@gt-fe/eap-runtime 0.0.14 → 0.0.16

package/README.md

@@ -163,7 +163,7 @@ DSL / 契约细节见 `.kiro/specs/04-runtime-core/design.md` §1.4 与 `src/gra
 |------|------|------|
 | `EAP_PREINSTALL_ROOT` | — | 预装根；也可用 `GraphLoader({ preinstallRoot })` |
 | `EAP_PRELOAD_REQUIRE_READY` | 关 | 缺 `.ready` → `runtime.preload.missing` |
-| `EAP_PRELOAD_REQUIRE_CHECKSUM` | 关 | snapshot 须含 sha256 或 artifacts |
+| `EAP_PRELOAD_REQUIRE_CHECKSUM` | 关 | snapshot 须含 sha256 或 artifacts。加载期比对文件摘要，不匹配则 warn、不中断 |
 | `EAP_PRELOAD_USER_SKILL_OVERRIDE` | 关 | `users` 优先于 `shared` |
 | `EAP_PRELOAD_VALIDATE_SKILL_IO` | 关 | 校验 Skill `inputDef.required`（`state.skillInput`） |
 | `EAP_PRELOAD_DEFINITION_CACHE` | 有预装时开 | 定义缓存；`0`/`false` 关闭，`1`/`true` 强制开 |

package/dist/api/handlers/stream.handler.js

@@ -25,7 +25,7 @@ import { TokenBudgetExhaustedError } from '../../token/token-budget-guard.js';
 import { SSEEmitter } from '../../sse/sse-emitter.js';
 import { resolveExecutionContext } from '../../governance/governance-client.js';
 import { resolveSkillInputFromInvokeInput } from '../../registry/skill-io-guard.js';
-import { ErrorCodes } from '@eap/contracts';
+import { ErrorCodes } from '@gt-fe/eap-contracts';
 import { resolveAgentSystemPromptFromLoader } from '../../registry/graph-loader.js';
 import { classifyRuntimeError } from '../../utils/http-error.js';
 import { toLoadedToolMap } from '../../tool/loaded-tool-definition.js';

package/dist/api/routes/agent.routes.d.ts

@@ -4,12 +4,12 @@
  * 生产环境由 Hosting 提供对外 HTTP；本模块供 `EAP_DEV_HTTP=1` 本地调试。
  */
 import type { ServerResponse } from 'node:http';
-import type { InvokeRequest as ContractInvokeRequest, InvokeResponse as ContractInvokeResponse } from '@eap/contracts';
+import type { InvokeRequest as ContractInvokeRequest, InvokeResponse as ContractInvokeResponse } from '@gt-fe/eap-contracts';
 import type { ITaskManager } from '../../task/task.service.js';
 import type { SessionService } from '../../session/session.service.js';
 import type { IStateGraphEngine } from '../../graph/contracts/executable-graph.js';
 import type { SSEEmitter } from '../../sse/sse-emitter.js';
-export type { InvokeConfig, InvokeResponseData } from '@eap/contracts';
+export type { InvokeConfig, InvokeResponseData } from '@gt-fe/eap-contracts';
 /**
  * dev HTTP 层 Invoke 请求（扩展 userId，Hosting 从 auth 注入）
  */

package/dist/common/types.d.ts

@@ -1,8 +1,8 @@
 /**
  * eap-runtime 内部共享类型定义
  *
- * 本文件定义 Runtime 模块内部使用的类型，与 @eap/contracts 中的公共协议类型互补但不重复。
- * - @eap/contracts 定义跨模块的公共协议（如 Task 实体、Session 实体、Agent Manifest）
+ * 本文件定义 Runtime 模块内部使用的类型，与 @gt-fe/eap-contracts 中的公共协议类型互补但不重复。
+ * - @gt-fe/eap-contracts 定义跨模块的公共协议（如 Task 实体、Session 实体、Agent Manifest）
  * - 本文件定义 Runtime 执行引擎内部流转的配置、上下文、枚举等
  */
 /**
@@ -32,7 +32,7 @@ export declare const DEFAULT_RUNTIME_CONFIG: RuntimeConfig;
 /**
  * 执行上下文 — 贯穿 Graph 执行生命周期（Runtime 内部）
  *
- * 平台级 ExecutionContext（@eap/contracts）由 Hosting/eap dev 注入；
+ * 平台级 ExecutionContext（@gt-fe/eap-contracts）由 Hosting/eap dev 注入；
  * 本类型在 Task 创建后组装，供引擎子服务使用。
  */
 export interface RuntimeRunContext {
@@ -62,7 +62,7 @@ export type TaskStatus = 'pending' | 'running' | 'waiting_hitl' | 'success' | 'f
 /**
  * Runtime 执行上下文绑定状态（非平台 Session 生命周期）
  *
- * 平台 Session 三态（active/paused/closed）由 Hosting 管理，见 @eap/contracts。
+ * 平台 Session 三态（active/paused/closed）由 Hosting 管理，见 @gt-fe/eap-contracts。
  * Runtime 仅在引擎内标记执行上下文是否仍可绑定：`active` | `archived`。
  */
 export type ExecutionSessionBindingStatus = 'active' | 'archived';
@@ -77,7 +77,7 @@ export type MessageRole = 'user' | 'assistant' | 'system' | 'tool';
 /**
  * 单次 LLM/Tool 调用的 Token 消耗记录
  *
- * 与 @eap/contracts.TokenUsage 的区别：
+ * 与 @gt-fe/eap-contracts.TokenUsage 的区别：
  * - contracts 版本是 Task 级聚合结果（含 byNode/byModel）
  * - 本类型是单次调用粒度的原始记录，用于 Runtime 内部累计和 stats.node_token 事件
  */

