@qlingzzy/qling 1.0.0 → 1.1.0

package/dist/pipeline/verification.js

@@ -1,8 +1,9 @@
 // ============================================================
-// 轻灵 - Verification Agent（精简版）
-// - 简单操作跳过 LLM，直接规则判断
-// - LLM 输出严格限制在 150 tokens 内
-// - 只返回判决 + 一句话说明
+// 轻灵 - Verification Agent（精简版，已 deprecated）
+//
+// 写操作失败恢复闭环请使用 StagedVerifier + resolveVerificationStages。
+// 本类仅作无验证命令时的 advisory 旁路提示，不得驱动 RecoveryController。
+// - 默认规则判断；LLM 路径需 QLING_VERIFY_LLM=1 显式开启
 // ============================================================
 const VERIFICATION_PROMPT = `你是轻灵的验证 Agent，负责判断操作是否成功。
 
@@ -20,6 +21,7 @@ PARTIAL  // 部分成功，有警告
 - PARTIAL: 达到了核心目标，但有小问题
 
 请直接返回判决和说明，不要解释验证过程。`;
+/** @deprecated Prefer StagedVerifier for recovery-driving verification. */
 export class VerificationAgent {
     apiKey;
     model;
@@ -28,11 +30,12 @@ export class VerificationAgent {
         this.model = model;
     }
     async verify(operation, expectedOutcome, actualOutput, context) {
-        // 规则验证（快速路径）
+        // 规则验证（快速路径）；advisory only — never feeds RecoveryController
         const ruleResult = this.ruleBasedVerify(operation, expectedOutcome, actualOutput);
-        // 如果 output 很短（bash 无输出、权限拒绝等），直接用规则结果
+        const llmEnabled = ["1", "true", "on", "yes"].includes(String(process.env.QLING_VERIFY_LLM ?? "").trim().toLowerCase());
+        // 如果 output 很短且显式开启 LLM 旁路，才调用模型
         const isSimple = actualOutput.length < 100 || actualOutput.includes("denied") || actualOutput.includes("not found") || actualOutput.includes("Error");
-        if (isSimple && this.apiKey) {
+        if (llmEnabled && isSimple && this.apiKey) {
             try {
                 const llmResult = await this.verifyWithLLM(operation, actualOutput, ruleResult);
                 return llmResult;

package/dist/providers/llm-client.d.ts

@@ -0,0 +1,38 @@
+import { type ChatUsage } from "../token-usage.js";
+import type { Message, RawToolCall, ToolDefinition } from "../types.js";
+export interface LlmChatOverrides {
+    max_tokens?: number;
+    temperature?: number;
+    [key: string]: unknown;
+}
+export interface LlmChatResponse {
+    content: string;
+    tool_calls?: RawToolCall[];
+    usage?: ChatUsage;
+}
+export interface LlmClientOptions {
+    endpoint: string;
+    apiKey: string;
+    timeoutMs: number;
+    provider?: string;
+    /** Invoked once per transport retry attempt. */
+    onRetry?: () => void;
+}
+export declare class LlmHttpClient {
+    private client;
+    private provider;
+    private onRetry?;
+    constructor(options: LlmClientOptions);
+    reconfigure(options: LlmClientOptions): void;
+    /** Introspection for doctor/tests — request timeout in ms. */
+    getTimeoutMs(): number;
+    chatCompletions(input: {
+        model: string;
+        systemPrompt: string;
+        messages: Message[];
+        tools: ToolDefinition[];
+        overrides?: LlmChatOverrides;
+    }): Promise<LlmChatResponse>;
+    private buildClient;
+}
+//# sourceMappingURL=llm-client.d.ts.map

