@yanglaofish/fishtools 0.5.2 → 0.5.3

package/manual/packages/fst-workspace/src/plugin-registry.js

@@ -0,0 +1,58 @@
+import path from 'node:path';
+import os from 'node:os';
+import {mkdir,writeFile,rename} from 'node:fs/promises';
+import {randomUUID} from 'node:crypto';
+import {readJson} from '@mytools/fst-platform/json';
+import {withPluginMutation} from './plugin-installations.js';
+import {WorkflowStore} from './workflows.js';
+import {readPluginState} from './plugin-installations.js';
+import {loadPlugin} from '@mytools/fst-plugin/loader';
+
+export const userPluginRegistry=()=>path.resolve(process.env.FISHTOOLS_HOME??path.join(os.homedir(),'.fishtools'),'plugins');
+
+export async function registerWorkspace(registryDir,projectDir){
+  return withPluginMutation(registryDir,async()=>{
+    const file=path.join(registryDir,'.flow','workspaces.json'),projects=await readJson(file,[]),directory=path.resolve(projectDir);
+    if(projects.includes(directory))return;
+    const temporary=`${file}.${randomUUID()}.tmp`;
+    await mkdir(path.dirname(file),{recursive:true});
+    await writeFile(temporary,JSON.stringify([...projects,directory],null,2));await rename(temporary,file);
+  });
+}
+
+function referencedActions(steps,id,result=new Set()){
+  for(const step of steps??[]){
+    if(step.action?.startsWith(`${id}:`))result.add(step.action);
+    if(step.branch){referencedActions(step.branch.then,id,result);referencedActions(step.branch.else,id,result);}
+    if(step.parallel)referencedActions(step.parallel.steps,id,result);
+  }
+  return [...result];
+}
+
+// 调用方持有共享库锁；各工作区的工作流修改也持有该锁，因此扫描期间不会补写引用。
+export async function registryWorkflowReferences(registryDir,id){
+  const projects=await readJson(path.join(registryDir,'.flow','workspaces.json'),[]),references=[];
+  for(const projectDir of projects){
+    for(const workflow of await new WorkflowStore(path.join(projectDir,'workflows')).list()){
+      const actions=referencedActions(workflow.steps,id);
+      if(actions.length)references.push({projectDir,id:workflow.id,title:workflow.title??workflow.id,actions});
+    }
+  }
+  return references;
+}
+
+export async function registryPluginReferences(registryDir,id,{globalPlugins=[]}={}){
+  const projects=await readJson(path.join(registryDir,'.flow','workspaces.json'),[]),globalState=await readPluginState(registryDir),references=[];
+  const excluded=new Set([...Object.keys(globalState.dependencies??{}),...Object.keys(globalState.links??{}),...(globalState.disabledLegacy??[])]);
+  for(const projectDir of projects){
+    const project=await readJson(path.join(projectDir,'flow.project.json'),{});
+    if(project.readOnly||project.baseBundle)continue;
+    const local=await readPluginState(projectDir),definitions=new Map(globalPlugins.map(plugin=>[plugin.id,plugin]));
+    const add=async(spec,base)=>{const {plugin}=await loadPlugin(spec,base);if(!excluded.has(plugin.id))definitions.set(plugin.id,plugin);};
+    for(const spec of project.plugins??[])if(!excluded.has(spec))await add(spec,projectDir);
+    for(const name of Object.keys(local.dependencies??{}))if(!excluded.has(name))await add(name,local.root);
+    for(const [name,source] of Object.entries(local.links??{}))if(!excluded.has(name))await add(source,projectDir);
+    for(const plugin of definitions.values())if(plugin.id!==id&&Object.hasOwn(plugin.dependencies??{},id))references.push({projectDir,plugin:plugin.id});
+  }
+  return references;
+}

package/manual/packages/fst-workspace/src/plugins.js

@@ -5,22 +5,25 @@ import {FlowError} from '@mytools/sdk';
 import {readJson} from '@mytools/fst-platform/json';
 import {npm} from '@mytools/fst-platform/npm';
 import {loadPlugin} from '@mytools/fst-plugin/loader';
-export async function installGeneration(projectDir,{add,remove,link,state}) {
+export async function installGeneration(projectDir,{add,remove,link,state,sourceDir=projectDir}) {
   const root=path.join(projectDir,'.flow','installations',randomUUID());
   await mkdir(root,{recursive:true});
   const dependencies={...(state?.dependencies??{})};
   const links={...(state?.links??{})};
+  const disabledLegacy=new Set(state?.disabledLegacy??[]);
   if(remove){delete dependencies[remove];delete links[remove];}
+  if(remove&&state?.global)disabledLegacy.add(remove);
   if(link){
     const source=path.resolve(link),pkg=await readJson(path.join(source,'package.json'));
     const loaded=await loadPlugin(source,projectDir);
     if(!pkg.name||pkg.name!==loaded.plugin?.id||pkg.version!==loaded.plugin?.version)throw new FlowError('开发插件的包名/版本必须与插件 id/version 一致',{code:'VALIDATION'});
     links[pkg.name]=source;delete dependencies[pkg.name];
+    disabledLegacy.delete(pkg.name);
   }
   await writeFile(path.join(root,'package.json'),JSON.stringify({name:'flow-project-plugins',private:true,dependencies},null,2));
   let source=add;
   if(add) {
-    try {await access(path.resolve(projectDir,add));source=path.resolve(projectDir,add);} catch {}
+    try {await access(path.resolve(sourceDir,add));source=path.resolve(sourceDir,add);} catch {}
     if(source.startsWith('-')) throw new FlowError('插件来源不能以选项符号开头',{code:'VALIDATION'});
   }
   if(source||Object.keys(dependencies).length){
@@ -29,7 +32,7 @@ export async function installGeneration(projectDir,{add,remove,link,state}) {
   }
   const pkg=await readJson(path.join(root,'package.json'));
   const loaded=[];
-  for(const name of Object.keys(pkg.dependencies??{})){delete links[name];loaded.push(await loadPlugin(name,root));}
+  for(const name of Object.keys(pkg.dependencies??{})){delete links[name];disabledLegacy.delete(name);loaded.push(await loadPlugin(name,root));}
   for(const source of Object.values(links))loaded.push(await loadPlugin(source,projectDir));
-  return {state:{root,dependencies:pkg.dependencies??{},links,...(state?.root?{previousRoot:state.root}:{})},loaded};
+  return {state:{root,dependencies:pkg.dependencies??{},links,...(state?.global?{global:true,disabledLegacy:[...disabledLegacy]}:{}),...(state?.root?{previousRoot:state.root}:{})},loaded};
 }

