@actiondock/builder 2.2.2 → 2.3.0

package/dist/archive.d.ts

@@ -1,4 +1,9 @@
 import { Readable, Transform, Writable } from "node:stream";
+/** Unix 毫秒时间戳转 DOS 时间格式（date/time 各 16 位） */
+export declare function dosDateTime(ms: number): {
+    date: number;
+    time: number;
+};
 /**
  * 将目录打包为标准 zip 归档（PKZIP APPNOTE 结构）。
  * 直接流式分块写入磁盘，避免在内存中积压全量归档内容。

package/dist/archive.js

@@ -92,9 +92,14 @@ function crc32(buf) {
     return (updateCrc32(0xffffffff, buf) ^ 0xffffffff) >>> 0;
 }
 /** Unix 毫秒时间戳转 DOS 时间格式（date/time 各 16 位） */
-function dosDateTime(ms) {
+export function dosDateTime(ms) {
     const d = new Date(ms);
-    const year = Math.max(d.getFullYear(), 1980);
+    const rawYear = d.getFullYear();
+    // DOS 时间字段边界：年份仅能表达 [1980, 2107]，超出统一映射为 1980-01-01 00:00:00
+    const year = Math.min(Math.max(rawYear, 1980), 2107);
+    if (rawYear < 1980) {
+        return { date: ((1980 - 1980) << 9) | (1 << 5) | 1, time: 0 };
+    }
     const time = (d.getHours() << 11) | (d.getMinutes() << 5) | (d.getSeconds() >> 1);
     const date = ((year - 1980) << 9) | ((d.getMonth() + 1) << 5) | d.getDate();
     return { date, time };