package/dist/providers/llm-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-client.d.ts","sourceRoot":"","sources":["../../src/providers/llm-client.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,SAAS,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAExE,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAC,CAAa;gBAEjB,OAAO,EAAE,gBAAgB;IAMrC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI;IAM5C,8DAA8D;IAC9D,YAAY,IAAI,MAAM;IAKhB,eAAe,CAAC,KAAK,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpB,KAAK,EAAE,cAAc,EAAE,CAAC;QACxB,SAAS,CAAC,EAAE,gBAAgB,CAAC;KAC9B,GAAG,OAAO,CAAC,eAAe,CAAC;IA4D5B,OAAO,CAAC,WAAW;CAkCpB"}

package/dist/providers/llm-client.js

@@ -0,0 +1,105 @@
+// ============================================================
+// 轻灵 — OpenAI 兼容 LLM HTTP 客户端（从 AgentLoop 抽出）
+// foundation 层：仅 axios + token-usage，无业务副作用。
+// ============================================================
+import axios from "axios";
+import { extractProviderUsage, } from "../token-usage.js";
+export class LlmHttpClient {
+    client;
+    provider;
+    onRetry;
+    constructor(options) {
+        this.provider = options.provider ?? "unknown";
+        this.onRetry = options.onRetry;
+        this.client = this.buildClient(options);
+    }
+    reconfigure(options) {
+        this.provider = options.provider ?? this.provider;
+        this.onRetry = options.onRetry ?? this.onRetry;
+        this.client = this.buildClient(options);
+    }
+    /** Introspection for doctor/tests — request timeout in ms. */
+    getTimeoutMs() {
+        const t = this.client.defaults.timeout;
+        return typeof t === "number" ? t : 0;
+    }
+    async chatCompletions(input) {
+        const systemMsg = { role: "system", content: input.systemPrompt };
+        const payload = {
+            model: input.model,
+            messages: [systemMsg, ...input.messages],
+            tools: input.tools.map((t) => ({
+                type: "function",
+                function: {
+                    name: t.name,
+                    description: t.description,
+                    parameters: t.parameters,
+                },
+            })),
+            stream: false,
+            ...(input.overrides ?? {}),
+        };
+        let resp;
+        try {
+            resp = await this.client.post("/chat/completions", payload);
+        }
+        catch (err) {
+            const e = err;
+            const detail = JSON.stringify(e.response?.data ?? {}).slice(0, 500);
+            throw new Error(`${this.provider} API error: ` + detail);
+        }
+        const choice = resp.data.choices?.[0];
+        if (!choice) {
+            throw new Error(`${this.provider} API error: ` + JSON.stringify(resp.data));
+        }
+        const msg = choice.message;
+        let rawToolCalls;
+        if (msg.tool_calls && msg.tool_calls.length > 0) {
+            rawToolCalls = msg.tool_calls.map((tc) => ({
+                id: tc.id,
+                type: "function",
+                function: {
+                    name: tc.function.name,
+                    arguments: typeof tc.function.arguments === "string"
+                        ? tc.function.arguments
+                        : JSON.stringify(tc.function.arguments),
+                },
+            }));
+        }
+        const usage = extractProviderUsage(resp.data?.usage) ?? extractProviderUsage(resp.data);
+        return {
+            content: msg.content ?? "",
+            tool_calls: rawToolCalls,
+            usage,
+        };
+    }
+    buildClient(options) {
+        const client = axios.create({
+            baseURL: options.endpoint,
+            headers: {
+                Authorization: "Bearer " + options.apiKey,
+                "Content-Type": "application/json",
+            },
+            timeout: options.timeoutMs,
+        });
+        client.interceptors.response.use((response) => response, async (err) => {
+            const cfg = err.config;
+            if (!cfg)
+                return Promise.reject(err);
+            const maxRetries = 3;
+            cfg.__retryCount = cfg.__retryCount ?? 0;
+            const status = err.response?.status;
+            const shouldRetry = (!err.response || status === 429 || (status >= 500 && status <= 503)) &&
+                cfg.__retryCount < maxRetries;
+            if (shouldRetry) {
+                cfg.__retryCount++;
+                this.onRetry?.();
+                const delay = Math.min(1000 * Math.pow(2, cfg.__retryCount - 1), 10_000);
+                await new Promise((r) => setTimeout(r, delay));
+                return client(cfg);
+            }
+            return Promise.reject(err);
+        });
+        return client;
+    }
+}

