@actiondock/core 2.15.0 → 2.17.0

package/dist/registry/registry.js

@@ -2,7 +2,6 @@ import { existsSync, mkdirSync, readFileSync, renameSync, statSync } from "node:
 import { readFile, rename, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { findProjectRoot, loadProjectConfig } from "../project/loader.js";
-import { inspectLocalPackageDirectory, isExplicitPath } from "../project/skill-dir.js";
 import { getActionDockHome, getPackageSlug } from "../utils/index.js";
 import { ActionDockError, MANIFEST_NOT_FOUND, REGISTRY_CORRUPTED } from "../errors.js";
 import { withRegistryLock } from "./lock.js";
@@ -400,42 +399,31 @@ export function resolvePackageRoot(packageIdOrPath, cwd, customHome) {
     const resolvedPath = resolve(baseDir, packageIdOrPath);
     // 检查 packageIdOrPath 是否为磁盘上现存的目录或文件路径
     if (existsSync(resolvedPath)) {
-        let info;
         try {
-            info = statSync(resolvedPath);
-        }
-        catch (err) {
-            if (err?.code !== "ENOENT" && err?.code !== "ENOTDIR") {
-                throw err;
-            }
-        }
-        if (info) {
+            const info = statSync(resolvedPath);
             const targetDir = info.isDirectory() ? resolvedPath : dirname(resolvedPath);
-            // 普通开发包根目录：直接包含 actiondock.json 清单。
-            // 普通清单根目录定位与封闭 Skill 执行校验分离，不能被当成只含一个包的 Skill 闭包拒绝。
             if (existsSync(join(targetDir, "actiondock.json"))) {
-                loadProjectConfig(targetDir);
                 return targetDir;
             }
-            // 复合技能布局：根目录下存在 packages/ 目录且包含有效子包。
-            const localSkill = inspectLocalPackageDirectory(targetDir);
-            if (localSkill) {
-                return localSkill.root;
-            }
-            // 具体文件查找所属工程根目录：仅当 packageIdOrPath 指向具体文件（非目录）时，
-            // 才尝试向上查找所属工程根目录；目录形态绝不向上回退，防止显式目录越界命中父级工程。
-            if (!info.isDirectory()) {
-                const parentRoot = findProjectRoot(targetDir);
-                if (parentRoot) {
-                    loadProjectConfig(parentRoot);
-                    return parentRoot;
-                }
+            const parentRoot = findProjectRoot(targetDir);
+            if (parentRoot) {
+                return parentRoot;
             }
         }
+        catch {
+            // stat 失败（如并发删除）：忽略并继续走标识符解析路径
+        }
     }
     // 显式路径形态但未解析成功的场景：
     // scoped package 标识符（如 @team/tools）虽含 '/' 但属于包 ID 而非文件路径
-    if (isExplicitPath(packageIdOrPath)) {
+    const isScopedPackage = packageIdOrPath.startsWith("@");
+    const isExplicitPath = !isScopedPackage &&
+        (packageIdOrPath.startsWith(".") ||
+            packageIdOrPath.startsWith("/") ||
+            packageIdOrPath.startsWith("~") ||
+            packageIdOrPath.includes("/") ||
+            packageIdOrPath.includes("\\"));
+    if (isExplicitPath) {
         // 显式路径不存在或不是 ActionDock 项目时必须失败，禁止静默回退
         return null;
     }

package/dist/runtime/context.d.ts

@@ -1,5 +1,5 @@
 import type { ActionContext, ActionRef, Config, Logger, ProcessAPI, ProgressReporter, StateStore } from "@actiondock/sdk";
-import type { ProjectConfig, RuntimeProjectConfig } from "../project/types.js";
+import type { ProjectConfig } from "../project/types.js";
 import type { RuntimeStorage } from "../storage/types.js";
 import { ProcessManager, type ProcessOwner } from "../process/index.js";
 /**
@@ -17,7 +17,7 @@ export declare class RuntimeConfig implements Config {
     private storage;
     private projectConfig?;
     private globalStorage?;
-    constructor(storage: RuntimeStorage, overrides?: Record<string, unknown>, projectConfig?: ProjectConfig | RuntimeProjectConfig, globalStorage?: RuntimeStorage);
+    constructor(storage: RuntimeStorage, overrides?: Record<string, unknown>, projectConfig?: ProjectConfig, globalStorage?: RuntimeStorage);
     get<T = unknown>(key: string): T | undefined;
     get<T = unknown>(key: string, defaultValue: T): T;
     has(key: string): boolean;
@@ -70,7 +70,7 @@ export interface ContextOptions {
     storage: RuntimeStorage;
     globalStorage?: RuntimeStorage;
     overrides?: Record<string, unknown>;
-    projectConfig?: ProjectConfig | RuntimeProjectConfig;
+    projectConfig?: ProjectConfig;
     parentRunId?: string;
     runId?: string;
     rootRunId?: string;

