@qlingzzy/qling 1.0.0 → 1.1.0

package/dist/tools/lsp.js

@@ -0,0 +1,136 @@
+// ============================================================
+// Phase 4.3 — lsp 工具（可选 TS 语义查询）
+// QLING_LSP=1 启用
+// ============================================================
+import { toolError, toolSuccess } from "./error-utils.js";
+import { getRuntimeRootsFromEnv, isWithinAllowedRoots } from "../runtime-paths.js";
+import { getOrCreateServiceForFile, isLspEnabled, loadTypeScript, lspDefinition, lspDocumentSymbols, lspHover, lspReferences, resetTsServiceCache, resolveAbsFile, } from "../lsp/ts-service.js";
+export { isLspEnabled, resetTsServiceCache };
+export const lspTool = {
+    name: "lsp",
+    description: "Optional TypeScript semantic queries (definition/hover/references/document_symbols). DISABLED by default — set QLING_LSP=1. Uses in-process TypeScript LanguageService (not full multi-language LSP).",
+    longDescription: `可选 TypeScript 语义查询（进程内 LanguageService）。
+
+**启用**: \`QLING_LSP=1\`（且环境可 resolve \`typescript\` 包）
+
+**action**:
+- definition — 跳转到定义（path + line + character，1-based）
+- hover — 类型/文档提示
+- references — 查找引用
+- document_symbols — 当前文件符号大纲
+
+**限制**: 当前仅 TS/JS 系；非 LSP 多语言协议客户端。通用符号搜索请用 code_symbols。`,
+    parameters: {
+        type: "object",
+        properties: {
+            action: {
+                type: "string",
+                description: "definition | hover | references | document_symbols",
+            },
+            path: {
+                type: "string",
+                description: "File path relative to workspace or absolute",
+            },
+            line: {
+                type: "number",
+                description: "1-based line number",
+            },
+            character: {
+                type: "number",
+                description: "1-based column (character offset in line)",
+            },
+            limit: {
+                type: "number",
+                description: "Max results for references/symbols (default 30/80)",
+            },
+        },
+        required: ["action", "path"],
+    },
+    scenes: ["code", "navigation"],
+    priority: 7,
+    readOnly: true,
+    destructive: false,
+    concurrencySafe: true,
+    effortHint: "low",
+};
+function parseLineChar(args) {
+    const line = Number(args.line);
+    const character = Number(args.character ?? 1);
+    return {
+        line: Number.isFinite(line) && line >= 1 ? Math.floor(line) : 1,
+        character: Number.isFinite(character) && character >= 1 ? Math.floor(character) : 1,
+    };
+}
+const MAX_LSP_RESULTS = 200;
+export function clampLspLimit(raw, fallback) {
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return fallback;
+    return Math.min(MAX_LSP_RESULTS, Math.floor(parsed));
+}
+export async function runLsp(args) {
+    if (!isLspEnabled()) {
+        return toolError("LSP_DISABLED", "lsp 默认关闭。启用: QLING_LSP=1（需可加载 typescript）。通用符号搜索用 code_symbols。", { category: "permission" });
+    }
+    const action = String(args.action ?? "").trim().toLowerCase();
+    const allowed = ["definition", "hover", "references", "document_symbols", "symbols"];
+    if (!allowed.includes(action)) {
+        return toolError("LSP_INVALID_ACTION", `action must be one of: definition, hover, references, document_symbols`);
+    }
+    const filePath = String(args.path ?? "").trim();
+    if (!filePath) {
+        return toolError("LSP_MISSING_PATH", "path is required");
+    }
+    const ts = await loadTypeScript();
+    if (!ts) {
+        return toolError("LSP_TYPESCRIPT_MISSING", "无法加载 typescript 包。请在项目中安装 typescript（devDependency）后重试。");
+    }
+    const roots = getRuntimeRootsFromEnv();
+    const workspaceDir = roots.workspaceDir ?? process.cwd();
+    const abs = resolveAbsFile(workspaceDir, filePath);
+    const rootsWithWorkspace = { ...roots, workspaceDir };
+    if (!isWithinAllowedRoots(abs, rootsWithWorkspace)) {
+        return toolError("LSP_PATH_OUTSIDE_ROOTS", `拒绝读取 runtime roots 外文件: ${filePath}`, { category: "permission" });
+    }
+    try {
+        const bundle = getOrCreateServiceForFile(ts, workspaceDir, abs);
+        const { line, character } = parseLineChar(args);
+        if (action === "definition") {
+            const locs = lspDefinition(bundle, abs, line, character);
+            if (locs.length === 0) {
+                return toolSuccess(`lsp definition: (none) at ${filePath}:${line}:${character}`);
+            }
+            const lines = locs.map((l) => `${l.file}:${l.line}:${l.character}` +
+                (l.preview ? `  ${l.preview}` : ""));
+            return toolSuccess(`lsp definition (${locs.length}):\n${lines.join("\n")}`);
+        }
+        if (action === "hover") {
+            const h = lspHover(bundle, abs, line, character);
+            if (!h) {
+                return toolSuccess(`lsp hover: (none) at ${filePath}:${line}:${character}`);
+            }
+            return toolSuccess(`lsp hover @ ${filePath}:${line}:${character}\n${h.display}` +
+                (h.documentation ? `\n\n${h.documentation}` : ""));
+        }
+        if (action === "references") {
+            const limit = clampLspLimit(args.limit, 30);
+            const locs = lspReferences(bundle, abs, line, character, limit);
+            if (locs.length === 0) {
+                return toolSuccess(`lsp references: (none)`);
+            }
+            const lines = locs.map((l) => `${l.file}:${l.line}:${l.character}`);
+            return toolSuccess(`lsp references (${locs.length}):\n${lines.join("\n")}`);
+        }
+        // document_symbols | symbols
+        const limit = clampLspLimit(args.limit, 80);
+        const syms = lspDocumentSymbols(bundle, abs, limit);
+        if (syms.length === 0) {
+            return toolSuccess(`lsp document_symbols: (none) in ${filePath}`);
+        }
+        const lines = syms.map((s) => `${s.line}:${s.character}  [${s.kind}] ${s.name}`);
+        return toolSuccess(`lsp document_symbols (${syms.length}) ${filePath}:\n${lines.join("\n")}`);
+    }
+    catch (err) {
+        return toolError("LSP_FAILED", err instanceof Error ? err.message : String(err), { category: "runtime" });
+    }
+}