package/dist/sdk.d.ts

@@ -6,6 +6,7 @@ export { addMcpPresetToStore, loadMcpStore, saveMcpStore, defaultMcpStorePath, t
 export { getRuntimeRootsFromEnv, isPathAllowedForWrite, checkSensitiveWriteTarget, resolveWriteSandboxMode, type RuntimeRoots, type WriteSandboxMode, } from "./runtime-paths.js";
 export { runEvalSuite, formatEvalReport, type RunEvalOptions, } from "./eval/runner.js";
 export { buildEvalSmokeTasks } from "./eval/tasks.js";
+export { buildEvalRepoTasks, materializeBrokenFixture } from "./eval/repo-tasks.js";
 export { ALL_TOOLS, buildToolRegistry, dispatch } from "./tools/index.js";
 export { getPackageVersion, formatCliVersion, formatDaemonVersion, } from "./package-version.js";
 export type { AgentConfig, Message, ToolDefinition, ToolResult } from "./types.js";

package/dist/sdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../src/sdk.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,KAAK,SAAS,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,KAAK,YAAY,EACjB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../src/sdk.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,KAAK,SAAS,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,KAAK,YAAY,EACjB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}

package/dist/sdk.js

@@ -14,5 +14,6 @@ export { addMcpPresetToStore, loadMcpStore, saveMcpStore, defaultMcpStorePath, }
 export { getRuntimeRootsFromEnv, isPathAllowedForWrite, checkSensitiveWriteTarget, resolveWriteSandboxMode, } from "./runtime-paths.js";
 export { runEvalSuite, formatEvalReport, } from "./eval/runner.js";
 export { buildEvalSmokeTasks } from "./eval/tasks.js";
+export { buildEvalRepoTasks, materializeBrokenFixture } from "./eval/repo-tasks.js";
 export { ALL_TOOLS, buildToolRegistry, dispatch } from "./tools/index.js";
 export { getPackageVersion, formatCliVersion, formatDaemonVersion, } from "./package-version.js";

package/dist/session/durable-session-supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"durable-session-supervisor.d.ts","sourceRoot":"","sources":["../../src/session/durable-session-supervisor.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA4B;IAChD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,EAAE,+BAA+B;IAMpD,KAAK,IAAI,IAAI;IAQP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,IAAI;YAoBJ,iBAAiB;YAcjB,iBAAiB;YAiBjB,sBAAsB;YA+BtB,cAAc;YAoCd,iBAAiB;YAyBjB,WAAW;CA+B1B"}
+{"version":3,"file":"durable-session-supervisor.d.ts","sourceRoot":"","sources":["../../src/session/durable-session-supervisor.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA4B;IAChD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,EAAE,+BAA+B;IAMpD,KAAK,IAAI,IAAI;IAQP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,IAAI;YAyBJ,iBAAiB;YAcjB,iBAAiB;YAiBjB,sBAAsB;YAiCtB,cAAc;YAoCd,iBAAiB;YAyBjB,WAAW;CA8B1B"}

