@yanglaofish/fishtools 0.3.0 → 0.5.0

package/manual/packages/core/src/application.js

@@ -1,75 +1,93 @@
-import { mkdir, appendFile, writeFile, rename, readFile } from 'node:fs/promises';
+import { mkdir, readFile, writeFile, rename } from 'node:fs/promises';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { EventEmitter } from 'node:events';
-import { createHost } from './host.js';
-import { WorkflowStore } from './workflows.js';
-import { runWorkflow } from './engine.js';
-import { runProcess } from './process.js';
-import { readJson, loadPlugin, installGeneration } from './plugins.js';
+import {isDeepStrictEqual} from 'node:util';
+import { createHost } from '@mytools/fst-plugin';
+import { WorkflowStore } from '@mytools/fst-workspace/workflows';
+import { runWorkflow } from '@mytools/fst-workflow';
+import { runProcess } from '@mytools/fst-platform';
+import {createFileProbe} from '@mytools/fst-platform/fs';
+import {readJson} from '@mytools/fst-platform/json';
+import {loadPlugin} from '@mytools/fst-plugin/loader';
+import {installGeneration} from '@mytools/fst-workspace/plugins';
 import { FlowError } from '@mytools/sdk';
-import {prepareBundleWorkspace} from './bundle-workspace.js';
-import {validate} from './validation.js';
+import {prepareBundleWorkspace} from '@mytools/fst-workspace/bundles';
+import {validate} from '@mytools/sdk/schema';
 import {createResources} from './resources.js';
-import {errorRecord} from './diagnostics.js';
-import {markdownHeader,markdownEvent,markdownResult} from './markdown-log.js';
-import {createRunLogs,validateKeepRuns} from './run-logs.js';
+import {errorRecord} from '@mytools/sdk/diagnostics';
+import {createExportSnapshot} from './export-snapshot.js';
+import {createRunLogs,validateKeepRuns} from '@mytools/fst-logs';
+import {openPluginState,withPluginMutation,assertPluginState,savePluginState,leaseInstallation} from '@mytools/fst-workspace/installations';
+import {planPluginUpdate,changedPluginSources} from './plugin-update.js';
+import {validateNetworkPolicy,inspectNetworkPolicy} from '@mytools/fst-platform/network';
+import {resolvePrivilegeRequirement,checkStaticPrivilege} from '@mytools/fst-plugin/privileges';
 
-export async function createApplication({projectDir=process.cwd(),workspace,outputDir,plugins,config={},maintenance=false}={}) {
+export async function createApplication({projectDir=process.cwd(),workspace,outputDir,plugins,config={},maintenance=false,omitInstalledPlugin,allowUnknownPrivileges=false}={}) {
   projectDir=await prepareBundleWorkspace(path.resolve(projectDir),workspace);
   const project=await readJson(path.join(projectDir,'flow.project.json'),{plugins:[]});
   const output=path.resolve(outputDir??process.env.FLOW_OUTPUT_DIR??(project.readOnly?path.join(process.cwd(),'flow-results'):path.join(projectDir,'.flow','runs')));
   const store=new WorkflowStore(path.join(projectDir,'workflows'));
-  const emitter=new EventEmitter(), runs=new Map();
+  const emitter=new EventEmitter(), runs=new Map(),journals=new WeakMap();
   const resources=createResources(),operations=new Set();let closing,launching=0;
-  const runLogs=createRunLogs(output,{projectDir,allowLegacy:output===path.join(projectDir,'.flow','runs')}),writingRuns=new Set();
+  const runLogs=createRunLogs(output,{...project.logs,projectDir,allowLegacy:output===path.join(projectDir,'.flow','runs')}),writingRuns=new Set();
+  const maxCachedRuns=project.logs?.maxCachedRuns??50;
+  if(!Number.isSafeInteger(maxCachedRuns)||maxCachedRuns<1||maxCachedRuns>1000)throw new FlowError('maxCachedRuns 必须为 1 到 1000 的整数');
+  const fileProbe=createFileProbe(project.fileAccess);
   validateKeepRuns(project.logs?.keepRuns??null);
-  let host,state=await readJson(path.join(projectDir,'.flow','plugins.json'),{}),busy=false;
+  const opened=await openPluginState(projectDir,{readOnly:project.readOnly});
+  let host,state=opened.state,busy=false;
+  const installationLeases=new Map();
+  if(state.root)installationLeases.set(path.resolve(state.root),opened.release);
   const app={
     projectDir,project,outputDir:output,store,
     get host(){return host;},
     get maintenance(){return maintenance;},
+    developmentStatus:()=>({running:launching+writingRuns.size+operations.size,busy,closing:!!closing}),
     catalog:()=>host.catalog(),
-    listPlugins:()=>[...host.definitions.values()].map(p=>({id:p.id,version:p.version,title:p.title,description:p.description,platforms:p.platforms,architectures:p.architectures,environments:p.environments,config:p.config,runtime:host.runtimeStatus().find(r=>r.id===p.id),removable:!!state.dependencies?.[p.id]})),