package/dist/build.js

@@ -62,13 +62,17 @@ function calculateDirectoryDigest(dir) {
 }
 /**
  * 生成 Host 子进程入口脚本源码（负责运行 ActionDockHost，通过 Node IPC 暴露 Target）。
+ * 与 serializePlanManifest / stageSources 的过滤条件保持一致：跨包外部 Action 不进入 import 与运行时注册，
+ * 避免入口 import 清单没有的源文件产生孤儿模块（外部源码未物化进本包目录，运行时必然加载失败）。
  */
-function generateNodeHostEntrySource(plan, relativeActionPaths) {
-    const imports = relativeActionPaths
-        .map((relPath, idx) => `import action_${idx} from ${JSON.stringify(relPath)};`)
+function generateNodeHostEntrySource(plan) {
+    // 仅包自有 Action 参与 import 与注册，与产物清单保持同一事实源
+    const ownActions = plan.actions.filter((a) => !a.isExternal && !a.id.includes("/"));
+    const imports = ownActions
+        .map((act, idx) => `import action_${idx} from ${JSON.stringify(`./${act.entry.replace(/\\/g, "/")}`)};`)
         .join("\n");
     const actionsDict = {};
-    for (const a of plan.actions) {
+    for (const a of ownActions) {
         actionsDict[a.id] = {
             entry: a.entry,
             description: a.description || "",
@@ -79,7 +83,7 @@ function generateNodeHostEntrySource(plan, relativeActionPaths) {
             annotations: a.annotations || {},
         };
     }
-    const actionItems = plan.actions
+    const actionItems = ownActions
         .map((a, idx) => {
         const entryObj = `{
       ...(typeof action_${idx} === "function" ? { run: action_${idx} } : action_${idx}),
@@ -278,11 +282,16 @@ try {
 }
 /**
  * 拷贝 Action 源码、Playbook 规程与声明的代码文件/静态资产到暂存目录。
+ * 与 serializePlanManifest 的过滤条件保持一致：跨包外部 Action 不物化进本包目录，
+ * 避免产物混入外部源文件与本包入口发生非确定性覆盖。
  */
 function stageSources(root, stagingDir, plan) {
-    // 拷贝 Action 源码文件，保留相对路径
+    // 拷贝 Action 源码文件，保留相对路径（仅拷贝包自有 Action，跨包外部依赖不物化进本包目录）
     const relativeActionImports = [];
     for (const act of plan.actions) {
+        if (act.isExternal || act.id.includes("/")) {
+            continue;
+        }
         if (existsSync(act.resolvedPath)) {
             const destFile = join(stagingDir, act.entry);
             mkdirSync(dirname(destFile), { recursive: true });
@@ -365,8 +374,8 @@ function writePkgJsonAndLockfiles(root, stagingDir, plan, pkgSlug) {
 /**
  * 生成三个入口脚本（Host 子进程、监督父进程与兼容代理转发入口）并设置可执行权限。
  */
-function writeEntrypoints(stagingDir, plan, relativeActionImports) {
-    const hostCode = generateNodeHostEntrySource(plan, relativeActionImports);
+function writeEntrypoints(stagingDir, plan) {
+    const hostCode = generateNodeHostEntrySource(plan);
     const hostPath = join(stagingDir, "entry-host.js");
     writeFileSync(hostPath, hostCode, "utf-8");
     const supervisorCode = generateNodeSupervisorEntrySource(plan);
@@ -395,15 +404,18 @@ function vendorDependencies(root, stagingDir, plan) {
         join(root, "node_modules"),
         resolve(import.meta.dirname, "../../../node_modules"),