package/dist/session/durable-session-supervisor.js

@@ -43,11 +43,17 @@ export class DurableSessionSupervisor {
                 if (this.runningSessions.has(sessionId)) {
                     continue;
                 }
-                const handledGoal = await this.tryRunDurableGoal(sessionId);
-                if (handledGoal) {
-                    continue;
+                try {
+                    const handledGoal = await this.tryRunDurableGoal(sessionId);
+                    if (handledGoal) {
+                        continue;
+                    }
+                    await this.tryRunDurableLoopTasks(sessionId);
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    this.log(`[durable-session] session=${sessionId} failed: ${message.slice(0, 500)}`);
                 }
-                await this.tryRunDurableLoopTasks(sessionId);
             }
         }
         finally {
@@ -100,7 +106,9 @@ export class DurableSessionSupervisor {
         const hasDue = tasks.some((task) => task.runner === "daemon" &&
             task.status !== "canceled" &&
             task.status !== "completed" &&
-            (task.pending || task.nextRunAt <= now));
+            task.status !== "failed" &&
+            task.status !== "blocked" &&
+            (task.pending || (task.nextRunAt <= now && (task.backoffUntil ?? 0) <= now)));
         if (!hasDue) {
             return false;
         }
@@ -184,7 +192,6 @@ export class DurableSessionSupervisor {
                 fileStateDir: this.stateDir,
                 maxSteps: config.runtime.max_steps,
                 parseRetries: config.runtime.parse_retries,
-                maxTokenBudget: config.runtime.max_token_budget,
                 toolRepeatLimit: config.runtime.tool_repeat_limit,
                 timeoutMs: config.runtime.timeout_ms,
             },

package/dist/session/session-persistence.d.ts

@@ -0,0 +1,29 @@
+import type { Message } from "../types.js";
+import type { SavedSessionSnapshot, SavedSessionSummary } from "./session-registry.js";
+export interface SessionLiveFields {
+    sessionId: string;
+    sessionCreatedAt: string;
+    messages: Message[];
+    turnCount: number;
+    sessionTokens: number;
+    compactionCount: number;
+    workspaceDir: string | null;
+}
+/** Fields AgentLoop should write back after restore. */
+export interface SessionRestorePatch {
+    messages: Message[];
+    turnCount: number;
+    sessionTokens: number;
+    sessionPromptTokens: number;
+    sessionCompletionTokens: number;
+    tokenUsageSource: "provider" | "unknown";
+    compactionCount: number;
+    sessionId: string;
+    sessionCreatedAt: string;
+    workspaceDir: string | null;
+    summary: SavedSessionSummary;
+}
+export declare function buildSessionSnapshot(name: string, fields: SessionLiveFields): Omit<SavedSessionSnapshot, "version">;
+export declare function applySessionSnapshot(snapshot: SavedSessionSnapshot): SessionRestorePatch;
+export declare function defaultSessionSaveName(now?: Date): string;
+//# sourceMappingURL=session-persistence.d.ts.map

package/dist/session/session-persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-persistence.d.ts","sourceRoot":"","sources":["../../src/session/session-persistence.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEvF,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,gBAAgB,EAAE,UAAU,GAAG,SAAS,CAAC;IACzC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,iBAAiB,GACxB,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAYvC;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,mBAAmB,CAwBxF;AAED,wBAAgB,sBAAsB,CAAC,GAAG,OAAa,GAAG,MAAM,CAE/D"}

package/dist/session/session-persistence.js

@@ -0,0 +1,45 @@
+// ============================================================
+// Session 快照构建 / 应用（从 AgentLoop 抽出）
+// domain 层：纯数据结构，不依赖 AgentLoop 实例
+// ============================================================
+export function buildSessionSnapshot(name, fields) {
+    return {
+        name,
+        sessionId: fields.sessionId,
+        workspaceDir: fields.workspaceDir,
+        createdAt: fields.sessionCreatedAt,
+        updatedAt: new Date().toISOString(),
+        messages: fields.messages.map((message) => ({ ...message })),
+        turnCount: fields.turnCount,
+        sessionTokens: fields.sessionTokens,
+        compactionCount: fields.compactionCount,
+    };
+}
+export function applySessionSnapshot(snapshot) {
+    return {
+        messages: snapshot.messages.map((message) => ({ ...message })),
+        turnCount: snapshot.turnCount,
+        sessionTokens: snapshot.sessionTokens,
+        sessionPromptTokens: 0,
+        sessionCompletionTokens: 0,
+        tokenUsageSource: "unknown",
+        compactionCount: snapshot.compactionCount,
+        sessionId: snapshot.sessionId,
+        sessionCreatedAt: snapshot.createdAt,
+        workspaceDir: snapshot.workspaceDir,
+        summary: {
+            name: snapshot.name,
+            sessionId: snapshot.sessionId,
+            workspaceDir: snapshot.workspaceDir,
+            createdAt: snapshot.createdAt,
+            updatedAt: snapshot.updatedAt,
+            turnCount: snapshot.turnCount,
+            messageCount: snapshot.messages.length,
+            sessionTokens: snapshot.sessionTokens,
+            compactionCount: snapshot.compactionCount,
+        },
+    };
+}
+export function defaultSessionSaveName(now = new Date()) {
+    return "session-" + now.toISOString().replace(/[:.]/g, "-");
+}