package/dist/tools/patch.d.ts

@@ -17,6 +17,11 @@ export declare function runPatch(args: {
     chunks: PatchChunk[];
     dry_run?: boolean;
 }): Promise<ToolResult>;
+/**
+ * Write via temp file then rename. Falls back to direct write on platforms
+ * where rename cannot replace an existing target (common on Windows).
+ */
+export declare function writeFileAtomic(targetPath: string, content: string): Promise<void>;
 export declare function generateUnifiedDiff(filePath: string, originalContent: string, newContent: string): string;
 export {};
 //# sourceMappingURL=patch.d.ts.map

package/dist/tools/patch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patch.d.ts","sourceRoot":"","sources":["../../src/tools/patch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzD,yCAAyC;AACzC,eAAO,MAAM,oBAAoB,QAAkB,CAAC;AAEpD,eAAO,MAAM,SAAS,EAAE,cA+EvB,CAAC;AAEF,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,gBAAgB,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,cAAc,CAmC5F;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAAC,UAAU,CAAC,CA4HtB;AAkID,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,GACjB,MAAM,CA6IR"}
+{"version":3,"file":"patch.d.ts","sourceRoot":"","sources":["../../src/tools/patch.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzD,yCAAyC;AACzC,eAAO,MAAM,oBAAoB,QAAkB,CAAC;AAEpD,eAAO,MAAM,SAAS,EAAE,cA+EvB,CAAC;AAEF,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,gBAAgB,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,cAAc,CAmC5F;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAAC,UAAU,CAAC,CA4HtB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBxF;AAkID,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,GACjB,MAAM,CA6IR"}