package/dist/common/types.js

@@ -1,8 +1,8 @@
 /**
  * eap-runtime 内部共享类型定义
  *
- * 本文件定义 Runtime 模块内部使用的类型，与 @eap/contracts 中的公共协议类型互补但不重复。
- * - @eap/contracts 定义跨模块的公共协议（如 Task 实体、Session 实体、Agent Manifest）
+ * 本文件定义 Runtime 模块内部使用的类型，与 @gt-fe/eap-contracts 中的公共协议类型互补但不重复。
+ * - @gt-fe/eap-contracts 定义跨模块的公共协议（如 Task 实体、Session 实体、Agent Manifest）
  * - 本文件定义 Runtime 执行引擎内部流转的配置、上下文、枚举等
  */
 /** RuntimeConfig 默认值 */

package/dist/contracts/permission-checker.d.ts

@@ -1,7 +1,7 @@
 /**
  * 权限校验器接口（对齐 06-governance R16.8）
  */
-import type { ExecutionContext, GovernancePermissionCheckParams, GovernancePermissionCheckResult } from '@eap/contracts';
+import type { ExecutionContext, GovernancePermissionCheckParams, GovernancePermissionCheckResult } from '@gt-fe/eap-contracts';
 /**
  * IPermissionChecker — Runtime 执行期权限校验
  */

package/dist/governance/governance-client.d.ts

@@ -1,7 +1,7 @@
 /**
  * 治理服务 HTTP 客户端（06-governance validateToken / checkPermission）
  */
-import type { ExecutionContext, GovernancePermissionCheckParams, GovernancePermissionCheckResult } from '@eap/contracts';
+import type { ExecutionContext, GovernancePermissionCheckParams, GovernancePermissionCheckResult } from '@gt-fe/eap-contracts';
 export interface HttpGovernanceClientOptions {
     baseUrl: string;
     timeout?: number;

package/dist/governance/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * 权限校验 — 对齐 06-governance R16.8
  */
-export type { CallerType, ExecutionContext, GovernancePermissionCheckParams, GovernancePermissionCheckResult, PermissionAction, PermissionDenyReason, PermissionResourceType, } from '@eap/contracts';
+export type { CallerType, ExecutionContext, GovernancePermissionCheckParams, GovernancePermissionCheckResult, PermissionAction, PermissionDenyReason, PermissionResourceType, } from '@gt-fe/eap-contracts';
 export type { IGovernanceClient } from './governance-client.js';
 export { HttpGovernanceClient, AllowAllGovernanceClient, resolveExecutionContext, } from './governance-client.js';
 export { assertToolPermission, assertSkillPermission, permissionMessage, PermissionDeniedError, GovernanceUnavailableError, } from './permission-guard.js';

package/dist/governance/permission-guard.d.ts

@@ -1,7 +1,7 @@
 /**
  * 执行期 Tool 权限守卫
  */
-import type { ExecutionContext, PermissionDenyReason } from '@eap/contracts';
+import type { ExecutionContext, PermissionDenyReason } from '@gt-fe/eap-contracts';
 import type { IGovernanceClient } from './governance-client.js';
 export declare class GovernanceUnavailableError extends Error {
     readonly reason: PermissionDenyReason;

package/dist/graph/adapters/langgraph.adapter.js

@@ -26,7 +26,7 @@ import { resolveGraphPrompt } from '../resolve-graph-prompt.js';
 import { hydrateMcpTools, MCP_LIST_TOOL_NAME } from '../../tool/mcp-list.js';
 import { SkillAuditRecorder } from '../skill-audit-recorder.js';
 import { preloadSkillNotFound } from '../../registry/preload-errors.js';
-import { AppError, ErrorCodes } from '@eap/contracts';
+import { AppError, ErrorCodes } from '@gt-fe/eap-contracts';
 import { pickContextFields } from '../../token/context-window.js';
 import { isHitlDecision, lastAssistantHasUnansweredToolCalls } from '../hitl/hitl-handler.js';
 import { classifySkillRead } from './skill-read.js';

