@yanglaofish/fishtools 0.5.1 → 0.5.3

package/node_modules/@mytools/fst-platform/src/shell.js

@@ -0,0 +1,103 @@
+import {FlowError} from '@mytools/sdk';
+import {randomUUID} from 'node:crypto';
+import {mkdir,open,rm} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {runProcess as executeProcess} from './process.js';
+
+const shells=new Set(['auto','powershell','pwsh','sh','bash']);
+const powerShellArgs=['-NoLogo','-NoProfile','-NonInteractive','-OutputFormat','Text'];
+const windowsOemEncodings=new Map([[866,'ibm866'],[874,'windows-874'],[932,'shift_jis'],[936,'gbk'],[949,'euc-kr'],[950,'big5'],[65001,'utf-8']]);
+let windowsOemCodePage;
+
+function selectShell(script,shell,platform){
+  if(typeof script!=='string'||!script.trim()||script.includes('\u0000'))throw new FlowError('命令文本必须是非空字符串，且不能包含 NUL 字符',{code:'VALIDATION'});
+  if(!shells.has(shell))throw new FlowError(`不支持的 Shell：${String(shell)}`,{code:'VALIDATION'});
+  return shell==='auto'?(platform==='win32'?'powershell':'sh'):shell;
+}
+
+function ipconfigArguments(script){
+  // 只解析单行字面量；Shell 运算符、展开、组合引号与特殊引号均留给 PowerShell。
+  if(/[\r\n\u0085\u2028\u2029\u2018\u2019\u201c\u201d]/.test(script))return;
+  const command=/^\s*ipconfig(?:\.exe)?(?=\s|$)/i.exec(script);
+  if(!command)return;
+  let remaining=script.slice(command[0].length);const args=[];
+  while(remaining.trim()){
+    const token=/^\s+(?:'((?:[^']|'')*)'|"([^"`$]*)"|([^\s"'`$;|&<>(){}\[\]#@,]+))(?=\s|$)/.exec(remaining);
+    if(!token)return;
+    const value=token[1]!==undefined?token[1].replaceAll("''","'"):token[2]??token[3];
+    if(value==='--%')return;
+    args.push(value);remaining=remaining.slice(token[0].length);
+  }
+  return args;
+}
+
+async function ipconfigEncoding(windowsRoot,{cwd,env,extendEnv,signal,timeout}){
+  if(windowsOemCodePage===undefined){
+    // GetOEMCP 读取当前系统原生代码页，不修改控制台代码页或依赖用户的区域格式。
+    const source=`Add-Type -Namespace Fst -Name NativeCodePage -MemberDefinition '[System.Runtime.InteropServices.DllImport("kernel32.dll")] public static extern uint GetOEMCP();'; [Console]::WriteLine([Fst.NativeCodePage]::GetOEMCP())`;
+    const encoded=Buffer.from(source,'utf16le').toString('base64');
+    const command=`& ([ScriptBlock]::Create([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('${encoded}'))))`;
+    let result;
+    try{
+      result=await executeProcess(path.join(windowsRoot,'System32','WindowsPowerShell','v1.0','powershell.exe'),[...powerShellArgs,'-Command',command],{cwd,env,extendEnv,signal,timeout,maxBuffer:4096});
+    }catch(error){
+      if(error.code==='CANCELLED'||error.code==='TIMEOUT')throw error;
+      return;
+    }
+    if(result.exitCode!==0||!/^\d+$/.test(result.stdout.trim()))return;
+    windowsOemCodePage=Number(result.stdout.trim());
+  }
+  // TextDecoder 不支持 OEM 437、850 等代码页；无法准确解码时保留原 Shell 路径。
+  return windowsOemEncodings.get(windowsOemCodePage);
+}
+
+function powerShellSource(script){
+  // $? 在脚本最后一条命令后立即读取，避免沿用更早的外部命令退出码。
+  return `[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$OutputEncoding = [Console]::OutputEncoding
+& {
+${script}
+if (-not $?) {
+  if ($LASTEXITCODE) { exit $LASTEXITCODE }
+  exit 1
+}
+exit 0
+}`;
+}
+
+export function shellInvocation(script,{shell='auto',platform=process.platform}={}){
+  const file=selectShell(script,shell,platform);
+  if(file==='sh'||file==='bash')return {file,args:['-c',script]};
+  // 编码只改变传输形式；保留用户的引号、管道、换行及尾部注释。
+  const source=powerShellSource(script);
+  const encoded=Buffer.from(source,'utf16le').toString('base64');
+  // 普通 -Command 避免 Windows PowerShell 在 -EncodedCommand 下把 stderr 序列化为 CLIXML。
+  const command=`& ([ScriptBlock]::Create([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('${encoded}'))))`;
+  return {file,args:[...powerShellArgs,'-Command',command]};
+}
+
+export async function runShell(script,{shell='auto',runProcess:execute=executeProcess,temporaryDir=tmpdir(),...processOptions}={}){
+  const file=selectShell(script,shell,process.platform),powershell=file==='powershell'||file==='pwsh';
+  if(processOptions.signal?.aborted)throw new FlowError('操作已取消',{code:'CANCELLED'});
+  if(process.platform==='win32'&&shell==='auto'){
+    const args=ipconfigArguments(script),windowsRoot=process.env.SystemRoot??process.env.windir;
+    if(args&&windowsRoot&&path.isAbsolute(windowsRoot)){
+      const encoding=processOptions.encoding??await ipconfigEncoding(windowsRoot,processOptions);
+      if(encoding)return execute(path.join(windowsRoot,'System32','ipconfig.exe'),args,{...processOptions,encoding,commandText:script});
+    }
+  }
+  const directory=path.resolve(temporaryDir);
+  await mkdir(directory,{recursive:true});
+  const scriptFile=path.join(directory,`fst-shell-${randomUUID()}.${powershell?'ps1':'sh'}`);
+  // 独占创建后才承担清理责任；不覆盖已有文件，也不清空调用者的输出目录。
+  const handle=await open(scriptFile,'wx',0o600);
+  try{
+    try{
+      // Windows PowerShell 5.1 读取 UTF-8 文件需要 BOM；POSIX Shell 使用无 BOM 原文。
+      await handle.writeFile(powershell?'\uFEFF'+powerShellSource(script):script,'utf8');
+    }finally{await handle.close();}
+    const args=powershell?[...powerShellArgs,'-ExecutionPolicy','Bypass','-File',scriptFile]:[scriptFile];
+    return await execute(file,args,{...processOptions,commandText:script});
+  }finally{await rm(scriptFile,{force:true});}
+}