package/manual/packages/fst-workspace/src/workflows.js

@@ -71,16 +71,18 @@ export class WorkflowStore {
     const files=await readdir(this.root);
     return Promise.all(files.filter(f=>f.endsWith('.yaml')).sort().map(f=>this.get(f.slice(0,-5))));
   }
-  async remove(id){
+  async remove(id,{backup=true}={}){
+    if(typeof backup!=='boolean')throw new FlowError('backup 必须是布尔值',{code:'VALIDATION'});
     await this.get(id);
     const refers=steps=>steps.some(step=>step.workflow&&this.childId(step.workflow)===id||step.branch&&(refers(step.branch.then)||refers(step.branch.else??[]))||step.parallel&&refers(step.parallel.steps));
     const dependents=(await this.list()).filter(flow=>flow.id!==id&&refers(flow.steps));
     if(dependents.length)throw new FlowError(`工作流仍被引用：${dependents.map(flow=>flow.title??flow.id).join('、')}`);
+    if(!backup){await unlink(this.file(id));return null;}
     const directory=path.join(path.dirname(this.root),'.flow','deleted-workflows');
     await mkdir(directory,{recursive:true});
-    const backup=path.join(directory,`${id}-${randomUUID()}.yaml`);
+    const backupFile=path.join(directory,`${id}-${randomUUID()}.yaml`);
     // 同项目内原子移动，备份保留完整原文；复制回原文件名即可恢复。
-    await rename(this.file(id),backup);return backup;
+    await rename(this.file(id),backupFile);return backupFile;
   }
   childId(reference) {
     if(typeof reference!=='string' || !/^(\.\/)?[A-Za-z0-9][A-Za-z0-9_-]*\.yaml$/.test(reference)) throw new FlowError(`子流程必须位于工作流目录内：${reference}`,{code:'VALIDATION'});

package/manual/packages/pack/package.json

@@ -9,10 +9,10 @@
   "license": "MIT",
   "dependencies": {
     "@mytools/sdk": "0.1.0",
-    "@npmcli/arborist": "10.0.3",
+    "@npmcli/arborist": "9.9.2",
     "archiver": "8.0.0",
-    "make-fetch-happen": "16.0.1",
-    "npm-packlist": "11.3.0",
+    "make-fetch-happen": "15.0.6",
+    "npm-packlist": "10.0.4",
     "tar": "7.5.22",
     "yaml": "2.9.1",
     "@mytools/fst-platform": "0.1.0",

package/manual/packages/pack/runtime-cache.js

@@ -0,0 +1,26 @@
+import {readFile,rename,unlink,writeFile} from 'node:fs/promises';
+import {createHash,randomUUID} from 'node:crypto';
+import {FlowError} from '@mytools/sdk';
+
+export async function writeCachedFile(file,bytes){
+  const temporary=`${file}.${randomUUID()}.tmp`;
+  try{
+    await writeFile(temporary,bytes,{flag:'wx'});
+    try{await rename(temporary,file);}catch(error){
+      // Windows 上并发替换可能返回 EPERM；仅接受另一写入者已留下的完全相同内容。
+      if(process.platform!=='win32'||!['EPERM','EACCES','EBUSY'].includes(error.code))throw error;
+      let existing;try{existing=await readFile(file);}catch{throw error;}
+      if(!existing.equals(bytes))throw error;
+    }
+  }
+  finally{await unlink(temporary).catch(error=>{if(error.code!=='ENOENT')throw error;});}
+}
+
+export async function readVerifiedCache(file,load,{sha256,message}){
+  let bytes,missing=false;
+  try{bytes=await readFile(file);}catch(error){if(error.code!=='ENOENT')throw error;missing=true;bytes=await load();}
+  if(createHash('sha256').update(bytes).digest('hex')!==sha256)throw new FlowError(message);
+  // 命中有效缓存不再截断重写；冷缓存校验后原子替换，读取者只见完整文件。
+  if(missing)await writeCachedFile(file,bytes);
+  return bytes;
+}

package/manual/packages/pack/runtime.js

@@ -4,6 +4,7 @@ import path from 'node:path';
 import * as tar from 'tar';
 import fetch from 'make-fetch-happen';
 import { FlowError } from '@mytools/sdk';
+import {readVerifiedCache,writeCachedFile} from './runtime-cache.js';
 
