const controller = new Controller({
+  const coreController = new Controller({
     qrAuth,
     credentials: ctx.credentials,
-    configStore,
+    configStore: observedConfigStore,
     logger,
-    createRuntime: async ({ botId, config: botConfig, appSecret }) => new Runtime({
-      config: botConfig,
-      appSecret,
-      harness,
-      state: await stateFor(botId),
-      replyTimeoutMs: config.replyTimeoutMs ?? 600_000,
-      connectTimeoutMs: config.connectTimeoutMs ?? 20_000,
-      logger: {
-        error: (...args) => logger.error?.(`[${botId}]`, ...args),
-        warn: (...args) => logger.warn?.(`[${botId}]`, ...args),
-        info: (...args) => logger.info?.(`[${botId}]`, ...args),
-        debug: (...args) => logger.debug?.(`[${botId}]`, ...args),
-      },
-    }),
+    createRuntime: async ({ botId, config: botConfig, appSecret }) => {
+      const state = await stateFor(botId);
+      await workspaces.ensure(botId);
+      const workspaceScope = createBotWorkspaceScope(harness, { botId, workspaces, state });
+      return new Runtime({
+        config: botConfig,
+        appSecret,
+        harness: workspaceScope.harness,
+        state: workspaceScope.state,
+        replyTimeoutMs: config.replyTimeoutMs ?? 600_000,
+        connectTimeoutMs: config.connectTimeoutMs ?? 20_000,
+        logger: {
+          error: (...args) => logger.error?.(`[${botId}]`, ...args),
+          warn: (...args) => logger.warn?.(`[${botId}]`, ...args),
+          info: (...args) => logger.info?.(`[${botId}]`, ...args),
+          debug: (...args) => logger.debug?.(`[${botId}]`, ...args),
+        },
+      });
+    },
     deleteState: async ({ botId }) => {
       const state = stateStores.get(botId);
       stateStores.delete(botId);
-      if (state && typeof state.remove === 'function') return state.remove();
-      try {
-        await unlink(statePath(botId));
-      } catch (error) {
-        if (error?.code !== 'ENOENT') throw error;
+      if (state && typeof state.remove === 'function') {
+        await state.remove();
+      } else {
+        try {
+          await unlink(statePath(botId));
+        } catch (error) {
+          if (error?.code !== 'ENOENT') throw error;
+        }
       }
     },
   });
+  const controller = createWorkspaceAwareController(coreController, { workspaces, stateFor });
   const supervisor = createSupervisor({
     controller,
     harness,

package/plugin-src/host/channels/qq/rpc.mjs

@@ -1,5 +1,6 @@
 import QRCode from 'qrcode';
 import { resolveRpcAuthority } from '../../rpc-authority.mjs';
+import { publicWorkspaceError, SET_WORKSPACE_ENDPOINT, validWorkspacePayload } from '../shared/workspace-rpc.mjs';
 
 export const QQ_RPC_CHANNEL = '/qq';
 export const QQ_ENDPOINTS = Object.freeze({
@@ -10,6 +11,7 @@ export const QQ_ENDPOINTS = Object.freeze({
   bindCredentials: 'bot.bind-credentials',
   reconnectBot: 'bot.reconnect',
   deleteBot: 'bot.delete',
+  setWorkspace: SET_WORKSPACE_ENDPOINT,
 });
 export const QQ_RPC_ENDPOINTS = Object.freeze(Object.values(QQ_ENDPOINTS));
 
@@ -57,6 +59,10 @@ function payloadFailure(endpoint, payload) {
     return exactKeys(payload, ['botId', 'confirm']) && validId(payload.botId) && payload.confirm === true
       ? null : 'bot.delete requires a botId and confirm=true.';
   }
+  if (endpoint === QQ_ENDPOINTS.setWorkspace) {
+    return validWorkspacePayload(payload)
+      ? null : '请输入工作区绝对路径。';
+  }
   return 'Unknown QQ endpoint.';
 }
 