package/dist/tools/patch.js

@@ -1,5 +1,6 @@
-import { readFile, writeFile } from "fs/promises";
-import { relative } from "path";
+import { randomBytes } from "crypto";
+import { readFile, rename, unlink, writeFile } from "fs/promises";
+import { basename, dirname, join, relative } from "path";
 import { getErrorMessage, toolError, toolSuccess } from "./error-utils.js";
 import { checkSensitiveWriteTarget, getRuntimeRootsFromEnv, isPathAllowedForWrite, resolveToolPath, } from "../runtime-paths.js";
 /** 超过该字节数拒绝做 LCS diff / 写入，防止超大文件 OOM */
@@ -205,9 +206,9 @@ export async function runPatch(args) {
         return toolSuccess(`🔎 dry_run OK — would apply ${chunks.length} patch chunk(s) to ${resolvedPath}\n` +
             `${summary}\n\n${diffText}\n\n(no file written)`);
     }
-    // Write changes after all validations pass
+    // Atomic write after all validations pass (temp + rename; Windows-safe fallback)
     try {
-        await writeFile(resolvedPath, currentContent, "utf-8");
+        await writeFileAtomic(resolvedPath, currentContent);
         return toolSuccess(`✅ Successfully applied ${chunks.length} patch chunk(s) to ${resolvedPath}\n` +
             `${summary}\n\n${diffText}`);
     }
@@ -215,6 +216,26 @@ export async function runPatch(args) {
         return toolError("PATCH_WRITE_FAILED", `failed to write file: ${getErrorMessage(err)}`);
     }
 }
+/**
+ * Write via temp file then rename. Falls back to direct write on platforms
+ * where rename cannot replace an existing target (common on Windows).
+ */
+export async function writeFileAtomic(targetPath, content) {
+    const dir = dirname(targetPath);
+    const tmp = join(dir, `.qling-patch-${basename(targetPath)}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`);
+    await writeFile(tmp, content, "utf-8");
+    try {
+        await rename(tmp, targetPath);
+    }
+    catch {
+        try {
+            await writeFile(targetPath, content, "utf-8");
+        }
+        finally {
+            await unlink(tmp).catch(() => undefined);
+        }
+    }
+}
 function countOccurrences(text, searchStr) {
     if (!searchStr)
         return 0;

package/dist/tools/search.d.ts

@@ -1,4 +1,9 @@
 import { ToolDefinition, ToolResult } from "../types.js";
+/** Sprint 3: 默认更紧的结果预算，减少上下文膨胀 */
+export declare const SEARCH_DEFAULT_LIMIT = 40;
+export declare const SEARCH_MAX_LIMIT = 200;
+/** 单行匹配展示上限（字符，含路径前缀后） */
+export declare const SEARCH_MAX_LINE_CHARS = 240;
 export declare const searchTool: ToolDefinition;
 export declare function runSearch(args: {
     pattern: string;
@@ -8,4 +13,6 @@ export declare function runSearch(args: {
     context?: number;
     limit?: number;
 }): Promise<ToolResult>;
+/** Truncate long match lines so search results stay harness-friendly. */
+export declare function truncateSearchLine(line: string, maxChars?: number): string;
 //# sourceMappingURL=search.d.ts.map

package/dist/tools/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../src/tools/search.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqBzD,eAAO,MAAM,UAAU,EAAE,cAgGxB,CAAC;AAEF,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,UAAU,CAAC,CAkDtB"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../src/tools/search.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzD,kCAAkC;AAClC,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC,0BAA0B;AAC1B,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAiBzC,eAAO,MAAM,UAAU,EAAE,cAgGxB,CAAC;AAEF,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,UAAU,CAAC,CAmDtB;AA6hBD,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,SAAwB,GAAG,MAAM,CAIzF"}

