release: sync develop to main

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
   - name: Security vulnerability
-    url: https://github.com/haowei2000/Cheers/security/advisories/new
+    url: https://github.com/ElePerson/Cheers/security/advisories/new
     about: Please report vulnerabilities privately instead of opening a public issue.

.github/workflows/ci.yml

@@ -148,7 +148,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: "npm"

CHANGELOG.md

@@ -101,5 +101,5 @@ First tagged public-preview release.
 - Status: early public preview. Deployment hardening, permission boundaries,
   and wider agent-ecosystem integration are still evolving.
 
-[Unreleased]: https://github.com/haowei2000/Cheers/compare/v0.1.0...HEAD
-[0.1.0]: https://github.com/haowei2000/Cheers/releases/tag/v0.1.0
+[Unreleased]: https://github.com/ElePerson/Cheers/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/ElePerson/Cheers/releases/tag/v0.1.0

README.md

@@ -2,11 +2,11 @@
 
 > **Language**: English | [中文](README.zh-CN.md)
 
-[![CI](https://github.com/haowei2000/Cheers/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/haowei2000/Cheers/actions/workflows/ci.yml)
-[![Release](https://img.shields.io/github/v/release/haowei2000/Cheers)](https://github.com/haowei2000/Cheers/releases)
+[![CI](https://github.com/ElePerson/Cheers/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/ElePerson/Cheers/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/ElePerson/Cheers)](https://github.com/ElePerson/Cheers/releases)
 [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
 
-🌐 **Live overview:** <https://haowei2000.github.io/Cheers/>
+🌐 **Live overview:** <https://eleperson.github.io/Cheers/>
 
 🚀 **Try it live:** <https://www.tocheers.com> — public sign-up is open. Create an account (with email verification), then start a channel and `@`-mention an AI agent.
 

README.zh-CN.md

@@ -2,11 +2,11 @@
 
 > **语言**：中文 | [English](README.md)
 
-[![CI](https://github.com/haowei2000/Cheers/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/haowei2000/Cheers/actions/workflows/ci.yml)
-[![Release](https://img.shields.io/github/v/release/haowei2000/Cheers)](https://github.com/haowei2000/Cheers/releases)
+[![CI](https://github.com/ElePerson/Cheers/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/ElePerson/Cheers/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/ElePerson/Cheers)](https://github.com/ElePerson/Cheers/releases)
 [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
 
-🌐 **在线介绍页：** <https://haowei2000.github.io/Cheers/>
+🌐 **在线介绍页：** <https://eleperson.github.io/Cheers/>
 
 🚀 **在线体验：** <https://www.tocheers.com> —— 已开放公开注册。用邮箱验证码注册一个账号，然后创建频道并 `@` 提及 AI 智能体开始体验。
 

deploy/helm/cheers/Chart.yaml

@@ -13,6 +13,6 @@ keywords:
   - cheers
   - acp
   - gateway
-home: https://github.com/haowei2000/Cheers
+home: https://github.com/ElePerson/Cheers
 maintainers:
   - name: Cheers

deploy/helm/cheers/README.md

@@ -75,18 +75,18 @@ and every `v*.*.*` tag:
 
 | Image | Tags |
 |---|---|
-| `ghcr.io/haowei2000/cheers-gateway` | `main`, `latest`, semver (`0.1.0`, `0.1`), `sha-<short>` |
-| `ghcr.io/haowei2000/cheers-frontend` | `main`, `latest`, semver (`0.1.0`, `0.1`), `sha-<short>` |
+| `ghcr.io/eleperson/cheers-gateway` | `main`, `latest`, semver (`0.1.0`, `0.1`), `sha-<short>` |
+| `ghcr.io/eleperson/cheers-frontend` | `main`, `latest`, semver (`0.1.0`, `0.1`), `sha-<short>` |
 
