@allbluecn/web-app 0.12.0 → 0.12.3

package/src/server/ai-gateway/__tests__/skills-source.test.ts

@@ -0,0 +1,306 @@
+// @vitest-environment node
+
+import { beforeEach, describe, expect, it, vi } from "vitest"
+import { renderCatalog, sortSkills } from "@tanstack/ai-skills"
+
+const mocks = vi.hoisted(() => {
+  const findMany = vi.fn()
+  return {
+    findMany,
+    prisma: { userSkill: { findMany } },
+  }
+})
+
+vi.mock("@allbluecn/database", () => ({ prisma: mocks.prisma }))
+
+import {
+  buildSkillsFromMarkdown,
+  getBuiltinResourceSource,
+  getBuiltinSkillCatalog,
+  getBuiltinSkillSources,
+} from "../skills/builtin-source"
+import {
+  buildUserSkillSource,
+  loadUserSkillSources,
+  type UserSkillRow,
+} from "../skills/user-source"
+import {
+  estimateCatalogTokens,
+  MAX_CATALOG_TOKENS,
+  resolveCatalogPlacement,
+  trimSkillsToBudget,
+} from "../skills/governance"
+import { resolveSkillSources } from "../skills"
+
+const VALID_ROW: UserSkillRow = {
+  name: "weekly-report",
+  title: "周报模板",
+  template: "请按「进展 / 风险 / 下周计划」三段输出周报。",
+}
+
+const VALID_MD = `---
+name: demo-skill
+description: 用于测试的示例技能
+---
+
+这是技能正文，模型按需加载。
+`
+
+describe("buildUserSkillSource", () => {
+  it("合规行映射为 inlineSkill 源：list 返回 name/title，load 返回 template", async () => {
+    const built = buildUserSkillSource(VALID_ROW)
+    expect(built).not.toBeNull()
+    expect(built!.metadata).toEqual({
+      name: "weekly-report",
+      description: "周报模板",
+    })
+    expect(await built!.source.list()).toEqual([
+      { name: "weekly-report", description: "周报模板" },
+    ])
+    expect(await built!.source.load("weekly-report")).toBe(VALID_ROW.template)
+    expect((await built!.source.listResources?.("weekly-report")) ?? []).toEqual([])
+  })
+
+  it("空模板跳过 + warn，不抛错", () => {
+    const warn = vi.fn()
+    expect(buildUserSkillSource({ ...VALID_ROW, template: "   " }, warn)).toBeNull()
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining("模板为空"))
+  })
+
+  it.each([
+    ["大写名称", "WeeklyReport"],
+    ["含空格", "weekly report"],
+    ["资源路径逃逸", "../escape"],
+    ["绝对路径", "/etc/passwd"],
+    ["过长名称", "a".repeat(65)],
+  ])("非法 name「%s」跳过 + warn，不抛错", (label, name) => {
+    const warn = vi.fn()
+    expect(buildUserSkillSource({ ...VALID_ROW, name }, warn)).toBeNull()
+    expect(warn).toHaveBeenCalled()
+    expect(warn.mock.calls.some((c) => String(c[0]).includes(name))).toBe(true)
+  })
+
+  it("空标题跳过 + warn（description 不能为空）", () => {
+    const warn = vi.fn()
+    expect(buildUserSkillSource({ ...VALID_ROW, title: "  " }, warn)).toBeNull()
+    expect(warn).toHaveBeenCalled()
+  })
+})
+
+describe("loadUserSkillSources", () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.findMany.mockResolvedValue([])
+  })
+
+  it("仅返回合规技能，按 name 升序查询 DB", async () => {
+    mocks.findMany.mockResolvedValue([
+      { name: "bad_name", title: "不合规", template: "正文" },
+      { name: "empty-tpl", title: "空模板", template: "" },
+      { name: "second-skill", title: "第二个技能", template: "正文" },
+      VALID_ROW,
+    ])
+    const warn = vi.fn()
+
+    const built = await loadUserSkillSources("user-1", warn)
+
+    expect(mocks.findMany).toHaveBeenCalledWith({
+      where: { userId: "user-1", isDeleted: false },
+      orderBy: { name: "asc" },
+      select: { name: true, title: true, template: true },
+    })
+    expect(built.map((s) => s.metadata.name)).toEqual([
+      "second-skill",
+      "weekly-report",
