@gt-fe/eap-runtime 0.0.15 → 0.0.17

package/README.md

@@ -163,7 +163,7 @@ DSL / 契约细节见 `.kiro/specs/04-runtime-core/design.md` §1.4 与 `src/gra
 |------|------|------|
 | `EAP_PREINSTALL_ROOT` | — | 预装根；也可用 `GraphLoader({ preinstallRoot })` |
 | `EAP_PRELOAD_REQUIRE_READY` | 关 | 缺 `.ready` → `runtime.preload.missing` |
-| `EAP_PRELOAD_REQUIRE_CHECKSUM` | 关 | snapshot 须含 sha256 或 artifacts |
+| `EAP_PRELOAD_REQUIRE_CHECKSUM` | 关 | snapshot 须含 sha256 或 artifacts。加载期比对文件摘要，不匹配则 warn、不中断 |
 | `EAP_PRELOAD_USER_SKILL_OVERRIDE` | 关 | `users` 优先于 `shared` |
 | `EAP_PRELOAD_VALIDATE_SKILL_IO` | 关 | 校验 Skill `inputDef.required`（`state.skillInput`） |
 | `EAP_PRELOAD_DEFINITION_CACHE` | 有预装时开 | 定义缓存；`0`/`false` 关闭，`1`/`true` 强制开 |
@@ -256,7 +256,7 @@ FOUNDATION_SERVICE_URL=...
 EAP_DEPLOYMENT_CONTEXT=dev
 EAP_PREINSTALL_ROOT=/abs/path/to/preinstall   # 或 Agent 工程内预装树
 EAP_RUNTIME_STORAGE_PROFILE=dev
-EAP_TOOL_EXECUTION_MODE=mcp                  # 本地默认；http-debug 走 Gateway 调试口
+EAP_TOOL_EXECUTION_MODE=mcp                  # 仅 createDevRuntime / eap chat；Hosting 的 TOOL_EXECUTION_MODE 不读
 # OPENAI_BASE_URL / OPENAI_API_KEY / EAP_DEFAULT_MODEL
 ```
 

package/dist/registry/deployment-snapshot.js

@@ -17,6 +17,7 @@ import { parseSkillMd } from '@gt-fe/eap-contracts';
 import { findSkillEntryFile } from './skill-tree.js';
 import { preloadMissing, preloadPackageCorrupt, } from './preload-errors.js';
 import { isRequireChecksum, resolvePreloadBehaviorFlags, } from './preload-flags.js';
+import { emitRuntimeLog } from '../common/logger.js';
 async function pathExists(p) {
     try {
         await access(p, fsConstants.F_OK);
@@ -115,17 +116,19 @@ async function findDigestMatch(items, expectedRaw) {
     }
     return undefined;
 }
-async function assertDigestMatch(expectedRaw, actualHex, label, details) {
+async function warnIfDigestMismatch(expectedRaw, actualHex, label, details) {
     const expected = normalizeDigest(expectedRaw);
     if (!expected)
         return;
-    if (expected !== actualHex.toLowerCase()) {
-        throw preloadPackageCorrupt(`预装校验和不匹配: ${label}`, {
-            expected,
-            actual: actualHex.toLowerCase(),
-            ...details,
-        });
-    }
+    const actual = actualHex.toLowerCase();
+    if (expected === actual)
+        return;
+    emitRuntimeLog('warn', 'preload', `预装校验和不匹配: ${label}`, {
+        event: 'runtime.preload.digest_mismatch',
+        expected,
+        actual,
+        ...details,
+    });
 }
 async function pickLatestVersionDir(parent) {
     if (!(await pathExists(parent)))
@@ -358,10 +361,14 @@ export class FileSystemDeploymentSnapshot {
                 const raw = (await readTextFile(pkgFile))?.trim() ?? '';
                 const fileDigest = normalizeDigest(raw);
                 if (!fileDigest) {
-                    throw preloadPackageCorrupt(`.package.sha256 内容非法`, { path: pkgFile });
+                    emitRuntimeLog('warn', 'preload', '.package.sha256 内容非法', {
+                        event: 'runtime.preload.digest_mismatch',
+                        path: pkgFile,
+                    });
                 }
-                if (fileDigest !== expectedPkg) {
-                    throw preloadPackageCorrupt(`snapshot.sha256 与 .package.sha256 不一致（以 snapshot 为准核对）`, {
+                else if (fileDigest !== expectedPkg) {
+                    emitRuntimeLog('warn', 'preload', 'snapshot.sha256 与 .package.sha256 不一致', {
+                        event: 'runtime.preload.digest_mismatch',
                         expected: expectedPkg,