 To install from GHCR instead of building + loading local images (skip step 1
 of the local-dev path):
 
 ```bash
 helm upgrade --install cheers deploy/helm/cheers -n cheers --create-namespace \
   -f deploy/helm/cheers/values-dev.yaml \
-  --set gateway.image.repository=ghcr.io/haowei2000/cheers-gateway \
+  --set gateway.image.repository=ghcr.io/eleperson/cheers-gateway \
   --set gateway.image.tag=main \
-  --set frontend.image.repository=ghcr.io/haowei2000/cheers-frontend \
+  --set frontend.image.repository=ghcr.io/eleperson/cheers-frontend \
   --set frontend.image.tag=main \
   --set-file secrets.jwtPrivateKey=/tmp/jwt_priv.pem \
   --set-file secrets.jwtPublicKey=/tmp/jwt_pub.pem

docs/arch/RENDERER_PLUGIN.md

@@ -1,8 +1,11 @@
 # 渲染器插件开发指南
 
-> **Language**: [English](../developer/PLUGIN_DEVELOPMENT.md) | 中文(本文,设计原文)
+> **Language**: [English(规范版)](../developer/PLUGIN_DEVELOPMENT.md) | 中文(本文,设计原文)
+>
+> ⚠️ **规范以英文版为准**:协议消息表、manifest 校验规则、Troubleshooting 都维护在
+> [PLUGIN_DEVELOPMENT.md](../developer/PLUGIN_DEVELOPMENT.md);本文保留设计动机与中文语境,两边冲突时以英文版为准。
 
-> 状态:**v1 已实现**。host 侧 `render/save` 协议已落地——工作台 **File 面板**里选中一个文件,用顶部「渲染器」下拉选内置 lens 或已装插件;绑定(`path → renderer id`)存进 `.workbench.json`。旧的 `panels`/`init` 沙箱(场景插件)仍并存。代码:`renderers/registry.ts`、`renderers/RendererHost.tsx`、`sandbox/SandboxRenderer.tsx`、`panels/FilePanel.tsx`。
+> 状态:**v1 已实现**。host 侧 `render/save` 协议已落地——工作台 **File 面板**里选中一个文件,用顶部「渲染器」下拉选内置 lens 或已装插件;绑定(`path → renderer id`)存进 `.workbench.json`。旧的 `panels`/`init` 沙箱(场景插件)**已退役**(上传会被拒绝,示例已删除)。代码:`renderers/registry.ts`、`renderers/RendererHost.tsx`、`sandbox/SandboxRenderer.tsx`、`panels/FilePanel.tsx`。
 > 关联:[[WORKBENCH]]「关系与边界」· [[context-and-environment]]
 
 ## 0. 一分钟心智模型
@@ -43,11 +46,13 @@
 | `title` | 给人看的名字 |
 | `renderers[]` | 这个插件提供的渲染器,可多个 |
 | `renderers[].id` | 渲染器在插件内唯一 |
-| `renderers[].match.format` | `markdown` / `json` / `toml` / `xml` / `text`。host 按扩展名归类(`.md`→markdown,无扩展名→text)。 |
+| `renderers[].match.format` | `markdown` / `json` / `yaml` / `toml` / `xml` / `text`(可为数组)。host 按扩展名归类(`.md`→markdown,`.yaml`/`.yml`→yaml,无扩展名→text)。 |
 | `renderers[].match.glob` | (可选)按路径窄化,如 `"reviews/*.md"` |
 | `renderers[].match.requireAll` | (可选)内容必须**全部包含**这些子串。用于「md 含某些标题」,如 `["## 待办","## 进行中"]`。 |
 | `renderers[].match.requireAny` | (可选)内容至少包含**其一**,如 `["- [ ]","- [x]"]`(待办行)。 |
-| `renderers[].match.jsonHas` | (可选,仅 json)解析后的对象必须**含全部**这些顶层键,如 `["columns","cards"]`。 |
+| `renderers[].match.jsonHas` | (可选,仅 json)解析后的对象必须**含全部**这些顶层键,如 `["columns","cards"]`。**已弃用**:新 manifest 用 `dataHas`。 |
+
+> **协议 1 补充(规范见英文版)**:manifest 顶层可声明 `"protocol": 1`(缺省即 1);`match.format` 可为字符串**数组**;新增 `dataHas`(结构化内容顶层键,格式无关,取代 `jsonHas`)与 `dataKind`(`"object" | "array"`,声明顶层形状——认领「JSON 数组」的唯一方式)。服务端安装时校验 manifest(错误表见英文版 §8);bundle ≤ 2 MiB。
 