package/dist/graph/contracts/executable-graph.d.ts

@@ -2,17 +2,17 @@
  * Executable Graph 类型定义
  *
  * 定义 Graph 引擎核心的可执行图、DSL、节点、边等类型。
- * 与 @eap/contracts 的 GraphDSL 基础类型互补，在 Runtime 层提供更丰富的类型支持。
+ * 与 @gt-fe/eap-contracts 的 GraphDSL 基础类型互补，在 Runtime 层提供更丰富的类型支持。
  *
  * @see design.md §1.4 StateGraph Contract
  * @see requirements.md Requirement 1 AC1-AC2
  */
-import type { GraphDSL as BaseGraphDSL, GraphNode as BaseGraphNode, GraphEdge as BaseGraphEdge, GraphNodeType, GraphConfig } from '@eap/contracts';
+import type { GraphDSL as BaseGraphDSL, GraphNode as BaseGraphNode, GraphEdge as BaseGraphEdge, GraphNodeType, GraphConfig } from '@gt-fe/eap-contracts';
 export type { GraphNodeType, GraphConfig };
 /**
  * RuntimeGraphConfig — Runtime 层扩展的 Graph 配置
  *
- * 在 @eap/contracts GraphConfig 基础上增加 Runtime 执行所需的 maxRetries。
+ * 在 @gt-fe/eap-contracts GraphConfig 基础上增加 Runtime 执行所需的 maxRetries。
  */
 export interface RuntimeGraphConfig extends GraphConfig {
     /** Graph 级默认重试次数（节点级 retry 可覆盖） */
@@ -21,7 +21,7 @@ export interface RuntimeGraphConfig extends GraphConfig {
 /**
  * GraphNode — Runtime 层扩展的节点定义
  *
- * 继承 @eap/contracts 基础 GraphNode，增加 Runtime 执行所需的字段：
+ * 继承 @gt-fe/eap-contracts 基础 GraphNode，增加 Runtime 执行所需的字段：
  * - 重试配置（节点级 maxRetries + 退避策略）
  * - HITL 标记（interrupt_before / interrupt_after）
  * - 描述信息（调试/Trace 用）
@@ -79,7 +79,7 @@ export interface ConditionalBranch {
 /**
  * GraphDSL — Runtime 层扩展的声明式工作流定义
  *
- * 扩展 @eap/contracts 的 BaseGraphDSL，增加条件路由、入口/终止节点等。
+ * 扩展 @gt-fe/eap-contracts 的 BaseGraphDSL，增加条件路由、入口/终止节点等。
  */
 export interface GraphDSL extends Omit<BaseGraphDSL, 'config' | 'nodes' | 'edges'> {
     /** 覆盖节点类型为 Runtime 扩展版本 */
@@ -163,7 +163,7 @@ export interface ExecutableGraph {
     /** 底层引擎内部实例引用（opaque，由 adapter 管理） */
     _engineInstance?: unknown;
 }
-import type { ExecutionContext as PlatformExecutionContext } from '@eap/contracts';
+import type { ExecutionContext as PlatformExecutionContext } from '@gt-fe/eap-contracts';
 /**
  * GraphState — 传入 stream/invoke 的上下文数据
  */

package/dist/graph/contracts/executable-graph.js

@@ -2,7 +2,7 @@
  * Executable Graph 类型定义
  *
  * 定义 Graph 引擎核心的可执行图、DSL、节点、边等类型。
- * 与 @eap/contracts 的 GraphDSL 基础类型互补，在 Runtime 层提供更丰富的类型支持。
+ * 与 @gt-fe/eap-contracts 的 GraphDSL 基础类型互补，在 Runtime 层提供更丰富的类型支持。
  *
  * @see design.md §1.4 StateGraph Contract
  * @see requirements.md Requirement 1 AC1-AC2

package/dist/index.d.ts

@@ -16,7 +16,7 @@ export * from './common/index.js';
 export * from './registry/index.js';
 export * from './providers/index.js';
 export type { ITraceCollector, TraceEvent, TraceSession, ExecutionFlowEvent, ExecutionNodeEvent, TraceLinkEvent, TraceLinkNodeEvent, } from './contracts/trace-collector.js';
-export type { ExecutionContext, CallerType, GovernancePermissionCheckParams, GovernancePermissionCheckResult, PermissionDenyReason, } from '@eap/contracts';
+export type { ExecutionContext, CallerType, GovernancePermissionCheckParams, GovernancePermissionCheckResult, PermissionDenyReason, } from '@gt-fe/eap-contracts';
 export { HttpGovernanceClient, AllowAllGovernanceClient, resolveExecutionContext, assertToolPermission, assertSkillPermission, permissionMessage, PermissionDeniedError, GovernanceUnavailableError, } from './governance/index.js';
 export type { IGovernanceClient } from './governance/index.js';
 export { FileLlmTurnLog, InMemoryLlmTurnLog, createFileLlmTurnLogFromEnv, maskApiKey, resolveLlmTurnDir, } from './debug/llm-turn-log.js';

package/dist/providers/local-llm-provider.d.ts

@@ -4,7 +4,7 @@
  */
 import type { ILLMProvider } from '../graph/nodes/llm-node.js';
 import type { ILlmTurnLog } from '../debug/llm-turn-log.js';
-import { type ModelCallDefaults } from '@eap/contracts';
+import { type ModelCallDefaults } from '@gt-fe/eap-contracts';
 export interface LocalLlmConnection {
     baseUrl: string;
     apiKey: string;

package/dist/providers/local-llm-provider.js

@@ -2,7 +2,7 @@
  * 本地多模型 LLM：按节点 model 选网关。仅 dev。
  * 连接表里只带 apiKeyEnv，密钥从 process.env 读取，不进 JSON。
  */
-import { mergeModelCallParams } from '@eap/contracts';
+import { mergeModelCallParams } from '@gt-fe/eap-contracts';
 import { HttpLLMProvider } from './http-llm-provider.js';
 function parseTimeoutMs(value) {
     if (typeof value !== 'number' || !Number.isFinite(value) || value < 1000)

package/dist/providers/routing-llm-provider.js

@@ -11,7 +11,7 @@
  * - 支持任意 OpenAI 兼容 API（OpenAI / DeepSeek / 本地 Ollama 等）
  * - 连接配置由 Foundation 统一管理，Runtime 无感知
  */
-import { mergeModelCallParams } from '@eap/contracts';
+import { mergeModelCallParams } from '@gt-fe/eap-contracts';
 import { EchoLLMProvider } from './echo-llm-provider.js';
 import { DEFAULT_LLM_HTTP_TIMEOUT_MS, HttpLLMProvider } from './http-llm-provider.js';
 export class RoutingLLMProvider {

package/dist/registry/agent-models.d.ts

@@ -1 +1 @@
-export { resolveDeclaredModels, resolveAgentDefaultModel, resolveAgentModelAllowlist, } from '@eap/contracts';
+export { resolveDeclaredModels, resolveAgentDefaultModel, resolveAgentModelAllowlist, } from '@gt-fe/eap-contracts';

package/dist/registry/agent-models.js

@@ -1 +1 @@
-export { resolveDeclaredModels, resolveAgentDefaultModel, resolveAgentModelAllowlist, } from '@eap/contracts';
+export { resolveDeclaredModels, resolveAgentDefaultModel, resolveAgentModelAllowlist, } from '@gt-fe/eap-contracts';