package/dist/runtime/index.d.ts

@@ -6,3 +6,4 @@ export * from "./run-persistence.js";
 export * from "./standalone.js";
 export * from "./env.js";
 export * from "./events.js";
+export * from "./run-origin.js";

package/dist/runtime/index.js

@@ -6,3 +6,4 @@ export * from "./run-persistence.js";
 export * from "./standalone.js";
 export * from "./env.js";
 export * from "./events.js";
+export * from "./run-origin.js";

package/dist/runtime/run-origin.d.ts

@@ -0,0 +1,9 @@
+import type { RunOrigin } from "@actiondock/sdk";
+/**
+ * 运行来源快照辅助函数（纯领域无副作用，单一事实源）。
+ *
+ * 仅安全提取 channel、viewName 与 authenticated 3个非秘密字段并冻结对象，
+ * 严禁携带额外凭证或扩展字段，防范对象后续被篡改。
+ * 若入参缺省则返回 undefined；非法来源严格校验报错，杜绝静默吞没。
+ */
+export declare function snapshotRunOrigin(origin?: unknown): RunOrigin | undefined;

package/dist/runtime/run-origin.js

@@ -0,0 +1,33 @@
+import { ActionDockError, INVALID_ARGUMENT } from "../errors.js";
+/**
+ * 运行来源快照辅助函数（纯领域无副作用，单一事实源）。
+ *
+ * 仅安全提取 channel、viewName 与 authenticated 3个非秘密字段并冻结对象，
+ * 严禁携带额外凭证或扩展字段，防范对象后续被篡改。
+ * 若入参缺省则返回 undefined；非法来源严格校验报错，杜绝静默吞没。
+ */
+export function snapshotRunOrigin(origin) {
+    if (origin === undefined || origin === null) {
+        return undefined;
+    }
+    if (typeof origin !== "object" || Array.isArray(origin)) {
+        throw new ActionDockError(INVALID_ARGUMENT, "Invalid run origin: expected an object");
+    }
+    const raw = origin;
+    const channel = raw.channel;
+    if (channel !== "http" && channel !== "mcp") {
+        throw new ActionDockError(INVALID_ARGUMENT, "Invalid run origin channel: expected 'http' or 'mcp'");
+    }
+    const viewName = raw.viewName;
+    if (typeof viewName !== "string" || viewName.length === 0) {
+        throw new ActionDockError(INVALID_ARGUMENT, "Invalid run origin viewName: expected a non-empty string");
+    }
+    if (typeof raw.authenticated !== "boolean") {
+        throw new ActionDockError(INVALID_ARGUMENT, `Invalid run origin authenticated: expected boolean, got '${typeof raw.authenticated}'`);
+    }
+    return Object.freeze({
+        channel,
+        viewName,
+        authenticated: raw.authenticated,
+    });
+}

package/dist/runtime/run-persistence.d.ts

@@ -1,4 +1,4 @@
-import type { RuntimeError, RunRecord } from "@actiondock/sdk";
+import type { RuntimeError, RunOrigin, RunRecord } from "@actiondock/sdk";
 import type { RuntimeStorage, TerminalRunStatus } from "../storage/types.js";
 /**
  * 运行记录落库参数（RunRecord 构造与写入的领域入参）。
@@ -13,6 +13,8 @@ export interface InitialRunRecordInput {
     rootRunId: string;
     /** 父级运行 ID（嵌套调用场景下建立调用链树） */
     parentRunId?: string;
+    /** 运行来源追踪快照 */
+    origin?: RunOrigin;
     /** 执行归属所有者标识 */
     ownerId?: string;
     /** 执行宿主会话标识 */