 > **`match` = 你声明「我接受什么」**。host 拿文件内容廉价评估(子串/JSON 键,**不**启动你的沙箱),据此决定你**是否出现在该文件的渲染器候选里**——所以一个需要 `## ` 标题的渲染器,不会被推荐给一篇纯散文。
 >
@@ -202,6 +207,7 @@ var info = await res("channel.info", {});   // → { ok, data }
 
 ## 7. 安装与绑定
 
+- **试用/开发**(人人):把 `.html` 拖进工作台抽屉(或点「Load extension」选文件)——**仅本浏览器会话**生效,渲染器立即进入匹配文件的候选列表(⏱ 标记);同 id 会话插件会遮蔽已安装版本,方便迭代调试,刷新即消失。
 - **安装**(admin):设置 → Workbench extensions → 上传 `.html`(进 `workbench_plugins` 表,全频道可见)。
 - **绑定**:打开某文件时,工作台按 `.workbench.json` 的 `bindings[path]` 选渲染器;没有就默认「原文」(textarea)或让用户从候选里挑,选择持久化进 `.workbench.json`(`path → rendererId`)。**绑定不进文件**,文件始终是纯内容。
 

docs/arch/RESEARCH_SCENARIO.md

@@ -372,9 +372,10 @@ crosshair + tooltip, recessive hairline grid, tabular numerals.
 
 ### 6.3 Knowledge graph — sandbox plugin (Phase 2)
 Paper/citation graph fits the sandboxed iframe plugin renderer
-(`workbench/sandbox/`, table `workbench_plugins`, example
-`sandbox/examples/research-plugin.html`): reads a `context_files` JSON via the
-whitelisted postMessage fs proxy, draws client-side, network-isolated by CSP.
+(`workbench/sandbox/`, table `workbench_plugins`, current-protocol example
+`sandbox/examples/lit-review.html`): the host assigns one `context_files` JSON
+over the render/save postMessage protocol, the plugin draws client-side,
+network-isolated by the sandbox.
 
 ### 6.4 Daily recommendation / email — out of scope
 SMTP exists, but no scheduler/cron. A recurring digest needs new backend work; excluded

docs/arch/WORKBENCH.md

@@ -43,8 +43,8 @@ Workbench 是频道右侧的工作台:一个频道一个,浏览/编辑 bot 工
 | 本质 | **声明式场景清单**(数据) | **渲染器**(代码),可选自带一个默认场景 |
 | 是什么 | 「视图声明 + seed 文件」,激活时 seed 进当前频道 | 自带 UI 渲染逻辑的代码单元 |
 | 需要插件机制吗 | **不需要**——它只是数据 | **需要**——沙箱、服务端安装、代码加载 |
-| 作用域 | **全局**(admin 装,全频道可见)**或临时**(浏览器会话内上传,仅本会话) | server-level(admin 装一次,全频道) |
-| 装在哪 | 全局:设置 → Workbench extensions(admin);临时:工作台抽屉「临时模板」(人人) | 设置 → Workbench extensions(admin) |
+| 作用域 | **全局**(admin 装,全频道可见)**或临时**(浏览器会话内上传,仅本会话) | server-level(admin 装一次,全频道)**或临时**(会话内,调试用) |
+| 装在哪 | 全局:设置 → Workbench extensions(admin);临时:工作台抽屉「Load extension」(人人) | 全局:设置 → Workbench extensions(admin);临时:工作台抽屉拖入 `.html`(人人,仅本会话,同 id 遮蔽已装版) |
 | 渲染靠 | 内置 lens **或** 插件提供的渲染器 | 自身(iframe 里自带渲染器) |
 | 格式 | 声明式 manifest JSON(纯数据) | `.html` bundle(代码)+ 内嵌 manifest |
 | 后端存储 | `workbench_templates` 表(全局,仅 manifest);临时模板**不入库** | `workbench_plugins` 表(manifest + bundle) |

docs/arch/examples/README.md

@@ -5,12 +5,14 @@
 
 ## 渲染器插件(代码/沙箱)
 
-设置 → Workbench extensions → 「插件」卡上传 `.html`。
+设置 → Workbench extensions → 「插件」卡上传 `.html`;或**直接把 `.html` 拖进工作台抽屉临时试用**(仅本会话,⏱ 标记,刷新即消失——插件开发的调试回路)。
+
+> 另有一套**官方基础渲染插件**(checklist / table / kanban-md / frontmatter)随 gateway 启动自动预装(Settings 里带 Official 徽章),源码在 [`server/assets/workbench-plugins/`](../../../server/assets/workbench-plugins/),同时是最好的参考实现;规则见英文指南 §9。
 
 | 文件 | 场景 | 说明 |
 |---|---|---|