package/dist/session/session-scheduler.d.ts

@@ -1,6 +1,6 @@
 export type SessionTaskKind = "loop";
 export type SessionTaskMode = "fixed" | "default";
-export type SessionTaskStatus = "active" | "running" | "completed" | "canceled";
+export type SessionTaskStatus = "active" | "running" | "blocked" | "failed" | "completed" | "canceled";
 export type SessionTaskRunner = "session" | "daemon";
 export interface SessionTask {
     id: string;
@@ -15,6 +15,13 @@ export interface SessionTask {
     updatedAt: number;
     lastRunAt?: number;
     nextRunAt: number;
+    attemptCount?: number;
+    consecutiveFailures?: number;
+    lastError?: {
+        message: string;
+        timestamp: number;
+    };
+    backoffUntil?: number;
 }
 export interface SessionSchedulerOptions {
     stateDir: string;

package/dist/session/session-scheduler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-scheduler.d.ts","sourceRoot":"","sources":["../../src/session/session-scheduler.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AACrC,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,CAAC;AAClD,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;AAChF,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;IACxD,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,KAAK,CAA+C;gBAEhD,OAAO,EAAE,uBAAuB;IAStC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAK3B,KAAK,IAAI,IAAI;IAOP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAIvB,cAAc,CAAC,OAAO,EAAE;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,eAAe,CAAC;QACtB,MAAM,CAAC,EAAE,iBAAiB,CAAC;KAC5B,GAAG,OAAO,CAAC,WAAW,CAAC;IAqBlB,SAAS,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAOnC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAU5C,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAiBjC,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC;IAqD9C,OAAO,CAAC,cAAc;YAQR,SAAS;YAaT,SAAS;CAMxB"}
+{"version":3,"file":"session-scheduler.d.ts","sourceRoot":"","sources":["../../src/session/session-scheduler.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AACrC,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,CAAC;AAClD,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;AACvG,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;IACxD,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,KAAK,CAA+C;gBAEhD,OAAO,EAAE,uBAAuB;IAStC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAK3B,KAAK,IAAI,IAAI;IAOP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAIvB,cAAc,CAAC,OAAO,EAAE;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,eAAe,CAAC;QACtB,MAAM,CAAC,EAAE,iBAAiB,CAAC;KAC5B,GAAG,OAAO,CAAC,WAAW,CAAC;IAqBlB,SAAS,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAOnC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAU5C,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAiBjC,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC;IA4E9C,OAAO,CAAC,cAAc;YAQR,SAAS;YAaT,SAAS;CAMxB"}