package/dist/tools/search.js

@@ -10,6 +10,11 @@ import { execFile } from "child_process";
 import { getErrorMessage, toolError, toolSuccess } from "./error-utils.js";
 import { getRuntimeRootsFromEnv, isWithinAllowedRoots, resolveToolPath } from "../runtime-paths.js";
 const MAX_SEARCH_FILE_BYTES = 2 * 1024 * 1024; // 2MB
+/** Sprint 3: 默认更紧的结果预算，减少上下文膨胀 */
+export const SEARCH_DEFAULT_LIMIT = 40;
+export const SEARCH_MAX_LIMIT = 200;
+/** 单行匹配展示上限（字符，含路径前缀后） */
+export const SEARCH_MAX_LINE_CHARS = 240;
 const DEFAULT_IGNORES = new Set([
     "node_modules",
     ".git",
@@ -132,7 +137,8 @@ export async function runSearch(args) {
         return toolError("SEARCH_INVALID_TARGET", `unsupported target: ${target}`);
     }
     const context = clamp(args.context ?? 0, 0, 10);
-    const limit = clamp(args.limit ?? 50, 1, 200);
+    // Sprint 3: tighter limit 40；单行过长截断，避免冲垮上下文
+    const limit = clamp(args.limit ?? SEARCH_DEFAULT_LIMIT, 1, SEARCH_MAX_LIMIT);
     const absPath = resolveToolPath(searchPath, roots, "workspace");
     if (!isWithinAllowedRoots(absPath, roots)) {
         return toolError("SEARCH_OUTSIDE_ALLOWED_ROOT", `${absPath} is outside allowed roots`);
@@ -239,7 +245,9 @@ async function searchWithRipgrep(absPath, pattern, target, fileGlob, context, li
                 const truncated = parsedLines.length > limit;
                 const sliced = parsedLines.slice(0, limit);
                 const suffix = truncated ? `\n... (truncated at ${limit} results)` : "";
-                const formatted = sliced.map(pl => `${pl.file}:${pl.line}:${pl.content}`).join("\n");
+                const formatted = sliced
+                    .map((pl) => truncateSearchLine(`${pl.file}:${pl.line}:${pl.content}`))
+                    .join("\n");
                 resolve(toolSuccess(`${truncated ? `${limit}+` : parsedLines.length} match(es):\n${formatted}${suffix}`));
                 return;
             }
@@ -399,7 +407,9 @@ async function searchWithGitGrep(absPath, pattern, target, fileGlob, context, li
                     const truncated = parsedLines.length > limit;
                     const sliced = parsedLines.slice(0, limit);
                     const suffix = truncated ? `\n... (truncated at ${limit} results)` : "";
-                    const formatted = sliced.map(pl => `${pl.file}:${pl.line}:${pl.content}`).join("\n");
+                    const formatted = sliced
+                        .map((pl) => truncateSearchLine(`${pl.file}:${pl.line}:${pl.content}`))
+                        .join("\n");
                     resolve(toolSuccess(`${truncated ? `${limit}+` : parsedLines.length} match(es):\n${formatted}${suffix}`));
                     return;
                 }
@@ -631,6 +641,13 @@ function buildRegex(pattern, flags = "") {
 function escapeRegExp(char) {
     return char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+/** Truncate long match lines so search results stay harness-friendly. */
+export function truncateSearchLine(line, maxChars = SEARCH_MAX_LINE_CHARS) {
+    const text = String(line ?? "");
+    if (text.length <= maxChars)
+        return text;
+    return text.slice(0, Math.max(0, maxChars - 1)) + "…";
+}
 function clamp(value, min, max) {
     return Math.max(min, Math.min(max, value));
 }

package/dist/tools/skill.d.ts

@@ -1,4 +1,6 @@
 import { ToolDefinition, ToolResult } from "../types.js";
+/** 包根目录（dist/tools/skill.js → 仓库或 npm 包根，含 skills/） */
+export declare function getPackageRootForSkills(): string;
 export declare function getSkillDirs(): string[];
 export declare const skillTool: ToolDefinition;
 export declare function runSkill(args: {

package/dist/tools/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/tools/skill.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzD,wBAAgB,YAAY,IAAI,MAAM,EAAE,CAUvC;AAiCD,eAAO,MAAM,SAAS,EAAE,cAmEvB,CAAC;AAEF,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CA4D3F"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/tools/skill.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzD,uDAAuD;AACvD,wBAAgB,uBAAuB,IAAI,MAAM,CAIhD;AAMD,wBAAgB,YAAY,IAAI,MAAM,EAAE,CAuBvC;AAiCD,eAAO,MAAM,SAAS,EAAE,cAmEvB,CAAC;AAEF,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CA0E3F"}

package/dist/tools/skill.js

@@ -5,21 +5,43 @@
 // ============================================================
 import { readFile } from "fs/promises";
 import { existsSync } from "fs";
-import { resolve, join } from "path";
+import { homedir } from "os";
+import { resolve, join, dirname } from "path";
+import { fileURLToPath } from "url";
 import { toolError, toolSuccess } from "./error-utils.js";
 import { listSkills, searchSkills } from "../skills/registry.js";
+import { formatSkillScanBlockMessage, scanSkillContent, } from "../skills/security-scan.js";
+/** 包根目录（dist/tools/skill.js → 仓库或 npm 包根，含 skills/） */
+export function getPackageRootForSkills() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    // dist/tools → ../.. = package root
+    return resolve(here, "..", "..");
+}
 // Skill 查找路径
 // 支持两种格式：
 //   name="foo"        → 搜索 skills/foo.md
 //   name="@scope/foo" → 搜索 skills/scopes/scope/foo.md
 export function getSkillDirs() {
-    const dirs = [
-        resolve(process.cwd(), "skills"),
-        resolve(process.cwd(), ".qling/skills"),
-    ];
+    const dirs = [];
+    const seen = new Set();
+    const add = (p) => {
+        const abs = resolve(p);
+        if (seen.has(abs))
+            return;
+        seen.add(abs);
+        dirs.push(abs);
+    };
+    // 1) 随包发布的 skills（全局 npm 安装仍可用）
+    add(join(getPackageRootForSkills(), "skills"));
+    // 2) 用户全局
+    add(join(homedir(), ".qling", "skills"));
+    // 3) 当前工作区
+    add(resolve(process.cwd(), "skills"));
+    add(resolve(process.cwd(), ".qling", "skills"));
+    // 4) 可选 Hermes 兼容路径
     const hermesHome = process.env.HERMES_HOME;
     if (hermesHome && hermesHome.trim()) {
-        dirs.push(join(hermesHome.trim(), "skills"));
+        add(join(hermesHome.trim(), "skills"));
     }
     return dirs;
 }
@@ -58,26 +80,26 @@ function resolveSkillPath(name) {
 }
 export const skillTool = {
     name: "skill",
-    description: "Dynamically load a skill/knowledge file (.md). Use when encountering unfamiliar tools, APIs, or frameworks. Use 'list' to discover available skills, 'search query=X' to find skills, or 'name=X' to load one.",
+    description: "Load a skill knowledge file. Use for unfamiliar tools/APIs and ALWAYS before opencli/social platforms (Douyin, Xiaohongshu, Weibo, Bilibili, TikTok, Twitter). Actions: list | search query= | name=opencli.",
     longDescription: `动态加载技能/知识文件（SKILL.md），内容通过 tool_result 注入上下文。
 