package/dist/registry/agent-registry-client.d.ts

@@ -1,7 +1,7 @@
 /**
  * Agent Registry 客户端 — 从 foundation-service 拉取 Agent 定义
  */
-/** Agent 清单（与 @eap/contracts AgentManifest 对齐） */
+/** Agent 清单（与 @gt-fe/eap-contracts AgentManifest 对齐） */
 export interface AgentManifest {
     id: string;
     name: string;

package/dist/registry/deployment-snapshot.js

@@ -13,10 +13,11 @@ import { readdir, readFile, access } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { constants as fsConstants } from 'node:fs';
-import { parseSkillMd } from '@eap/contracts';
+import { parseSkillMd } from '@gt-fe/eap-contracts';
 import { findSkillEntryFile } from './skill-tree.js';
 import { preloadMissing, preloadPackageCorrupt, } from './preload-errors.js';
 import { isRequireChecksum, resolvePreloadBehaviorFlags, } from './preload-flags.js';
+import { emitRuntimeLog } from '../common/logger.js';
 async function pathExists(p) {
     try {
         await access(p, fsConstants.F_OK);
@@ -115,17 +116,19 @@ async function findDigestMatch(items, expectedRaw) {
     }
     return undefined;
 }
-async function assertDigestMatch(expectedRaw, actualHex, label, details) {
+async function warnIfDigestMismatch(expectedRaw, actualHex, label, details) {
     const expected = normalizeDigest(expectedRaw);
     if (!expected)
         return;
-    if (expected !== actualHex.toLowerCase()) {
-        throw preloadPackageCorrupt(`预装校验和不匹配: ${label}`, {
-            expected,
-            actual: actualHex.toLowerCase(),
-            ...details,
-        });
-    }
+    const actual = actualHex.toLowerCase();
+    if (expected === actual)
+        return;
+    emitRuntimeLog('warn', 'preload', `预装校验和不匹配: ${label}`, {
+        event: 'runtime.preload.digest_mismatch',
+        expected,
+        actual,
+        ...details,
+    });
 }
 async function pickLatestVersionDir(parent) {
     if (!(await pathExists(parent)))
@@ -358,10 +361,14 @@ export class FileSystemDeploymentSnapshot {
                 const raw = (await readTextFile(pkgFile))?.trim() ?? '';
                 const fileDigest = normalizeDigest(raw);
                 if (!fileDigest) {
-                    throw preloadPackageCorrupt(`.package.sha256 内容非法`, { path: pkgFile });
+                    emitRuntimeLog('warn', 'preload', '.package.sha256 内容非法', {
+                        event: 'runtime.preload.digest_mismatch',
+                        path: pkgFile,
+                    });
                 }
-                if (fileDigest !== expectedPkg) {
-                    throw preloadPackageCorrupt(`snapshot.sha256 与 .package.sha256 不一致（以 snapshot 为准核对）`, {
+                else if (fileDigest !== expectedPkg) {
+                    emitRuntimeLog('warn', 'preload', 'snapshot.sha256 与 .package.sha256 不一致', {
+                        event: 'runtime.preload.digest_mismatch',
                         expected: expectedPkg,
                         actual: fileDigest,
                         path: pkgFile,
@@ -387,7 +394,7 @@ export class FileSystemDeploymentSnapshot {
                 throw preloadPackageCorrupt(`artifacts 指向的文件不存在: ${rel}`, { path: full });
             }
             const actual = await sha256OfFile(full);
-            await assertDigestMatch(expected, actual, `artifact ${rel}`, { path: full });
+            await warnIfDigestMismatch(expected, actual, `artifact ${rel}`, { path: full });
         }
     }
     async resolveAgentDir(agentCode, version) {
@@ -492,7 +499,7 @@ export class FileSystemDeploymentSnapshot {
             if (ref.sha256) {
                 const matched = await findDigestMatch(existingManifests, ref.sha256);
                 if (!matched) {
-                    await assertDigestMatch(ref.sha256, await sha256OfFile(existingManifests[0].path), `tool ${ref.name}`, { path: existingManifests[0].path });
+                    await warnIfDigestMismatch(ref.sha256, await sha256OfFile(existingManifests[0].path), `tool ${ref.name}`, { path: existingManifests[0].path });
                 }
                 chosen = matched ?? existingManifests[0];
             }
@@ -564,9 +571,12 @@ export class FileSystemDeploymentSnapshot {
                 continue;
             const isUserOverridePath = bundlePath.includes('/users/') || bundlePath.includes('\\users\\');
             const isAuthorOverlay = extraRoots.some((root) => root && isPathInside(root, bundlePath));
-            if (ref.sha256 && !isUserOverridePath && !isAuthorOverlay && manifestPath.endsWith('.json')) {
+            if (ref.sha256 &&
+                !isUserOverridePath &&
+                !isAuthorOverlay &&
+                manifestPath.endsWith('.json')) {
                 const actual = await sha256OfFile(manifestPath);
-                await assertDigestMatch(ref.sha256, actual, `skill ${ref.skillId}`, { path: manifestPath });
+                await warnIfDigestMismatch(ref.sha256, actual, `skill ${ref.skillId}`, { path: manifestPath });
             }
             const skillId = String(ref.skillId);
             return {