package/dist/session/session-scheduler.js

@@ -100,13 +100,13 @@ export class SessionScheduler {
         let dirty = false;
         const tasks = Array.from(this.tasks.values()).sort((a, b) => a.nextRunAt - b.nextRunAt);
         for (const task of tasks) {
-            if (task.status === "canceled" || task.status === "completed") {
+            if (["canceled", "completed", "failed", "blocked"].includes(task.status)) {
                 continue;
             }
             if ((task.runner ?? "session") !== this.runner) {
                 continue;
             }
-            const isDue = task.pending || task.nextRunAt <= now;
+            const isDue = task.pending || (task.nextRunAt <= now && (task.backoffUntil ?? 0) <= now);
             if (!isDue)
                 continue;
             if (this.busy) {
@@ -119,20 +119,45 @@ export class SessionScheduler {
             }
             task.pending = false;
             task.status = "running";
+            task.attemptCount = (task.attemptCount ?? 0) + 1;
             task.updatedAt = now;
             await this.saveTasks();
             try {
                 await this.onDue(cloneTask(task));
                 triggered++;
-            }
-            finally {
                 const currentTask = this.tasks.get(task.id);
                 if (currentTask && currentTask.status !== "canceled") {
                     currentTask.status = "active";
+                    currentTask.consecutiveFailures = 0;
+                    currentTask.lastError = undefined;
+                    currentTask.backoffUntil = undefined;
                     currentTask.lastRunAt = now;
                     currentTask.nextRunAt = now + currentTask.intervalMs;
                     currentTask.updatedAt = this.clock();
                 }
+            }
+            catch (error) {
+                const currentTask = this.tasks.get(task.id);
+                if (currentTask && currentTask.status !== "canceled") {
+                    const failures = (currentTask.consecutiveFailures ?? 0) + 1;
+                    const failedAt = this.clock();
+                    currentTask.consecutiveFailures = failures;
+                    currentTask.lastError = { message: sanitizeError(error), timestamp: failedAt };
+                    currentTask.lastRunAt = now;
+                    currentTask.updatedAt = failedAt;
+                    if (failures >= 4) {
+                        currentTask.status = "failed";
+                        currentTask.backoffUntil = undefined;
+                    }
+                    else {
+                        const delay = Math.min(60_000, 1_000 * 2 ** (failures - 1));
+                        currentTask.status = "active";
+                        currentTask.backoffUntil = failedAt + delay;
+                        currentTask.nextRunAt = currentTask.backoffUntil;
+                    }
+                }
+            }
+            finally {
                 await this.saveTasks();
             }
         }
@@ -168,3 +193,7 @@ export class SessionScheduler {
         await fs.writeFile(this.stateFile, JSON.stringify(payload, null, 2), "utf-8");
     }
 }
+function sanitizeError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.replace(/\b(?:sk|api)[-_][a-z0-9_-]{8,}\b/gi, "[redacted]").slice(0, 500);
+}

package/dist/session-task-report.d.ts

@@ -14,6 +14,7 @@ export interface SessionTaskReport {
 export declare function parseSessionTaskCount(value?: string): number;
 export declare function listLocalSessionTasks(stateDir: string, options?: {
     count?: number;
+    maxCount?: number;
 }): Promise<SessionTaskReport>;
 export declare function cancelLocalSessionTask(stateDir: string, taskId: string, options?: {
     clock?: () => number;

package/dist/session-task-report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-task-report.d.ts","sourceRoot":"","sources":["../src/session-task-report.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAKlE,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CA8D5B;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GACrC,OAAO,CAAC,gBAAgB,CAAC,CA0C3B;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAkC3E;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAY1E"}
+{"version":3,"file":"session-task-report.d.ts","sourceRoot":"","sources":["../src/session-task-report.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAKlE,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClD,OAAO,CAAC,iBAAiB,CAAC,CA+D5B;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GACrC,OAAO,CAAC,gBAAgB,CAAC,CA0C3B;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAkC3E;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAY1E"}

package/dist/session-task-report.js

@@ -13,7 +13,8 @@ export function parseSessionTaskCount(value) {
 }
 export async function listLocalSessionTasks(stateDir, options = {}) {
     const tasksDir = path.join(stateDir, "session-tasks");
-    const count = Math.min(Math.max(1, Math.floor(options.count ?? DEFAULT_TASK_COUNT)), MAX_TASK_COUNT);
+    const maxCount = Math.max(1, Math.floor(options.maxCount ?? MAX_TASK_COUNT));
+    const count = Math.min(Math.max(1, Math.floor(options.count ?? DEFAULT_TASK_COUNT)), maxCount);
     const warnings = [];
     if (!existsSync(tasksDir)) {
         return {

