修复: 安全加固+DRY 收敛+文档同步+测试补齐

安全:
- ScriptNode 默认黑名单兜底(rm/del/format/shutdown/mkfs/dd)
- bind_directory 分段 .. 检测替代 contains 子串(对齐 tool_registry)
- ai_providers 白名单移除 api_key(防 update_field 旁路写明文)

DRY:
- useAiEvents 抽 cleanupTerminatedConversation 统一三分支收尾
- 新增 useStoreAction 工具,4 个 store 替换 38 处 try/catch 样板

文档:
- df-core → df-types 批量替换(ARCHITECTURE/PROGRESS/SQLite-CRUD)
- INDEX 补齐 9 漏列文档(单对话并行多轮/跑题试验/工程系统设计等)
- Agent架构说明 死链修复(../构想审查/)
- AI对话引擎工具清单改为数量+按风险分组(不再用固定数字)
- ARCH 状态标签 设计阶段 → Phase 2 验证

测试:
- df-relay 新增 registry_test: ConnRegistry 路由 + RelayState + 16 项单测

src/stores/knowledge.ts

@@ -1,6 +1,7 @@
 import { reactive, computed } from 'vue'
 import { knowledgeApi } from '@/api'
 import { t } from '@/i18n/i18n-helpers'
+import { runWithCatch, runWithCatchGuarded } from '@/composables/useStoreAction'
 import type {
   KnowledgeRecord,
   KnowledgeDetailPayload,
@@ -140,73 +141,58 @@ export function useKnowledgeStore() {
   }
 
   async function create(input: CreateKnowledgeInput) {
-    try {
-      const record = await knowledgeApi.create(input)
-      // 手动录入默认 candidate,刷新收件箱。
-      // create 已成功返回 record,刷新失败不应污染成功语义 —— 直接走原始 API + 非阻塞 console.warn,
-      // 不经 loadCandidates(后者会写 state.error,污染 create 成功语义)。
+    const record = await runWithCatch(state, t('knowledge.err.createFailed'), async () => {
+      const r = await knowledgeApi.create(input)
+      // 手动录入默认 candidate,刷新收件箱。刷新失败不污染 create 成功语义(独立 console.warn)。
       try {
         state.candidates = await knowledgeApi.listCandidates()
-      } catch (e: any) {
-        console.warn('create 后刷新收件箱失败(非阻塞)', e?.toString?.() ?? e)
+      } catch (e: unknown) {
+        console.warn('create 后刷新收件箱失败(非阻塞)', e)
       }
-      return record
-    } catch (e: any) {
-      state.error = e?.toString() ?? t('knowledge.err.createFailed')
-      return null
-    }
+      return r
+    })
+    return record ?? null
   }
 
   async function updateStatus(id: string, status: string) {
-    try {
+    await runWithCatch(state, t('knowledge.err.updateStatusFailed'), async () => {
       await knowledgeApi.updateStatus(id, status)
       // 从 items 和 candidates 中同步移除
       state.items = state.items.filter(k => k.id !== id)
       state.candidates = state.candidates.filter(k => k.id !== id)
-    } catch (e: any) {
-      state.error = e?.toString() ?? t('knowledge.err.updateStatusFailed')
-    }
+    })
   }
 
   async function archive(id: string) {
-    try {
+    await runWithCatch(state, t('knowledge.err.archiveFailed'), async () => {
       await knowledgeApi.archive(id)
       state.items = state.items.filter(k => k.id !== id)
       state.candidates = state.candidates.filter(k => k.id !== id)
-    } catch (e: any) {
-      state.error = e?.toString() ?? t('knowledge.err.archiveFailed')
-    }
+    })
   }
 
   // ── 配置 ──
   async function loadConfig() {
     const seq = ++_configReqSeq
-    try {
+    await runWithCatchGuarded(state, t('knowledge.err.loadConfigFailed'), () => seq === _configReqSeq, async () => {
       const result = await knowledgeApi.getConfig()
-      if (seq !== _configReqSeq) return // 旧响应丢弃,只取最新
+      if (seq !== _configReqSeq) return // 旧响应丢弃
       state.config = result
-    } catch (e: any) {
-      if (seq !== _configReqSeq) return
-      state.error = e?.toString() ?? t('knowledge.err.loadConfigFailed')
-    }
+    })
   }
 
   async function saveConfig(config: KnowledgeConfig) {
-    try {
+    await runWithCatch(state, t('knowledge.err.saveConfigFailed'), async () => {
       await knowledgeApi.saveConfig(config)
       state.config = config
-    } catch (e: any) {
-      state.error = e?.toString() ?? t('knowledge.err.saveConfigFailed')
-    }
+    })
   }
 
   async function extractNow() {
-    try {
+    await runWithCatch(state, t('knowledge.err.extractFailed'), async () => {
       await knowledgeApi.extractNow()
       await loadCandidates()
-    } catch (e: any) {
-      state.error = e?.toString() ?? t('knowledge.err.extractFailed')
-    }
+    })
   }
 
   // ── 生命线:详情 / 编辑 / 事件查询(按需调用,不入全局 state) ──