package/node_modules/@mytools/fst-plugin/package.json

@@ -18,7 +18,7 @@
   ],
   "license": "MIT",
   "engines": {
-    "node": ">=24.15.0"
+    "node": "^22.22.2 || >=24.0.0"
   },
   "dependencies": {
     "@mytools/sdk": "0.1.0",

package/node_modules/@mytools/fst-plugin/src/contracts.js

@@ -7,7 +7,7 @@ import path from 'node:path';
 export const builtinCommands=[
   ['workflows','选择已有工作流'],['new','新建工作流'],['add','添加插件能力或子工作流'],
   ['steps','设置步骤参数、排序或删除'],['outputs','设置最终输出'],['save','保存工作流'],
-  ['run','运行工作流，可附带 @参数.json'],['runs','运行记录：选择任意一次执行，查看进度、结果和日志'],['logs','查看运行日志'],['plugin','管理插件'],['plugins','管理插件（兼容旧入口）'],['config','配置 Fishtools'],['tools','Web 与离线文档'],
+  ['run','运行工作流，可附带 @参数.json'],['runs','运行记录：选择任意一次执行，查看进度、结果和日志'],['logs','查看运行日志'],['plugin','管理插件'],['plugins','管理插件（兼容旧入口）'],['commands','管理常用命令'],['shortcuts','管理自定义快捷名称'],['config','配置 Fishtools'],['tools','Web 与离线文档'],
   ['pack','选择工作流打包'],['web','启动 Web 工作台'],['docs','阅读离线开发与使用文档'],['help','查看操作说明'],['exit','退出终端工作台'],
 ].map(([name,description])=>({name,description}));
 
@@ -76,9 +76,13 @@ export function validateDeclarations(plugin){
   }
 }
 
+export function isCommandName(name){
+  return typeof name==='string'&&name===name.normalize('NFC')&&/^\p{L}[\p{L}\p{N}_.-]*$/u.test(name);
+}
+
 export function validateCommands(plugin,registered){
   for(const [name,c] of Object.entries(plugin.commands??{})){
-    if(!/^[a-zA-Z][\w.-]*$/.test(name)||builtinCommands.some(x=>x.name===name)||registered.has(name))throw new FlowError(`命令名称无效或冲突：/${name}`);
+    if(!isCommandName(name)||builtinCommands.some(x=>x.name===name)||registered.has(name))throw new FlowError(`命令名称无效或冲突：/${name}`);
     if(!c||Boolean(c.action)===Boolean(c.run)||c.run&&typeof c.run!=='function')throw new FlowError(`命令 /${name} 必须声明 action 或 run`);
     if(c.action&&!plugin.actions?.[c.action])throw new FlowError(`命令 /${name} 指向不存在的动作：${c.action}`);
     registered.add(name);