@@ -120,16 +126,24 @@ export function createQqRpcHandler(controller, { encodeQr = qrDataUrl } = {}) {
         value = await publicStatus(await controller.bindCredentials(payload), cachedEncode);
       } else if (endpoint === QQ_ENDPOINTS.reconnectBot) {
         value = await publicStatus(await controller.reconnectBot(payload.botId), cachedEncode);
+      } else if (endpoint === QQ_ENDPOINTS.setWorkspace) {
+        if (typeof controller.updateWorkspace !== 'function') throw new Error('Workspace update is unavailable');
+        value = await publicStatus(
+          await controller.updateWorkspace(payload.botId, payload.workspace),
+          cachedEncode,
+        );
       } else {
         value = await publicStatus(await controller.deleteBot(payload.botId), cachedEncode);
       }
       return signal?.aborted
         ? { ok: false, error: { code: 'cancelled', message: 'The request was cancelled.' } }
         : { ok: true, value };
-    } catch {
+    } catch (error) {
+      const workspaceError = publicWorkspaceError(error);
       return signal?.aborted
         ? { ok: false, error: { code: 'cancelled', message: 'The request was cancelled.' } }
-        : { ok: false, error: { code: 'qq-operation-failed', message: 'QQ 操作失败，请稍后重试。' } };
+        : { ok: false, error: workspaceError
+          ?? { code: 'qq-operation-failed', message: 'QQ 操作失败，请稍后重试。' } };
     }
   };
 }

package/plugin-src/host/channels/shared/production.mjs

@@ -3,6 +3,12 @@ import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 
 import { createTokenConnectionSupervisor } from './connection-supervisor.mjs';
+import {
+  BotWorkspaceStore,
+  createBotWorkspaceScope,
+  createWorkspaceAwareController,
+  observeBotWorkspaceRemovals,
+} from '../../../../src/channels/shared/bot-workspace-store.mjs';
 
 export function harnessOrigin(webServer, configured) {
   if (configured !== undefined) return new URL(configured);
@@ -19,6 +25,7 @@ export function pluginPaths(config, channel) {
   return {
     config: resolve(config.configPath ?? join(root, 'config.json')),
     bots: resolve(config.botsDir ?? join(root, 'bots')),
+    workspaces: resolve(config.workspacesPath ?? join(root, 'workspaces.json')),
   };
 }
 
@@ -37,6 +44,16 @@ export async function createTokenProductionController(ctx, config, internals, de
     ? ctx.logger(`dsh-im:${channel}`) : (ctx.logger ?? console);
   const paths = pluginPaths(config, channel);
   const configStore = await new ResolvedConfigStore(paths.config).load();
+  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
+  const workspaces = internals.workspaces
+    ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
+  const configuredBots = configStore.list();
+  await workspaces.reconcile(configuredBots.map((bot) => bot.botId));
+  await Promise.all(configuredBots.map((bot) => workspaces.ensure(bot.botId)));
+  const observedConfigStore = typeof configStore.remove === 'function'
+    ? observeBotWorkspaceRemovals(configStore, { workspaces })
+    : configStore;
   const stateStores = new Map();
   const statePath = (botId) => resolve(paths.bots, botId, 'state.json');
   const stateFor = async (botId) => {
@@ -49,41 +66,50 @@ export async function createTokenProductionController(ctx, config, internals, de
   };
   const harness = new ResolvedHarness({
     baseUrl: harnessOrigin(ctx.webServer, config.harnessBaseUrl),
-    workspace: resolve(config.workspace ?? process.cwd()),
+    workspace: defaultWorkspace,
     agentPreset: config.agentPreset ?? 'standard',
     autostart: false,
     dshBin: config.dshBin ?? 'dsh',
   });
-  const controller = new ResolvedController({
+  const coreController = new ResolvedController({
     credentials: ctx.credentials,
-    configStore,
+    configStore: observedConfigStore,
     logger,
     ...(internals.inspectToken ? { inspectToken: internals.inspectToken } : {}),
-    createRuntime: async ({ botId, config: botConfig, token }) => new ResolvedRuntime({
-      config: botConfig,
-      token,
-      harness,
-      state: await stateFor(botId),
-      replyTimeoutMs: config.replyTimeoutMs ?? 600_000,
-      connectTimeoutMs: config.connectTimeoutMs ?? 20_000,
-      logger: {
-        error: (...args) => logger.error?.(`[${botId}]`, ...args),
-        warn: (...args) => logger.warn?.(`[${botId}]`, ...args),
-        info: (...args) => logger.info?.(`[${botId}]`, ...args),
-        debug: (...args) => logger.debug?.(`[${botId}]`, ...args),
-      },
-    }),
+    createRuntime: async ({ botId, config: botConfig, token }) => {
+      const state = await stateFor(botId);
+      await workspaces.ensure(botId);
+      const workspaceScope = createBotWorkspaceScope(harness, { botId, workspaces, state });
+      return new ResolvedRuntime({
+        config: botConfig,
+        token,
+        harness: workspaceScope.harness,
+        state: workspaceScope.state,
+        replyTimeoutMs: config.replyTimeoutMs ?? 600_000,
+        connectTimeoutMs: config.connectTimeoutMs ?? 20_000,
+        logger: {
+          error: (...args) => logger.error?.(`[${botId}]`, ...args),
+          warn: (...args) => logger.warn?.(`[${botId}]`, ...args),
+          info: (...args) => logger.info?.(`[${botId}]`, ...args),
+          debug: (...args) => logger.debug?.(`[${botId}]`, ...args),
+        },
+      });
+    },
     deleteState: async ({ botId }) => {
       const state = stateStores.get(botId);
       stateStores.delete(botId);
-      if (state && typeof state.remove === 'function') return state.remove();
-      try {
-        await unlink(statePath(botId));
-      } catch (error) {
-        if (error?.code !== 'ENOENT') throw error;
+      if (state && typeof state.remove === 'function') {
+        await state.remove();
+      } else {
+        try {
+          await unlink(statePath(botId));
+        } catch (error) {
+          if (error?.code !== 'ENOENT') throw error;
+        }
       }
     },
   });
+  const controller = createWorkspaceAwareController(coreController, { workspaces, stateFor });
   const supervisor = createSupervisor({
     channel,
     controller,