package/dist/runtime/run-persistence.js

@@ -1,11 +1,14 @@
 import { ActionDockError, RUN_PERSISTENCE_FAILED, RUN_REPOSITORY_UNAVAILABLE } from "../errors.js";
+import { snapshotRunOrigin } from "./run-origin.js";
 /**
  * 构建运行初始记录（RunRecord 组装单一事实源）。
  */
 export function buildInitialRunRecord(params, status, error) {
     const { runId, rootRunId, parentRunId, ownerId, hostSessionId, hostPid, packageInstanceId, generationId, targetPackageId, targetActionId, startedAt, input, runnerPackageId, runnerPackageInstanceId, runnerGenerationId, runnerHostSessionId, } = params;
+    const origin = snapshotRunOrigin(params.origin);
     const record = {
         id: runId,
+        ...(origin !== undefined ? { origin } : {}),
         rootRunId,
         parentRunId,
         packageId: targetPackageId,

package/dist/runtime/standalone-commands.js

@@ -29,7 +29,7 @@ export async function handleList(ctx, subArgs) {
     const effectiveIntent = intent || (positionalPatterns.length > 0 ? positionalPatterns.join("|") : undefined);
     const actions = await ctx.service.discovery.listActions();
     const list = actions.map((a) => ({
-        id: ctx.options.multiPackage && a.packageId && !a.id.includes("/") ? `${a.packageId}/${a.id}` : a.id,
+        id: a.id,
         description: a.description || "",
     }));
     const filterRes = filterWithFallbackInfo(list, effectiveIntent, [(a) => a.id, (a) => a.description], !noFallback);
@@ -66,7 +66,7 @@ export async function handleDescribe(ctx, subArgs) {
         });
     }
     const payload = buildActionDescribePayload(action, {
-        packageId: action.packageId || ctx.options.packageId,
+        packageId: ctx.options.packageId,
     });
     if (isJson) {
         ctx.writeOut(JSON.stringify(payload, null, 2));
@@ -274,9 +274,6 @@ function isServiceCapabilityError(err) {
         code === "TARGET_CAPABILITY_UNAVAILABLE");
 }
 export async function handleConfig(ctx, subArgs) {
-    if (ctx.options.multiPackage) {
-        return ctx.emitError(subArgs.includes("--json"), "CAPABILITY_UNAVAILABLE", "Multi-package entries do not support config/state management; configure actions using --config and --data-dir.", ExitCode.INVALID_ARGUMENT);
-    }
     const sub = subArgs[0] || "list";
     if (!ctx.service.management) {
         ctx.writeErr("Error: management port is not enabled on this service");
@@ -353,9 +350,6 @@ function decodeStateKeyArg(key) {
     }
 }
 export async function handleState(ctx, subArgs) {
-    if (ctx.options.multiPackage) {
-        return ctx.emitError(subArgs.includes("--json"), "CAPABILITY_UNAVAILABLE", "Multi-package entries do not support config/state management; configure actions using --config and --data-dir.", ExitCode.INVALID_ARGUMENT);
-    }
     const sub = subArgs[0] || "list";
     let namespace;
     let isAll = false;

package/dist/runtime/standalone.d.ts

@@ -24,8 +24,6 @@ export interface InvocationControl {
 export interface StandaloneDispatcherOptions {
     /** 所属 Package ID */
     packageId: string;
-    /** 多包入口使用完全限定发现标识，不以展示名操作配置和状态。 */
-    multiPackage?: boolean;
     /** 版本号 */
     version: string;
     /** 描述信息 */

package/dist/server/policy.d.ts

@@ -1,3 +1,4 @@
+import type { RunOrigin } from "@actiondock/sdk";
 import { ActionDockError } from "../errors.js";
 import type { McpEndpointHandler } from "./mcp-endpoint.js";
 import type { EffectiveServerPolicy, ServerOptions, ServerViewOptions } from "./types.js";
@@ -136,3 +137,10 @@ export declare function assertActionAllowedByPolicy(action: {
  * @param policy 当前生效的服务端策略
  */
 export declare function assertPackageAllowedByPolicy(packageId: string, policy?: EffectiveServerPolicy): void;
+/**
+ * 构造受信任的服务端执行来源快照。
+ *
+ * 仅挑选 channel、viewName（默认 "default"）与 authenticated（视图配置非空有效令牌）。
+ * 严禁暴露令牌原文、片段或摘要。
+ */
+export declare function createServerRunOrigin(policy: Pick<EffectiveServerPolicy, "viewName" | "token">, channel: RunOrigin["channel"]): RunOrigin;