     ];
+    // 嵌套 node_modules 不再跳过：多版本共存时传递依赖必须完整物化，
+    // 否则产物运行时 Cannot find module 且构建阶段无任何警告；
+    // 保留 .git、.bin 等目录排除（.bin 为平台相关的命令行 shim，不参与运行时模块解析）
     const copyVendorPackage = (srcDir, destDir) => {
         if (!existsSync(srcDir))
             return;
         mkdirSync(destDir, { recursive: true });
         const entries = readdirSync(srcDir);
         for (const entry of entries) {
-            if (entry === "node_modules" ||
-                entry === ".git" ||
+            if (entry === ".git" ||
                 entry === ".actiondock" ||
+                entry === ".bin" ||
                 entry === "test" ||
                 entry === "tests") {
                 continue;
@@ -500,10 +512,10 @@ export async function buildProject(options) {
     mkdirSync(stagingDir, { recursive: true });
     let platformInfo;
     try {
-        const relativeActionImports = stageSources(root, stagingDir, plan);
+        stageSources(root, stagingDir, plan);
         writeManifest(stagingDir, plan);
         writePkgJsonAndLockfiles(root, stagingDir, plan, pkgSlug);
-        writeEntrypoints(stagingDir, plan, relativeActionImports);
+        writeEntrypoints(stagingDir, plan);
         // 若开启 options.vendorDeps，物化锁定生产依赖
         if (options.vendorDeps) {
             platformInfo = {

package/dist/dependency-check.js

@@ -222,8 +222,15 @@ export function assertRelativeDependenciesIntegrity(projectRoot, plan) {
             }
             // 检查目标文件是否越出项目根目录
             const relToRoot = relative(realRoot, resolvedTarget);
-            if (isPathOutsideBoundary(relToRoot) || resolve(resolvedTarget) === resolve(realRoot, "..")) {
-                throw new BuilderError(`Action '${actionId}' imports relative module '${specifier}', which resolves outside project root: '${resolvedTarget}'. External relative imports outside project root are not allowed in exported Skill packages.`, "EXTERNAL_LOCAL_DEPENDENCY");
+            if (isPathOutsideBoundary(relToRoot)) {
+                // 区分「项目外路径」与「monorepo 相邻包」两种情形，给出针对性修复指引
+                const resolvedParent = dirname(realRoot);
+                const relToParent = relative(resolvedParent, resolvedTarget);
+                const isSiblingPackage = !isPathOutsideBoundary(relToParent);
+                const detail = isSiblingPackage
+                    ? `它位于项目根的父目录内，疑似 monorepo 相邻包。若确需依赖，请将其纳入本项目或改用包管理器依赖声明；若为本地辅助模块，请调整目录结构或将其声明进 files`
+                    : `它完全位于项目外部。导出的 Skill 产物不允许携带项目外部的相对路径依赖，请将所需模块移入项目内并声明进 files`;
+                throw new BuilderError(`Action '${actionId}' 通过相对路径 '${specifier}' 引用了项目根之外的模块（解析到 '${resolvedTarget}'）。${detail}`, "EXTERNAL_LOCAL_DEPENDENCY");
             }
             // 检查目标文件是否在构建收集集合中
             if (!collectedPaths.has(resolvedTarget)) {