package/plugin-src/host/channels/shared/rpc.mjs

@@ -1,10 +1,16 @@
 import { resolveRpcAuthority } from '../../rpc-authority.mjs';
+import {
+  publicWorkspaceError,
+  SET_WORKSPACE_ENDPOINT,
+  validWorkspacePayload,
+} from './workspace-rpc.mjs';
 
 export const TOKEN_BOT_ENDPOINTS = Object.freeze({
   status: 'connection.status',
   bindCredentials: 'bot.bind-credentials',
   reconnectBot: 'bot.reconnect',
   deleteBot: 'bot.delete',
+  setWorkspace: SET_WORKSPACE_ENDPOINT,
 });
 
 const ENDPOINTS = Object.freeze(Object.values(TOKEN_BOT_ENDPOINTS));
@@ -45,6 +51,10 @@ function payloadFailure(endpoint, payload) {
     return exactKeys(payload, ['botId', 'confirm']) && validId(payload.botId) && payload.confirm === true
       ? null : 'bot.delete requires a botId and confirm=true.';
   }
+  if (endpoint === TOKEN_BOT_ENDPOINTS.setWorkspace) {
+    return validWorkspacePayload(payload)
+      ? null : '请输入工作区绝对路径。';
+  }
   return 'Unknown bot endpoint.';
 }
 
@@ -59,6 +69,8 @@ function sanitizePublic(value) {
 }
 
 function operationError(channel, error) {
+  const workspaceError = publicWorkspaceError(error);
+  if (workspaceError) return workspaceError;
   if (error?.code === 'webhook-configured') {
     return { code: 'webhook-configured', message: error.message };
   }
@@ -93,6 +105,9 @@ export function createTokenBotRpcHandler(controller, { channel }) {
         value = await controller.bindCredentials(payload);
       } else if (endpoint === TOKEN_BOT_ENDPOINTS.reconnectBot) {
         value = await controller.reconnectBot(payload.botId);
+      } else if (endpoint === TOKEN_BOT_ENDPOINTS.setWorkspace) {
+        if (typeof controller.updateWorkspace !== 'function') throw new Error('Workspace update is unavailable');
+        value = await controller.updateWorkspace(payload.botId, payload.workspace);
       } else {
         value = await controller.deleteBot(payload.botId);
       }

package/plugin-src/host/channels/shared/workspace-rpc.mjs

@@ -0,0 +1,25 @@
+import { isAbsolute } from 'node:path';
+
+export const SET_WORKSPACE_ENDPOINT = 'bot.workspace.set';
+
+export function validWorkspacePayload(payload) {
+  return payload !== null
+    && typeof payload === 'object'
+    && !Array.isArray(payload)
+    && Object.keys(payload).every((key) => ['botId', 'workspace'].includes(key))
+    && typeof payload.botId === 'string'
+    && /^[A-Za-z0-9_-]{1,128}$/.test(payload.botId)
+    && typeof payload.workspace === 'string'
+    && payload.workspace.length <= 4_096
+    && isAbsolute(payload.workspace.trim());
+}
+
+export function publicWorkspaceError(error) {
+  if (![
+    'workspace-not-absolute',
+    'workspace-not-found',
+    'workspace-not-directory',
+    'workspace-bot-not-found',
+  ].includes(error?.code)) return null;
+  return { code: error.code, message: error.message };
+}