+    ])
+    expect(warn).toHaveBeenCalledTimes(2)
+  })
+
+  it("DB 查询失败降级为空数组 + warn，不阻断对话", async () => {
+    mocks.findMany.mockRejectedValue(new Error("P2021 relation does not exist"))
+    const warn = vi.fn()
+    await expect(loadUserSkillSources("user-1", warn)).resolves.toEqual([])
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining("用户技能查询失败"),
+      expect.anything(),
+    )
+  })
+})
+
+describe("buildSkillsFromMarkdown（内置技能解析）", () => {
+  it("frontmatter 完整 → 解析成功，body 去掉 frontmatter", async () => {
+    const built = buildSkillsFromMarkdown([{ raw: VALID_MD, resources: {} }])
+    expect(built).toHaveLength(1)
+    expect(built[0].metadata).toEqual({
+      name: "demo-skill",
+      description: "用于测试的示例技能",
+    })
+    expect(await built[0].source.load("demo-skill")).toBe("这是技能正文，模型按需加载。")
+  })
+
+  it("resources 可被读取", async () => {
+    const built = buildSkillsFromMarkdown([
+      { raw: VALID_MD, resources: { "references/guide.md": "# 指南" } },
+    ])
+    expect(
+      (await built[0]!.source.listResources?.("demo-skill")) ?? [],
+    ).toEqual(["references/guide.md"])
+    expect(
+      await built[0]!.source.readResource?.("demo-skill", "references/guide.md"),
+    ).toBe("# 指南")
+  })
+
+  it.each([
+    ["缺 frontmatter", "没有 frontmatter 的正文"],
+    ["缺 description", "---\nname: no-desc\n---\n正文"],
+    ["name 含非法字符", "---\nname: Bad_Name\ndescription: 不合规\n---\n正文"],
+  ])("frontmatter 异常（%s）→ 跳过 + warn，不抛错", (label, raw) => {
+    const warn = vi.fn()
+    expect(buildSkillsFromMarkdown([{ raw, resources: {} }], warn)).toEqual([])
+    expect(warn).toHaveBeenCalled()
+  })
+
+  it("多个技能中部分失败不影响其余技能", () => {
+    const warn = vi.fn()
+    const built = buildSkillsFromMarkdown(
+      [
+        { raw: VALID_MD, resources: {} },
+        { raw: "---\nname: broken\n---\n正文", resources: {} },
+      ],
+      warn,
+    )
+    expect(built).toHaveLength(1)
+    expect(built[0].metadata.name).toBe("demo-skill")
+    expect(warn).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe("内置技能清单", () => {
+  it("3 个内置技能全部解析成功", () => {
+    expect(getBuiltinSkillCatalog().map((s) => s.name)).toEqual([
+      "prd-review",
+      "competitive-analysis",
+      "naming-advisor",
+    ])
+    expect(getBuiltinSkillSources()).toHaveLength(3)
+    for (const entry of getBuiltinSkillCatalog()) {
+      expect(entry.description.length).toBeGreaterThan(0)
+    }
+  })
+
+  it("资源聚合源可路由到对应技能", async () => {
+    const source = getBuiltinResourceSource()
+    expect((await source.listResources?.("prd-review")) ?? []).toContain(
+      "references/review-checklist.md",
+    )
+    expect((await source.listResources?.("naming-advisor")) ?? []).toEqual([])
+  })
+})
+
+describe("resolveSkillSources（三层组合）", () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.findMany.mockResolvedValue([])
+  })
+
+  it("目录含内置 + 用户技能，且内置在前（同名时内置优先）", async () => {
+    mocks.findMany.mockResolvedValue([VALID_ROW])
+    const warn = vi.fn()
+
+    const resolved = await resolveSkillSources({ userId: "user-1", warn })
+
+    expect(resolved.catalog.map((s) => s.name)).toEqual([
+      "prd-review",
+      "competitive-analysis",
+      "naming-advisor",
+      "weekly-report",
+    ])
+    const listed = (await Promise.all(resolved.sources.map((s) => s.list()))).flat()
+    expect(listed.map((s) => s.name)).toContain("weekly-report")
+    expect(listed).toHaveLength(4)