package/node_modules/@mytools/fst-plugin/src/host.js

@@ -7,7 +7,7 @@ import {prepareEnvironments,platformWarnings} from '@mytools/fst-platform/enviro
 import path from 'node:path';
 import {mkdir} from 'node:fs/promises';
 import {createHash} from 'node:crypto';
-import {createRuntime} from './runtime.js';
+import {createRuntime,validateRuntimes} from './runtime.js';
 import {pluginError} from '@mytools/sdk/diagnostics';
 import {validateNetworkPolicy,resolveNetworkPolicy,createHttpClient,buildProcessEnv} from '@mytools/fst-platform/network';
 import {resolvePrivilegeRequirement,resolvePrivilegePreflight,checkStaticPrivilege,runPrivilegePreflight} from './privileges.js';
@@ -17,10 +17,9 @@ export async function createHost({ plugins = [], config = {}, services = {}, pro
   validateNetworkPolicy(currentNetwork());
   const ctx = new Context();
   const actions = new Map();
-  const definitions = new Map();
+  const definitions = validatePluginDefinitions(plugins);
   const extensions = new Map();
-  const serviceNames = new Set();
-  const commandNames=new Set(),commands=new Map();
+  const commands=new Map();
   function bindContext(context){
     const {application:ignored,...capabilities}=services;
     const bound={...capabilities,...context},execute=bound.runProcess;
@@ -28,7 +27,10 @@ export async function createHost({ plugins = [], config = {}, services = {}, pro
     bound.print=(message,data)=>Promise.resolve(bound.log?.(message,data,{audience:'user'}));
     if(typeof execute==='function')bound.runProcess=(file,args,options={})=>{
       const signal=context.signal&&options.signal?AbortSignal.any([context.signal,options.signal]):context.signal??options.signal;
-      return execute(file,args,{...options,signal,onOutput:async({stream,message})=>{
+      return execute(file,args,{...options,signal,onStart:async invocation=>{
+        await bound.log?.('执行程序',invocation,{kind:'process'});
+        await options.onStart?.(invocation);
+      },onOutput:async({stream,message})=>{
         await bound.log?.(message,undefined,{stream});
         await options.onOutput?.({stream,message});
       }});
@@ -48,6 +50,7 @@ export async function createHost({ plugins = [], config = {}, services = {}, pro
     const stateDir=projectDir&&!readOnly?path.join(projectDir,'.flow','plugin-state',createHash('sha256').update(plugin.id).digest('hex')):undefined;
     if(stateDir)await mkdir(stateDir,{recursive:true});
     for(const message of platformWarnings(plugin))await bound.log?.(message,{code:'PLATFORM_MISMATCH'},{audience:'user'});
+    if(plugin.root)await bound.log?.('插件文件目录',{plugin:plugin.id,directory:plugin.root},{kind:'source'});
     const environments=await prepareEnvironments(plugin,action,environmentOverrides[plugin.id],{cwd:projectDir??process.cwd()});
     context.signal?.throwIfAborted();
     const policy=context.networkPolicy??currentNetwork();
@@ -75,26 +78,8 @@ export async function createHost({ plugins = [], config = {}, services = {}, pro
     if(result.status==='unknown')await context.log?.('权限状态未确认，按本次选择继续运行',{plugin:plugin.id,action:actionName,reason:result.reason},{audience:'user'});
     return requirement;
   }
-  for (const entry of plugins) {
-    const plugin = entry.plugin ?? entry;
-    validateDeclarations(plugin);validateCommands(plugin,commandNames);
-    if (!plugin.id || definitions.has(plugin.id)) throw new FlowError(`插件标识缺失或重复：${plugin.id}`, {code:'VALIDATION'});
-    if (!semver.satisfies(SDK_VERSION, plugin.sdk ?? '^0.1.0')) throw new FlowError(`插件 ${plugin.id} 与 SDK ${SDK_VERSION} 不兼容`, {code:'VALIDATION'});
-    for(const [name,action] of Object.entries(plugin.actions??{})){
-      if(typeof action?.run!=='function')throw new FlowError(`动作 ${plugin.id}:${name} 缺少执行函数`);
-    }
-    for(const [name,extension] of Object.entries(plugin.services??{})){
-      if(serviceNames.has(name))throw new FlowError(`服务重复：${name}`);
-      if(typeof extension!=='function')throw new FlowError(`服务 ${name} 缺少执行函数`);
-      serviceNames.add(name);
-    }
-    definitions.set(plugin.id, {...plugin, root:entry.root});
-  }
   const settingsById=new Map();
   for (const plugin of definitions.values()) {
-    for (const [id, range] of Object.entries(plugin.dependencies ?? {})) {
-      if (!definitions.has(id) || !semver.satisfies(definitions.get(id).version,range)) throw new FlowError(`插件 ${plugin.id} 缺少兼容依赖 ${id}@${range}`,{code:'VALIDATION'});
-    }
     const settings = validate(plugin.config, config[plugin.id] ?? {}, `${plugin.id} 配置`);
     settingsById.set(plugin.id,settings);
   }
@@ -233,3 +218,26 @@ export async function createHost({ plugins = [], config = {}, services = {}, pro
     close:()=>runtime.close(),
   };
 }
+
+// 可用和待配置的插件共用声明检查；配置不足不会掩盖 SDK、依赖或代码错误。
+export function validatePluginDefinitions(entries){
+  const definitions=new Map(),commandNames=new Set(),serviceNames=new Set();
+  for(const entry of entries){
+    const plugin=entry.plugin??entry;
+    validateDeclarations(plugin);validateCommands(plugin,commandNames);
+    if(!plugin.id||definitions.has(plugin.id))throw new FlowError(`插件标识缺失或重复：${plugin.id}`,{code:'VALIDATION'});
+    if(!semver.satisfies(SDK_VERSION,plugin.sdk??'^0.1.0'))throw new FlowError(`插件 ${plugin.id} 与 SDK ${SDK_VERSION} 不兼容`,{code:'VALIDATION'});
+    for(const [name,action] of Object.entries(plugin.actions??{}))if(typeof action?.run!=='function')throw new FlowError(`动作 ${plugin.id}:${name} 缺少执行函数`,{code:'VALIDATION'});
+    for(const [name,extension] of Object.entries(plugin.services??{})){
+      if(serviceNames.has(name))throw new FlowError(`服务重复：${name}`,{code:'VALIDATION'});
+      if(typeof extension!=='function')throw new FlowError(`服务 ${name} 缺少执行函数`,{code:'VALIDATION'});
+      serviceNames.add(name);
+    }
+    definitions.set(plugin.id,{...plugin,root:entry.root});
+  }
+  for(const plugin of definitions.values())for(const [id,range] of Object.entries(plugin.dependencies??{})){
+    if(!definitions.has(id)||!semver.satisfies(definitions.get(id).version,range))throw new FlowError(`插件 ${plugin.id} 缺少兼容依赖 ${id}@${range}`,{code:'VALIDATION'});
+  }
+  validateRuntimes(definitions,new Context());
+  return definitions;
+}