package/plugin-src/host/channels/slack/production.mjs

@@ -6,6 +6,12 @@ import { SlackController } from '../../../../src/channels/slack/slack-controller
 import { SlackHarnessClient } from '../../../../src/channels/slack/harness-client.mjs';
 import { SlackRuntime } from '../../../../src/channels/slack/slack-runtime.mjs';
 import { SlackStateStore } from '../../../../src/channels/slack/state-store.mjs';
+import {
+  BotWorkspaceStore,
+  createBotWorkspaceScope,
+  createWorkspaceAwareController,
+  observeBotWorkspaceRemovals,
+} from '../../../../src/channels/shared/bot-workspace-store.mjs';
 import { createTokenConnectionSupervisor } from '../shared/connection-supervisor.mjs';
 import { harnessOrigin, pluginPaths } from '../shared/production.mjs';
 
@@ -23,6 +29,16 @@ export async function createProductionController(ctx, config = {}, internals = {
     ? ctx.logger('dsh-im:slack') : (ctx.logger ?? console);
   const paths = pluginPaths(config, 'slack');
   const configStore = await new ResolvedConfigStore(paths.config).load();
+  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
+  const workspaces = internals.workspaces
+    ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
+  const configuredBots = configStore.list();
+  await workspaces.reconcile(configuredBots.map((bot) => bot.botId));
+  await Promise.all(configuredBots.map((bot) => workspaces.ensure(bot.botId)));
+  const observedConfigStore = typeof configStore.remove === 'function'
+    ? observeBotWorkspaceRemovals(configStore, { workspaces })
+    : configStore;
   const stateStores = new Map();
   const statePath = (botId) => resolve(paths.bots, botId, 'state.json');
   const stateFor = async (botId) => {
@@ -35,42 +51,51 @@ export async function createProductionController(ctx, config = {}, internals = {
   };
   const harness = new ResolvedHarness({
     baseUrl: harnessOrigin(ctx.webServer, config.harnessBaseUrl),
-    workspace: resolve(config.workspace ?? process.cwd()),
+    workspace: defaultWorkspace,
     agentPreset: config.agentPreset ?? 'standard',
     autostart: false,
     dshBin: config.dshBin ?? 'dsh',
   });
-  const controller = new ResolvedController({
+  const coreController = new ResolvedController({
     credentials: ctx.credentials,
-    configStore,
+    configStore: observedConfigStore,
     logger,
     ...(internals.inspectCredentials ? { inspectCredentials: internals.inspectCredentials } : {}),
-    createRuntime: async ({ botId, config: botConfig, botToken, appToken }) => new ResolvedRuntime({
-      config: botConfig,
-      botToken,
-      appToken,
-      harness,
-      state: await stateFor(botId),
-      replyTimeoutMs: config.replyTimeoutMs ?? 600_000,
-      connectTimeoutMs: config.connectTimeoutMs ?? 20_000,
-      logger: {
-        error: (...args) => logger.error?.(`[${botId}]`, ...args),
-        warn: (...args) => logger.warn?.(`[${botId}]`, ...args),
-        info: (...args) => logger.info?.(`[${botId}]`, ...args),
-        debug: (...args) => logger.debug?.(`[${botId}]`, ...args),
-      },
-    }),
+    createRuntime: async ({ botId, config: botConfig, botToken, appToken }) => {
+      const state = await stateFor(botId);
+      await workspaces.ensure(botId);
+      const workspaceScope = createBotWorkspaceScope(harness, { botId, workspaces, state });
+      return new ResolvedRuntime({
+        config: botConfig,
+        botToken,
+        appToken,
+        harness: workspaceScope.harness,
+        state: workspaceScope.state,
+        replyTimeoutMs: config.replyTimeoutMs ?? 600_000,
+        connectTimeoutMs: config.connectTimeoutMs ?? 20_000,
+        logger: {
+          error: (...args) => logger.error?.(`[${botId}]`, ...args),
+          warn: (...args) => logger.warn?.(`[${botId}]`, ...args),
+          info: (...args) => logger.info?.(`[${botId}]`, ...args),
+          debug: (...args) => logger.debug?.(`[${botId}]`, ...args),
+        },
+      });
+    },
     deleteState: async ({ botId }) => {
       const state = stateStores.get(botId);
       stateStores.delete(botId);
-      if (state && typeof state.remove === 'function') return state.remove();
-      try {
-        await unlink(statePath(botId));
-      } catch (error) {
-        if (error?.code !== 'ENOENT') throw error;
+      if (state && typeof state.remove === 'function') {
+        await state.remove();
+      } else {
+        try {
+          await unlink(statePath(botId));
+        } catch (error) {
+          if (error?.code !== 'ENOENT') throw error;
+        }
       }
     },
   });
+  const controller = createWorkspaceAwareController(coreController, { workspaces, stateFor });
   const supervisor = createSupervisor({
     channel: 'slack',
     controller,