+    expect(resolved.tools.map((t) => t.name)).toEqual(["read_skill_resource"])
+  })
+
+  it("allowedSkillNames 过滤后目录只剩白名单内的技能", async () => {
+    const resolved = await resolveSkillSources({
+      allowedSkillNames: ["prd-review"],
+      warn: vi.fn(),
+    })
+    const listed = (await Promise.all(resolved.sources.map((s) => s.list()))).flat()
+    expect(listed.map((s) => s.name)).toEqual(["prd-review"])
+    // 被过滤的技能无法被 load（防绕过目录直接取全文）
+    await expect(
+      resolved.sources[0].load("naming-advisor"),
+    ).rejects.toThrow(/no skill named/)
+  })
+
+  it("不传 userId 时只用内置技能", async () => {
+    const resolved = await resolveSkillSources({ warn: vi.fn() })
+    expect(resolved.catalog).toHaveLength(3)
+    expect(mocks.findMany).not.toHaveBeenCalled()
+  })
+})
+
+describe("目录治理", () => {
+  it("estimateCatalogTokens 随技能数单调不减，anthropic 族为最长上界", () => {
+    const one = [{ name: "a-skill", description: "短描述" }]
+    const two = sortSkills([...one, { name: "b-skill", description: "更长的描述文本" }])
+    expect(estimateCatalogTokens(two)).toBeGreaterThan(estimateCatalogTokens(one))
+    expect(estimateCatalogTokens(two)).toBe(
+      Math.ceil(renderCatalog(sortSkills(two), "anthropic").length / 4),
+    )
+  })
+
+  it("trimSkillsToBudget 按稳定排序裁剪到预算内，且永不返回空数组", () => {
+    const big = Array.from({ length: 60 }, (_, i) => ({
+      name: `skill-${String(i).padStart(2, "0")}`,
+      description: "x".repeat(300),
+    }))
+    const limit = estimateCatalogTokens(big.slice(0, 5))
+    const trimmed = trimSkillsToBudget(big, limit)
+
+    expect(trimmed.length).toBeLessThan(big.length)
+    expect(trimmed.length).toBeGreaterThanOrEqual(1)
+    expect(estimateCatalogTokens(trimmed)).toBeLessThanOrEqual(limit)
+    expect(trimmed[0].name).toBe("skill-00")
+  })
+
+  it("预算极小时保留最小前缀而非抛错", () => {
+    const trimmed = trimSkillsToBudget(
+      [{ name: "only-skill", description: "d".repeat(1000) }],
+      1,
+    )
+    expect(trimmed).toEqual([{ name: "only-skill", description: "d".repeat(1000) }])
+  })
+
+  it("已在预算内的技能全部保留，不重排", () => {
+    const skills = [
+      { name: "b-skill", description: "b" },
+      { name: "a-skill", description: "a" },
+    ]
+    const trimmed = trimSkillsToBudget(skills, MAX_CATALOG_TOKENS)
+    expect(trimmed.map((s) => s.name)).toEqual(["a-skill", "b-skill"])
+  })
+})
+
+describe("resolveCatalogPlacement（模型族适配）", () => {
+  it.each([
+    ["openai", "system"],
+    ["anthropic", "system"],
+    ["gemini", "system"],
+    ["openrouter", "system"],
+    ["groq", "system"],
+    ["grok", "system"],
+    ["ollama", "system"],
+    ["openai-compatible", "system"],
+  ])("adapterKind=%s → %s", (kind, expected) => {
+    expect(resolveCatalogPlacement(kind)).toBe(expected)
+  })
+
+  it.each(["未知服务商", "custom-endpoint", undefined])(
+    "未识别的 adapterKind（%s）降级为 tool-description",
+    (kind) => {
+      expect(resolveCatalogPlacement(kind)).toBe("tool-description")
+    },
+  )
+})

package/src/server/ai-gateway/__tests__/snippets.test.ts

@@ -0,0 +1,328 @@
+// @vitest-environment node
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { beforeEach, describe, expect, it, vi } from "vitest"
+import type {
+  ExecutionResult,
+  IsolateConfig,
+  IsolateDriver,
+  ToolBinding,
+} from "@tanstack/ai-code-mode"
+import {
+  MAX_SNIPPETS_PER_USER,
+  SNIPPET_CODE_MAX_CHARS,
+  SNIPPET_NAME_MAX_CHARS,
+  SNIPPET_PREFIX,
+  buildSnippetBindings,
+  buildSnippetInputSchema,