package/node_modules/@mytools/fst-workflow/package.json

@@ -16,7 +16,7 @@
   ],
   "license": "MIT",
   "engines": {
-    "node": ">=24.15.0"
+    "node": "^22.22.2 || >=24.0.0"
   },
   "dependencies": {
     "@mytools/sdk": "0.1.0"

package/node_modules/@mytools/fst-workflow/src/engine.js

@@ -57,7 +57,7 @@ export async function runWorkflow({store,host,id,input={},signal,onEvent=()=>{},
       let output;
       if(step.action)output=await host.invoke(step.action,args,{
         ...context,signal:currentSignal,runId,stepId:step.id,callPath,workflow:w,
-        log:(message,data,meta={})=>emit({type:'log',stream:meta.stream,...(meta.audience==='user'?{audience:'user'}:{}),...base,message,data}),
+        log:(message,data,meta={})=>emit({type:'log',stream:meta.stream,...(meta.audience==='user'?{audience:'user'}:{}),...(['process','source'].includes(meta.kind)?{kind:meta.kind}:{}),...base,message,data}),
       });
       else if(step.workflow)output=await execute(store.childId(step.workflow),args,callPath,currentSignal,reportFailure);
       else if(step.branch){

package/node_modules/@mytools/fst-workspace/README.md

@@ -6,6 +6,8 @@
 
 项目初始化、模板、工作流文件、插件安装批次、租约、开发引用及便携工作区。插件执行由 plugin 负责，系统调用由 platform 负责。
 
+`@mytools/fst-workspace/registry` 提供用户级插件库路径、工作区登记与跨工作区工作流引用查询。共享库复用安装批次、状态恢复备份及租约；普通工作区的配置与文件仍独立保存。
+
 内部依赖：`@mytools/sdk`、`@mytools/fst-platform`、`@mytools/fst-plugin`、`@mytools/fst-workflow`。
 ## 公开入口
 
@@ -17,12 +19,15 @@
 | `@mytools/fst-workspace/plugins` | `./src/plugins.js` |
 | `@mytools/fst-workspace/installations` | `./src/plugin-installations.js` |
 | `@mytools/fst-workspace/bundles` | `./src/bundle-workspace.js` |
+| `@mytools/fst-workspace/shortcuts` | `./src/shortcuts.js` |
 | `@mytools/fst-workspace/package.json` | `./package.json` |
 
 仅依赖 exports 声明的入口，禁止消费者跨包读取 src/bin 私有文件。入口路径由本模块维护，修改协议时同步消费方回归。
 
 ## 维护与验证
 
+`/shortcuts` 提供 `validateShortcuts` 校验、`bindShortcutCommands` 在用户配置时补齐命令提供者身份，以及 `describeShortcuts` 生成可用或失效状态。绑定函数可传入 previous 保留旧项：未绑定命令修改参数或重命名仍保持失效，需重新选择目标。命令项使用 command 与 plugin 同时匹配，动作项使用稳定 action ID；不执行其他插件的同名能力。实际保存、备份与宿主装配由 core 协调。
+
 本模块负责上述职责的实现、文档与回归；跨模块接口调整需要同时检查生产者与消费者。具体维护人员尚未指定。
 