package/dist/exporter.js

@@ -1,4 +1,4 @@
-import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { COMPOSITE_CUSTOM_DECLARATION_FILE, generateCompositeSkillMd, generateSourceSkillMd, generateStandaloneSkillMd, getPackageSlug, loadManifest, loadPlaybooks, loadProjectConfig, parseCustomSkillDeclaration, } from "@actiondock/core";
 import { createTarGzArchiveAsync, createZipArchiveAsync } from "./archive.js";
@@ -21,24 +21,33 @@ function toPlaybookDefinitions(playbooks) {
 }
 /**
  * 执行归档压缩操作。
+ * 先压缩到临时路径，成功后原子重命名覆盖最终路径；失败时清理临时文件后透传原始异常，
+ * 避免旧档已删、新档半成品残留的中间态。
  */
 async function createArchive(skillDir, format) {
     const parentDir = dirname(skillDir);
     const folderName = basename(skillDir);
     const archiveName = `${folderName}.${format === "tar.gz" ? "tar.gz" : "zip"}`;
     const archivePath = join(parentDir, archiveName);
-    if (existsSync(archivePath)) {
-        rmSync(archivePath, { force: true });
+    const tempArchivePath = `${archivePath}.tmp`;
+    if (existsSync(tempArchivePath)) {
+        // 清理上次失败可能残留的临时文件（兼容目录形态，避免阻塞本次压缩）
+        rmSync(tempArchivePath, { force: true, recursive: true, maxRetries: 3, retryDelay: 50 });
     }
     try {
         if (format === "tar.gz") {
-            await createTarGzArchiveAsync(skillDir, archivePath);
+            await createTarGzArchiveAsync(skillDir, tempArchivePath);
         }
         else {
-            await createZipArchiveAsync(skillDir, archivePath);
+            await createZipArchiveAsync(skillDir, tempArchivePath);
         }
+        renameSync(tempArchivePath, archivePath);
     }
     catch (err) {
+        // 压缩失败：清理临时半成品，旧档保持原样，透传原始异常
+        if (existsSync(tempArchivePath)) {
+            rmSync(tempArchivePath, { force: true, recursive: true, maxRetries: 3, retryDelay: 50 });
+        }
         throw new BuilderError(`Failed to create ${format} archive: ${err?.message || String(err)}`);
     }
     return archivePath;
@@ -108,9 +117,8 @@ export function findExistingCompositeSkillMd(options) {
     searchDirs.add(process.cwd());
     for (const root of options.projectRoots) {
         const absRoot = resolve(root);
-        const parentDir = dirname(absRoot);
-        searchDirs.add(parentDir);
-        searchDirs.add(dirname(parentDir));
+        // 仅搜索父目录（工作区根）一级；祖父目录搜索可能命中毫不相关的全局 SKILL.md 并复制进产物
+        searchDirs.add(dirname(absRoot));
     }
     const candidateRelativePaths = [
         join("skills", options.bundleName, "SKILL.md"),
@@ -356,6 +364,8 @@ function writeCompositePkgJson(stagingDir, packagesDestDir, packageInfos, bundle
             catch (err) {
                 if (err instanceof BuilderError)
                     throw err;
+                // 复合导出缺依赖影响面大：读文件与解析失败必须显式报错，严禁静默吞掉导致聚合依赖缺失
+                throw new BuilderError(`Failed to read or parse package.json of exported subpackage '${info.packageDir}' (${pkgJsonPath}): ${err instanceof Error ? err.message : String(err)}`);
             }
         }
     }
@@ -405,8 +415,16 @@ export class SkillExporter {
         const defaultSkillDir = join(root, "dist", defaultFolderName);
         const targetSkillDir = resolve(options.outDir || defaultSkillDir);
         const hasExternalDeps = Boolean(plan.externalProjectRoots && plan.externalProjectRoots.length > 0);
-        // 单包源码导出如果依赖闭包含外部包，导成 mini-workspace 形态（packages/ 下带齐依赖包），和 bundle 统一成一个交付形状
-        if (mode === "source" && !options._isSubpackage && hasExternalDeps) {
+        // 单包源码导出若依赖闭包含外部包，导成 mini-workspace 形态（packages/ 下带齐依赖包），和 bundle 统一成一个交付形状
+        // 该复合分支会展开全部依赖包，无法保留调用方传入的 actions/playbooks 过滤选项；
+        // 静默丢弃过滤会导致产物全量导出，必须显式拒绝并给出调整指引（CLI 侧已有 roots>1 守卫，此处补齐 composite 分支守卫）
+        const hasFilters = Boolean((options.actions && options.actions.length > 0) ||
+            (options.playbooks && options.playbooks.length > 0));
+        const willUseComposite = mode === "source" && !options._isSubpackage && hasExternalDeps;
+        if (hasFilters && willUseComposite) {
+            throw new BuilderError("Filtering options (--actions, --playbook) cannot be combined with a source export whose dependency closure spans external linked packages (composite mini-workspace output). Remove the filtering options to export the full closure, or adjust the 'uses' declarations so the closure stays within a single package.", "FILTERS_UNSUPPORTED_FOR_COMPOSITE");
+        }
+        if (willUseComposite) {
             const allProjectRoots = Array.from(new Set([root, ...plan.externalProjectRoots]));
             const compositeRes = await this.exportComposite({
                 bundleName: plan.packageName || plan.packageId,
@@ -680,6 +698,10 @@ export class SkillExporter {
                     ? resolve(options.outDir)
                     : resolve(options.outDir ? join(options.outDir, "SKILL.md") : join(process.cwd(), "SKILL.md"));
                 mkdirSync(dirname(targetFile), { recursive: true });
+                // 目标文件即将被覆盖时输出警告，避免无提示覆盖用户已有内容
+                if (existsSync(targetFile)) {
+                    console.warn(`[WARN] Existing SKILL.md will be overwritten: ${targetFile}`);
+                }
                 writeFileSync(targetFile, compositeSkillMd, "utf-8");
                 return {
                     bundleName: options.bundleName,