                         actual: fileDigest,
                         path: pkgFile,
@@ -387,7 +394,7 @@ export class FileSystemDeploymentSnapshot {
                 throw preloadPackageCorrupt(`artifacts 指向的文件不存在: ${rel}`, { path: full });
             }
             const actual = await sha256OfFile(full);
-            await assertDigestMatch(expected, actual, `artifact ${rel}`, { path: full });
+            await warnIfDigestMismatch(expected, actual, `artifact ${rel}`, { path: full });
         }
     }
     async resolveAgentDir(agentCode, version) {
@@ -492,7 +499,7 @@ export class FileSystemDeploymentSnapshot {
             if (ref.sha256) {
                 const matched = await findDigestMatch(existingManifests, ref.sha256);
                 if (!matched) {
-                    await assertDigestMatch(ref.sha256, await sha256OfFile(existingManifests[0].path), `tool ${ref.name}`, { path: existingManifests[0].path });
+                    await warnIfDigestMismatch(ref.sha256, await sha256OfFile(existingManifests[0].path), `tool ${ref.name}`, { path: existingManifests[0].path });
                 }
                 chosen = matched ?? existingManifests[0];
             }
@@ -564,9 +571,12 @@ export class FileSystemDeploymentSnapshot {
                 continue;
             const isUserOverridePath = bundlePath.includes('/users/') || bundlePath.includes('\\users\\');
             const isAuthorOverlay = extraRoots.some((root) => root && isPathInside(root, bundlePath));
-            if (ref.sha256 && !isUserOverridePath && !isAuthorOverlay && manifestPath.endsWith('.json')) {
+            if (ref.sha256 &&
+                !isUserOverridePath &&
+                !isAuthorOverlay &&
+                manifestPath.endsWith('.json')) {
                 const actual = await sha256OfFile(manifestPath);
-                await assertDigestMatch(ref.sha256, actual, `skill ${ref.skillId}`, { path: manifestPath });
+                await warnIfDigestMismatch(ref.sha256, actual, `skill ${ref.skillId}`, { path: manifestPath });
             }
             const skillId = String(ref.skillId);
             return {

package/dist/registry/preload-flags.d.ts

@@ -5,7 +5,7 @@
  * |------|------|------|
  * | EAP_PRELOAD_REQUIRE_READY | 关 | 强制校验 .ready |
  * | EAP_PRELOAD_VALIDATE_SKILL_IO | **开** | 执行子图前校验 skill inputDef.required；`0`/`false` 关闭 |
- * | EAP_PRELOAD_REQUIRE_CHECKSUM | 关 | snapshot 必须带 sha256 或 artifacts[] |
+ * | EAP_PRELOAD_REQUIRE_CHECKSUM | 关 | snapshot 必须带 sha256 或 artifacts[]（字段存在性）。加载期摘要不匹配为 warn |
  * | EAP_PRELOAD_DEFINITION_CACHE | 有预装时开 | 进程内定义缓存；`0`/`false` 关闭 |
  * | EAP_SKILL_HOT_RELOAD | **dev 开 / server 关** | 已装配 Skill 的目录 mtime 变化则丢缓存；未写入装配名单的目录不进清单 |
  * | EAP_LOCAL_SKILLS_DIR | 关 | 开发态作者源 Skill 根；查找优先于 preinstall，低于 users/ |

package/dist/registry/preload-flags.js

@@ -5,7 +5,7 @@
  * |------|------|------|
  * | EAP_PRELOAD_REQUIRE_READY | 关 | 强制校验 .ready |
  * | EAP_PRELOAD_VALIDATE_SKILL_IO | **开** | 执行子图前校验 skill inputDef.required；`0`/`false` 关闭 |
- * | EAP_PRELOAD_REQUIRE_CHECKSUM | 关 | snapshot 必须带 sha256 或 artifacts[] |
+ * | EAP_PRELOAD_REQUIRE_CHECKSUM | 关 | snapshot 必须带 sha256 或 artifacts[]（字段存在性）。加载期摘要不匹配为 warn |
  * | EAP_PRELOAD_DEFINITION_CACHE | 有预装时开 | 进程内定义缓存；`0`/`false` 关闭 |
  * | EAP_SKILL_HOT_RELOAD | **dev 开 / server 关** | 已装配 Skill 的目录 mtime 变化则丢缓存；未写入装配名单的目录不进清单 |
  * | EAP_LOCAL_SKILLS_DIR | 关 | 开发态作者源 Skill 根；查找优先于 preinstall，低于 users/ |

package/dist/tool/create-tool-executor.d.ts

@@ -1,9 +1,11 @@
 /**