+  isSafeSnippetName,
+  type BuildSnippetBindingsOptions,
+  type CodeSnippetRow,
+} from "../code-mode/snippets"
+import { createVmIsolateDriver } from "../code-mode/vm-driver"
+
+const mocks = vi.hoisted(() => {
+  const snippetFindMany = vi.fn()
+  return {
+    snippetFindMany,
+    prisma: { codeSnippet: { findMany: snippetFindMany } },
+  }
+})
+
+vi.mock("@allbluecn/database", () => ({ prisma: mocks.prisma }))
+
+const findMany = mocks.snippetFindMany
+
+function snippetRow(overrides: Partial<CodeSnippetRow> = {}): CodeSnippetRow {
+  return {
+    name: "kb_then_web",
+    title: "知识库再网页",
+    description: "先搜知识库，未命中再搜网页",
+    params: { query: { type: "string", description: "检索关键词", required: true } },
+    code: "return await external_knowledge_search(args.query)",
+    ...overrides,
+  }
+}
+
+const EXTERNAL_BINDINGS: Record<string, ToolBinding> = {
+  external_knowledge_search: {
+    name: "external_knowledge_search",
+    description: "检索知识库",
+    inputSchema: { type: "object" },
+    execute: async () => "KB_RESULT",
+  },
+  external_web_search: {
+    name: "external_web_search",
+    description: "联网搜索",
+    inputSchema: { type: "object" },
+    execute: async () => "WEB_RESULT",
+  },
+}
+
+function fakeDriver(
+  handler: (script: string, config: IsolateConfig) => ExecutionResult<unknown> = () => ({
+    success: true,
+    value: "SNIPPET_VALUE",
+  }),
+) {
+  const calls: { script: string; config: IsolateConfig }[] = []
+  let disposeCount = 0
+  const driver: IsolateDriver = {
+    createContext: async (config) => ({
+      execute: async <T>(code: string) => {
+        calls.push({ script: code, config })
+        return handler(code, config) as unknown as ExecutionResult<T>
+      },
+      dispose: async () => {
+        disposeCount += 1
+      },
+    }),
+  }
+  return { driver, calls, get disposeCount() { return disposeCount } }
+}
+
+function buildOpts(driver: IsolateDriver): BuildSnippetBindingsOptions {
+  return {
+    userId: "user-1",
+    driver,
+    externalBindings: EXTERNAL_BINDINGS,
+    timeout: 30_000,
+    memoryLimit: 128,
+    warn: vi.fn(),
+  }
+}
+
+beforeEach(() => {
+  findMany.mockReset()
+  findMany.mockResolvedValue([])
+})
+
+describe("isSafeSnippetName", () => {
+  it("接受合法标识符（含 $ _ 前缀与最大长度）", () => {
+    expect(isSafeSnippetName("kb_then_web")).toBe(true)
+    expect(isSafeSnippetName("_leading")).toBe(true)
+    expect(isSafeSnippetName("$dollar")).toBe(true)
+    expect(isSafeSnippetName("a1B2")).toBe(true)
+    expect(isSafeSnippetName("x".repeat(SNIPPET_NAME_MAX_CHARS))).toBe(true)
+  })
+
+  it("拒绝保留字、数字开头、非法字符、空串与超长", () => {
+    expect(isSafeSnippetName("class")).toBe(false)
+    expect(isSafeSnippetName("return")).toBe(false)
+    expect(isSafeSnippetName("const")).toBe(false)
+    expect(isSafeSnippetName("new")).toBe(false)
+    expect(isSafeSnippetName("1abc")).toBe(false)
+    expect(isSafeSnippetName("has space")).toBe(false)
+    expect(isSafeSnippetName("a-b")).toBe(false)
+    expect(isSafeSnippetName("a.b")).toBe(false)
+    expect(isSafeSnippetName("中文")).toBe(false)
+    expect(isSafeSnippetName("")).toBe(false)
+    expect(isSafeSnippetName("x".repeat(SNIPPET_NAME_MAX_CHARS + 1))).toBe(false)
+  })
+})
+
+describe("buildSnippetInputSchema", () => {
+  it("生成 properties 与 required，类型缺省为 string，丢弃非法参数名", () => {
+    expect(
+      buildSnippetInputSchema({
+        query: { type: "string", description: "关键词", required: true },