 在仓库根目录执行：

package/node_modules/@mytools/fst-workspace/package.json

@@ -8,8 +8,10 @@
     ".": "./src/index.js",
     "./workflows": "./src/workflows.js",
     "./project": "./src/project.js",
+    "./shortcuts": "./src/shortcuts.js",
     "./plugins": "./src/plugins.js",
     "./installations": "./src/plugin-installations.js",
+    "./registry": "./src/plugin-registry.js",
     "./bundles": "./src/bundle-workspace.js",
     "./package.json": "./package.json"
   },
@@ -21,7 +23,7 @@
   ],
   "license": "MIT",
   "engines": {
-    "node": ">=24.15.0"
+    "node": "^22.22.2 || >=24.0.0"
   },
   "dependencies": {
     "@mytools/sdk": "0.1.0",

package/node_modules/@mytools/fst-workspace/src/plugin-registry.js

@@ -0,0 +1,58 @@
+import path from 'node:path';
+import os from 'node:os';
+import {mkdir,writeFile,rename} from 'node:fs/promises';
+import {randomUUID} from 'node:crypto';
+import {readJson} from '@mytools/fst-platform/json';
+import {withPluginMutation} from './plugin-installations.js';
+import {WorkflowStore} from './workflows.js';
+import {readPluginState} from './plugin-installations.js';
+import {loadPlugin} from '@mytools/fst-plugin/loader';
+
+export const userPluginRegistry=()=>path.resolve(process.env.FISHTOOLS_HOME??path.join(os.homedir(),'.fishtools'),'plugins');
+
+export async function registerWorkspace(registryDir,projectDir){
+  return withPluginMutation(registryDir,async()=>{
+    const file=path.join(registryDir,'.flow','workspaces.json'),projects=await readJson(file,[]),directory=path.resolve(projectDir);
+    if(projects.includes(directory))return;
+    const temporary=`${file}.${randomUUID()}.tmp`;
+    await mkdir(path.dirname(file),{recursive:true});
+    await writeFile(temporary,JSON.stringify([...projects,directory],null,2));await rename(temporary,file);
+  });
+}
+
+function referencedActions(steps,id,result=new Set()){
+  for(const step of steps??[]){
+    if(step.action?.startsWith(`${id}:`))result.add(step.action);
+    if(step.branch){referencedActions(step.branch.then,id,result);referencedActions(step.branch.else,id,result);}
+    if(step.parallel)referencedActions(step.parallel.steps,id,result);
+  }
+  return [...result];
+}
+
+// 调用方持有共享库锁；各工作区的工作流修改也持有该锁，因此扫描期间不会补写引用。
+export async function registryWorkflowReferences(registryDir,id){
+  const projects=await readJson(path.join(registryDir,'.flow','workspaces.json'),[]),references=[];
+  for(const projectDir of projects){
+    for(const workflow of await new WorkflowStore(path.join(projectDir,'workflows')).list()){
+      const actions=referencedActions(workflow.steps,id);
+      if(actions.length)references.push({projectDir,id:workflow.id,title:workflow.title??workflow.id,actions});
+    }
+  }
+  return references;
+}
+
+export async function registryPluginReferences(registryDir,id,{globalPlugins=[]}={}){
+  const projects=await readJson(path.join(registryDir,'.flow','workspaces.json'),[]),globalState=await readPluginState(registryDir),references=[];
+  const excluded=new Set([...Object.keys(globalState.dependencies??{}),...Object.keys(globalState.links??{}),...(globalState.disabledLegacy??[])]);
+  for(const projectDir of projects){
+    const project=await readJson(path.join(projectDir,'flow.project.json'),{});
+    if(project.readOnly||project.baseBundle)continue;
+    const local=await readPluginState(projectDir),definitions=new Map(globalPlugins.map(plugin=>[plugin.id,plugin]));
+    const add=async(spec,base)=>{const {plugin}=await loadPlugin(spec,base);if(!excluded.has(plugin.id))definitions.set(plugin.id,plugin);};
+    for(const spec of project.plugins??[])if(!excluded.has(spec))await add(spec,projectDir);
+    for(const name of Object.keys(local.dependencies??{}))if(!excluded.has(name))await add(name,local.root);
+    for(const [name,source] of Object.entries(local.links??{}))if(!excluded.has(name))await add(source,projectDir);
+    for(const plugin of definitions.values())if(plugin.id!==id&&Object.hasOwn(plugin.dependencies??{},id))references.push({projectDir,plugin:plugin.id});
+  }
+  return references;
+}