package/plugin-src/host/channels/slack/rpc.mjs

@@ -1,4 +1,9 @@
 import { resolveRpcAuthority } from '../../rpc-authority.mjs';
+import {
+  publicWorkspaceError,
+  SET_WORKSPACE_ENDPOINT,
+  validWorkspacePayload,
+} from '../shared/workspace-rpc.mjs';
 
 export const SLACK_RPC_CHANNEL = '/slack';
 export const SLACK_ENDPOINTS = Object.freeze({
@@ -6,6 +11,7 @@ export const SLACK_ENDPOINTS = Object.freeze({
   bindCredentials: 'bot.bind-credentials',
   reconnectBot: 'bot.reconnect',
   deleteBot: 'bot.delete',
+  setWorkspace: SET_WORKSPACE_ENDPOINT,
 });
 export const SLACK_RPC_ENDPOINTS = Object.freeze(Object.values(SLACK_ENDPOINTS));
 
@@ -54,6 +60,10 @@ function payloadFailure(endpoint, payload) {
     return exactKeys(payload, ['botId', 'confirm']) && validId(payload.botId) && payload.confirm === true
       ? null : 'bot.delete requires a botId and confirm=true.';
   }
+  if (endpoint === SLACK_ENDPOINTS.setWorkspace) {
+    return validWorkspacePayload(payload)
+      ? null : '请输入工作区绝对路径。';
+  }
   return 'Unknown Slack endpoint.';
 }
 
@@ -68,6 +78,8 @@ function sanitizePublic(value) {
 }
 
 function operationError(error) {
+  const workspaceError = publicWorkspaceError(error);
+  if (workspaceError) return workspaceError;
   if (error?.code === 'slack-invalid-bot-token') {
     return { code: 'invalid-bot-token', message: 'Slack Bot Token 无效，请确认使用以 xoxb- 开头的令牌。' };
   }
@@ -103,6 +115,10 @@ export function createSlackRpcHandler(controller) {
       if (endpoint === SLACK_ENDPOINTS.status) value = await controller.status();
       else if (endpoint === SLACK_ENDPOINTS.bindCredentials) value = await controller.bindCredentials(payload);
       else if (endpoint === SLACK_ENDPOINTS.reconnectBot) value = await controller.reconnectBot(payload.botId);
+      else if (endpoint === SLACK_ENDPOINTS.setWorkspace) {
+        if (typeof controller.updateWorkspace !== 'function') throw new Error('Workspace update is unavailable');
+        value = await controller.updateWorkspace(payload.botId, payload.workspace);
+      }
       else value = await controller.deleteBot(payload.botId);
       return signal?.aborted
         ? { ok: false, error: { code: 'cancelled', message: 'The request was cancelled.' } }

package/plugin-src/host/channels/wecom/production.mjs

@@ -8,6 +8,12 @@ import { WecomQrAuth } from '../../../../src/channels/wecom/qr-auth.mjs';
 import { WecomStateStore } from '../../../../src/channels/wecom/state-store.mjs';
 import { WecomController } from '../../../../src/channels/wecom/wecom-controller.mjs';
 import { WecomRuntime } from '../../../../src/channels/wecom/wecom-runtime.mjs';
+import {
+  BotWorkspaceStore,
+  createBotWorkspaceScope,
+  createWorkspaceAwareController,
+  observeBotWorkspaceRemovals,
+} from '../../../../src/channels/shared/bot-workspace-store.mjs';
 import { createConnectionSupervisor } from './connection-supervisor.mjs';
 
 function harnessOrigin(webServer, configured) {
@@ -25,6 +31,7 @@ function pluginPaths(config) {
   return {
     config: resolve(config.configPath ?? join(root, 'config.json')),
     bots: resolve(config.botsDir ?? join(root, 'bots')),
+    workspaces: resolve(config.workspacesPath ?? join(root, 'workspaces.json')),
   };
 }
 