  * createToolExecutor — 按部署上下文组装 Router + Gateway/Local 执行器
  *
- * server / hosting：**默认 MCP**（McpToolExecutor → POST /api/v1/mcp）；
+ * server / hosting：**默认 MCP**（McpToolExecutor → POST {绝对基址}/api/v1/mcp）；
  * `EAP_TOOL_GATEWAY_TRANSPORT=http` 时用 HttpToolExecutor（仅调试）。
  * desktop 经 ToolExecutionRouter 分流 Local / Gateway。
+ * desktop|dev 且 foundationUrl 不是绝对 http(s)：不创建 Gateway 客户端，只挂 LocalToolExecutor。
+ * 不读 Hosting 的 TOOL_EXECUTION_MODE。
  */
 import type { ILocalToolInstallStore, LocalToolInstallRecord } from '@gt-fe/eap-contracts';
 import { type DeploymentContext } from './tool-execution-router.js';

package/dist/tool/create-tool-executor.js

@@ -1,12 +1,14 @@
 /**
  * createToolExecutor — 按部署上下文组装 Router + Gateway/Local 执行器
  *
- * server / hosting：**默认 MCP**（McpToolExecutor → POST /api/v1/mcp）；
+ * server / hosting：**默认 MCP**（McpToolExecutor → POST {绝对基址}/api/v1/mcp）；
  * `EAP_TOOL_GATEWAY_TRANSPORT=http` 时用 HttpToolExecutor（仅调试）。
  * desktop 经 ToolExecutionRouter 分流 Local / Gateway。
+ * desktop|dev 且 foundationUrl 不是绝对 http(s)：不创建 Gateway 客户端，只挂 LocalToolExecutor。
+ * 不读 Hosting 的 TOOL_EXECUTION_MODE。
  */
 import { HttpToolExecutor } from './http-tool-executor.js';
-import { McpToolExecutor } from './mcp-tool-executor.js';
+import { isAbsoluteHttpUrl, McpToolExecutor } from './mcp-tool-executor.js';
 import { LocalToolExecutor } from './local-tool-executor.js';
 import { ToolExecutionRouter, } from './tool-execution-router.js';
 import { withHarnessPrimitives } from './harness-primitives.js';
@@ -46,14 +48,19 @@ function createServerExecutor(foundationUrl, transport, timeout) {
  */
 export function createToolExecutor(options) {
     const installStore = options.installStore ?? new EmptyInstallStore();
+    const localExecutor = new LocalToolExecutor({ installStore });
+    const deploymentContext = resolveDeploymentContext(options.deploymentContext);
+    const hasGateway = isAbsoluteHttpUrl(options.foundationUrl);
+    if (!hasGateway && (deploymentContext === 'desktop' || deploymentContext === 'dev')) {
+        return withHarnessPrimitives(localExecutor);
+    }
     const transport = resolveGatewayTransport(options.gatewayTransport);
     const serverExecutor = createServerExecutor(options.foundationUrl, transport, options.httpTimeout);
-    const localExecutor = new LocalToolExecutor({ installStore });
     return withHarnessPrimitives(new ToolExecutionRouter({
         httpExecutor: serverExecutor,
         localExecutor,
         installStore,
-        deploymentContext: resolveDeploymentContext(options.deploymentContext),
+        deploymentContext,
         toolTypes: options.toolTypes,
         toolRuntimes: options.toolRuntimes,
         forceToolServer: options.forceToolServer,

package/dist/tool/index.d.ts

@@ -3,7 +3,7 @@ export { hydrateMcpTools, isMcpDiscoverStub, needsMcpHydration, parseListedTools
 export { toLoadedToolMap, type LoadedToolDefinition, type LoadedToolMap, type LoadedToolManifestRef, } from './loaded-tool-definition.js';
 export { ToolOrchestrator } from './tool-orchestrator.js';
 export { HttpToolExecutor, type HttpToolExecutorOptions, } from './http-tool-executor.js';
-export { McpToolExecutor, type McpToolExecutorOptions, } from './mcp-tool-executor.js';
+export { McpToolExecutor, isAbsoluteHttpUrl, type McpToolExecutorOptions, } from './mcp-tool-executor.js';
 export { LocalToolExecutor, isLocalPreferredExecution, resolveCodeExecutionFromRequest } from './local-tool-executor.js';
 export { DevMcpExecutor, type DevMcpExecutorOptions, } from './dev-mcp-executor.js';