package/dist/shortcuts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shortcuts.d.ts","sourceRoot":"","sources":["../src/shortcuts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,UA+B1B,CAAC"}
+{"version":3,"file":"shortcuts.d.ts","sourceRoot":"","sources":["../src/shortcuts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,UAgC1B,CAAC"}

package/dist/shortcuts.js

@@ -5,6 +5,7 @@ export const SHORTCUT_LINES = [
     "界面入口 : /help slash 查看本地命令；/privacy 查看边界；/context 查看上下文；/statusline 查看状态线；Tab agents 打开本地 agents 视图",
     "Enter    : 发送当前输入",
     "Tab      : 空输入时打开本地 /agents mission 视图；slash 前缀补全最佳命令；其他非空输入会保留草稿并提示补全未启用",
+    "Shift+Tab: 循环 Agent/ask → Plan → Agent/allow (Always Agree) → Agent/ask；保留当前草稿",
     "Slash    : 输入 / 或 /sk 显示本地命令候选，Tab 补全最佳候选，不自动执行",
     "Ctrl+N   : 插入换行，继续编辑多行 prompt",
     "Ctrl+R   : 用当前输入搜索本会话内历史；未命中会提示并保留草稿",

package/dist/skills/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/skills/registry.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAS5C,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAYxE;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAErE;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAStF;AA+BD,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAoBhF;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAiCzE;AAED,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/skills/registry.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAS5C,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAYxE;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAErE;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAStF;AA+BD,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAoBhF;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CA2CzE;AAED,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}

package/dist/skills/registry.js

@@ -89,6 +89,7 @@ export function parseFrontmatter(raw, filePath) {
         name: fallbackName,
         description: "",
         tags: [],
+        triggers: [],
         path: filePath,
     };
     const lines = raw.split("\n");
@@ -103,10 +104,19 @@ export function parseFrontmatter(raw, filePath) {
         const parsed = YAML.parse(yamlBlock);
         if (!parsed || typeof parsed !== "object")
             return fallback;
+        const triggersRaw = parsed.triggers ?? parsed.trigger;
+        let triggers = [];
+        if (Array.isArray(triggersRaw)) {
+            triggers = triggersRaw.map(String).filter(Boolean);
+        }
+        else if (typeof triggersRaw === "string" && triggersRaw.trim()) {
+            triggers = triggersRaw.split(/[,，]/).map((s) => s.trim()).filter(Boolean);
+        }
         return {
             name: typeof parsed.name === "string" && parsed.name ? parsed.name : fallbackName,
             description: typeof parsed.description === "string" ? parsed.description : "",
             tags: Array.isArray(parsed.tags) ? parsed.tags.map(String) : [],
+            triggers,
             path: filePath,
         };
     }

package/dist/skills/security-scan.d.ts

@@ -0,0 +1,15 @@
+export type SkillScanSeverity = "critical" | "high" | "medium" | "low";
+export interface SkillScanFinding {
+    severity: SkillScanSeverity;
+    rule: string;
+    detail: string;
+}
+export interface SkillScanResult {
+    ok: boolean;
+    findings: SkillScanFinding[];
+    mode: "on" | "warn" | "off";
+}
+export declare function resolveSkillScanMode(env?: NodeJS.ProcessEnv | Record<string, string | undefined>): "on" | "warn" | "off";
+export declare function scanSkillContent(content: string, env?: NodeJS.ProcessEnv | Record<string, string | undefined>): SkillScanResult;
+export declare function formatSkillScanBlockMessage(name: string, result: SkillScanResult): string;
+//# sourceMappingURL=security-scan.d.ts.map