package/dist/server/policy.js

@@ -1,3 +1,4 @@
+import { snapshotRunOrigin } from "../runtime/run-origin.js";
 import { parseActionRef } from "../catalog/resolve-action.js";
 import { ActionDockError, ACTION_FORBIDDEN, PACKAGE_NOT_ALLOWED } from "../errors.js";
 import { safeEqual } from "./security.js";
@@ -366,3 +367,16 @@ export function assertPackageAllowedByPolicy(packageId, policy) {
         throw new PackageNotAllowedError(packageId);
     }
 }
+/**
+ * 构造受信任的服务端执行来源快照。
+ *
+ * 仅挑选 channel、viewName（默认 "default"）与 authenticated（视图配置非空有效令牌）。
+ * 严禁暴露令牌原文、片段或摘要。
+ */
+export function createServerRunOrigin(policy, channel) {
+    return snapshotRunOrigin({
+        channel,
+        viewName: policy.viewName || "default",
+        authenticated: Boolean(policy.token?.trim()),
+    });
+}

package/dist/server/routes/actions.js

@@ -2,6 +2,7 @@ import { parseActionRef } from "../../catalog/resolve-action.js";
 import { filterByIntent } from "../../utils/intent.js";
 import { ACTION_EXECUTION_ERROR, ACTION_FORBIDDEN, ACTION_NOT_FOUND, ACTION_START_FAILED, ACTION_TIMEOUT, ACTIONS_LIST_ERROR, IDEMPOTENCY_CONFLICT, INPUT_VALIDATION_FAILED, INVALID_JSON, PACKAGE_FORBIDDEN, PACKAGE_NOT_FOUND, REQUEST_TOO_LARGE, } from "../../errors.js";
 import { InvalidJsonError, readJsonBody, RequestTooLargeError } from "../body.js";
+import { createServerRunOrigin } from "../policy.js";
 import { filterActionsByPolicy, getSubPath, isActionAllowedByPolicy, isPackageAllowedByPolicy, jsonResponse, } from "./common.js";
 /**
  * 处理 Action 相关的 HTTP 路由（列表、规范查询、同步执行与异步启动）。
@@ -257,10 +258,12 @@ export async function handleActionsRoutes(ctx) {
         }
         if (isAsync) {
             try {
+                const origin = createServerRunOrigin(policy, "http");
                 const ticket = await service.execution.start(actionRefObj, input, {
                     timeoutMs,
                     config: configOverrides,
                     requestId,
+                    origin,
                 });
                 if (ticket.status === "failed") {
                     const res = await ticket.result;
@@ -296,11 +299,13 @@ export async function handleActionsRoutes(ctx) {
         }
         // 同步执行模式
         try {
+            const origin = createServerRunOrigin(policy, "http");
             const result = await service.execution.run(actionRefObj, input, {
                 signal: req.signal,
                 timeoutMs,
                 config: configOverrides,
                 requestId,
+                origin,
             });
             let status = 200;
             if (!result.ok) {

package/dist/service/types.d.ts

@@ -1,4 +1,4 @@
-import type { ActionRef, ExecutionEvent, ExecutionResult, JsonValue, RunRecord } from "@actiondock/sdk";
+import type { ActionRef, ExecutionEvent, ExecutionResult, JsonValue, RunOrigin, RunRecord } from "@actiondock/sdk";
 import type { ActionSpec, ActionSummary, ListActionsOptions, PackageInfo, PackageRuntime, PackageRuntimeOptions, PlaybookSpec, PlaybookSummary } from "../package/types.js";
 import type { CancelResult, ExecutionTicket } from "../execution/types.js";
 import type { ActionDockHostOptions } from "../host/types.js";
@@ -18,6 +18,8 @@ export interface RunOptions {
     config?: Record<string, JsonValue>;
     /** 幂等请求标识 */
     requestId?: string;
+    /** 运行来源追踪快照 */
+    origin?: RunOrigin;
 }
 /**
  * 统一协议版本常量。