+    listPlugins:()=>[...host.definitions.values()].map(p=>({id:p.id,version:p.version,title:p.title,description:p.description,platforms:p.platforms,architectures:p.architectures,environments:p.environments,config:p.config,requirements:p.requirements,privileges:pluginPrivileges(p),runtime:{...host.runtimeStatus().find(r=>r.id===p.id),...(p.runtime?{updatePolicy:p.runtime.updatePolicy??'maintenance'}:{})},removable:!!(state.dependencies?.[p.id]||state.links?.[p.id]),development:!!state.links?.[p.id],warnings:host.warnings.filter(item=>item.plugin===p.id).map(item=>item.message)})),
     listCommands:()=>host.commands(),
     listWorkflows:()=>store.list(),
-    async saveWorkflow(w){if(project.readOnly)throw new FlowError('此分发包仅用于运行；请在开发项目中编辑');return store.save(w);},
-    async removeWorkflow(id){if(project.readOnly)throw new FlowError('只读项目不能删除工作流');return store.remove(id);},
-    checkWorkflow:id=>store.resolve([id],host),
+    async saveWorkflow(w){return mutateWorkflow(()=>store.save(w));},
+    async duplicateWorkflow(definition,options){return mutateWorkflow(()=>store.duplicate(definition,options));},
+    async removeWorkflow(id){return mutateWorkflow(()=>store.remove(id));},
+    async checkWorkflow(id){
+      host.assertHealthy();
+      const closure=await store.resolve([id],host);
+      return {...closure,privileges:workflowPrivileges(closure,id)};
+    },
     subscribe(fn){emitter.on('event',fn);return ()=>emitter.off('event',fn);},
-    async startRun(id,input={}) {
+    async startRun(id,input={},options={}) {
       if(busy) throw new FlowError('插件更新中，请稍后运行');
-      const closure=await store.resolve([id],host);
+      const closure=await app.checkWorkflow(id);
+      const blocked=closure.privileges.filter(item=>item.mandatory&&item.static.status==='blocked');
       const snapshotStore={resolve:async()=>structuredClone(closure),childId:ref=>store.childId(ref)};
-      return app.executeTracked(id,(activeHost,context,event)=>runWorkflow({store:snapshotStore,host:activeHost,id,input,signal:context.signal,onEvent:event,runId:context.runId,context}));
+      const networkPolicy=structuredClone(project.network??{});
+      return app.executeTracked(id,(activeHost,context,event)=>{
+        if(blocked.length)throw new FlowError(`工作流缺少运行权限：${blocked.map(item=>item.action).join('、')}`,{code:'INSUFFICIENT_PRIVILEGE',details:{actions:blocked}});
+        return runWorkflow({store:snapshotStore,host:activeHost,id,input,signal:context.signal,onEvent:event,runId:context.runId,context:{...context,allowUnknownPrivileges:!!options.allowUnknownPrivileges,networkPolicy}});
+      });
     },
     async startCommand(name,input={},context={}){
       if(busy)throw new FlowError('插件更新中，请稍后调用');
-      return app.executeTracked(`/${name}`,(activeHost,runContext)=>activeHost.invokeCommand(name,input,{...context,...runContext}));
+      const networkPolicy=structuredClone(project.network??{});
+      return app.executeTracked(`/${name}`,(activeHost,runContext)=>activeHost.invokeCommand(name,input,{...context,...runContext,networkPolicy}));
     },
     async executeTracked(id,execute){
-      const runId=randomUUID(),dir=path.join(output,runId),controller=new AbortController();
-      await mkdir(dir,{recursive:true});
-      const run={id:runId,workflowId:id,logOwner:runLogs.owner,status:'running',startedAt:new Date().toISOString(),events:[],controller};
+      const runId=randomUUID(),controller=new AbortController();
+      const run={id:runId,workflowId:id,logOwner:runLogs.owner,status:'running',startedAt:new Date().toISOString(),controller};
+      const journal=await runLogs.start({id:runId,workflowId:id,status:run.status,startedAt:run.startedAt},{onEvent:event=>emitter.emit('event',event)});
+      journals.set(run,journal);
+      // 兼容运行句柄的事件读取；外部修改不影响日志模块的缓存。
+      Object.defineProperty(run,'events',{get:()=>journal.snapshot().events});
       runs.set(runId,run);
       writingRuns.add(runId);
-      const markdownFile=path.join(dir,'run.md');
-      let writes=writeFile(markdownFile,markdownHeader(run));
-      const event=e=>{
-        const full={time:new Date().toISOString(),runId,...e};run.events.push(full);
-        emitter.emit('event',full);
-        const {output:ignored,...record}=full;
-        writes=writes.then(async()=>{
-          await appendFile(path.join(dir,'events.jsonl'),JSON.stringify(record)+'\n');
-          await appendFile(markdownFile,markdownEvent(full));
-        });
-        return writes;
-      };