package/dist/skills/security-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scan.d.ts","sourceRoot":"","sources":["../../src/skills/security-scan.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,KAAK,CAAC;CAC7B;AAkED,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACxE,IAAI,GAAG,MAAM,GAAG,KAAK,CAKvB;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACxE,eAAe,CAsBjB;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM,CASzF"}

package/dist/skills/security-scan.js

@@ -0,0 +1,95 @@
+// ============================================================
+// Phase 3.1 — Skill 静态安全扫描
+// QLING_SKILL_SCAN: on（默认）| warn | off
+// ============================================================
+const RULES = [
+    {
+        severity: "critical",
+        rule: "private-key-pem",
+        pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/i,
+        detail: "疑似私钥 PEM 块",
+    },
+    {
+        severity: "critical",
+        rule: "aws-access-key",
+        pattern: /\bAKIA[0-9A-Z]{16}\b/,
+        detail: "疑似 AWS Access Key ID",
+    },
+    {
+        severity: "critical",
+        rule: "generic-secret-assignment",
+        pattern: /\b(api[_-]?key|secret[_-]?key|access[_-]?token)\s*[:=]\s*['"][A-Za-z0-9_\-]{24,}['"]/i,
+        detail: "疑似硬编码密钥赋值",
+    },
+    {
+        severity: "high",
+        rule: "curl-pipe-shell",
+        pattern: /curl\s+[^\n|]*\|\s*(?:ba)?sh/i,
+        detail: "curl 管道 shell 远程执行模式",
+    },
+    {
+        severity: "high",
+        rule: "irm-iex",
+        pattern: /irm\s+[^\n|]*\|\s*iex|Invoke-Expression/i,
+        detail: "PowerShell 远程下载执行模式",
+    },
+    {
+        severity: "high",
+        rule: "wget-pipe-shell",
+        pattern: /wget\s+[^\n|]*\|\s*(?:ba)?sh/i,
+        detail: "wget 管道 shell 远程执行模式",
+    },
+    {
+        severity: "high",
+        rule: "base64-decode-exec",
+        pattern: /base64\s+-d[^;\n]*\|\s*(?:ba)?sh|Buffer\.from\([^)]+,\s*['"]base64['"]\)[^;]{0,80}(exec|spawn|eval)/i,
+        detail: "base64 解码后执行模式",
+    },
+    {
+        severity: "medium",
+        rule: "eval-call",
+        pattern: /\beval\s*\(/,
+        detail: "动态 eval 调用",
+    },
+    {
+        severity: "medium",
+        rule: "child-process",
+        pattern: /child_process\.(exec|spawn|execSync|spawnSync)/,
+        detail: "Node child_process 直接调用（需人工确认）",
+    },
+];
+export function resolveSkillScanMode(env = process.env) {
+    const raw = String(env.QLING_SKILL_SCAN ?? "on").trim().toLowerCase();
+    if (raw === "off" || raw === "0" || raw === "false")
+        return "off";
+    if (raw === "warn" || raw === "warning")
+        return "warn";
+    return "on";
+}
+export function scanSkillContent(content, env = process.env) {
+    const mode = resolveSkillScanMode(env);
+    if (mode === "off") {
+        return { ok: true, findings: [], mode };
+    }
+    const findings = [];
+    for (const rule of RULES) {
+        if (rule.pattern.test(content)) {
+            findings.push({
+                severity: rule.severity,
+                rule: rule.rule,
+                detail: rule.detail,
+            });
+        }
+    }
+    const blocking = findings.some((f) => f.severity === "critical" || f.severity === "high");
+    if (mode === "warn") {
+        return { ok: true, findings, mode };
+    }
+    return { ok: !blocking, findings, mode };
+}
+export function formatSkillScanBlockMessage(name, result) {
+    const lines = result.findings.map((f) => `  - [${f.severity}] ${f.rule}: ${f.detail}`);
+    return (`skill 安全扫描未通过: ${name}\n` +
+        lines.join("\n") +
+        `\n（策略 QLING_SKILL_SCAN=${result.mode}；调试可设 off/warn）`);
+}