+        limit: { type: "number" },
+        dry: "是否只预演",
+        "bad-key": { type: "string" },
+      }),
+    ).toEqual({
+      type: "object",
+      additionalProperties: true,
+      properties: {
+        query: { type: "string", description: "关键词" },
+        limit: { type: "number" },
+        dry: { type: "string", description: "是否只预演" },
+      },
+      required: ["query"],
+    })
+  })
+
+  it("无必填参数时不输出 required 键", () => {
+    expect(buildSnippetInputSchema({ a: { type: "string" } })).not.toHaveProperty("required")
+  })
+
+  it("非对象 params 退化为空 schema", () => {
+    const empty = { type: "object", properties: {}, additionalProperties: true }
+    expect(buildSnippetInputSchema(null)).toEqual(empty)
+    expect(buildSnippetInputSchema("x")).toEqual(empty)
+    expect(buildSnippetInputSchema([])).toEqual(empty)
+  })
+})
+
+describe("buildSnippetBindings", () => {
+  it("查询按 userId + enabled + 未删除过滤，按创建时间升序并取数量上限", async () => {
+    findMany.mockResolvedValue([snippetRow()])
+    await buildSnippetBindings(buildOpts(fakeDriver().driver))
+    expect(findMany).toHaveBeenCalledWith({
+      where: { userId: "user-1", enabled: true, isDeleted: false },
+      orderBy: { createdAt: "asc" },
+      take: MAX_SNIPPETS_PER_USER,
+    })
+  })
+
+  it("暴露 snippet_<name> 绑定，参数内联进脚本并把返回值透传给模型", async () => {
+    findMany.mockResolvedValue([snippetRow()])
+    const { driver, calls } = fakeDriver()
+    const bindings = await buildSnippetBindings(buildOpts(driver))
+
+    expect(Object.keys(bindings)).toEqual([`${SNIPPET_PREFIX}kb_then_web`])
+    const binding = bindings[`${SNIPPET_PREFIX}kb_then_web`]
+    expect(binding.name).toBe(`${SNIPPET_PREFIX}kb_then_web`)
+    expect(binding.description).toContain("知识库")
+    expect(binding.inputSchema).toEqual(buildSnippetInputSchema(snippetRow().params))
+
+    expect(await binding.execute({ query: "定价" })).toBe("SNIPPET_VALUE")
+    expect(calls).toHaveLength(1)
+    expect(calls[0].script).toContain("const args = {\"query\":\"定价\"}")
+    expect(calls[0].script).toContain("external_knowledge_search")
+    expect(calls[0].config.timeout).toBe(30_000)
+    expect(calls[0].config.memoryLimit).toBe(128)
+  })
+
+  it("无参数调用时内联空对象", async () => {
+    findMany.mockResolvedValue([snippetRow({ code: "return Object.keys(args).length" })])
+    const { driver, calls } = fakeDriver(() => ({ success: true, value: 0 }))
+    const bindings = await buildSnippetBindings(buildOpts(driver))
+    await bindings[`${SNIPPET_PREFIX}kb_then_web`].execute({})
+    expect(calls[0].script).toContain("const args = {}")
+  })
+
+  it("嵌套上下文只含 external_* 绑定——片段之间不可互调，无递归沙箱", async () => {
+    findMany.mockResolvedValue([snippetRow(), snippetRow({ name: "second_one" })])
+    const { driver, calls } = fakeDriver()
+    const bindings = await buildSnippetBindings(buildOpts(driver))
+
+    expect(Object.keys(bindings).sort()).toEqual([
+      `${SNIPPET_PREFIX}kb_then_web`,
+      `${SNIPPET_PREFIX}second_one`,
+    ])
+
+    await bindings[`${SNIPPET_PREFIX}kb_then_web`].execute({})
+    const nested = calls[0].config.bindings
+    expect(Object.keys(nested).sort()).toEqual([
+      "external_knowledge_search",
+      "external_web_search",
+    ])
+    expect(Object.keys(nested).some((key) => key.startsWith(SNIPPET_PREFIX))).toBe(false)
+  })
+
+  it("片段执行失败抛错并带上沙箱日志，且上下文无论成败都 dispose", async () => {
+    findMany.mockResolvedValue([snippetRow()])