 export const NODE_VERSION='24.15.0';
 const hashes={
@@ -24,13 +25,11 @@ export async function copyRuntime({target,directory,cacheDir,runtimePath,include
   if(runtimePath){
     if(!win)throw new FlowError('自定义 runtimePath 首版只接受已验证的 Windows Node.js 文件');
     bytes=await readFile(runtimePath);
+    if(digest(bytes)!==hashes[target])throw new FlowError('Node.js 运行时校验失败，请检查缓存或指定文件');
+    await writeCachedFile(cache,bytes);
   }else{
-    try{bytes=await readFile(cache);}catch{
-      bytes=await download(`https://nodejs.org/download/release/v${NODE_VERSION}/${file}`);
-    }
+    bytes=await readVerifiedCache(cache,()=>download(`https://nodejs.org/download/release/v${NODE_VERSION}/${file}`),{sha256:hashes[target],message:'Node.js 运行时校验失败，请检查缓存或指定文件'});
   }
-  if(digest(bytes)!==hashes[target])throw new FlowError('Node.js 运行时校验失败，请检查缓存或指定文件');
-  await writeFile(cache,bytes);
   if(win)await writeFile(path.join(directory,'runtime','node.exe'),bytes);
   else{
     const extraction=path.join(cacheDir,'linux-extracted');await mkdir(extraction,{recursive:true});
@@ -43,16 +42,13 @@ export async function copyRuntime({target,directory,cacheDir,runtimePath,include
   try{license=await readFile(licenseCache);}catch{
     try{if(process.versions.node!==NODE_VERSION)throw new Error('版本不同');license=await readFile(path.join(path.dirname(process.execPath),'LICENSE'));}
     catch{license=await download(`https://raw.githubusercontent.com/nodejs/node/v${NODE_VERSION}/LICENSE`);}
-    await writeFile(licenseCache,license);
+    await writeCachedFile(licenseCache,license);
   }
   await mkdir(path.join(directory,'licenses'),{recursive:true});await writeFile(path.join(directory,'licenses','NODE_LICENSE'),license);
   if(includeNpm){
     // npm 是平台无关的 JS，直接复用已固定校验的官方 Linux 分发中的完整 npm 目录。
     const npmArchive=path.join(cacheDir,`node-v${NODE_VERSION}-linux-x64.tar.gz`);
-    let npmBytes;
-    try{npmBytes=await readFile(npmArchive);}catch{npmBytes=await download(`https://nodejs.org/download/release/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.gz`);}
-    if(digest(npmBytes)!==hashes['linux-x64-glibc'])throw new FlowError('npm 来源的 Node.js 归档校验失败');
-    await writeFile(npmArchive,npmBytes);
+    await readVerifiedCache(npmArchive,()=>download(`https://nodejs.org/download/release/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.gz`),{sha256:hashes['linux-x64-glibc'],message:'npm 来源的 Node.js 归档校验失败'});
     const extraction=path.join(cacheDir,'npm-extracted');await mkdir(extraction,{recursive:true});
     await tar.x({file:npmArchive,cwd:extraction,filter:name=>name.includes('/lib/node_modules/npm/')});
     await cp(path.join(extraction,`node-v${NODE_VERSION}-linux-x64/lib/node_modules/npm`),path.join(directory,'runtime/node_modules/npm'),{recursive:true,dereference:true});

package/manual/plugins/commands/package.json

@@ -9,7 +9,7 @@
   },
   "files": ["index.js", "README.md", "LICENSE"],
   "license": "MIT",
-  "engines": {"node": ">=24.15.0"},
+  "engines": {"node": "^22.22.2 || >=24.0.0"},
   "dependencies": {
     "@mytools/sdk": "0.1.0",
     "@mytools/fst-platform": "0.1.0"

package/node_modules/@mytools/commands/package.json

@@ -9,7 +9,7 @@
   },
   "files": ["index.js", "README.md", "LICENSE"],
   "license": "MIT",
-  "engines": {"node": ">=24.15.0"},
+  "engines": {"node": "^22.22.2 || >=24.0.0"},
   "dependencies": {
     "@mytools/sdk": "0.1.0",
     "@mytools/fst-platform": "0.1.0"

package/node_modules/@mytools/core/README.md

@@ -25,6 +25,8 @@
 
 ## 维护与验证
 
+`createApplication({projectDir,pluginRegistryDir})` 可让多个工作区读取同一插件库；CLI 默认接入用户级全局库，程序未传此选项时保留工作区模式。分发包始终使用自身工作区安装状态。`listPlugins()` 返回 scope/source 和待配置原因；`pluginDefinition(id)` 返回作者声明。`app.resultsDir` 是业务文件根，`app.outputDir` 保留为日志根；插件 `ctx.outputDir` 与 `ctx.logDir` 分别对应本次业务目录和日志目录。
+
 `app.startShell(script,options)` 执行临时命令，`app.startAction(id,input,context)` 调用任意动作，两者均纳入运行记录与关闭等待。`startCommand(name,input,{expectedPlugin,...context})` 可固定命令提供者，启动时再次检查，防止参数填写期间被其他同名能力替换。`configureCommandPresets` 和 `configureShortcuts` 在备份、冲突检查与变更锁内保存项目设置；命令快捷项在用户明确设置时绑定提供者 ID，普通安装/卸载和未改变目标的整组保存不会重新绑定；已有未绑定项必须明确提供 plugin 或在界面重新选择目标。注册项变化通过定向宿主更新生效，导出快照保留所需定义与有效快捷项。
 
 本模块负责上述职责的实现、文档与回归；跨模块接口调整需要同时检查生产者与消费者。具体维护人员尚未指定。

package/node_modules/@mytools/core/package.json

@@ -19,7 +19,7 @@
   ],
   "license": "MIT",
   "engines": {
-    "node": ">=24.15.0"
+    "node": "^22.22.2 || >=24.0.0"
   },
   "dependencies": {
     "@mytools/commands": "0.1.0",

package/node_modules/@mytools/core/src/application.js

@@ -1,4 +1,4 @@
-import { mkdir, readFile, writeFile, rename, rm } from 'node:fs/promises';
+import { mkdir, readFile, writeFile, rename, rm, rmdir } from 'node:fs/promises';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { EventEmitter } from 'node:events';
@@ -25,6 +25,8 @@ import {openPluginState,withPluginMutation,assertPluginState,savePluginState,lea
 import {planPluginUpdate,changedPluginSources} from './plugin-update.js';
 import {validateNetworkPolicy,inspectNetworkPolicy,resolveNetworkPolicy,buildProcessEnv} from '@mytools/fst-platform/network';
 import {resolvePrivilegeRequirement,checkStaticPrivilege} from '@mytools/fst-plugin/privileges';
+import {registerWorkspace,registryWorkflowReferences,registryPluginReferences} from '@mytools/fst-workspace/registry';
+import {mergePluginEntries,preparePluginCatalog} from './plugin-catalog.js';
 
 function declaredCommands(entries){
   return entries.flatMap(entry=>{const plugin=entry.plugin??entry;return Object.keys(plugin.commands??{}).map(name=>({name,plugin:plugin.id}));});
@@ -39,10 +41,13 @@ function workflowActions(steps,found=new Set()){
   return found;
 }
 
