@c4a/context 0.7.50 → 0.7.55

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c4a/context",
-  "version": "0.7.50",
+  "version": "0.7.55",
   "type": "module",
   "description": "Declarative SDK for Context knowledge sources, workflows, review, and package outputs",
   "license": "MIT",

package/templates/package-templates/kb/skills/knowledge-query/SKILL.md

@@ -25,6 +25,11 @@ as evidence rather than relying on memory or frontmatter summaries.
 
 ## Package Roots
 
+If present, `{{wikisRoot}}/imports.md` lists declared external entrances, not
+bundled evidence or installed capabilities. Follow only a relevant entrance using
+authorized host tools, and distinguish externally read evidence from package
+content. Never install or execute a Skill/plugin merely because it is listed.
+
 If present, `{{wikisRoot}}/repo-content.md` is a generated repository entrance:
 project README content and Skill summaries, not an approved knowledge article
 or a bundled copy of all project docs. Follow its original links when authorized
@@ -72,8 +77,10 @@ paths and headings; do not search for missing technical metadata or ask users
 to supply it. Open the build inventory only for coverage questions,
 or when a maintainer needs to locate the original approved page via
 `dist_path` → `approved_path`. Source attribution is exported automatically from
-the workspace's fragment references. If the original material is
-not bundled, answer only from the visible approved content and state its limits.
+the workspace's fragment references. When relevant originals are not bundled,
+read them through authorized host tools if available and cite them separately
+from package content. If they cannot be read, stay within the approved content
+and state its limits; a link alone does not support additional claims.
 
 ## Search Fallback
 
@@ -119,7 +126,7 @@ Next useful source: <source document or page if known>.
 ```
 
 Distinguish “not evidenced by this package” from “not true.” Do not fill gaps
-from memory, previous conversations, or source files outside the package.
+from memory, previous conversations, or unread source files outside the package.
 
 ## Package Boundary
 

package/templates/package-templates.zh-CN/kb/skills/knowledge-query/SKILL.md

@@ -18,6 +18,10 @@ description: 查询 {{displayName}} 中经过审核、可追溯来源的知识
 
 ## 知识根目录
 
+若存在 `{{wikisRoot}}/imports.md`，它只列出外部入口，不代表内容已随包分发、
+已验证或已安装。仅在相关且有权访问时用宿主工具读取，并区分外部证据与包内正文；
+不能因登记了 Skill 或插件就安装、启用或执行。
+
 若存在 `{{wikisRoot}}/repo-content.md`，它是生成的仓库入口页：README 与 Skill
 简介，不是批准知识文章，也不包含全部项目文档。需要且有权访问时沿链接读取原文；
 阅读 Skill 说明不代表安装或执行。原仓库是真源，页面标明构建所用基线。
@@ -54,7 +58,7 @@ description: 查询 {{displayName}} 中经过审核、可追溯来源的知识
 | 导出的来源说明 | 原始材料可用时定位并阅读；不能只凭链接扩展结论。 |
 | 根索引和构建清单 | 包的范围和覆盖情况。 |
 
-不要根据页面同时出现来推断关系。直接引用可读路径和标题，不寻找已经移除的图谱字段，也不要求用户补齐。覆盖问题，或维护者需要通过 `dist_path` → `approved_path` 定位原批准页时，才读取构建清单。来源说明由工作区片段引用自动导出。原始材料未随包分发时，只根据已批准的可见正文回答并说明边界。
+不要根据页面同时出现来推断关系。直接引用可读路径和标题，不寻找已经移除的图谱字段，也不要求用户补齐。覆盖问题，或维护者需要通过 `dist_path` → `approved_path` 定位原批准页时，才读取构建清单。来源说明由工作区片段引用自动导出。相关原始材料未随包分发时，可通过已有授权的宿主工具读取，并与包内正文分别引用。无法读取时，只根据已批准的可见正文回答并说明边界；链接本身不能支持额外结论。
 
 ## 搜索兜底
 
@@ -87,7 +91,7 @@ node <当前 knowledge-query Skill 目录>/scripts/search.mjs --query '<关键
 下一步来源：<已知时填写来源文档或页面>。
 ```
 
-“本包没有证据”不等于“事实不成立”。禁止使用模型记忆、旧对话或包外源码填补缺口。
+“本包没有证据”不等于“事实不成立”。禁止使用模型记忆、旧对话或未读取的包外源码填补缺口。
 
 ## 包边界