 **核心原则**: "用到什么知识，临时加载什么知识，不塞 system prompt"
 
 **三种操作**:
 - skill list — 列出所有可用技能
-- skill search query="docker" — 搜索技能
-- skill name="docker" — 加载技能内容
+- skill search query="opencli" — 搜索技能
+- skill name="opencli" — 加载 opencli 调用手册（抖音/小红书等）
 
 **查找路径**:
-- skills/{name}.md
-- skills/{category}/{name}.md
+- 包内 skills/（npm 全局安装可用）
+- ~/.qling/skills/
+- 工作区 skills/ 与 .qling/skills/
 - @scope/name → scopes/{scope}/{name}.md
 
 **使用场景**:
+- 抖音/小红书/微博/B站/TikTok/推特 → skill(name="opencli") 再用 bash 跑 opencli
 - 调用 docker 但不熟悉命令 → skill(name="docker")
-- 调用 Kubernetes API → skill(name="k8s-debug")
 - 不确定有哪些技能 → skill list
-- 搜索特定领域技能 → skill search query="api"
 
 **返回内容**:
 - 文件的 markdown body（不含 frontmatter）
@@ -167,13 +189,24 @@ export async function runSkill(args) {
     }
     try {
         const content = await readFile(filePath, "utf-8");
+        const scan = scanSkillContent(content);
+        if (!scan.ok) {
+            return toolError("SKILL_SECURITY_BLOCKED", formatSkillScanBlockMessage(name, scan));
+        }
         const lines = content.split("\n");
         const startIdx = lines.findIndex((l) => l.trim() === "---");
         const endIdx = startIdx >= 0 ? lines.findIndex((l, i) => i > startIdx && l.trim() === "---") : -1;
         const body = startIdx >= 0 && endIdx >= 0
             ? lines.slice(endIdx + 1).join("\n").trim()
             : content;
-        return toolSuccess(`📖 Skill: ${name}\n\n${body}`);
+        let prefix = `📖 Skill: ${name}\n\n`;
+        if (scan.findings.length > 0 && scan.mode === "warn") {
+            prefix +=
+                `⚠️ 安全扫描警告（仍加载）:\n` +
+                    scan.findings.map((f) => `  - [${f.severity}] ${f.rule}: ${f.detail}`).join("\n") +
+                    "\n\n";
+        }
+        return toolSuccess(`${prefix}${body}`);
     }
     catch (err) {
         return toolError("SKILL_READ_FAILED", `failed to read skill: ${err.message}`);

package/dist/tools/subtask.d.ts

@@ -1,8 +1,10 @@
 import type { ToolDefinition, ToolResult } from "../types.js";
 export declare const subtaskTool: ToolDefinition;
 export declare function runSubtask(args: {
-    task: string;
+    task?: string;
+    tasks?: unknown;
     context?: string;
+    role?: string;
     max_iterations?: number;
     timeout_ms?: number;
 }): Promise<ToolResult>;

package/dist/tools/subtask.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subtask.d.ts","sourceRoot":"","sources":["../../src/tools/subtask.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAa9D,eAAO,MAAM,WAAW,EAAE,cAyBzB,CAAC;AAEF,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,UAAU,CAAC,CAwFtB"}
+{"version":3,"file":"subtask.d.ts","sourceRoot":"","sources":["../../src/tools/subtask.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA0C9D,eAAO,MAAM,WAAW,EAAE,cAkDzB,CAAC;AAgDF,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,UAAU,CAAC,CAsHtB"}