package/node_modules/@mytools/fst-workspace/src/plugins.js

@@ -5,22 +5,25 @@ import {FlowError} from '@mytools/sdk';
 import {readJson} from '@mytools/fst-platform/json';
 import {npm} from '@mytools/fst-platform/npm';
 import {loadPlugin} from '@mytools/fst-plugin/loader';
-export async function installGeneration(projectDir,{add,remove,link,state}) {
+export async function installGeneration(projectDir,{add,remove,link,state,sourceDir=projectDir}) {
   const root=path.join(projectDir,'.flow','installations',randomUUID());
   await mkdir(root,{recursive:true});
   const dependencies={...(state?.dependencies??{})};
   const links={...(state?.links??{})};
+  const disabledLegacy=new Set(state?.disabledLegacy??[]);
   if(remove){delete dependencies[remove];delete links[remove];}
+  if(remove&&state?.global)disabledLegacy.add(remove);
   if(link){
     const source=path.resolve(link),pkg=await readJson(path.join(source,'package.json'));
     const loaded=await loadPlugin(source,projectDir);
     if(!pkg.name||pkg.name!==loaded.plugin?.id||pkg.version!==loaded.plugin?.version)throw new FlowError('开发插件的包名/版本必须与插件 id/version 一致',{code:'VALIDATION'});
     links[pkg.name]=source;delete dependencies[pkg.name];
+    disabledLegacy.delete(pkg.name);
   }
   await writeFile(path.join(root,'package.json'),JSON.stringify({name:'flow-project-plugins',private:true,dependencies},null,2));
   let source=add;
   if(add) {
-    try {await access(path.resolve(projectDir,add));source=path.resolve(projectDir,add);} catch {}
+    try {await access(path.resolve(sourceDir,add));source=path.resolve(sourceDir,add);} catch {}
     if(source.startsWith('-')) throw new FlowError('插件来源不能以选项符号开头',{code:'VALIDATION'});
   }
   if(source||Object.keys(dependencies).length){
@@ -29,7 +32,7 @@ export async function installGeneration(projectDir,{add,remove,link,state}) {
   }
   const pkg=await readJson(path.join(root,'package.json'));
   const loaded=[];
-  for(const name of Object.keys(pkg.dependencies??{})){delete links[name];loaded.push(await loadPlugin(name,root));}
+  for(const name of Object.keys(pkg.dependencies??{})){delete links[name];disabledLegacy.delete(name);loaded.push(await loadPlugin(name,root));}
   for(const source of Object.values(links))loaded.push(await loadPlugin(source,projectDir));
-  return {state:{root,dependencies:pkg.dependencies??{},links,...(state?.root?{previousRoot:state.root}:{})},loaded};
+  return {state:{root,dependencies:pkg.dependencies??{},links,...(state?.global?{global:true,disabledLegacy:[...disabledLegacy]}:{}),...(state?.root?{previousRoot:state.root}:{})},loaded};
 }