package/dist/registry/graph-loader.d.ts

@@ -7,7 +7,7 @@
 import type { GraphDSL } from '../graph/contracts/executable-graph.js';
 import type { AgentRegistryClient } from './agent-registry-client.js';
 import type { DeploymentContext } from '../tool/tool-execution-router.js';
-import type { ILocalToolInstallStore } from '@eap/contracts';
+import type { ILocalToolInstallStore } from '@gt-fe/eap-contracts';
 import { type LoadedToolDefinition } from '../tool/loaded-tool-definition.js';
 import type { LoadedSkillInfo } from '../tool/system-prompt-builder.js';
 import { type IDeploymentSnapshot } from './deployment-snapshot.js';

package/dist/registry/preload-errors.d.ts

@@ -1,7 +1,7 @@
 /**
  * 预装加载错误 — 对齐 runtime.preload.* / 联调契约
  */
-import { AppError, type ErrorCode } from '@eap/contracts';
+import { AppError, type ErrorCode } from '@gt-fe/eap-contracts';
 export declare function preloadError(code: ErrorCode, message: string, details?: unknown): AppError;
 export declare function preloadMissing(message: string, details?: unknown): AppError;
 export declare function preloadManifestNotFound(message: string, details?: unknown): AppError;

package/dist/registry/preload-errors.js

@@ -1,7 +1,7 @@
 /**
  * 预装加载错误 — 对齐 runtime.preload.* / 联调契约
  */
-import { AppError, ErrorCodes } from '@eap/contracts';
+import { AppError, ErrorCodes } from '@gt-fe/eap-contracts';
 export function preloadError(code, message, details) {
     return new AppError(code, message, {
         exposeMessage: true,

package/dist/registry/preload-flags.d.ts

@@ -5,7 +5,7 @@
  * |------|------|------|
  * | EAP_PRELOAD_REQUIRE_READY | 关 | 强制校验 .ready |
  * | EAP_PRELOAD_VALIDATE_SKILL_IO | **开** | 执行子图前校验 skill inputDef.required；`0`/`false` 关闭 |
- * | EAP_PRELOAD_REQUIRE_CHECKSUM | 关 | snapshot 必须带 sha256 或 artifacts[] |
+ * | EAP_PRELOAD_REQUIRE_CHECKSUM | 关 | snapshot 必须带 sha256 或 artifacts[]（字段存在性）。加载期摘要不匹配为 warn |
  * | EAP_PRELOAD_DEFINITION_CACHE | 有预装时开 | 进程内定义缓存；`0`/`false` 关闭 |
  * | EAP_SKILL_HOT_RELOAD | **dev 开 / server 关** | 已装配 Skill 的目录 mtime 变化则丢缓存；未写入装配名单的目录不进清单 |
  * | EAP_LOCAL_SKILLS_DIR | 关 | 开发态作者源 Skill 根；查找优先于 preinstall，低于 users/ |

package/dist/registry/preload-flags.js

@@ -5,7 +5,7 @@
  * |------|------|------|
  * | EAP_PRELOAD_REQUIRE_READY | 关 | 强制校验 .ready |
  * | EAP_PRELOAD_VALIDATE_SKILL_IO | **开** | 执行子图前校验 skill inputDef.required；`0`/`false` 关闭 |
- * | EAP_PRELOAD_REQUIRE_CHECKSUM | 关 | snapshot 必须带 sha256 或 artifacts[] |
+ * | EAP_PRELOAD_REQUIRE_CHECKSUM | 关 | snapshot 必须带 sha256 或 artifacts[]（字段存在性）。加载期摘要不匹配为 warn |
  * | EAP_PRELOAD_DEFINITION_CACHE | 有预装时开 | 进程内定义缓存；`0`/`false` 关闭 |
  * | EAP_SKILL_HOT_RELOAD | **dev 开 / server 关** | 已装配 Skill 的目录 mtime 变化则丢缓存；未写入装配名单的目录不进清单 |
  * | EAP_LOCAL_SKILLS_DIR | 关 | 开发态作者源 Skill 根；查找优先于 preinstall，低于 users/ |

package/dist/registry/skill-io-guard.js

@@ -1,7 +1,7 @@
 /**
  * Skill inputDef / outputDef 轻量校验（默认开启；EAP_PRELOAD_VALIDATE_SKILL_IO=0 关闭）
  */
-import { AppError, ErrorCodes } from '@eap/contracts';
+import { AppError, ErrorCodes } from '@gt-fe/eap-contracts';
 import { isValidateSkillIo } from './preload-flags.js';
 function asRecord(value) {
     if (value && typeof value === 'object' && !Array.isArray(value)) {

package/dist/registry/skill-tree.js

@@ -10,7 +10,7 @@ import { readdir, stat, access, readFile } from 'node:fs/promises';
 import { watch } from 'node:fs';
 import { constants as fsConstants } from 'node:fs';
 import path from 'node:path';
-import { SKILL_ENTRY_CANDIDATES } from '@eap/contracts';
+import { SKILL_ENTRY_CANDIDATES } from '@gt-fe/eap-contracts';
 const SKILL_CODE = /^[a-z0-9][a-z0-9-]*$/;
 async function exists(p) {
     try {

package/dist/runtime/agent-runtime.js

@@ -13,7 +13,7 @@ import { toLoadedSkillMap } from '../tool/system-prompt-builder.js';
 import { assembleLoadedTools } from '../tool/harness-primitives.js';
 import { createFileLlmTurnLogFromEnv, } from '../debug/llm-turn-log.js';
 import { buildHitlWaitingTaskOutput, buildTurnGraphMessages, buildTurnTranscriptFromStreamEvents, extractHitlThreadId, extractStreamReasoning, extractStreamTextDelta, messageRecordsToGraphMessages, persistHitlWaitingPlaceholder, persistTurnTranscript, persistUserTurnMessage, } from '../session/persist-turn-messages.js';
-import { AppError, ErrorCodes } from '@eap/contracts';
+import { AppError, ErrorCodes } from '@gt-fe/eap-contracts';
 import { resolveExecutionContext } from '../governance/governance-client.js';
 import { resolveAgentCode } from '../common/agent-code.js';
 import { resolveTraceId } from '../common/trace-id.js';

