feat: OpenMesh 基础平台与 MD/PDF 转换技能

- 后端: coworker 智能体框架, WS API, 文件上传, 附件处理
- 前端: Open WebUI, 文件全量走 upload API (含 MD/TXT/JSON 等文本类)
- 技能: md-to-office (pandoc + wkhtmltopdf)
- 修复: 上传文件路径丢失, Agent 搜索浪费, 输出文件跑到 uploads/
- 打包: PyInstaller one-dir, 预打包 pandoc/wkhtmltopdf/chromium

pyproject.toml

@@ -0,0 +1,75 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "coworker"
+version = "0.0.0"
+description = "Agent coworker platform — provider-agnostic agentic coworker runtime"
+requires-python = ">=3.10"
+dependencies = [
+    "openai>=1.0",
+    "anthropic>=0.40",  # native Claude Messages API provider
+    "google-genai>=1.0",  # native Gemini provider
+    "google-auth>=2.23",  # Vertex credentials (service account / ADC / MaaS bearer)
+    "textual>=1.0",
+    "fastapi>=0.110",
+    "uvicorn[standard]>=0.27",
+    # aisuite (toolkits/tracing), using local mirror
+    "aisuite @ file:///D:/project/senmeshworker-main/deps/aisuite",
+    "docstring_parser",
+    "pyyaml>=6",  # persona manifest frontmatter (YAML)
+    "pydantic>=2",
+    "mcp>=1.28.1,<2",  # MCP client (stdio + streamable-http); floor >=1.28.1 avoids PYSEC-2026-3481/3482/3483 (fixed in 1.27.2/1.28.1); <2 since 2.0.0 removed streamablehttp_client
+    "httpx>=0.27",  # sync outbound senders for messaging connectors (send_message tool)
+    "websockets>=13",  # managed Slack relay client transport (relay_client.py)
+    "ddgs>=9",  # keyless default web-search provider (DuckDuckGo); Tavily/Brave use httpx
+    "croniter>=2",  # cron next-fire math for the automation scheduler
+    # PDF attachments for models without native PDF support (pdf_support.py):
+    # pypdf = pure-python text extraction; pypdfium2 = page rasterization (BSD pdfium,
+    # ships its own libpdfium — NOT PyMuPDF, whose AGPL license can't ride in the DMG).
+    "pypdf>=5",
+    "pypdfium2>=4",
+    # IANA tz database for zoneinfo. Windows ships no system tz db, so without this every
+    # named schedule timezone (UTC, Asia/Kolkata, …) silently falls back to local time.
+    "tzdata; sys_platform == 'win32'",
+    # tomllib landed in the 3.11 stdlib; on the 3.10 floor config.py falls back to tomli.
+    "tomli>=2; python_version < '3.11'",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "pytest-asyncio", "httpx"]
+# Inbound messaging listeners (outbound send_message needs only httpx, already a core dep).
+# aiohttp is slack-bolt's Socket Mode transport at runtime (and the FakeSlack test harness
+# drives the real handler) — declare it so CI installs it, not just transitively.
+messaging = ["python-telegram-bot>=21", "slack-bolt>=1.18", "aiohttp>=3.9"]
+# Interactive Cowork browser automation.
+browser = ["playwright>=1.44"]
+# AWS Bedrock provider (lazy-imported; desktop builds bundle it, pip users opt in).
+bedrock = ["boto3>=1.34"]
+
+[project.scripts]
+openworker = "coworker.cli:main"
+openworker-server = "coworker.server.run:main"
+openworker-connectors = "coworker.connectors.cli:main"
+# The board as an open surface (OPE-100): `ocw board …` / `ocw journal …`,
+# including `ocw board mcp` — the stdio MCP server external harnesses attach to.
+ocw = "coworker.teams.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["coworker*"]
+
+[tool.setuptools.package-data]
+coworker = [
+    "personas/builtin/*.md",
+    "personas/builtin/*/manifest.md",
+    "personas/builtin/*/skills/*/SKILL.md",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+# The reviewer-eval tests import from the repo-root scripts/ package; the pytest
+# console script (CI) does not put the root on sys.path the way `python -m pytest` does.
+pythonpath = ["."]
+asyncio_mode = "auto"