+      const event=e=>journal.append(e);
       const activeHost=host;
       run.done=(async()=>{
         try {
           await event({type:'run.started'});
-          run.output=await execute(activeHost,{outputDir:dir,signal:controller.signal,runId,log:(message,data,meta={})=>event({...meta,type:'log',message,data})},event);
+          run.output=await execute(activeHost,{outputDir:journal.directory,signal:controller.signal,runId,log:(message,data,meta={})=>event({...meta,type:'log',message,data})},event);
           run.status='succeeded';await event({type:'run.succeeded'});
         } catch(error) {
           if(error?.code==='WORKFLOW_STOPPED'){
@@ -82,23 +100,48 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
           }
         } finally {
           run.finishedAt=new Date().toISOString();
-          await writes;
-          await appendFile(markdownFile,markdownResult(app.getRun(runId)));
-          await writeFile(path.join(dir,'result.json'),JSON.stringify(snapshotRun(run),null,2));
-          writingRuns.delete(runId);
+          try{await journal.finish(runState(run));}finally{writingRuns.delete(runId);}
           try{await pruneLogs();}catch(error){
-            await event({type:'log',message:`日志自动清理失败：${error.message}`});
-            await writeFile(path.join(dir,'result.json'),JSON.stringify(snapshotRun(run),null,2));
+            run.warnings=[{code:'LOG_PRUNE_FAILED',message:`日志自动清理失败：${error.message}`}];
+            await journal.save(runState(run));
           }
         }
-        return snapshotRun(run);
+        const result=snapshotRun(run);trimRuns();return result;
       })();
+      // Web 等调用方只保留运行 ID；立即观察拒绝，但不替换供 CLI/TUI 等待的原 Promise。
+      run.done.catch(error=>{
+        run.status='failed';
+        run.error=errorRecord(new FlowError(`运行日志保存失败：${error.message}`,{code:'LOG_WRITE_FAILED',details:errorRecord(error),cause:run.error}));
+        trimRuns();
+      });
       return run;
     },
     getRun(id){const r=runs.get(id);return r?snapshotRun(r):null;},
-    async readRun(id){if(runs.has(id))return app.getRun(id);if(!/^[a-f0-9-]{36}$/.test(id))throw new FlowError('运行 ID 无效');return JSON.parse(await readFile(path.join(output,id,'result.json'),'utf8'));},
+    async readRun(id){if(runs.has(id))return app.getRun(id);return runLogs.read(id);},
+    readLogPage:(id,options)=>runLogs.page(id,options),
     listRuns:()=>[...runs.keys()].map(id=>{const {events,...r}=app.getRun(id);return r;}),
     logSettings:()=>({keepRuns:project.logs?.keepRuns??null}),
+    networkPolicy:()=>structuredClone(project.network??{}),
+    networkReport:()=>inspectNetworkPolicy(project.network??{},{plugins:[...host.definitions.keys()],actions:[...host.actions.keys()]}),
+    async configureNetworkPolicy(next){
+      validateNetworkPolicy(next);
+      if(project.readOnly)throw new FlowError('只读运行包不能修改代理设置');
+      if(busy)throw new FlowError('项目正在更新，请稍后修改代理设置');
+      busy=true;let backup;
+      try{
+        await withPluginMutation(projectDir,async()=>{
+          const file=path.join(projectDir,'flow.project.json'),latest=await readJson(file,project);
+          if(latest.readOnly)throw new FlowError('只读运行包不能修改代理设置');
+          if(!isDeepStrictEqual(latest.network??{},project.network??{}))throw new FlowError('代理设置已被另一实例修改，请重新读取后再保存',{code:'NETWORK_CONFLICT'});
+          backup=await backupProjectFile(file,latest,'network');
+          const nextProject={...latest,network:structuredClone(next)},temp=`${file}.${randomUUID()}.tmp`;
+          await writeFile(temp,JSON.stringify(nextProject,null,2));await rename(temp,file);
+          for(const key of Object.keys(project))delete project[key];Object.assign(project,nextProject);
+        });
+      }finally{busy=false;}
+      return {policy:app.networkPolicy(),backup};
+    },
+    logUsage:()=>runLogs.usage(),
     async listRunHistory(){
       const records=new Map((await runLogs.list()).map(r=>[r.id,r]));
       for(const id of runs.keys())records.set(id,app.getRun(id));
@@ -106,39 +149,65 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
     },
     async readLog(id){
       const run=runs.get(id);
-      if(run&&writingRuns.has(id))return markdownHeader(run)+run.events.map(markdownEvent).join('');
+      if(run&&writingRuns.has(id))return journals.get(run).markdown(runState(run));
       return runLogs.markdown(id);
     },
     async configureLogs(keepRuns){
       validateKeepRuns(keepRuns);if(project.readOnly)throw new FlowError('只读运行包不能保存日志设置');
       if(busy)throw new FlowError('项目正在更新，请稍后修改日志设置');