package/dist/runtime/types.d.ts

@@ -6,7 +6,7 @@
  *
  * @see 04-runtime-core/design.md §1.5
  */
-import type { ExecutionContext, InvokeConfig, ResumeHitlResult } from '@eap/contracts';
+import type { ExecutionContext, InvokeConfig, ResumeHitlResult } from '@gt-fe/eap-contracts';
 import type { InvokeResponseData } from '../api/routes/agent.routes.js';
 import type { GraphMessage } from '../graph/contracts/executable-graph.js';
 import type { SSEEvent } from '../sse/contracts/sse-emitter.contract.js';
@@ -31,7 +31,7 @@ export interface ExecuteParams {
 }
 /** 同步执行结果 */
 export type ExecuteResult = InvokeResponseData;
-/** HITL 恢复结果（与 @eap/contracts ResumeHitlResult 对齐） */
+/** HITL 恢复结果（与 @gt-fe/eap-contracts ResumeHitlResult 对齐） */
 export type { ResumeHitlResult };
 /** HITL 用户响应 */
 export interface HitlResponse {

package/dist/server.js

@@ -7,7 +7,7 @@
  * TODO: Phase 2 将本文件迁移至 dev-tools/cli（作为 `eap dev` 命令实现），
  *       runtime 包不再包含 HTTP 服务代码，仅作为纯库导出。
  */
-import { ErrorCodes } from '@eap/contracts';
+import { ErrorCodes } from '@gt-fe/eap-contracts';
 import { createServer } from 'node:http';
 import { URL } from 'node:url';
 import { resolveExecutionContext } from './governance/index.js';

package/dist/sse/events/skill-events.d.ts

@@ -6,7 +6,7 @@
  * - skill.started / skill.completed / skill.failed（子图执行生命周期）
  *
  * @see design.md §1.6 SSE事件协议定义
- * @see @eap/contracts OPTIONAL_SSE_EVENTS
+ * @see @gt-fe/eap-contracts OPTIONAL_SSE_EVENTS
  */
 /** 技能匹配成功 */
 export interface SkillMatchedPayload {

package/dist/sse/events/skill-events.js

@@ -6,6 +6,6 @@
  * - skill.started / skill.completed / skill.failed（子图执行生命周期）
  *
  * @see design.md §1.6 SSE事件协议定义
- * @see @eap/contracts OPTIONAL_SSE_EVENTS
+ * @see @gt-fe/eap-contracts OPTIONAL_SSE_EVENTS
  */
 export {};

package/dist/tool/create-tool-executor.d.ts

@@ -5,7 +5,7 @@
  * `EAP_TOOL_GATEWAY_TRANSPORT=http` 时用 HttpToolExecutor（仅调试）。
  * desktop 经 ToolExecutionRouter 分流 Local / Gateway。
  */
-import type { ILocalToolInstallStore, LocalToolInstallRecord } from '@eap/contracts';
+import type { ILocalToolInstallStore, LocalToolInstallRecord } from '@gt-fe/eap-contracts';
 import { type DeploymentContext } from './tool-execution-router.js';
 import type { IToolExecutor } from './tool-executor.interface.js';
 export declare class EmptyInstallStore implements ILocalToolInstallStore {

package/dist/tool/dev-http-executor.d.ts

@@ -1,6 +1,6 @@
 /**
  * Dev 下按 type:http 清单直连出站（gateway.baseUrl + pathTemplate）。
- * URL 拼接与 host 白名单与 Tool Gateway 共用 @eap/contracts http-outbound。
+ * URL 拼接与 host 白名单与 Tool Gateway 共用 @gt-fe/eap-contracts http-outbound。
  */
 import type { IToolExecutor, ToolCallRequest, ToolCallResult } from './tool-executor.interface.js';
 export interface DevHttpExecution {

package/dist/tool/dev-http-executor.js

@@ -1,8 +1,8 @@
 /**
  * Dev 下按 type:http 清单直连出站（gateway.baseUrl + pathTemplate）。
- * URL 拼接与 host 白名单与 Tool Gateway 共用 @eap/contracts http-outbound。
+ * URL 拼接与 host 白名单与 Tool Gateway 共用 @gt-fe/eap-contracts http-outbound。
  */
-import { assertHttpHostAllowlisted, buildHttpToolUrl as buildSharedHttpToolUrl, ErrorCodes } from '@eap/contracts';
+import { assertHttpHostAllowlisted, buildHttpToolUrl as buildSharedHttpToolUrl, ErrorCodes } from '@gt-fe/eap-contracts';
 import { abortOrTimeoutMessage, DEFAULT_HTTP_TOOL_TIMEOUT_SEC, isAbortError, resolveToolTimeoutSec, toToolTimeoutMs, } from './timeout.js';
 export function resolveHttpExecutionFromRequest(request) {
     const raw = request.execution;

package/dist/tool/dev-mcp-executor.d.ts

@@ -17,7 +17,7 @@
  * @see docs/workflows/local-agent-dev-loop.md
  * @see runtime/src/tool/local-mcp-client.ts
  */
-import { type McpRuntimeExecution } from '@eap/contracts';
+import { type McpRuntimeExecution } from '@gt-fe/eap-contracts';
 import { type ILocalMcpClient } from './local-mcp-client.js';
 import type { IToolExecutor, McpListedTool, ToolCallRequest, ToolCallResult } from './tool-executor.interface.js';
 export interface DevMcpExecutorOptions {