package/dist/fs-utils.d.ts

@@ -1,7 +1,8 @@
 export declare function moveDirAtomic(src: string, dest: string): Promise<void>;
 /**
- * 递归收集目录内全部文件的相对路径（正斜杠分隔，名称排序）。
- * 统一排序保证产物文件清单与内容摘要的确定性。
+ * 递归收集目录内全部文件的相对路径（正斜杠分隔）。
+ * 收集完成后对最终 POSIX 相对路径统一排序，保证跨平台 digest 一致性；
+ * 符号链接防护策略与 archive.ts collectEntries 对齐：越出根边界的软链接与循环软链接直接跳过。
  */
 export declare function collectRelativeFiles(dir: string, baseDir?: string): string[];
 /**

package/dist/fs-utils.js

@@ -1,6 +1,6 @@
-import { cpSync, existsSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
+import { cpSync, existsSync, readdirSync, realpathSync, renameSync, rmSync, statSync } from "node:fs";
 import { join, relative, sep } from "node:path";
-import { ACTIONDOCK_VERSION } from "@actiondock/core";
+import { ACTIONDOCK_VERSION, assertPathWithinRoot } from "@actiondock/core";
 /**
  * builder 包内共享的文件系统基础设施。
  * 消除 pack / build / exporter 三个业务模块中成体系的重复实现，
@@ -65,22 +65,71 @@ export async function moveDirAtomic(src, dest) {
     }
 }
 /**
- * 递归收集目录内全部文件的相对路径（正斜杠分隔，名称排序）。
- * 统一排序保证产物文件清单与内容摘要的确定性。
+ * 递归收集目录内全部文件的相对路径（正斜杠分隔）。
+ * 收集完成后对最终 POSIX 相对路径统一排序，保证跨平台 digest 一致性；
+ * 符号链接防护策略与 archive.ts collectEntries 对齐：越出根边界的软链接与循环软链接直接跳过。
  */
 export function collectRelativeFiles(dir, baseDir = dir) {
+    const results = collectRelativeFilesUnsorted(dir, baseDir, new Set());
+    return results.sort();
+}
+function collectRelativeFilesUnsorted(dir, baseDir, visited) {
     if (!existsSync(dir))
         return [];
+    if (visited.size === 0) {
+        try {
+            visited.add(existsSync(baseDir) ? realpathSync(baseDir) : baseDir);
+        }
+        catch {
+            // 忽略根目录真实路径解析异常，退化为不携带根真实路径的循环拦截
+        }
+    }
     const results = [];
-    const entries = readdirSync(dir).sort();
+    let entries;
+    try {
+        entries = readdirSync(dir).sort();
+    }
+    catch {
+        return [];
+    }
     for (const entry of entries) {
         const fullPath = join(dir, entry);
-        const stat = statSync(fullPath);
-        if (stat.isDirectory()) {
-            results.push(...collectRelativeFiles(fullPath, baseDir));
+        try {
+            assertPathWithinRoot(baseDir, fullPath, "collect files path");
+        }
+        catch {
+            continue;
+        }
+        let real;
+        try {
+            real = existsSync(fullPath) ? realpathSync(fullPath) : fullPath;
+        }
+        catch {
+            continue;
+        }
+        try {
+            assertPathWithinRoot(baseDir, real, "collect files path");
+        }
+        catch {
+            // 忽略并跳过指向 baseDir 外部的软链接，与归档防护策略保持一致
+            continue;
+        }
+        if (visited.has(real)) {
+            continue;
+        }
+        visited.add(real);
+        try {
+            const stat = statSync(fullPath);
+            if (stat.isDirectory()) {
+                results.push(...collectRelativeFilesUnsorted(fullPath, baseDir, visited));
+            }
+            else if (stat.isFile()) {
+                results.push(relative(baseDir, fullPath).split(sep).join("/"));
+            }
         }
-        else if (stat.isFile()) {
-            results.push(relative(baseDir, fullPath).split(sep).join("/"));
+        catch {
+            // 忽略无法访问或损坏的文件/符号链接
+            continue;
         }
     }
     return results;

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export { BuilderError, PlannerError } from "./errors.js";
 export { collectRelativeFiles, getInternalDependencyVersion, moveDirAtomic, replaceDirAtomic, } from "./fs-utils.js";
 export { assertNoFileProtocolDeps, assertValidManifestActionIds, serializeManifestAction, serializeManifestPlaybooks, serializePlanManifest, } from "./manifest.js";
 export type { SerializePlanManifestOptions } from "./manifest.js";
-export { createTarGzArchive, createTarGzArchiveAsync, createZipArchive, createZipArchiveAsync, writeToStream, } from "./archive.js";
+export { createTarGzArchive, createTarGzArchiveAsync, createZipArchive, createZipArchiveAsync, dosDateTime, writeToStream, } from "./archive.js";
 export type { TarGzArchiveOptions } from "./archive.js";
 export { BuildPlanner, buildPlan, SelectionPlanner, selectionPlan } from "./planner.js";
 export { assertRelativeDependenciesIntegrity, extractRelativeSpecifiers, resolveRelativeModule, } from "./dependency-check.js";