package/dist/storage/sqlite-runs.js

@@ -1,5 +1,6 @@
 import { isTerminalRunStatus, DEFAULT_MAX_RUNS_PER_PACKAGE, DEFAULT_MIN_RETAIN_RUNS, DEFAULT_RUNS_RETENTION_MS } from "./types.js";
 import { safeParseStoredJson } from "./utils.js";
+import { snapshotRunOrigin } from "../runtime/run-origin.js";
 import { isRunHostDead } from "./run-liveness.js";
 import { ActionDockError, STORAGE_CLOSED, STORED_ERROR_DECODE_FAILED } from "../errors.js";
 export class SqliteRunsStore {
@@ -146,15 +147,17 @@ export class SqliteRunsStore {
     createRun(record) {
         const stmt = this.getStatement(`
       INSERT INTO runs (
-        id, root_run_id, parent_run_id, package_id, package_instance_id,
+        id, root_run_id, parent_run_id, origin_json, package_id, package_instance_id,
         action_id, generation_id, owner_id, host_session_id, host_pid, heartbeat_at,
         status, input_json, output_json,
         error_json, started_at, finished_at, duration_ms
       )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
         const rootRunId = record.rootRunId || record.id;
         const parentRunId = record.parentRunId || null;
+        const origin = snapshotRunOrigin(record.origin);
+        const originJson = origin ? JSON.stringify(origin) : null;
         const packageInstanceId = record.packageInstanceId || record.packageId || this.packageId;
         const generationId = record.generationId || "1";
         const ownerId = record.ownerId || "local";
@@ -168,7 +171,7 @@ export class SqliteRunsStore {
         const errorJson = record.error ? JSON.stringify(record.error) : null;
         const finishedAt = record.finishedAt || null;
         const durationMs = typeof record.durationMs === "number" ? record.durationMs : null;
-        stmt.run(record.id, rootRunId, parentRunId, record.packageId || this.packageId, packageInstanceId, record.actionId ?? "", generationId, ownerId, hostSessionId, hostPid, heartbeatAt, record.status, inputJson, outputJson, errorJson, startedIso, finishedAt, durationMs);
+        stmt.run(record.id, rootRunId, parentRunId, originJson, record.packageId || this.packageId, packageInstanceId, record.actionId ?? "", generationId, ownerId, hostSessionId, hostPid, heartbeatAt, record.status, inputJson, outputJson, errorJson, startedIso, finishedAt, durationMs);
         this.runInsertCount++;
         const nowMs = this.clock.now().getTime();
         if (this.runInsertCount >= SqliteRunsStore.RUNS_CLEANUP_BATCH_THRESHOLD &&
@@ -595,8 +598,11 @@ export class SqliteRunsStore {
                 ? error
                 : { code: STORED_ERROR_DECODE_FAILED, message: String(error) }
             : undefined;
+        const rawOrigin = safeParseStoredJson(row.origin_json, `runs.origin db=${this.dbPath} package=${this.packageId} run=${row.id}`, { strict: true });
+        const origin = snapshotRunOrigin(rawOrigin);
         return {
             id: row.id,
+            ...(origin !== undefined ? { origin } : {}),
             rootRunId: row.root_run_id || row.id,
             parentRunId: row.parent_run_id || undefined,
             packageId: row.package_id,

package/dist/storage/sqlite-schema.js

@@ -49,6 +49,7 @@ export function initSchema(driver, dbPath, recoverOrphans, recoverDeadSessionFn,
           id TEXT PRIMARY KEY,
           root_run_id TEXT NOT NULL,
           parent_run_id TEXT,
+          origin_json TEXT,
           package_id TEXT NOT NULL,
           package_instance_id TEXT NOT NULL,
           action_id TEXT NOT NULL,
@@ -103,8 +104,11 @@ export function initSchema(driver, dbPath, recoverOrphans, recoverDeadSessionFn,
     }
     // 确保存量旧版本数据库补充新增的列或表
     if (version !== 0) {
+        const columns = driver.prepare("PRAGMA table_info(runs);").all();
+        if (Array.isArray(columns) && !columns.some((c) => c.name === "origin_json")) {
+            driver.exec("ALTER TABLE runs ADD COLUMN origin_json TEXT;");
+        }
         try {
-            const columns = driver.prepare("PRAGMA table_info(runs);").all();
             if (Array.isArray(columns) && !columns.some((c) => c.name === "host_session_id")) {
                 driver.exec("ALTER TABLE runs ADD COLUMN host_session_id TEXT;");
             }