 | [`md-checklist.plugin.html`](./md-checklist.plugin.html) | 通用 | 把 Markdown 待办(`- [ ]` / `- [x]`)渲染成可勾选清单,勾选写回 md。声明了**接受判断**(`match.requireAny` + 运行期 `cheers:unsupported`),只接受含待办行的 markdown。 |
-| [`lit-review.plugin.html`](./lit-review.plugin.html) | **科研** | 论文追踪表:把 `{ "papers": [...] }` 结构的 JSON 渲染成可编辑表格(标题/作者/期刊/年份/笔记 + 阅读状态下拉 + 星级评分),编辑写回 JSON。`match.jsonHas: ["papers"]` 预筛,运行期再验证 `papers` 是数组。 |
+| [`lit-review.plugin.html`](./lit-review.plugin.html) | **科研** | 论文追踪表:把 `{ "papers": [...] }` 结构的 JSON 渲染成可编辑表格(标题/作者/期刊/年份/笔记 + 阅读状态下拉 + 星级评分),编辑写回 JSON。`match.dataHas: ["papers"]` 预筛,运行期再验证 `papers` 是数组。 |
 | [`code-review.plugin.html`](./code-review.plugin.html) | **代码** | 代码评审清单:渲染 `## 文件路径` 分节、`- [ ] [P0/P1/P2] 描述` 的 markdown 评审记录,severity 徽章 + 顶部进度条,勾选就地改写该行并写回。`match.requireAny: ["[P0]","[P1]","[P2]"]`。 |
 
 ## 环境模板(数据)

docs/arch/examples/cheers-plugin-sdk.js

@@ -0,0 +1,75 @@
+/* cheers-plugin-sdk v1 — protocol 1.
+ *
+ * Copy-paste this function INLINE into your plugin's <script> — plugins are single
+ * self-contained .html files, there is no external script loading in the sandbox.
+ * It wraps the workbench render/save postMessage protocol (the normative reference
+ * is docs/developer/PLUGIN_DEVELOPMENT.md §5):
+ *
+ *   var host = cheersPlugin({
+ *     onRender: function (file) {
+ *       // { path, format, content, version, rendererId } — sent in reply to your
+ *       // cheers:ready and re-sent after a conflicted save (the only two triggers,
+ *       // §5.2 — external edits do NOT re-render): always re-draw here.
+ *     }
+ *   });
+ *   host.save(content)          // -> Promise<{version}>; rejects on failure (on a
+ *                               //    version conflict a fresh onRender follows — let
+ *                               //    the user reapply, don't blind-retry). At most ONE
+ *                               //    save may be in flight: the host does not correlate
+ *                               //    saves (cheers:saved carries no reqId), so calling
+ *                               //    save() again before the previous one settles
+ *                               //    rejects immediately.
+ *   host.resource(name, params) // -> Promise<data> for the read-only channel.*
+ *                               //    whitelist (channel.info / members / messages …)
+ *   host.unsupported(reason)    // -> final verdict: this content can't be rendered
+ *
+ * cheers:ready is posted for you, after the listener is wired.
+ */
+function cheersPlugin(opts) {
+  var reqId = 0;
+  var pendingRes = {}; // reqId -> {resolve, reject}
+  var pendingSave = null; // the ONE allowed in-flight save (hosts do not correlate saves)
+  window.addEventListener("message", function (e) {
+    var m = e.data;
+    if (!m || typeof m !== "object") return;