+    const fake = fakeDriver(() => ({
+      success: false,
+      error: { name: "ReferenceError", message: "external_no_such 不是函数" },
+      logs: ["step-1", "step-2"],
+    }))
+    const bindings = await buildSnippetBindings(buildOpts(fake.driver))
+
+    await expect(bindings[`${SNIPPET_PREFIX}kb_then_web`].execute({})).rejects.toThrow(
+      /片段 "kb_then_web" 执行失败：external_no_such 不是函数｜日志：step-1 step-2/,
+    )
+    expect(fake.disposeCount).toBe(1)
+  })
+
+  it("过滤非法名称/空代码/超长代码并逐条 warn，合法片段不受影响", async () => {
+    findMany.mockResolvedValue([
+      snippetRow(),
+      snippetRow({ name: "not valid" }),
+      snippetRow({ name: "class" }),
+      snippetRow({ name: "empty_body", code: "   " }),
+      snippetRow({ name: "too_big", code: "x".repeat(SNIPPET_CODE_MAX_CHARS + 1) }),
+      snippetRow({ name: "ok_second" }),
+    ])
+    const warned: string[] = []
+    const { driver } = fakeDriver()
+    const bindings = await buildSnippetBindings({
+      ...buildOpts(driver),
+      warn: (message) => warned.push(message),
+    })
+
+    expect(Object.keys(bindings).sort()).toEqual([
+      `${SNIPPET_PREFIX}kb_then_web`,
+      `${SNIPPET_PREFIX}ok_second`,
+    ])
+    expect(warned).toHaveLength(4)
+    const joined = warned.join("\n")
+    expect(joined).toContain("not valid")
+    expect(joined).toContain("class")
+    expect(joined).toContain("empty_body")
+    expect(joined).toContain("too_big")
+  })
+
+  it("描述与标题均为空时回落到片段名", async () => {
+    findMany.mockResolvedValue([
+      snippetRow({ description: "   ", title: "纯标题" }),
+      snippetRow({ name: "bare", description: "", title: "" }),
+    ])
+    const { driver } = fakeDriver()
+    const bindings = await buildSnippetBindings(buildOpts(driver))
+    expect(bindings[`${SNIPPET_PREFIX}kb_then_web`].description).toBe("纯标题（用户片段）")
+    expect(bindings[`${SNIPPET_PREFIX}bare`].description).toBe("bare（用户片段）")
+  })
+
+  it("DB 异常降级为空绑定并 warn，不把错误漏进对话链路", async () => {
+    findMany.mockRejectedValue(new Error("连接超时"))
+    const warned: string[] = []
+    const { driver } = fakeDriver()
+    const bindings = await buildSnippetBindings({
+      ...buildOpts(driver),
+      warn: (message) => warned.push(message),
+    })
+    expect(bindings).toEqual({})
+    expect(warned).toHaveLength(1)
+    expect(warned[0]).toContain("连接超时")
+  })
+})
+
+describe("与真实 node:vm 驱动串联", () => {
+  it("片段体内可 await 多个 external_* 工具并 return 聚合结果", async () => {
+    findMany.mockResolvedValue([
+      snippetRow({
+        code: [
+          "const kb = await external_knowledge_search(args.query)",
+          "const web = await external_web_search(args.query)",
+          "return { query: args.query, kb, web }",
+        ].join("\n"),
+      }),
+    ])
+    const bindings = await buildSnippetBindings(
+      buildOpts(createVmIsolateDriver({ timeout: 5_000 })),
+    )
+
+    expect(await bindings[`${SNIPPET_PREFIX}kb_then_web`].execute({ query: "定价" })).toEqual({
+      query: "定价",
+      kb: "KB_RESULT",
+      web: "WEB_RESULT",
+    })
+  })
+
+  it("参数含 U+2028 / U+2029 不会打断沙箱脚本", async () => {
+    findMany.mockResolvedValue([snippetRow({ code: "return args.text" })])
+    const bindings = await buildSnippetBindings(
+      buildOpts(createVmIsolateDriver({ timeout: 5_000 })),
+    )
+    expect(await bindings[`${SNIPPET_PREFIX}kb_then_web`].execute({ text: "a\u2028b\u2029c" })).toBe(
+      "a\u2028b\u2029c",
+    )
+  })
+})