-      busy=true;
+      busy=true;let backup,warning;
       try{
-        const logs={...project.logs,keepRuns},file=path.join(projectDir,'flow.project.json'),temp=`${file}.${randomUUID()}.tmp`;
-        await mkdir(projectDir,{recursive:true});await writeFile(temp,JSON.stringify({...project,logs},null,2));await rename(temp,file);project.logs=logs;
-        await pruneLogs();
+        await withPluginMutation(projectDir,async()=>{
+          const file=path.join(projectDir,'flow.project.json'),latest=await readJson(file,project);
+          if(latest.readOnly)throw new FlowError('只读运行包不能保存日志设置');
+          backup=await backupProjectFile(file,latest,'logs');
+          const nextProject={...latest,logs:{...latest.logs,keepRuns}},temp=`${file}.${randomUUID()}.tmp`;
+          await writeFile(temp,JSON.stringify(nextProject,null,2));await rename(temp,file);
+          for(const key of Object.keys(project))delete project[key];Object.assign(project,nextProject);
+          try{await pruneLogs();}
+          catch(error){warning={code:'LOG_PRUNE_FAILED',message:`日志保留设置已保存，但旧日志清理失败：${error.message}`};emitter.emit('event',{type:'logs.prune.warning',...warning});}
+        });
       }finally{busy=false;}
+      return {keepRuns,backup,...(warning?{warning}:{})};
     },
     cancelRun(id){const r=runs.get(id);if(r?.status==='running')r.controller.abort();return !!r;},
-    async installPlugin(source){return change({add:source});},
-    async removePlugin(name){if(resources.active(name))throw new FlowError('请先停止此插件提供的 Web');if(!state.dependencies?.[name])throw new FlowError('此插件来自发行配置，不能在此移除');return change({remove:name});},
-    async pack(options){const {packApplication}=await import('@mytools/pack');return packApplication(app,options);},
-    async packPlan(options){const {planApplication}=await import('@mytools/pack');return planApplication(app,options);},
-    async configurePlugin(id,value){
+    async installPlugin(source,options){return change({add:source},options);},
+    async linkPlugin(source,options){return change({link:path.resolve(projectDir,source)},options);},
+    async removePlugin(name,options={}){
+      return change({remove:name},options);
+    },
+    exportSnapshot:options=>createExportSnapshot({store,host,project},options),
+    async pack(options){if(project.readOnly)throw new FlowError('只读运行包不能重新打包');const {packApplication}=await import('@mytools/pack');return packApplication(await app.exportSnapshot(options),options);},
+    async packPlan(options){const {planApplication}=await import('@mytools/pack');return planApplication(await app.exportSnapshot(options),options);},
+    async configurePlugin(id,value,options={}){
       if(project.readOnly)throw new FlowError('只读项目不能保存配置');
-      assertMutable();
-      if(resources.active(id))throw new FlowError('请先停止此插件提供的 Web，再修改配置');
       if(busy||launching||app.listRuns().some(r=>r.status==='running'))throw new FlowError('请等待运行或安装结束');
       if(!host.definitions.has(id))throw new FlowError(`插件不存在：${id}`);
       value=validate(host.definitions.get(id).config,value,`${id} 配置`);
-      busy=true;let nextHost;
+      busy=true;let backup;
       try{
-        const nextConfig={...project.config,[id]:value};
-        nextHost=await createHost({plugins:[...host.definitions.values()].map(p=>({plugin:p,root:p.root})),config:{...nextConfig,...config},services,environmentOverrides:project.environments,runtimeEnabled:!maintenance});
-        const nextProject={...project,config:nextConfig},file=path.join(projectDir,'flow.project.json'),temp=`${file}.${randomUUID()}.tmp`;
-        await writeFile(temp,JSON.stringify(nextProject,null,2));await rename(temp,file);
-        const old=host;host=nextHost;nextHost=null;project.config=nextConfig;await old.close();
-      }finally{try{if(nextHost)await nextHost.close();}finally{busy=false;}}
+        await withPluginMutation(projectDir,async()=>{
+        await assertPluginState(projectDir,state);
+        const file=path.join(projectDir,'flow.project.json'),latest=await readJson(file,project);
+        if(latest.readOnly)throw new FlowError('只读项目不能保存配置');
+        const nextConfig={...latest.config,[id]:value};
+        const oldConfig={...project.config,...config},effectiveNext={...nextConfig,...config};
+        const entries=[...host.definitions.values()].map(p=>({plugin:p,root:p.root}));
+        const plan=planPluginUpdate(host.definitions,host.definitions,oldConfig,effectiveNext,new Set([id]));
+        assertMaintenance(plan,options);
+        backup=await backupProjectFile(file,latest,'config');