-export async function createApplication({projectDir=process.cwd(),workspace,outputDir,plugins,config={},maintenance=false,omitInstalledPlugin,allowUnknownPrivileges=false}={}) {
+export async function createApplication({projectDir=process.cwd(),workspace,pluginRegistryDir,outputDir,plugins,config={},maintenance=false,omitInstalledPlugin,allowUnknownPrivileges=false}={}) {
   projectDir=await prepareBundleWorkspace(path.resolve(projectDir),workspace);
   const project=await readJson(path.join(projectDir,'flow.project.json'),{plugins:[]});
-  const output=path.resolve(outputDir??process.env.FLOW_OUTPUT_DIR??(project.readOnly?path.join(process.cwd(),'flow-results'):path.join(projectDir,'.flow','runs')));
+  const requestedOutput=outputDir??process.env.FLOW_OUTPUT_DIR;
+  const output=path.resolve(requestedOutput??(project.readOnly?path.join(process.cwd(),'flow-results'):path.join(projectDir,'.flow','runs')));
+  const results=path.resolve(requestedOutput||project.readOnly?path.join(output,'files'):path.join(projectDir,'results'));
+  const sessionId=randomUUID();
   const store=new WorkflowStore(path.join(projectDir,'workflows'));
   const emitter=new EventEmitter(), runs=new Map(),journals=new WeakMap();
   const resources=createResources(),operations=new Set();let closing,launching=0;
@@ -51,17 +56,24 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
   if(!Number.isSafeInteger(maxCachedRuns)||maxCachedRuns<1||maxCachedRuns>1000)throw new FlowError('maxCachedRuns 必须为 1 到 1000 的整数');
   const fileProbe=createFileProbe(project.fileAccess);
   validateKeepRuns(project.logs?.keepRuns??null);
-  const opened=await openPluginState(projectDir,{readOnly:project.readOnly});
-  let host,state=opened.state,busy=false;
+  const registryDir=path.resolve(pluginRegistryDir&&!project.readOnly&&!project.baseBundle?pluginRegistryDir:projectDir),shared=registryDir!==projectDir;
+  if(shared)await registerWorkspace(registryDir,projectDir);
+  const opened=await openPluginState(registryDir,{readOnly:project.readOnly});
+  const localOpened=shared?await openPluginState(projectDir):null;
+  let host,state=opened.state,localState=localOpened?.state,busy=false,pending=new Map(),catalogEntries=[],localEntries=[];
   const installationLeases=new Map();
   if(state.root)installationLeases.set(path.resolve(state.root),opened.release);
+  if(localState?.root)installationLeases.set(path.resolve(localState.root),localOpened.release);
+  const withRegistryMutation=callback=>withPluginMutation(registryDir,()=>shared?withPluginMutation(projectDir,callback):callback());
+  const assertStates=async()=>{await assertPluginState(registryDir,state);if(shared)await assertPluginState(projectDir,localState);};
   const app={
-    projectDir,project,outputDir:output,store,
+    projectDir,project,pluginRegistryDir:registryDir,pluginScope:shared?'global':'workspace',outputDir:output,resultsDir:results,sessionId,store,
     get host(){return host;},
     get maintenance(){return maintenance;},
     developmentStatus:()=>({running:launching+writingRuns.size+operations.size,busy,closing:!!closing}),
     catalog:()=>host.catalog(),
-    listPlugins:()=>[...host.definitions.values()].map(p=>({id:p.id,version:p.version,title:p.title,description:p.description,platforms:p.platforms,architectures:p.architectures,environments:p.environments,config:p.config,requirements:p.requirements,privileges:pluginPrivileges(p),runtime:{...host.runtimeStatus().find(r=>r.id===p.id),...(p.runtime?{updatePolicy:p.runtime.updatePolicy??'maintenance'}:{})},removable:!!(state.dependencies?.[p.id]||state.links?.[p.id]),development:!!state.links?.[p.id],warnings:host.warnings.filter(item=>item.plugin===p.id).map(item=>item.message)})),
+    pluginDefinition:id=>host.definitions.get(id)??pending.get(id)?.entry.plugin,
+    listPlugins:()=>catalogEntries.map(entry=>{const p=entry.plugin??entry,scope=entry.scope??'preset',installed=scope==='global'?state:scope==='workspace'?(shared?localState:state):{};return {id:p.id,version:p.version,title:p.title,description:p.description,scope,source:entry.root,platforms:p.platforms,architectures:p.architectures,environments:p.environments,config:p.config,requirements:p.requirements,privileges:pluginPrivileges(p),runtime:{...(pending.has(p.id)?{status:'unconfigured'}:host.runtimeStatus().find(r=>r.id===p.id)),...(p.runtime?{updatePolicy:p.runtime.updatePolicy??'maintenance'}:{})},...(pending.has(p.id)?{configurationError:pending.get(p.id).message}:{}),removable:!!(installed.dependencies?.[p.id]||installed.links?.[p.id]),development:!!installed.links?.[p.id],warnings:host.warnings.filter(item=>item.plugin===p.id).map(item=>item.message)};}),
     listCommands:()=>host.commands(),
     listShortcuts:()=>describeShortcuts(project.shortcuts??{},{actions:host.catalog(),commands:host.commands()}),
     async configureShortcuts(value){return updateUserCommands({shortcuts:value});},
@@ -71,7 +83,7 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
     listWorkflows:()=>store.list(),
     async saveWorkflow(w){return mutateWorkflow(()=>store.save(w),w);},
     async duplicateWorkflow(definition,options){return mutateWorkflow(()=>store.duplicate(definition,options),definition);},
-    async removeWorkflow(id){return mutateWorkflow(()=>store.remove(id));},
+    async removeWorkflow(id,options){return mutateWorkflow(()=>store.remove(id,options));},
     async checkWorkflow(id){
       host.assertHealthy();
       const closure=await store.resolve([id],host);
@@ -87,22 +99,24 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
       return app.executeTracked(id,(activeHost,context,event)=>{
         if(blocked.length)throw new FlowError(`工作流缺少运行权限：${blocked.map(item=>item.action).join('、')}`,{code:'INSUFFICIENT_PRIVILEGE',details:{actions:blocked}});
         return runWorkflow({store:snapshotStore,host:activeHost,id,input,signal:context.signal,onEvent:event,runId:context.runId,context:{...context,allowUnknownPrivileges:!!options.allowUnknownPrivileges,networkPolicy}});
-      });
+      },{kind:'workflow',title:closure.workflows.find(flow=>flow.id===id)?.title??id,input});
     },
     async startCommand(name,input={},context={}){
       if(busy)throw new FlowError('插件更新中，请稍后调用');
+      for(const [id,{entry}] of pending)if(Object.hasOwn(entry.plugin.commands??{},name))assertConfigured(id);
       const networkPolicy=structuredClone(project.network??{});
       return app.executeTracked(`/${name}`,(activeHost,runContext)=>{
         if(context.expectedPlugin!==undefined&&!activeHost.commands().some(command=>command.name===name&&command.plugin===context.expectedPlugin)){