package/dist/tool/dev-mcp-executor.js

@@ -17,7 +17,7 @@
  * @see docs/workflows/local-agent-dev-loop.md
  * @see runtime/src/tool/local-mcp-client.ts
  */
-import { ErrorCodes } from '@eap/contracts';
+import { ErrorCodes } from '@gt-fe/eap-contracts';
 import { isAbortError } from './timeout.js';
 import { LocalMcpClient } from './local-mcp-client.js';
 export class DevMcpExecutor {

package/dist/tool/harness-primitives.js

@@ -11,7 +11,7 @@ import { spawn } from 'node:child_process';
 import { constants as fsConstants, existsSync, realpathSync } from 'node:fs';
 import { mkdir, open, readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { BUILTIN_TOOL_SOURCE, DEFAULT_BUILTIN_TIMEOUT_MS, MAX_BUILTIN_TIMEOUT_MS, clampBuiltinTimeout, isBuiltinToolExecution, resolveBuiltinToolsConfig, } from '@eap/contracts';
+import { BUILTIN_TOOL_SOURCE, DEFAULT_BUILTIN_TIMEOUT_MS, MAX_BUILTIN_TIMEOUT_MS, clampBuiltinTimeout, isBuiltinToolExecution, resolveBuiltinToolsConfig, } from '@gt-fe/eap-contracts';
 import { ensureInterpreterShims, formatSpawnError, killProcessTree, resolveShellSpawn, sandboxEnv, spawnOptionsFor, substituteSkillDir, } from './harness-command.js';
 import { expandSkillScriptRefs, isSkillEntryFile } from './skill-script-refs.js';
 function builtinConfig() {

package/dist/tool/http-tool-executor.js

@@ -4,7 +4,7 @@
  * @see docs/contracts/tool-execution.md §2
  * @see docs/contracts/cross-service-api.md §4.6
  */
-import { ErrorCodes } from '@eap/contracts';
+import { ErrorCodes } from '@gt-fe/eap-contracts';
 import { abortOrTimeoutMessage, isAbortError } from './timeout.js';
 function mapGatewayHttpError(status, body, statusText) {
     const code = body?.error?.code;

package/dist/tool/local-mcp-client.d.ts

@@ -4,7 +4,7 @@
  * mcp-data-service 等上游要求 HTTP 头 `userId`（或 query），再注入 `params._meta.userId`。
  * 身份优先来自 Runtime ExecutionContext（Token.sub）；manifest header.userId 作兜底。
  */
-import type { McpRuntimeExecution } from '@eap/contracts';
+import type { McpRuntimeExecution } from '@gt-fe/eap-contracts';
 import { type FileArtifact } from './file-artifact.js';
 import type { McpListedTool } from './tool-executor.interface.js';
 export interface LocalMcpInvokeContext {

package/dist/tool/local-tool-executor.d.ts

@@ -4,7 +4,7 @@
  * 优先 ILocalToolInstallStore；若无安装记录但 request.execution 带
  * 或 request.execution 带可解析的 code bundlePath+handler，则直接本机执行。
  */
-import type { ILocalToolInstallStore } from '@eap/contracts';
+import type { ILocalToolInstallStore } from '@gt-fe/eap-contracts';
 import type { IToolExecutor, McpListedTool, ToolCallRequest, ToolCallResult } from './tool-executor.interface.js';
 import { type ILocalMcpClient } from './local-mcp-client.js';
 export interface LocalToolExecutorOptions {

package/dist/tool/local-tool-executor.js

@@ -7,7 +7,7 @@
 import { spawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
-import { ErrorCodes, resolveReadyInstallByToolName, resolveMcpExecutionFromInstall, resolveCodeHandlerFromInstall, } from '@eap/contracts';
+import { ErrorCodes, resolveReadyInstallByToolName, resolveMcpExecutionFromInstall, resolveCodeHandlerFromInstall, } from '@gt-fe/eap-contracts';
 import { isAbortError, toToolTimeoutMs, toolTimeoutErrorMessage } from './timeout.js';
 import { fileArtifactFromToolOutput, fileBasesFromEnv } from './file-artifact.js';
 import { LocalMcpClient } from './local-mcp-client.js';

package/dist/tool/mcp-tool-executor.js

@@ -3,7 +3,7 @@
  *
  * @see docs/contracts/tool-execution.md §2.0
  */
-import { ErrorCodes } from '@eap/contracts';
+import { ErrorCodes } from '@gt-fe/eap-contracts';
 import { abortOrTimeoutMessage, isAbortError } from './timeout.js';
 import { nextListCursor, parseListedTools } from './mcp-list.js';
 function resolveAgentCode(request) {

package/dist/tool/timeout.d.ts

@@ -1,7 +1,7 @@
 /**
  * Tool / toolset `timeout`：秒。
- * 与 `@eap/contracts` `src/tool/timeout.ts` 同语义；Runtime 钉的是 contracts 0.0.9，
- * 尚未含这些导出。发版 contracts 后改为从 `@eap/contracts` 引用。
+ * 与 `@gt-fe/eap-contracts` `src/tool/timeout.ts` 同语义；Runtime 钉的是 contracts 0.0.9，
+ * 尚未含这些导出。发版 contracts 后改为从 `@gt-fe/eap-contracts` 引用。
  */
 export declare const DEFAULT_TOOL_TIMEOUT_SEC = 30;
 export declare const DEFAULT_HTTP_TOOL_TIMEOUT_SEC = 10;