+        if(plan.affected.length)await host.replace({plugins:entries,config:effectiveNext,affected:plan.affected});
+        const nextProject={...latest,config:nextConfig},temp=`${file}.${randomUUID()}.tmp`;
+        try{await writeFile(temp,JSON.stringify(nextProject,null,2));await rename(temp,file);}
+        catch(error){
+          if(plan.affected.length)try{await host.replace({plugins:entries,config:oldConfig,affected:plan.affected});}
+          catch(recovery){host.invalidate();throw new AggregateError([error,recovery],`配置保存失败且插件恢复失败：${error.message}；${recovery.message}`);}
+          throw error;
+        }
+        for(const key of Object.keys(project))delete project[key];Object.assign(project,nextProject);
+        });
+      }finally{busy=false;}
+      return {backup};
     },
     async setMaintenance(enabled){
       if(typeof enabled!=='boolean')throw new FlowError('维护模式必须为布尔值');
@@ -149,7 +218,7 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
       try{
         const entries=[...host.definitions.values()].map(p=>({plugin:p,root:p.root}));
         if(enabled){maintenance=true;await host.close();}
-        const next=await createHost({plugins:entries,config:{...project.config,...config},services,environmentOverrides:project.environments,runtimeEnabled:!enabled});
+        const next=await createHost({plugins:entries,config:{...project.config,...config},services,project:hostProject(),network:()=>project.network,environmentOverrides:project.environments,runtimeEnabled:!enabled,allowUnknownPrivileges});
         const old=host;host=next;maintenance=enabled;if(!enabled)await old.close();
       }finally{busy=false;}
     },
@@ -167,17 +236,24 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
         const errors=[];
         try{await resources.close();}catch(error){errors.push(error);}
         try{await host.close();}catch(error){errors.push(error);}
+        try{const report=await fileProbe.close();if(report.incomplete)errors.push(new FlowError('文件探测进程尚未全部回收',{code:'FS_CLEANUP_INCOMPLETE',details:report}));}catch(error){errors.push(error);}
+        for(const release of installationLeases.values())try{await release();}catch(error){errors.push(error);}
         if(errors.length)throw new AggregateError(errors,`应用关闭失败：${errors.map(e=>e.message).join('；')}`);
       });return closing;
     },
   };
-  const initial=plugins??await Promise.all((project.plugins??[]).map(spec=>loadPlugin(spec,project.baseBundle?.root??projectDir)));
-  const services={application:app,runProcess};
-  const build=extra=>createHost({plugins:[...initial,...extra],config:{...project.config,...config},services,environmentOverrides:project.environments,runtimeEnabled:!maintenance});
-  const external=[];
-  for(const name of Object.keys(state.dependencies??{}))external.push(await loadPlugin(name,state.root));
-  host=await build(external);
-  for(const name of ['startRun','startCommand','startWeb','saveWorkflow','removeWorkflow','installPlugin','removePlugin','configurePlugin','configureLogs','setMaintenance','pack']){
+  let initial;
+  const services={application:app,runProcess,fs:fileProbe};
+  const hostProject=()=>({directory:projectDir,readOnly:!!project.readOnly});
+  const build=extra=>createHost({plugins:[...initial,...extra],config:{...project.config,...config},services,project:hostProject(),network:()=>project.network,environmentOverrides:project.environments,runtimeEnabled:!maintenance,allowUnknownPrivileges});
+  try{
+    initial=plugins??await Promise.all((project.plugins??[]).map(spec=>loadPlugin(spec,project.baseBundle?.root??projectDir)));
+    const external=[];
+    for(const name of Object.keys(state.dependencies??{}))if(!maintenance||name!==omitInstalledPlugin)external.push(await loadPlugin(name,state.root));
+    for(const [name,source] of Object.entries(state.links??{}))if(!maintenance||name!==omitInstalledPlugin)external.push(await loadPlugin(source,projectDir));
+    host=await build(external);
+  }catch(error){await fileProbe.close();await opened.release();throw error;}
+  for(const name of ['startRun','startCommand','startWeb','saveWorkflow','duplicateWorkflow','removeWorkflow','installPlugin','linkPlugin','removePlugin','configurePlugin','configureNetworkPolicy','configureLogs','setMaintenance','pack']){
     const original=app[name],isRun=['startRun','startCommand'].includes(name);
     app[name]=async(...args)=>{
       if(closing)throw new FlowError('应用已关闭');
@@ -186,26 +262,131 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