package/dist/storage/utils.d.ts

@@ -17,6 +17,9 @@
  *
  * @param raw 存储层原始 JSON 字符串
  * @param context 存储路径上下文描述（包含数据库位置、包标识与键名）
- * @returns 解析成功返回解析后的值；入参为空返回 undefined；解析失败返回原始字符串
+ * @param options 严格模式下解析失败直接报错，且不输出原始载荷片段
+ * @returns 解析成功返回解析后的值；入参为空返回 undefined；默认模式解析失败返回原始字符串
  */
-export declare function safeParseStoredJson<T = unknown>(raw: string | null | undefined, context: string): T | undefined;
+export declare function safeParseStoredJson<T = unknown>(raw: string | null | undefined, context: string, options?: {
+    strict?: boolean;
+}): T | undefined;

package/dist/storage/utils.js

@@ -1,3 +1,4 @@
+import { ActionDockError, RUN_REPOSITORY_UNAVAILABLE } from "../errors.js";
 /**
  * 存储层 JSON 载荷统一安全解析工具。
  *
@@ -17,9 +18,10 @@
  *
  * @param raw 存储层原始 JSON 字符串
  * @param context 存储路径上下文描述（包含数据库位置、包标识与键名）
- * @returns 解析成功返回解析后的值；入参为空返回 undefined；解析失败返回原始字符串
+ * @param options 严格模式下解析失败直接报错，且不输出原始载荷片段
+ * @returns 解析成功返回解析后的值；入参为空返回 undefined；默认模式解析失败返回原始字符串
  */
-export function safeParseStoredJson(raw, context) {
+export function safeParseStoredJson(raw, context, options) {
     if (raw === null || raw === undefined) {
         return undefined;
     }
@@ -27,6 +29,9 @@ export function safeParseStoredJson(raw, context) {
         return JSON.parse(raw);
     }
     catch (err) {
+        if (options?.strict) {
+            throw new ActionDockError(RUN_REPOSITORY_UNAVAILABLE, `Corrupted stored JSON at ${context}`);
+        }
         const reason = err instanceof Error ? err.message : String(err);
         console.warn(`[actiondock] stored JSON corrupted at ${context}: ${reason}`);
         return raw;

package/dist/utils/semver.d.ts

@@ -6,11 +6,10 @@ export interface SemVer {
     minor: number;
     patch: number;
     prerelease?: string;
-    build?: string;
 }
 /**
  * 解析基础 SemVer 版本字符串（单一事实源）。
- * 仅接受可选 v/= 前缀的严格三段式语义化版本，可携带预发布后缀与构建元数据；
+ * 仅接受可选 v/= 前缀的严格三段式语义化版本，可携带预发布后缀；
  * 其余形态（两段式、非数值等）返回 null，由调用方自行兜底。
  *
  * 本模块不依赖任何 Node 内建与 core 领域模块，可在无 loader 的原生

package/dist/utils/semver.js

@@ -1,25 +1,19 @@
 /**
  * 解析基础 SemVer 版本字符串（单一事实源）。
- * 仅接受可选 v/= 前缀的严格三段式语义化版本，可携带预发布后缀与构建元数据；
+ * 仅接受可选 v/= 前缀的严格三段式语义化版本，可携带预发布后缀；
  * 其余形态（两段式、非数值等）返回 null，由调用方自行兜底。
  *
  * 本模块不依赖任何 Node 内建与 core 领域模块，可在无 loader 的原生
  * Node 直接以 .ts 形态导入（工程脚本域复用此处单一事实源）。
  */
 export function parseSemVer(v) {
-    const match = v.trim().replace(/^[v=]/, "").match(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/);
+    const match = v.trim().replace(/^[v=]/, "").match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/);
     if (!match)
         return null;
-    const [major, minor, patch] = match.slice(1, 4).map(Number);
-    if (![major, minor, patch].every(Number.isSafeInteger))
-        return null;
-    if (match[4]?.split(".").some((id) => /^\d+$/.test(id) && id.length > 1 && id.startsWith("0")))
-        return null;
     return {
-        major,
-        minor,
-        patch,
+        major: parseInt(match[1], 10),
+        minor: parseInt(match[2], 10),
+        patch: parseInt(match[3], 10),
         prerelease: match[4],
-        ...(match[5] === undefined ? {} : { build: match[5] }),
     };
 }