 export { DevHttpExecutor, buildHttpToolUrl, resolveHttpExecutionFromRequest, type DevHttpExecution, } from './dev-http-executor.js';

package/dist/tool/index.js

@@ -2,7 +2,7 @@ export { hydrateMcpTools, isMcpDiscoverStub, needsMcpHydration, parseListedTools
 export { toLoadedToolMap, } from './loaded-tool-definition.js';
 export { ToolOrchestrator } from './tool-orchestrator.js';
 export { HttpToolExecutor, } from './http-tool-executor.js';
-export { McpToolExecutor, } from './mcp-tool-executor.js';
+export { McpToolExecutor, isAbsoluteHttpUrl, } from './mcp-tool-executor.js';
 export { LocalToolExecutor, isLocalPreferredExecution, resolveCodeExecutionFromRequest } from './local-tool-executor.js';
 export { DevMcpExecutor, } from './dev-mcp-executor.js';
 export { DevHttpExecutor, buildHttpToolUrl, resolveHttpExecutionFromRequest, } from './dev-http-executor.js';

package/dist/tool/mcp-tool-executor.d.ts

@@ -4,6 +4,8 @@
  * @see docs/contracts/tool-execution.md §2.0
  */
 import type { IToolExecutor, McpListedTool, ToolCallRequest, ToolCallResult } from './tool-executor.interface.js';
+/** Tool Gateway 基址：必须是绝对 http(s)。空串 / 相对路径禁止 fetch。 */
+export declare function isAbsoluteHttpUrl(value: unknown): boolean;
 export interface McpToolExecutorOptions {
     baseUrl: string;
     timeout?: number;

package/dist/tool/mcp-tool-executor.js

@@ -4,8 +4,24 @@
  * @see docs/contracts/tool-execution.md §2.0
  */
 import { ErrorCodes } from '@gt-fe/eap-contracts';
+import { emitRuntimeLog } from '../common/logger.js';
 import { abortOrTimeoutMessage, isAbortError } from './timeout.js';
 import { nextListCursor, parseListedTools } from './mcp-list.js';
+/** Tool Gateway 基址：必须是绝对 http(s)。空串 / 相对路径禁止 fetch。 */
+export function isAbsoluteHttpUrl(value) {
+    if (typeof value !== 'string')
+        return false;
+    const trimmed = value.trim();
+    if (!trimmed)
+        return false;
+    try {
+        const url = new URL(trimmed);
+        return url.protocol === 'http:' || url.protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
 function resolveAgentCode(request) {
     return request.authContext.agentCode;
 }
@@ -49,7 +65,14 @@ export class McpToolExecutor {
     /** endpoint+user+agent → in-flight / completed tools/list */
     listCache = new Map();
     constructor(options) {
-        this.baseUrl = options.baseUrl.replace(/\/+$/, '');
+        if (!isAbsoluteHttpUrl(options.baseUrl)) {
+            emitRuntimeLog('warn', 'tool', 'McpToolExecutor 基址不是绝对 http(s)，拒绝请求', {
+                event: 'runtime.tool.gateway_base_invalid',
+                baseUrl: options.baseUrl,
+            });
+            throw new Error(`McpToolExecutor 需要绝对 http(s) 基址，收到 ${JSON.stringify(options.baseUrl ?? '')}`);
+        }
+        this.baseUrl = options.baseUrl.trim().replace(/\/+$/, '');
         this.timeout = options.timeout ?? 30_000;
         const path = options.mcpPath ?? '/api/v1/mcp';
         this.mcpUrl = `${this.baseUrl}${path.startsWith('/') ? path : `/${path}`}`;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gt-fe/eap-runtime",
-  "version": "0.0.15",
-  "description": "Enterprise Agent Platform — Runtime核心：Graph执行引擎、Task生命周期、Session管理、Checkpoint持久化",
+  "version": "0.0.17",
+  "description": "Enterprise Agent Platform \u2014 Runtime\u6838\u5fc3\uff1aGraph\u6267\u884c\u5f15\u64ce\u3001Task\u751f\u547d\u5468\u671f\u3001Session\u7ba1\u7406\u3001Checkpoint\u6301\u4e45\u5316",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",