package/dist/index.js

@@ -9,7 +9,7 @@ export { collectRelativeFiles, getInternalDependencyVersion, moveDirAtomic, repl
 // 清单组装与依赖协议校验
 export { assertNoFileProtocolDeps, assertValidManifestActionIds, serializeManifestAction, serializeManifestPlaybooks, serializePlanManifest, } from "./manifest.js";
 // 归档压缩
-export { createTarGzArchive, createTarGzArchiveAsync, createZipArchive, createZipArchiveAsync, writeToStream, } from "./archive.js";
+export { createTarGzArchive, createTarGzArchiveAsync, createZipArchive, createZipArchiveAsync, dosDateTime, writeToStream, } from "./archive.js";
 // 构建规划
 export { BuildPlanner, buildPlan, SelectionPlanner, selectionPlan } from "./planner.js";
 // 相对依赖完整性校验

package/dist/pack.js

@@ -1,9 +1,9 @@
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
-import { dirname, join, relative, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import { getPackageSlug, loadProjectConfig } from "@actiondock/core";
 import { BuilderError } from "./errors.js";
 import { assertNoFileProtocolDeps, assertValidManifestActionIds, normalizePkgExportsAndEngines, readPackageJson, serializePlanManifest, } from "./manifest.js";
@@ -70,13 +70,34 @@ export async function packProject(options) {
             };
         }
         mkdirSync(targetOutDir, { recursive: true });
-        const finalTarballPath = join(targetOutDir, tarballName);
-        if (existsSync(finalTarballPath)) {
-            rmSync(finalTarballPath, { force: true });
-        }
+        // 优先使用 npm pack 返回的实名产物（保证与压缩包内 package.json name 一致），
+        // 移动而非复制改名；仅当无法获取实名时回退到本地拼接名
         const generatedTarball = await runNpmPack(stagingPkgDir, tempBase, tarballName);
-        copyFileSync(generatedTarball, finalTarballPath);
-        rmSync(generatedTarball, { force: true });
+        let finalTarballPath;
+        let finalTarballName;
+        if (basename(generatedTarball) === tarballName) {
+            finalTarballPath = join(targetOutDir, tarballName);
+            finalTarballName = tarballName;
+            if (existsSync(finalTarballPath)) {
+                rmSync(finalTarballPath, { force: true });
+            }
+            renameSync(generatedTarball, finalTarballPath);
+        }
+        else {
+            finalTarballName = basename(generatedTarball);
+            finalTarballPath = join(targetOutDir, finalTarballName);
+            if (existsSync(finalTarballPath)) {
+                rmSync(finalTarballPath, { force: true });
+            }
+            try {
+                renameSync(generatedTarball, finalTarballPath);
+            }
+            catch {
+                // 跨设备 rename 失败时回退为复制后删除源文件
+                copyFileSync(generatedTarball, finalTarballPath);
+                rmSync(generatedTarball, { force: true });
+            }
+        }
         const stat = statSync(finalTarballPath);
         const fileBuf = readFileSync(finalTarballPath);
         const sha256 = createHash("sha256").update(fileBuf).digest("hex");
@@ -85,7 +106,7 @@ export async function packProject(options) {
             packageName: plan.packageName,
             version: plan.version,
             tarballPath: finalTarballPath,
-            tarballName,
+            tarballName: finalTarballName,
             sizeBytes: stat.size,
             sha256,
             files: relativeFiles,
@@ -168,6 +189,10 @@ async function compileTypeScript(root, stagingPkgDir, plan) {
             const configFile = ts.readConfigFile(tsconfigPath, ts.sys.readFile);
             if (!configFile.error) {
                 const parsedConfig = ts.parseJsonConfigFileContent(configFile.config, ts.sys, root);
+                // tsc 不会改写 import 说明符：paths 路径别名在产物中无法解析，必须显式拒绝而非静默编译出坏产物
+                if (parsedConfig.options.paths && Object.keys(parsedConfig.options.paths).length > 0) {
+                    throw new BuilderError(`tsconfig.json 'paths' aliases are not supported in packed output: TypeScript does not rewrite import specifiers, so the packed artifact would contain unresolvable module specifiers. Replace path aliases with relative imports, or pre-build the project and pack the compiled output instead.`, "PATHS_ALIAS_UNSUPPORTED");
+                }
                 Object.assign(compilerOptions, parsedConfig.options, {
                     outDir: stagingPkgDir,
                     rootDir: root,
@@ -178,7 +203,10 @@ async function compileTypeScript(root, stagingPkgDir, plan) {
                 });
             }
         }
-        catch {
+        catch (err) {
+            if (err instanceof BuilderError) {
+                throw err;
+            }
             // 忽略 tsconfig 解析失败，回退到标准 compilerOptions
         }
     }