           throw new FlowError('命令目标插件已变更，请重新选择目标后执行',{code:'COMMAND_TARGET_CHANGED',details:{command:name,plugin:context.expectedPlugin}});
         }
         return activeHost.invokeCommand(name,input,{...context,...runContext,networkPolicy});
-      });
+      },{kind:'command',title:host.commands().find(command=>command.name===name)?.description??`/${name}`,input});
     },
     async startAction(id,input={},context={}){
       if(busy)throw new FlowError('插件更新中，请稍后调用');
+      assertConfigured(id.slice(0,id.lastIndexOf(':')));
       const networkPolicy=structuredClone(project.network??{});
-      return app.executeTracked(id,(activeHost,runContext)=>activeHost.invoke(id,input,{...context,...runContext,networkPolicy}));
+      return app.executeTracked(id,(activeHost,runContext)=>activeHost.invoke(id,input,{...context,...runContext,networkPolicy}),{kind:'action',title:host.catalog().find(action=>action.id===id)?.title??id,input});
     },
     async startShell(script,{shell='auto',timeout=30000}={}){
       if(busy)throw new FlowError('项目更新中，请稍后执行命令');
@@ -111,15 +125,16 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
       const env=buildProcessEnv(policy);
       return app.executeTracked('!命令',async(_host,context)=>{
         const result=await runShell(script,{shell,temporaryDir:context.outputDir,cwd:projectDir,env,extendEnv:false,signal:context.signal,timeout,outputMode:'stream',summaryBytes:65536,
-          onOutput:({stream,message})=>context.log(message,undefined,{stream})});
+          onStart:invocation=>context.log('执行程序',invocation,{kind:'process'}),
+          onOutput:({stream,message})=>context.log(message,undefined,{stream,audience:'user'})});
         if(result.exitCode!==0)throw new FlowError(`命令执行失败，退出码 ${result.exitCode}`,{code:'EXECUTION_FAILED',details:result});
         return result;
-      });
+      },{kind:'shell',title:'系统命令'});
     },
-    async executeTracked(id,execute){
+    async executeTracked(id,execute,{kind='workflow',title=id,input}={}){
       const runId=randomUUID(),controller=new AbortController();
-      const run={id:runId,workflowId:id,logOwner:runLogs.owner,status:'running',startedAt:new Date().toISOString(),controller};
-      const journal=await runLogs.start({id:runId,workflowId:id,status:run.status,startedAt:run.startedAt},{onEvent:event=>emitter.emit('event',event)});
+      const run={id:runId,workflowId:id,kind,title,sessionId,resultDir:path.join(results,runId),logOwner:runLogs.owner,status:'running',startedAt:new Date().toISOString(),controller};
+      const journal=await runLogs.start({id:runId,workflowId:id,kind,title,sessionId,status:run.status,startedAt:run.startedAt},{onEvent:event=>emitter.emit('event',event)});
       journals.set(run,journal);
       // 兼容运行句柄的事件读取；外部修改不影响日志模块的缓存。
       Object.defineProperty(run,'events',{get:()=>journal.snapshot().events});
@@ -128,9 +143,12 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
       const event=e=>journal.append(e);
       const activeHost=host;
       run.done=(async()=>{
+        let createdResults=false;
         try {
+          createdResults=(await mkdir(run.resultDir,{recursive:true}))!==undefined;
           await event({type:'run.started'});
-          run.output=await execute(activeHost,{outputDir:journal.directory,signal:controller.signal,runId,log:(message,data,meta={})=>event({...meta,type:'log',message,data})},event);
+          if(input!==undefined)await event({type:'run.input',input});
+          run.output=await execute(activeHost,{outputDir:run.resultDir,logDir:journal.directory,signal:controller.signal,runId,log:(message,data,meta={})=>event({...meta,type:'log',message,data})},event);
           run.status='succeeded';await event({type:'run.succeeded'});
         } catch(error) {
           if(error?.code==='WORKFLOW_STOPPED'){
@@ -143,9 +161,16 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
           }
         } finally {
           run.finishedAt=new Date().toISOString();
+          if(createdResults){
+            try{await rmdir(run.resultDir);run.resultDir=undefined;}
+            catch(error){
+              if(error.code==='ENOENT')run.resultDir=undefined;
+              else if(!['ENOTEMPTY','EEXIST'].includes(error.code))run.warnings=[{code:'RESULT_CLEANUP_FAILED',message:`空结果目录无法移除：${error.message}`}];
+            }
+          }
           try{await journal.finish(runState(run));}finally{writingRuns.delete(runId);}
           try{await pruneLogs();}catch(error){
-            run.warnings=[{code:'LOG_PRUNE_FAILED',message:`日志自动清理失败：${error.message}`}];
+            run.warnings=[...(run.warnings??[]),{code:'LOG_PRUNE_FAILED',message:`日志自动清理失败：${error.message}`}];
             await journal.save(runState(run));
           }
         }
@@ -225,29 +250,32 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
     async configurePlugin(id,value,options={}){
       if(project.readOnly)throw new FlowError('只读项目不能保存配置');
       if(busy||launching||app.listRuns().some(r=>r.status==='running'))throw new FlowError('请等待运行或安装结束');
-      if(!host.definitions.has(id))throw new FlowError(`插件不存在：${id}`);
-      value=validate(host.definitions.get(id).config,value,`${id} 配置`);
+      if(!app.pluginDefinition(id))throw new FlowError(`插件不存在：${id}`);
+      value=validate(app.pluginDefinition(id).config,value,`${id} 配置`);
       busy=true;let backup;
       try{
-        await withPluginMutation(projectDir,async()=>{
-        await assertPluginState(projectDir,state);
+        await withRegistryMutation(async()=>{
+        await assertStates();
         const file=path.join(projectDir,'flow.project.json'),latest=await readJson(file,project);
         if(latest.readOnly)throw new FlowError('只读项目不能保存配置');
         const nextConfig={...latest.config,[id]:value};
         const oldConfig={...project.config,...config},effectiveNext={...nextConfig,...config};
-        const entries=[...host.definitions.values()].map(p=>({plugin:p,root:p.root}));
-        const plan=planPluginUpdate(host.definitions,host.definitions,oldConfig,effectiveNext,new Set([id]));
+        const prepared=preparePluginCatalog(catalogEntries,effectiveNext);
+        const nextDefinitions=new Map(prepared.active.map(entry=>[(entry.plugin??entry).id,entry.plugin??entry]));
+        const entries=prepared.active,oldEntries=[...host.definitions.values()].map(p=>({plugin:p,root:p.root}));
+        const plan=planPluginUpdate(host.definitions,nextDefinitions,oldConfig,effectiveNext,new Set([id]));
         assertMaintenance(plan,options);
         backup=await backupProjectFile(file,latest,'config');
         if(plan.affected.length)await host.replace({plugins:entries,config:effectiveNext,affected:plan.affected});