       try{return await task;}finally{operations.delete(task);if(isRun)launching--;}
     };
   }
-  function assertMutable(){if(!maintenance&&host.hasRuntime)throw new FlowError('运行时插件已启动，请先进入维护模式再修改插件或配置');}
-  function snapshotRun(run){const {done,controller,...result}=run;return structuredClone(result);}
+  async function mutateWorkflow(operation){
+    if(project.readOnly)throw new FlowError('只读运行包不能修改工作流');
+    if(busy)throw new FlowError('插件变更期间暂不能修改工作流',{code:'PLUGIN_BUSY'});
+    return withPluginMutation(projectDir,async()=>{
+      await assertPluginState(projectDir,state);
+      return operation();
+    });
+  }
+  async function backupProjectFile(file,latest,label){
+    const directory=path.join(projectDir,'.flow','backups');
+    await mkdir(directory,{recursive:true,mode:0o700});
+    const backup=path.join(directory,`flow.project.${label}-${randomUUID()}.json`);
+    let original;
+    try{original=await readFile(file,'utf8');}
+    catch(error){if(error.code!=='ENOENT')throw error;original=JSON.stringify(latest,null,2);}
+    await writeFile(backup,original,{flag:'wx',mode:0o600});
+    return backup;
+  }
+  function pluginPrivileges(plugin){
+    const report=action=>{
+      const requirement=resolvePrivilegeRequirement(plugin,action);
+      return {action:action===undefined?null:`${plugin.id}:${action}`,requirement,static:checkStaticPrivilege(requirement)};
+    };
+    return [report(),...Object.keys(plugin.actions??{}).map(report)];
+  }
+  function assertMaintenance(plan,options={}){
+    if(!maintenance&&plan.maintenance.length&&!options.allowMaintenance)throw new FlowError(`更新将重启插件 ${plan.maintenance.join('、')}，请确认本次定向维护`,{code:'MAINTENANCE_REQUIRED',details:{plugins:plan.maintenance,affected:plan.affected}});
+    const active=plan.affected.filter(id=>resources.active(id));
+    if(active.length)throw new FlowError(`请先停止受影响插件提供的 Web：${active.join('、')}`,{code:'WEB_ACTIVE',details:{plugins:active}});
+  }
+  function workflowPrivileges(closure,entryId){
+    const flows=new Map(closure.workflows.map(w=>[w.id,w])),report=[];
+    const visit=(id,mandatory)=>{
+      const workflow=flows.get(id);
+      if(!workflow)return;
+      const steps=(list,required)=>{
+        let available=required;
+        for(const step of list){
+          const needed=available&&!step.when;
+          if(step.action){
+            const pluginId=step.action.slice(0,step.action.lastIndexOf(':')),plugin=host.definitions.get(pluginId);
+            const requirement=resolvePrivilegeRequirement(plugin,step.action.slice(pluginId.length+1));
+            report.push({workflowId:id,stepId:step.id,action:step.action,mandatory:needed,requirement,static:checkStaticPrivilege(requirement)});
+          }
+          if(step.workflow)visit(store.childId(step.workflow),needed);
+          if(step.branch){steps(step.branch.then,false);steps(step.branch.else??[],false);}
+          if(step.parallel)steps(step.parallel.steps,needed);
+          if(step.stop)available=false;
+        }
+      };
+      steps(workflow.steps,mandatory);
+    };
+    visit(entryId,true);return report;
+  }
+  async function findPluginWorkflowReferences(id){
+    const refs=[];
+    const collect=(steps,found)=>{for(const step of steps??[]){
+      if(typeof step.action==='string'&&step.action.startsWith(`${id}:`))found.add(step.action);
+      if(step.branch){collect(step.branch.then,found);collect(step.branch.else,found);}
+      if(step.parallel)collect(step.parallel.steps,found);
+    }};
+    for(const workflow of await store.list()){
+      const found=new Set();collect(workflow.steps,found);
+      if(found.size)refs.push({id:workflow.id,title:workflow.title??workflow.id,actions:[...found]});
+    }
+    return refs;
+  }
+  function runState(run){const {done,controller,...result}=run;return result;}
+  function snapshotRun(run){return journals.get(run).snapshot(runState(run));}
+  function trimRuns(){
+    const completed=[...runs.values()].filter(run=>!writingRuns.has(run.id)&&run.status!=='running');
+    for(const run of completed.slice(0,Math.max(0,completed.length-maxCachedRuns)))runs.delete(run.id);
+    // 超大业务结果交给 done 的调用方；宿主历史改读磁盘摘要，避免长期持有大对象。
+    for(const run of completed){
+      try{if(run.output!==undefined&&Buffer.byteLength(JSON.stringify(run.output))>(project.logs?.maxMemoryBytes??1048576)){
+        if(run.error?.code==='LOG_WRITE_FAILED'){delete run.output;run.outputTruncated=true;}else runs.delete(run.id);
+      }}
+      catch{delete run.output;run.outputTruncated=true;}
+    }
+  }