package/dist/tool/timeout.js

@@ -1,7 +1,7 @@
 /**
  * Tool / toolset `timeout`：秒。
- * 与 `@eap/contracts` `src/tool/timeout.ts` 同语义；Runtime 钉的是 contracts 0.0.9，
- * 尚未含这些导出。发版 contracts 后改为从 `@eap/contracts` 引用。
+ * 与 `@gt-fe/eap-contracts` `src/tool/timeout.ts` 同语义；Runtime 钉的是 contracts 0.0.9，
+ * 尚未含这些导出。发版 contracts 后改为从 `@gt-fe/eap-contracts` 引用。
  */
 export const DEFAULT_TOOL_TIMEOUT_SEC = 30;
 export const DEFAULT_HTTP_TOOL_TIMEOUT_SEC = 10;

package/dist/tool/tool-execution-router.d.ts

@@ -5,7 +5,7 @@
  * @see design.md §1.8.7
  */
 import type { IToolExecutor, McpListedTool, ToolCallRequest } from './tool-executor.interface.js';
-import type { ILocalToolInstallStore } from '@eap/contracts';
+import type { ILocalToolInstallStore } from '@gt-fe/eap-contracts';
 export type DeploymentContext = 'server' | 'desktop' | 'dev';
 export interface ToolExecutionRouterOptions {
     httpExecutor: IToolExecutor;

package/dist/tool/tool-execution-router.js

@@ -4,7 +4,7 @@
  * @see docs/contracts/tool-execution.md §6
  * @see design.md §1.8.7
  */
-import { resolveReadyInstallByToolName } from '@eap/contracts';
+import { resolveReadyInstallByToolName } from '@gt-fe/eap-contracts';
 import { isLocalPreferredExecution } from './local-tool-executor.js';
 export class ToolExecutionRouter {
     options;

package/dist/tool/tool-orchestrator.d.ts

@@ -4,7 +4,7 @@
  * @see design.md §1.1 Tool调用编排
  * @see requirements.md Requirement 8 AC1, AC3
  */
-import { type ExecutionContext } from '@eap/contracts';
+import { type ExecutionContext } from '@gt-fe/eap-contracts';
 import type { IGovernanceClient } from '../governance/governance-client.js';
 export type { AuthContext, ToolCallRequest, ToolCallResult, LLMToolCall, LLMToolCallResponse, IToolExecutor, } from './tool-executor.interface.js';
 import type { AuthContext, ToolCallRequest, ToolCallResult, LLMToolCallResponse, IToolExecutor } from './tool-executor.interface.js';

package/dist/tool/tool-orchestrator.js

@@ -4,7 +4,7 @@
  * @see design.md §1.1 Tool调用编排
  * @see requirements.md Requirement 8 AC1, AC3
  */
-import { isBuiltinToolExecution } from '@eap/contracts';
+import { isBuiltinToolExecution } from '@gt-fe/eap-contracts';
 import { assertToolPermission, GovernanceUnavailableError, PermissionDeniedError, } from '../governance/permission-guard.js';
 /**
  * ToolOrchestrator — Tool 调用编排主服务

package/dist/utils/format-error.d.ts

@@ -1,4 +1,4 @@
 /**
- * 将未知异常格式化为可读字符串 — 委托 @eap/contracts
+ * 将未知异常格式化为可读字符串 — 委托 @gt-fe/eap-contracts
  */
-export { formatUnknownError } from '@eap/contracts';
+export { formatUnknownError } from '@gt-fe/eap-contracts';

package/dist/utils/format-error.js

@@ -1,4 +1,4 @@
 /**
- * 将未知异常格式化为可读字符串 — 委托 @eap/contracts
+ * 将未知异常格式化为可读字符串 — 委托 @gt-fe/eap-contracts
  */
-export { formatUnknownError } from '@eap/contracts';
+export { formatUnknownError } from '@gt-fe/eap-contracts';

package/dist/utils/http-error.d.ts

@@ -1,7 +1,7 @@
 /**
- * Runtime HTTP 错误出口 — 对齐 @eap/contracts ErrorCodes / AppError
+ * Runtime HTTP 错误出口 — 对齐 @gt-fe/eap-contracts ErrorCodes / AppError
  */
-import { type ErrorCode, type AppError } from '@eap/contracts';
+import { type ErrorCode, type AppError } from '@gt-fe/eap-contracts';
 import type { ServerResponse } from 'node:http';
 /** 公共 classify；连接失败不再误标为 GOVERNANCE_UNAVAILABLE */
 export declare function classifyRuntimeError(error: unknown): AppError;

package/dist/utils/http-error.js

@@ -1,7 +1,7 @@
 /**
- * Runtime HTTP 错误出口 — 对齐 @eap/contracts ErrorCodes / AppError
+ * Runtime HTTP 错误出口 — 对齐 @gt-fe/eap-contracts ErrorCodes / AppError
  */
-import { classifyError, formatUnknownError, ErrorCodes, } from '@eap/contracts';
+import { classifyError, formatUnknownError, ErrorCodes, } from '@gt-fe/eap-contracts';
 /** 公共 classify；连接失败不再误标为 GOVERNANCE_UNAVAILABLE */
 export function classifyRuntimeError(error) {
     return classifyError(error);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gt-fe/eap-runtime",
-  "version": "0.0.14",
-  "description": "Enterprise Agent Platform — Runtime核心：Graph执行引擎、Task生命周期、Session管理、Checkpoint持久化",
+  "version": "0.0.16",
+  "description": "Enterprise Agent Platform \u2014 Runtime\u6838\u5fc3\uff1aGraph\u6267\u884c\u5f15\u64ce\u3001Task\u751f\u547d\u5468\u671f\u3001Session\u7ba1\u7406\u3001Checkpoint\u6301\u4e45\u5316",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",