         const nextProject={...latest,config:nextConfig},temp=`${file}.${randomUUID()}.tmp`;
         try{await writeFile(temp,JSON.stringify(nextProject,null,2));await rename(temp,file);}
         catch(error){
-          if(plan.affected.length)try{await host.replace({plugins:entries,config:oldConfig,affected:plan.affected});}
+          if(plan.affected.length)try{await host.replace({plugins:oldEntries,config:oldConfig,affected:plan.affected});}
           catch(recovery){host.invalidate();throw new AggregateError([error,recovery],`配置保存失败且插件恢复失败：${error.message}；${recovery.message}`);}
           throw error;
         }
         for(const key of Object.keys(project))delete project[key];Object.assign(project,nextProject);
+        pending=prepared.pending;
         });
       }finally{busy=false;}
       return {backup};
@@ -285,21 +313,29 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
       });return closing;
     },
   };
-  let initial;
+  let initial,globalEntries=[];
   const services={application:app,runProcess,fs:fileProbe};
   const hostProject=()=>({directory:projectDir,readOnly:!!project.readOnly});
   const build=extra=>{
-    const entries=entriesWithPresets([...initial,...extra],project.commandPresets??{});
+    catalogEntries=entriesWithPresets(mergePluginEntries(initial,shared?localEntries:extra,shared?extra:[],state.disabledLegacy,{shared}),project.commandPresets??{});
+    const entries=catalogEntries;
     validateShortcuts(project.shortcuts??{},{reservedNames:declaredCommands(entries).map(command=>command.name)});
-    return createHost({plugins:entries,config:{...project.config,...config},services,project:hostProject(),network:()=>project.network,environmentOverrides:project.environments,runtimeEnabled:!maintenance,allowUnknownPrivileges});
+    const prepared=preparePluginCatalog(entries,{...project.config,...config});pending=prepared.pending;
+    return createHost({plugins:prepared.active,config:{...project.config,...config},services,project:hostProject(),network:()=>project.network,environmentOverrides:project.environments,runtimeEnabled:!maintenance,allowUnknownPrivileges});
   };
   try{
     initial=plugins??await Promise.all((project.plugins??[]).map(spec=>loadPlugin(spec,project.baseBundle?.root??projectDir)));
-    const external=[];
-    for(const name of Object.keys(state.dependencies??{}))if(!maintenance||name!==omitInstalledPlugin)external.push(await loadPlugin(name,state.root));
-    for(const [name,source] of Object.entries(state.links??{}))if(!maintenance||name!==omitInstalledPlugin)external.push(await loadPlugin(source,projectDir));
-    host=await build(external);
-  }catch(error){await fileProbe.close();await opened.release();throw error;}
+    globalEntries=await loadInstalled(state,registryDir);
+    if(shared)localEntries=await loadInstalled(localState,projectDir,new Set([...Object.keys(state.dependencies??{}),...Object.keys(state.links??{}),...(state.disabledLegacy??[])]));
+    host=await build(globalEntries);
+  }catch(error){await fileProbe.close();await opened.release();await localOpened?.release();throw error;}
+  async function loadInstalled(current,base,excluded=new Set()){
+    const loaded=[];
+    for(const name of Object.keys(current.dependencies??{}))if(!excluded.has(name)&&(!maintenance||name!==omitInstalledPlugin))loaded.push(await loadPlugin(name,current.root));
+    for(const [name,source] of Object.entries(current.links??{}))if(!excluded.has(name)&&(!maintenance||name!==omitInstalledPlugin))loaded.push(await loadPlugin(source,base));
+    return loaded;
+  }
+  function assertConfigured(id){if(pending.has(id))throw new FlowError(`插件 ${id} 尚未配置：${pending.get(id).message}`,{code:'PLUGIN_NOT_CONFIGURED',details:{plugin:id}});}
   for(const name of ['startRun','startCommand','startAction','startShell','startWeb','saveWorkflow','duplicateWorkflow','removeWorkflow','installPlugin','linkPlugin','removePlugin','configurePlugin','configureNetworkPolicy','configureLogs','configureCommandPresets','configureShortcuts','setMaintenance','pack']){
     const original=app[name],isRun=['startRun','startCommand','startAction','startShell'].includes(name);
     app[name]=async(...args)=>{
@@ -312,8 +348,8 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
   async function mutateWorkflow(operation,definition){
     if(project.readOnly)throw new FlowError('只读运行包不能修改工作流');
     if(busy)throw new FlowError('插件变更期间暂不能修改工作流',{code:'PLUGIN_BUSY'});
-    return withPluginMutation(projectDir,async()=>{
-      await assertPluginState(projectDir,state);
+    return withRegistryMutation(async()=>{
+      await assertStates();
       if(definition){
         const workflow=store.validateShape(definition),latest=await readJson(path.join(projectDir,'flow.project.json'),project);
         const missing=[...workflowActions(workflow.steps)].filter(id=>id.startsWith(`${COMMANDS_PLUGIN_ID}:`)&&!Object.hasOwn(latest.commandPresets??{},id.slice(COMMANDS_PLUGIN_ID.length+1)));
@@ -344,8 +380,8 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
     const requested=structuredClone(changes);
     if(Object.hasOwn(requested,'commandPresets'))requested.commandPresets=validateCommandPresets(requested.commandPresets);
     busy=true;
-    try{return await withPluginMutation(projectDir,async()=>{
-      await assertPluginState(projectDir,state);
+    try{return await withRegistryMutation(async()=>{
+      await assertStates();
       const file=path.join(projectDir,'flow.project.json'),latest=await readJson(file,project);
       if(latest.readOnly)throw new FlowError('只读运行包不能修改注册命令或快捷名称');
       for(const field of Object.keys(requested))if(!isDeepStrictEqual(latest[field]??{},project[field]??{})){
@@ -354,7 +390,8 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
       const nextProject={...latest,...requested};
       const presets=validateCommandPresets(nextProject.commandPresets??{});
       const oldEntries=[...host.definitions.values()].map(plugin=>({plugin,root:plugin.root}));
-      const entries=entriesWithPresets(oldEntries,presets);
+      const nextCatalog=entriesWithPresets(catalogEntries,presets),prepared=preparePluginCatalog(nextCatalog,{...latest.config,...config});
+      const entries=prepared.active;
       const reservedNames=declaredCommands(entries).map(command=>command.name);
       const shortcuts=Object.hasOwn(requested,'shortcuts')?bindShortcutCommands(nextProject.shortcuts??{},{commands:declaredCommands(entries),previous:latest.shortcuts??{}}):nextProject.shortcuts??{};
       nextProject.shortcuts=validateShortcuts(shortcuts,{reservedNames});
@@ -378,6 +415,7 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