package/dist/planner.js

@@ -329,12 +329,15 @@ export class SelectionPlanner {
      */
     resolveClosure(root, manifest, config, initialActionIds) {
         const resolvedActionIds = new Set();
+        // queued 与 resolvedActionIds 联合判重，避免高入度节点在 uses 图中被重复入队导致 O(边数) 重复解析
+        const queued = new Set(initialActionIds);
         const queue = Array.from(initialActionIds);
         const externalActionRoots = new Map();
         const externalActionEntries = new Map();
         const manifestActions = manifest.actions || {};
         while (queue.length > 0) {
             const currentId = queue.shift();
+            queued.delete(currentId);
             if (resolvedActionIds.has(currentId)) {
                 continue;
             }
@@ -366,12 +369,16 @@ export class SelectionPlanner {
                         if (externalEntry) {
                             entry = externalEntry;
                             entryRoot = extRoot;
-                            // 依赖包 actiondock.json 中声明的传递依赖闭包
+                            // 依赖包 actiondock.json 中声明的传递依赖闭包（入队前查重，避免重复膨胀）
                             const extPkgUses = extConfig?.uses;
                             if (Array.isArray(extPkgUses)) {
                                 for (const u of extPkgUses) {
-                                    if (typeof u === "string" && u.trim() && !resolvedActionIds.has(u.trim())) {
-                                        queue.push(u.trim());
+                                    const trimmedUse = typeof u === "string" ? u.trim() : "";
+                                    if (trimmedUse &&
+                                        !resolvedActionIds.has(trimmedUse) &&
+                                        !queued.has(trimmedUse)) {
+                                        queued.add(trimmedUse);
+                                        queue.push(trimmedUse);
                                     }
                                 }
                             }
@@ -379,7 +386,7 @@ export class SelectionPlanner {
                     }
                 }
                 catch {
-                    // 忽略
+                    // 外部包解析失败时交由下方缺失依赖报错统一透传
                 }
             }
             if (!entry) {
@@ -392,7 +399,8 @@ export class SelectionPlanner {
             resolvedActionIds.add(currentId);
             if (entry.uses && Array.isArray(entry.uses)) {
                 for (const depId of entry.uses) {
-                    if (!resolvedActionIds.has(depId)) {
+                    if (!resolvedActionIds.has(depId) && !queued.has(depId)) {
+                        queued.add(depId);
                         queue.push(depId);
                     }
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actiondock/builder",
-  "version": "2.2.2",
+  "version": "2.3.0",
   "description": "ActionDock Build Planner, distribution packaging, and Skill exporter",
   "type": "module",
   "main": "./dist/index.js",
@@ -29,9 +29,9 @@
     "test": "node ../../scripts/run-tests.ts"
   },
   "dependencies": {
-    "@actiondock/core": "^2.2.2",
-    "@actiondock/runtime-node": "^2.2.2",
-    "@actiondock/sdk": "^2.2.2"
+    "@actiondock/core": "^2.3.0",
+    "@actiondock/runtime-node": "^2.3.0",
+    "@actiondock/sdk": "^2.3.0"
   },
   "keywords": [
     "actiondock",