+    if (m.type === "cheers:render") {
+      if (opts.onRender) opts.onRender(m);
+    } else if (m.type === "cheers:saved") {
+      var p = pendingSave;
+      pendingSave = null;
+      if (p) (m.ok ? p.resolve({ version: m.version }) : p.reject(new Error(m.error || "save failed")));
+    } else if (m.type === "cheers:resource:result") {
+      var r = pendingRes[m.reqId];
+      if (!r) return;
+      delete pendingRes[m.reqId];
+      (m.ok ? r.resolve(m.data) : r.reject(new Error(m.error || "resource error")));
+    }
+  });
+  var api = {
+    save: function (content) {
+      return new Promise(function (resolve, reject) {
+        if (pendingSave) {
+          // cheers:saved carries no correlation id, so overlapping saves could adopt
+          // each other's results. Reject loudly instead of queueing silently — await
+          // the previous save() before issuing the next one.
+          reject(new Error("save already in flight — await the previous save() first"));
+          return;
+        }
+        pendingSave = { resolve: resolve, reject: reject };
+        parent.postMessage({ type: "cheers:save", content: content }, "*");
+      });
+    },
+    resource: function (name, params) {
+      return new Promise(function (resolve, reject) {
+        var id = ++reqId;
+        pendingRes[id] = { resolve: resolve, reject: reject };
+        parent.postMessage({ type: "cheers:resource", reqId: id, resource: name, params: params || {} }, "*");
+      });
+    },
+    unsupported: function (reason) {
+      parent.postMessage({ type: "cheers:unsupported", reason: reason }, "*");
+    },
+  };
+  parent.postMessage({ type: "cheers:ready" }, "*");
+  return api;
+}

docs/arch/examples/code-review.plugin.html

@@ -6,6 +6,7 @@
     <script type="application/json" id="cheers-plugin">
       {
         "id": "code-review",
+        "protocol": 1,
         "title": "Code review notes",
         "renderers": [
           { "id": "findings", "title": "Review findings", "match": { "format": "markdown", "requireAny": ["[P0]", "[P1]", "[P2]"] } }

docs/arch/examples/lit-review.plugin.html

@@ -6,9 +6,10 @@
     <script type="application/json" id="cheers-plugin">
       {
         "id": "lit-review",
+        "protocol": 1,
         "title": "Literature review",
         "renderers": [
-          { "id": "papers", "title": "Paper tracker", "match": { "format": "json", "jsonHas": ["papers"] } }
+          { "id": "papers", "title": "Paper tracker", "match": { "format": "json", "dataHas": ["papers"] } }
         ]
       }
     </script>

docs/arch/examples/md-checklist.plugin.html

@@ -6,6 +6,7 @@
     <script type="application/json" id="cheers-plugin">
       {
         "id": "md-checklist",
+        "protocol": 1,
         "title": "Markdown 清单",
         "renderers": [
           {