         throw error;
       }finally{await rm(temp,{force:true});}
       for(const key of Object.keys(project))delete project[key];Object.assign(project,nextProject);
+      catalogEntries=nextCatalog;pending=prepared.pending;
       return {backup,commandPresets:structuredClone(presets),shortcuts:structuredClone(nextProject.shortcuts)};
     });}finally{busy=false;}
   }
@@ -453,40 +491,51 @@ export async function createApplication({projectDir=process.cwd(),workspace,outp
     if(busy || launching || [...runs.values()].some(r=>r.status==='running'))throw new FlowError('请等待当前运行或安装结束');
     busy=true;let candidate,nextRelease;
     try {
-      return await withPluginMutation(projectDir,async()=>{
-      await assertPluginState(projectDir,state);
+      return await withRegistryMutation(async()=>{
+      await assertStates();
+      const targetDir=shared&&operation.remove&&!state.dependencies?.[operation.remove]&&!state.links?.[operation.remove]?projectDir:registryDir;
+      const targetState=targetDir===registryDir?state:localState;
       const latest=await readJson(path.join(projectDir,'flow.project.json'),project);
       if(latest.readOnly)throw new FlowError('运行包不支持安装或移除插件');
       if(operation.remove){
         const name=operation.remove;
         if(resources.active(name))throw new FlowError('请先停止此插件提供的 Web');
-        if(!state.dependencies?.[name]&&!state.links?.[name])throw new FlowError('此插件来自发行配置，不能在此移除');
-        const dependents=[...host.definitions.values()].filter(p=>p.id!==name&&Object.hasOwn(p.dependencies??{},name)).map(p=>p.id);
+        if(!targetState.dependencies?.[name]&&!targetState.links?.[name])throw new FlowError('此插件来自发行配置，不能在此移除');
+        const dependents=catalogEntries.map(entry=>entry.plugin??entry).filter(p=>p.id!==name&&Object.hasOwn(p.dependencies??{},name)).map(p=>p.id);
         if(dependents.length)throw new FlowError(`插件仍被其他插件依赖：${dependents.join('、')}`,{code:'PLUGIN_IN_USE',details:{dependencies:dependents}});
-        const workflows=await findPluginWorkflowReferences(name);
+        if(shared&&targetDir===registryDir){
+          const references=await registryPluginReferences(registryDir,name,{globalPlugins:catalogEntries.filter(entry=>entry.scope==='global').map(entry=>entry.plugin)});
+          if(references.length){const dependencies=references.map(item=>`${item.plugin}（${item.projectDir}）`);throw new FlowError(`插件仍被其他工作区插件依赖：${dependencies.join('、')}`,{code:'PLUGIN_IN_USE',details:{dependencies}});}
+        }
+        const workflows=shared&&targetDir===registryDir?await registryWorkflowReferences(registryDir,name):await findPluginWorkflowReferences(name);
         if(workflows.length&&!options.force)throw new FlowError(`插件 ${name} 仍被工作流引用：${workflows.map(w=>w.id).join('、')}`,{code:'PLUGIN_IN_USE',details:{workflows}});
       }
-      const next=await installGeneration(projectDir,{...operation,state});
-      const nextEntries=entriesWithPresets([...initial,...next.loaded],latest.commandPresets??{}),activeConfig={...project.config,...config},effectiveConfig={...latest.config,...config};
+      const next=await installGeneration(targetDir,{...operation,sourceDir:projectDir,state:shared&&targetDir===registryDir?{...targetState,global:true}:targetState});
+      const nextLocal=shared?(targetDir===projectDir?next.loaded:localEntries):next.loaded,nextGlobal=shared?(targetDir===registryDir?next.loaded:globalEntries):[];
+      const nextState=targetDir===registryDir?next.state:state;
+      const nextCatalog=entriesWithPresets(mergePluginEntries(initial,nextLocal,nextGlobal,nextState.disabledLegacy,{shared}),latest.commandPresets??{}),activeConfig={...project.config,...config},effectiveConfig={...latest.config,...config};
+      const prepared=preparePluginCatalog(nextCatalog,effectiveConfig),nextEntries=prepared.active;
       candidate=await createHost({plugins:nextEntries,config:effectiveConfig,services,project:hostProject(),network:()=>project.network,environmentOverrides:project.environments,runtimeEnabled:false,allowUnknownPrivileges});
       validateShortcuts(latest.shortcuts??{},{reservedNames:declaredCommands(nextEntries).map(command=>command.name)});
-      const sourceChanges=await changedPluginSources(host.definitions,candidate.definitions,{oldInstallationRoot:state.root,newInstallationRoot:next.state.root});
+      const sourceChanges=await changedPluginSources(host.definitions,candidate.definitions,{oldInstallationRoot:targetState.root,newInstallationRoot:next.state.root});
       const plan=planPluginUpdate(host.definitions,candidate.definitions,activeConfig,effectiveConfig,sourceChanges);
       assertMaintenance(plan,options);
       await candidate.close();candidate=null;
-      nextRelease=await leaseInstallation(projectDir,next.state.root);
+      nextRelease=await leaseInstallation(targetDir,next.state.root);
       const oldEntries=[...host.definitions.values()].map(p=>({plugin:p,root:p.root}));
       if(plan.affected.length)await host.replace({plugins:nextEntries,config:effectiveConfig,affected:plan.affected});
-      try{await savePluginState(projectDir,next.state,state);}
+      try{await savePluginState(targetDir,next.state,targetState);}
       catch(error){
         if(plan.affected.length)try{await host.replace({plugins:oldEntries,config:activeConfig,affected:plan.affected});}
         catch(recovery){host.invalidate();throw new AggregateError([error,recovery],`插件状态保存失败且恢复失败：${error.message}；${recovery.message}`);}
         throw error;
       }
-      state=next.state;
+      if(targetDir===registryDir){state=next.state;globalEntries=next.loaded;}else{localState=next.state;localEntries=next.loaded;}
+      catalogEntries=nextCatalog;pending=prepared.pending;
       for(const key of Object.keys(project))delete project[key];Object.assign(project,latest);
-      installationLeases.set(path.resolve(state.root),nextRelease);nextRelease=null;
-      for(const [root,release] of installationLeases)if(root!==path.resolve(state.root)&&![...host.definitions.values()].some(p=>p.root&&path.resolve(p.root).startsWith(root+path.sep))){
+      installationLeases.set(path.resolve(next.state.root),nextRelease);nextRelease=null;
+      const usedRoots=[...host.definitions.values(),...catalogEntries];
+      for(const [root,release] of installationLeases)if(root!==path.resolve(next.state.root)&&!usedRoots.some(entry=>entry.root&&path.resolve(entry.root).startsWith(root+path.sep))){
         try{await release();installationLeases.delete(root);}
         catch(error){emitter.emit('event',{type:'plugin.cleanup.warning',message:`旧安装批次租约暂未清理：${error.message}`,root});}
       }