package/node_modules/@mytools/fst-workspace/src/shortcuts.js

@@ -0,0 +1,119 @@
+import {FlowError} from '@mytools/sdk';
+import {builtinCommands,isCommandName} from '@mytools/fst-plugin/contracts';
+import {isBuiltin} from 'node:module';
+
+const dangerousFields=new Set(['__proto__','constructor','prototype']);
+const shortcutFields=new Set(['action','command','plugin','input']);
+
+function validPluginId(value){
+  if(typeof value!=='string'||!value.length||value.length>214||value!==value.toLowerCase()||isBuiltin(value)||['node_modules','favicon.ico'].includes(value))return false;
+  const parts=/^(?:@([^/]+)\/)?([^/]+)$/.exec(value);
+  if(!parts||/^[._-]/.test(value)||parts[2].startsWith('.'))return false;
+  return (!parts[1]||/^[a-z0-9_.~'!()*-]+$/.test(parts[1]))&&/^[a-z0-9_.-]+$/.test(parts[2]);
+}
+
+function invalid(location,message){
+  throw new FlowError(message,{code:'VALIDATION',details:{path:location}});
+}
+
+function plainObject(value){
+  return value!==null&&typeof value==='object'&&!Array.isArray(value)&&[Object.prototype,null].includes(Object.getPrototypeOf(value));
+}
+
+function entries(value,location){
+  if(!plainObject(value))invalid(location,`${location} 必须为普通 JSON 对象`);
+  return Reflect.ownKeys(value).map(key=>{
+    if(typeof key!=='string'||dangerousFields.has(key))invalid(location,`${location} 包含危险或非 JSON 字段`);
+    const field=Object.getOwnPropertyDescriptor(value,key);
+    if(!field.enumerable||!Object.hasOwn(field,'value'))invalid(`${location}.${key}`,`${location}.${key} 必须为普通 JSON 字段`);
+    return [key,field.value];
+  });
+}
+
+function cloneJson(value,location,ancestors=new Set()){
+  if(value===null||typeof value==='string'||typeof value==='boolean')return value;
+  if(typeof value==='number'&&Number.isFinite(value))return value;
+  if(typeof value!=='object')invalid(location,`${location} 必须为可序列化的 JSON 值`);
+  if(ancestors.has(value))invalid(location,`${location} 不能包含循环引用`);
+  ancestors.add(value);
+  try{
+    if(Array.isArray(value)){
+      if(Object.getPrototypeOf(value)!==Array.prototype||Reflect.ownKeys(value).length!==value.length+1)invalid(location,`${location} 必须为普通且完整的 JSON 数组`);
+      const copy=[];
+      for(let index=0;index<value.length;index++){
+        const field=Object.getOwnPropertyDescriptor(value,String(index));
+        if(!field?.enumerable||!Object.hasOwn(field,'value'))invalid(`${location}[${index}]`,`${location} 必须为普通且完整的 JSON 数组`);
+        copy.push(cloneJson(field.value,`${location}[${index}]`,ancestors));
+      }
+      return copy;
+    }
+    return Object.fromEntries(entries(value,location).map(([key,nested])=>[key,cloneJson(nested,`${location}.${key}`,ancestors)]));
+  }finally{ancestors.delete(value);}
+}
+
+export function validateShortcuts(shortcuts,{reservedNames=[]}={}){
+  if(!Array.isArray(reservedNames)||reservedNames.some(name=>typeof name!=='string'))invalid('reservedNames','保留名称必须为字符串数组');
+  const reserved=new Set([...builtinCommands.map(command=>command.name),...reservedNames].map(name=>name.normalize('NFC')));
+  const copy={};
+  for(const [name,shortcut] of entries(shortcuts,'shortcuts')){
+    const location=`shortcuts.${name}`;
+    // 明确拒绝未规范化名称，避免两个视觉相同的入口指向不同能力。
+    if(name!==name.normalize('NFC'))invalid(location,`快捷名称必须使用 NFC 规范形式：${name}`);
+    if(!isCommandName(name))invalid(location,`快捷名称无效：/${name}`);
+    if(reserved.has(name))invalid(location,`快捷名称与现有命令冲突：/${name}`);
+    reserved.add(name);
+    const fields=entries(shortcut,location);
+    if(fields.some(([key])=>!shortcutFields.has(key)))invalid(location,`快捷项 ${name} 包含未声明字段`);
+    const hasAction=Object.hasOwn(shortcut,'action'),hasCommand=Object.hasOwn(shortcut,'command');
+    if(hasAction===hasCommand)invalid(location,`快捷项 ${name} 必须声明 action 或 command 之一`);
+    const field=hasAction?'action':'command',target=shortcut[field];
+    if(hasAction){
+      const separator=typeof target==='string'?target.lastIndexOf(':'):-1;
+      if(separator<=0||separator===target.length-1||/[\s\p{C}]/u.test(target))invalid(`${location}.action`,`快捷项 ${name} 的 action 必须为稳定动作 ID`);
+    }else if(!isCommandName(target))invalid(`${location}.command`,`快捷项 ${name} 的 command 名称无效`);
+    copy[name]={[field]:target};
+    if(Object.hasOwn(shortcut,'plugin')){
+      if(hasAction)invalid(`${location}.plugin`,`动作快捷项 ${name} 不能声明 plugin`);
+      if(!validPluginId(shortcut.plugin))invalid(`${location}.plugin`,`快捷项 ${name} 的 plugin 必须为合法插件包 ID`);
+      copy[name].plugin=shortcut.plugin;
+    }
+    if(Object.hasOwn(shortcut,'input')){
+      if(!plainObject(shortcut.input))invalid(`${location}.input`,`快捷项 ${name} 的 input 必须为普通 JSON 对象`);
+      copy[name].input=cloneJson(shortcut.input,`${location}.input`);
+    }
+  }
+  return copy;
+}
+
+export function bindShortcutCommands(shortcuts,{commands=[],previous={}}={}){
+  const copy=validateShortcuts(shortcuts);
+  const old=validateShortcuts(previous),unbound=new Set(Object.values(old).filter(shortcut=>shortcut.command&&shortcut.plugin===undefined).map(shortcut=>shortcut.command));
+  for(const [name,shortcut] of Object.entries(copy)){
+    // 已有未绑定项即使改参数或重命名也需明确选择目标，不能被整组保存顺带启用。
+    if(!Object.hasOwn(shortcut,'command')||Object.hasOwn(shortcut,'plugin'))continue;
+    if(old[name]?.command===shortcut.command||unbound.has(shortcut.command))continue;
+    const command=commands.find(command=>command.name===shortcut.command);
+    if(command?.plugin!==undefined)shortcut.plugin=command.plugin;
+  }
+  return validateShortcuts(copy);
+}
+
+export function describeShortcuts(shortcuts,{actions=[],commands=[]}={}){
+  const actionIndex=new Map(actions.map(action=>[action.id,action]));
+  return Object.entries(validateShortcuts(shortcuts)).map(([name,shortcut])=>{
+    const field=Object.hasOwn(shortcut,'action')?'action':'command';
+    const id=shortcut[field];
+    let definition;
+    if(field==='action')definition=actionIndex.get(id);
+    else if(shortcut.plugin!==undefined)definition=commands.find(command=>command.name===id&&command.plugin===shortcut.plugin);
+    const descriptions=field==='action'?[definition?.title,definition?.description]:[definition?.description];
+    const target={[field]:id};
+    if(shortcut.plugin!==undefined)target.plugin=shortcut.plugin;
+    const entry={name,target,input:shortcut.input??{},available:Boolean(definition),description:descriptions.find(value=>typeof value==='string'&&value.trim())??id};
+    if(!definition){
+      if(field==='command'&&shortcut.plugin===undefined)entry.reason='尚未绑定目标插件，请重新选择目标';
+      else entry.reason=`${field==='action'?'动作':'命令'}不可用或尚未安装：${shortcut.plugin?`${shortcut.plugin} → `:''}${id}`;
+    }
+    return entry;
+  });
+}