   async function pruneLogs(){for(const id of await runLogs.prune(project.logs?.keepRuns??null,writingRuns))runs.delete(id);}
-  async function change(operation){
+  async function change(operation,options={}){
     if(project.readOnly)throw new FlowError('运行包不支持安装或移除插件');
-    assertMutable();
     if(busy || launching || [...runs.values()].some(r=>r.status==='running'))throw new FlowError('请等待当前运行或安装结束');
-    busy=true;let nextHost;
+    busy=true;let candidate,nextRelease;
     try {
+      return await withPluginMutation(projectDir,async()=>{
+      await assertPluginState(projectDir,state);
+      const latest=await readJson(path.join(projectDir,'flow.project.json'),project);
+      if(latest.readOnly)throw new FlowError('运行包不支持安装或移除插件');
+      if(operation.remove){
+        const name=operation.remove;
+        if(resources.active(name))throw new FlowError('请先停止此插件提供的 Web');
+        if(!state.dependencies?.[name]&&!state.links?.[name])throw new FlowError('此插件来自发行配置，不能在此移除');
+        const dependents=[...host.definitions.values()].filter(p=>p.id!==name&&Object.hasOwn(p.dependencies??{},name)).map(p=>p.id);
+        if(dependents.length)throw new FlowError(`插件仍被其他插件依赖：${dependents.join('、')}`,{code:'PLUGIN_IN_USE',details:{dependencies:dependents}});
+        const workflows=await findPluginWorkflowReferences(name);
+        if(workflows.length&&!options.force)throw new FlowError(`插件 ${name} 仍被工作流引用：${workflows.map(w=>w.id).join('、')}`,{code:'PLUGIN_IN_USE',details:{workflows}});
+      }
       const next=await installGeneration(projectDir,{...operation,state});
-      for(const p of host.definitions.values())if(resources.active(p.id)){
-        const candidate=[...initial,...next.loaded].find(e=>(e.plugin??e).id===p.id);
-        if(!candidate||candidate.root!==p.root||(candidate.plugin??candidate).version!==p.version)throw new FlowError('请先停止活动 Web，再替换其提供者');
+      const nextEntries=[...initial,...next.loaded],activeConfig={...project.config,...config},effectiveConfig={...latest.config,...config};
+      candidate=await createHost({plugins:nextEntries,config:effectiveConfig,services,project:hostProject(),network:()=>project.network,environmentOverrides:project.environments,runtimeEnabled:false,allowUnknownPrivileges});
+      const sourceChanges=await changedPluginSources(host.definitions,candidate.definitions,{oldInstallationRoot:state.root,newInstallationRoot:next.state.root});
+      const plan=planPluginUpdate(host.definitions,candidate.definitions,activeConfig,effectiveConfig,sourceChanges);
+      assertMaintenance(plan,options);
+      await candidate.close();candidate=null;
+      nextRelease=await leaseInstallation(projectDir,next.state.root);
+      const oldEntries=[...host.definitions.values()].map(p=>({plugin:p,root:p.root}));
+      if(plan.affected.length)await host.replace({plugins:nextEntries,config:effectiveConfig,affected:plan.affected});
+      try{await savePluginState(projectDir,next.state,state);}
+      catch(error){
+        if(plan.affected.length)try{await host.replace({plugins:oldEntries,config:activeConfig,affected:plan.affected});}
+        catch(recovery){host.invalidate();throw new AggregateError([error,recovery],`插件状态保存失败且恢复失败：${error.message}；${recovery.message}`);}
+        throw error;
+      }
+      state=next.state;
+      for(const key of Object.keys(project))delete project[key];Object.assign(project,latest);
+      installationLeases.set(path.resolve(state.root),nextRelease);nextRelease=null;
+      for(const [root,release] of installationLeases)if(root!==path.resolve(state.root)&&![...host.definitions.values()].some(p=>p.root&&path.resolve(p.root).startsWith(root+path.sep))){
+        try{await release();installationLeases.delete(root);}
+        catch(error){emitter.emit('event',{type:'plugin.cleanup.warning',message:`旧安装批次租约暂未清理：${error.message}`,root});}
       }
-      nextHost=await build(next.loaded);
-      const file=path.join(projectDir,'.flow','plugins.json'),temp=`${file}.tmp`;
-      await writeFile(temp,JSON.stringify(next.state,null,2));await rename(temp,file);
-      const old=host;host=nextHost;nextHost=null;state=next.state;await old.close();
       return app.listPlugins();
-    } finally {try{if(nextHost)await nextHost.close();}finally{busy=false;}}
+      });
+    } finally {try{if(candidate)await candidate.close();}finally{try{if(nextRelease)await nextRelease();}finally{busy=false;}}}
   }
   return app;
 }

package/manual/packages/core/src/bundle.js

@@ -0,0 +1,2 @@
+// 兼容既有 core 公开入口，实际能力由 platform 模块维护。
+export * from '@mytools/fst-platform/bundle';