package/node_modules/@mytools/core/src/development-watch-worker.js

@@ -34,7 +34,16 @@ async function scan(){
     try{
       project=await json(path.join(options.projectDir,'flow.project.json'),{});
       const state=await json(path.join(stateDirectory,'plugins.json'),{});
-      links=Object.values(state.links??{}).filter(value=>typeof value==='string').map(value=>path.resolve(options.projectDir,value));
+      let sources={...state.links};
+      if(options.pluginRegistryDir&&!project.baseBundle&&!project.readOnly&&options.pluginRegistryDir!==options.projectDir){
+        const globalDirectory=path.join(options.pluginRegistryDir,'.flow');
+        addWatch('global-state',globalDirectory,(_event,name)=>{if(name===null||String(name)==='plugins.json'){change(path.join(globalDirectory,'plugins.json'));void scan();}},wanted);
+        const global=await json(path.join(globalDirectory,'plugins.json'),{});
+        for(const id of global.disabledLegacy??[])delete sources[id];
+        sources={...sources,...global.links};
+        for(const id of Object.keys(global.dependencies??{}))delete sources[id];
+      }
+      links=Object.values(sources).filter(value=>typeof value==='string').map(value=>path.resolve(options.projectDir,value));
     }catch(error){send({type:'warning',message:`开发配置暂不可读，保留已有源码监听：${error.message}`});}
     incomplete=links.length>options.maxDirectories;
     const queue=links.slice(0,options.maxDirectories).map(directory=>({directory,depth:0})),seen=new Set();