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 /**
  * ActionDock 核心版本号单一事实源。
  */
-export declare const ACTIONDOCK_VERSION = "2.15.0";
+export declare const ACTIONDOCK_VERSION = "2.17.0";

package/dist/version.js

@@ -1,4 +1,4 @@
 /**
  * ActionDock 核心版本号单一事实源。
  */
-export const ACTIONDOCK_VERSION = "2.15.0";
+export const ACTIONDOCK_VERSION = "2.17.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actiondock/core",
-  "version": "2.15.0",
+  "version": "2.17.0",
   "description": "ActionDock Core Engine - Project loader, runtime execution, SQLite storage, standalone builder, and skill exporter",
   "type": "module",
   "main": "./dist/index.js",
@@ -59,7 +59,7 @@
     "test": "node ../../scripts/run-tests.ts"
   },
   "dependencies": {
-    "@actiondock/sdk": "^2.15.0",
+    "@actiondock/sdk": "^2.17.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "undici": "^7.29.1"

package/dist/project/skill-dir.d.ts

@@ -1,72 +0,0 @@
-import type { ProjectConfig } from "./types.js";
-/**
- * 本地包条目；是否构成封闭集合由校验入口保证。
- */
-export interface LocalPackageEntry {
-    packageId: string;
-    packageRoot: string;
-    projectConfig: ProjectConfig;
-}
-/**
- * 本地技能 / 包目录发现视图，不代表已经通过封闭集合校验。
- */
-export interface LocalSkillDirectory {
-    type: "single" | "composite";
-    root: string;
-    packages: LocalPackageEntry[];
-}
-/**
- * 判定路径字符串是否为显式文件/目录路径形态（而非包标识符）。
- *
- * 规则：
- * - 以 .、/、~ 开头；
- * - 包含 / 或 \\，且不是 scoped 包（@scope/name 仅含一个 /）；
- * - scoped 包若包含反斜杠或多于一个 /，亦视作路径。
- */
-export declare function isExplicitPath(p: string): boolean;
-/**
- * 对明确的本地封闭包集合实施一致性校验。
- *
- * 校验规则：
- * - 重复包标识防护：集合内不得存在相同 packageId；
- * - 依赖存在性与版本兼容性：声明的直接依赖必须在集合内存在且满足语义版本约束（复用 PackageGraphBuilder）；
- * - 跨包 uses 目标完整性：uses 声明引用的目标包与目标 Action 必须在集合内存在。
- *
- * @param packages 封闭包条目集合
- */
-export declare function validateLocalSkillPackages(packages: Array<{
-    packageId: string;
-    packageRoot: string;
-    projectConfig: ProjectConfig;
-}>): void;
-/**
- * 发现本地 Skill / 包目录结构（支持单包根目录与 packages/* 复合套件布局）。
- * 仅执行物理布局发现与清单加载，不执行跨包封闭依赖集合校验。
- *
- * @param directoryPath 待检查的目录路径（相对路径将基于 cwd 解析）
- * @param cwd 解析基准工作目录（默认为 process.cwd()）
- */
-export declare function discoverLocalSkillDirectory(directoryPath: string, cwd?: string): LocalSkillDirectory | null;
-/**
- * 查询指定路径的本地包或技能目录（供 info / 查询命令使用）。
- * 单包不要求 node_modules 依赖闭包；复合目录仍要求封闭集合完整。
- *
- * @param directoryPath 待检查的目录路径（相对路径将基于 cwd 解析）
- * @param cwd 解析基准工作目录（默认为 process.cwd()）
- */
-export declare function queryLocalPackageDirectory(directoryPath: string, cwd?: string): LocalSkillDirectory | null;
-/**
- * 探测指定路径是否为本地 Skill / 包目录（支持单包根目录与 packages/* 复合套件布局）。
- *
- * 封闭包装配与校验规则：
- * - 符号链接按目录布局正常解析；Action 与规程入口的文件边界由相应加载器校验；
- * - 单包布局：目录根部存在 actiondock.json，解析为包含单一包的 LocalSkillDirectory；
- * - 复合布局：目录根部存在 packages/ 目录，遍历其直接子目录，收集包含 actiondock.json 的子包；
- * - 集合一致性校验：通过 validateLocalSkillPackages 严格核查依赖闭包、版本兼容与 uses 目标；
- * - 异常透传：坏清单或权限异常原样抛出，严禁静默回退 Registry；
- * - 若非候选技能目录，返回 null。
- *
- * @param directoryPath 待检查的目录路径（相对路径将基于 cwd 解析）
- * @param cwd 解析基准工作目录（默认为 process.cwd()）
- */
-export declare function inspectLocalPackageDirectory(directoryPath: string, cwd?: string): LocalSkillDirectory | null;