@@ -42,6 +49,16 @@ export async function createProductionController(ctx, config = {}, internals = {
   const logger = typeof ctx.logger === 'function' ? ctx.logger('dsh-im:wecom') : (ctx.logger ?? console);
   const paths = pluginPaths(config);
   const configStore = await new ConfigStore(paths.config).load();
+  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
+  const workspaces = internals.workspaces
+    ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
+  const configuredBots = configStore.list();
+  await workspaces.reconcile(configuredBots.map((bot) => bot.botId));
+  await Promise.all(configuredBots.map((bot) => workspaces.ensure(bot.botId)));
+  const observedConfigStore = typeof configStore.remove === 'function'
+    ? observeBotWorkspaceRemovals(configStore, { workspaces })
+    : configStore;
   const qrAuth = internals.qrAuth ?? new QrAuth({
     source: config.qrSource ?? 'deepseek-harness',
     platform: config.qrPlatform,
@@ -58,42 +75,51 @@ export async function createProductionController(ctx, config = {}, internals = {
   };
   const harness = new Harness({
     baseUrl: harnessOrigin(ctx.webServer, config.harnessBaseUrl),
-    workspace: resolve(config.workspace ?? process.cwd()),
+    workspace: defaultWorkspace,
     agentPreset: config.agentPreset ?? 'standard',
     autostart: false,
     dshBin: config.dshBin ?? 'dsh',
   });
-  const controller = new Controller({
+  const coreController = new Controller({
     qrAuth,
     credentials: ctx.credentials,
-    configStore,
+    configStore: observedConfigStore,
     logger,
-    createRuntime: async ({ botId, config: botConfig, secret }) => new Runtime({
-      config: botConfig,
-      secret,
-      harness,
-      state: await stateFor(botId),
-      replyTimeoutMs: config.replyTimeoutMs ?? 600_000,
-      connectTimeoutMs: config.connectTimeoutMs ?? 20_000,
-      maxReconnectAttempts: config.maxReconnectAttempts ?? 10,
-      logger: {
-        error: (...args) => logger.error?.(`[${botId}]`, ...args),
-        warn: (...args) => logger.warn?.(`[${botId}]`, ...args),
-        info: (...args) => logger.info?.(`[${botId}]`, ...args),
-        debug: (...args) => logger.debug?.(`[${botId}]`, ...args),
-      },
-    }),
+    createRuntime: async ({ botId, config: botConfig, secret }) => {
+      const state = await stateFor(botId);
+      await workspaces.ensure(botId);
+      const workspaceScope = createBotWorkspaceScope(harness, { botId, workspaces, state });
+      return new Runtime({
+        config: botConfig,
+        secret,
+        harness: workspaceScope.harness,
+        state: workspaceScope.state,
+        replyTimeoutMs: config.replyTimeoutMs ?? 600_000,
+        connectTimeoutMs: config.connectTimeoutMs ?? 20_000,
+        maxReconnectAttempts: config.maxReconnectAttempts ?? 10,
+        logger: {
+          error: (...args) => logger.error?.(`[${botId}]`, ...args),
+          warn: (...args) => logger.warn?.(`[${botId}]`, ...args),
+          info: (...args) => logger.info?.(`[${botId}]`, ...args),
+          debug: (...args) => logger.debug?.(`[${botId}]`, ...args),
+        },
+      });
+    },
     deleteState: async ({ botId }) => {
       const state = stateStores.get(botId);
       stateStores.delete(botId);
-      if (state && typeof state.remove === 'function') return state.remove();
-      try {
-        await unlink(statePath(botId));
-      } catch (error) {
-        if (error?.code !== 'ENOENT') throw error;
+      if (state && typeof state.remove === 'function') {
+        await state.remove();
+      } else {
+        try {
+          await unlink(statePath(botId));
+        } catch (error) {
+          if (error?.code !== 'ENOENT') throw error;
+        }
       }
     },
   });
+  const controller = createWorkspaceAwareController(coreController, { workspaces, stateFor });
   const supervisor = createSupervisor({
     controller,
     harness,