package/node_modules/@mytools/fst-workspace/src/workflows.js

@@ -71,16 +71,18 @@ export class WorkflowStore {
     const files=await readdir(this.root);
     return Promise.all(files.filter(f=>f.endsWith('.yaml')).sort().map(f=>this.get(f.slice(0,-5))));
   }
-  async remove(id){
+  async remove(id,{backup=true}={}){
+    if(typeof backup!=='boolean')throw new FlowError('backup 必须是布尔值',{code:'VALIDATION'});
     await this.get(id);
     const refers=steps=>steps.some(step=>step.workflow&&this.childId(step.workflow)===id||step.branch&&(refers(step.branch.then)||refers(step.branch.else??[]))||step.parallel&&refers(step.parallel.steps));
     const dependents=(await this.list()).filter(flow=>flow.id!==id&&refers(flow.steps));
     if(dependents.length)throw new FlowError(`工作流仍被引用：${dependents.map(flow=>flow.title??flow.id).join('、')}`);
+    if(!backup){await unlink(this.file(id));return null;}
     const directory=path.join(path.dirname(this.root),'.flow','deleted-workflows');
     await mkdir(directory,{recursive:true});
-    const backup=path.join(directory,`${id}-${randomUUID()}.yaml`);
+    const backupFile=path.join(directory,`${id}-${randomUUID()}.yaml`);
     // 同项目内原子移动，备份保留完整原文；复制回原文件名即可恢复。
-    await rename(this.file(id),backup);return backup;
+    await rename(this.file(id),backupFile);return backupFile;
   }
   childId(reference) {
     if(typeof reference!=='string' || !/^(\.\/)?[A-Za-z0-9][A-Za-z0-9_-]*\.yaml$/.test(reference)) throw new FlowError(`子流程必须位于工作流目录内：${reference}`,{code:'VALIDATION'});

package/node_modules/@mytools/pack/index.js

@@ -78,7 +78,7 @@ export async function packApplication(app,{entries,target,outDir='dist',includeW
   for(const w of closure.workflows)await writeFile(path.join(workflowDir,`${w.id}.yaml`),YAML.stringify(w));
   const config={};
   for(const p of plugins)if(p.defaultConfig)config[p.id]=p.defaultConfig;
-  await writeFile(path.join(directory,'flow.project.json'),JSON.stringify({readOnly,plugins:plugins.map(p=>`./app/node_modules/${p.id}`),config,entries,environments:overrides,network:snapshot.project.network,logs:snapshot.project.logs},null,2));
+  await writeFile(path.join(directory,'flow.project.json'),JSON.stringify({readOnly,plugins:plugins.map(p=>`./app/node_modules/${p.id}`),config,entries,environments:overrides,network:snapshot.project.network,logs:snapshot.project.logs,commandPresets:snapshot.project.commandPresets,shortcuts:snapshot.project.shortcuts},null,2));
   const bundleId=randomUUID();
   await writeFile(path.join(directory,'bundle.json'),JSON.stringify({format:2,id:bundleId,editable:!readOnly}));
   await writeFile(path.join(directory,'package.json'),JSON.stringify({private:true,type:'module'},null,2));

package/node_modules/@mytools/pack/package.json

@@ -9,10 +9,10 @@
   "license": "MIT",
   "dependencies": {
     "@mytools/sdk": "0.1.0",
-    "@npmcli/arborist": "10.0.3",
+    "@npmcli/arborist": "9.9.2",
     "archiver": "8.0.0",
-    "make-fetch-happen": "16.0.1",
-    "npm-packlist": "11.3.0",
+    "make-fetch-happen": "15.0.6",
+    "npm-packlist": "10.0.4",
     "tar": "7.5.22",
     "yaml": "2.9.1",
     "@mytools/fst-platform": "0.1.0",

package/node_modules/@mytools/pack/runtime-cache.js

@@ -0,0 +1,26 @@
+import {readFile,rename,unlink,writeFile} from 'node:fs/promises';
+import {createHash,randomUUID} from 'node:crypto';
+import {FlowError} from '@mytools/sdk';
+
+export async function writeCachedFile(file,bytes){
+  const temporary=`${file}.${randomUUID()}.tmp`;
+  try{
+    await writeFile(temporary,bytes,{flag:'wx'});
+    try{await rename(temporary,file);}catch(error){
+      // Windows 上并发替换可能返回 EPERM；仅接受另一写入者已留下的完全相同内容。
+      if(process.platform!=='win32'||!['EPERM','EACCES','EBUSY'].includes(error.code))throw error;
+      let existing;try{existing=await readFile(file);}catch{throw error;}
+      if(!existing.equals(bytes))throw error;
+    }
+  }
+  finally{await unlink(temporary).catch(error=>{if(error.code!=='ENOENT')throw error;});}
+}
+
+export async function readVerifiedCache(file,load,{sha256,message}){
+  let bytes,missing=false;
+  try{bytes=await readFile(file);}catch(error){if(error.code!=='ENOENT')throw error;missing=true;bytes=await load();}
+  if(createHash('sha256').update(bytes).digest('hex')!==sha256)throw new FlowError(message);
+  // 命中有效缓存不再截断重写；冷缓存校验后原子替换，读取者只见完整文件。
+  if(missing)await writeCachedFile(file,bytes);
+  return bytes;
+}