package/manual/packages/core/src/development-watch-worker.js

@@ -0,0 +1,69 @@
+import {watch} from 'node:fs';
+import {readFile,opendir,lstat} from 'node:fs/promises';
+import path from 'node:path';
+
+// 所有目录 I/O 都留在可回收进程中；扫描限制同时约束监听句柄和遍历工作量。
+const options=JSON.parse(process.env.FISHTOOLS_WATCH_OPTIONS),handles=new Map();
+const ignored=new Set(['node_modules','.git','.flow','dist']);
+let stopped=false,scanning=false,again=false,first=true,links=[];
+const send=message=>{if(process.connected)process.send(message);};
+const remote=value=>/^\\\\|^\/\//.test(value);
+async function json(file,fallback){try{return JSON.parse(await readFile(file,'utf8'));}catch(error){if(error.code==='ENOENT')return fallback;throw error;}}
+function change(file){send({type:'changed',file});}
+function addWatch(key,directory,callback,wanted){
+  wanted.add(key);if(handles.has(key))return;
+  try{const handle=watch(directory,callback);handle.on('error',error=>send({type:'warning',message:`监听 ${directory} 失败：${error.message}`}));handles.set(key,handle);}
+  catch(error){send({type:'warning',message:`无法监听 ${directory}：${error.message}`});}
+}
+async function scan(){
+  if(stopped)return;if(scanning){again=true;return;}scanning=true;
+  send({type:'scanning'});const wanted=new Set();let directories=0,entries=0,incomplete=false;
+  try{
+    addWatch('project',options.projectDir,(_event,name)=>{
+      if(name===null||['flow.project.json','.flow'].includes(String(name))){
+        if(name===null||String(name)==='flow.project.json')change(path.join(options.projectDir,String(name??'')));
+        void scan();
+      }
+    },wanted);
+    const stateDirectory=path.join(options.projectDir,'.flow');
+    addWatch('state',stateDirectory,(_event,name)=>{if(name===null||String(name)==='plugins.json'){change(path.join(stateDirectory,'plugins.json'));void scan();}},wanted);
+    if(options.configFile)addWatch('config',path.dirname(options.configFile),(_event,name)=>{
+      if(name===null||String(name)===path.basename(options.configFile)){change(options.configFile);void scan();}
+    },wanted);
+    let project={};
+    try{
+      project=await json(path.join(options.projectDir,'flow.project.json'),{});
+      const state=await json(path.join(stateDirectory,'plugins.json'),{});
+      links=Object.values(state.links??{}).filter(value=>typeof value==='string').map(value=>path.resolve(options.projectDir,value));
+    }catch(error){send({type:'warning',message:`开发配置暂不可读，保留已有源码监听：${error.message}`});}
+    incomplete=links.length>options.maxDirectories;
+    const queue=links.slice(0,options.maxDirectories).map(directory=>({directory,depth:0})),seen=new Set();
+    while(queue.length&&!stopped){
+      const {directory,depth}=queue.shift();if(seen.has(directory))continue;seen.add(directory);
+      if(remote(directory)){send({type:'warning',message:`跳过远程开发目录：${directory}`});continue;}
+      if(directories>=options.maxDirectories||entries>=options.maxEntries){incomplete=true;break;}
+      let stat;try{stat=await lstat(directory);}catch{continue;}
+      if(!stat.isDirectory()||stat.isSymbolicLink())continue;directories++;
+      addWatch(`source:${directory}`,directory,(event,name)=>{
+        const relative=String(name??'');if(relative.split(/[\\/]/).some(part=>ignored.has(part)))return;
+        change(path.join(directory,relative));if(event==='rename')void scan();
+      },wanted);
+      if(depth>=options.maxDepth){incomplete=true;continue;}
+      let listing;
+      try{
+        listing=await opendir(directory);
+        for await(const entry of listing){
+          entries++;if(entries>=options.maxEntries){incomplete=true;break;}
+          if(entry.isDirectory()&&!ignored.has(entry.name))queue.push({directory:path.join(directory,entry.name),depth:depth+1});
+        }
+      }catch(error){send({type:'warning',message:`扫描 ${directory} 失败：${error.message}`});}
+    }
+    for(const [key,handle] of handles)if(!wanted.has(key)){handle.close();handles.delete(key);}
+    if(incomplete)send({type:'warning',message:'开发源码扫描达到目录、深度或条目预算，超出部分未监听'});
+    send({type:first?'ready':'snapshot',readOnly:!!project.readOnly,directories,watchers:handles.size,incomplete});first=false;
+  }finally{scanning=false;if(again){again=false;void scan();}}
+}
+function close(){stopped=true;for(const handle of handles.values())handle.close();handles.clear();process.disconnect?.();}
+process.on('message',message=>{if(message?.type==='close')close();});
+process.on('disconnect',close);
+void scan().catch(error=>{send({type:'fatal',message:error.message});close();});