@webskill/chatbot 0.19.0 → 0.20.0

package/README.md

@@ -114,18 +114,24 @@ implementation (OPFS storage, skills, demo/model providers, console embedding).
 `ChatEngine.listSessions()` forwards straight to the `SessionStore`, so the
 default `FsSessionStore` decides what you see:
 
-- Sessions are sorted by `createdAt` **ascending**, and a page is taken from the
-  **tail** of that list. The first screen therefore holds the _newest_ sessions,
-  and the oldest session is not on it.
+- Sessions come back **newest first**: `items[0]` is the most recently created
+  session, and the first screen holds the newest page.
 - The page size is the store's (`FS_SESSION_PAGE_SIZE`, 50). `<Chatbot>` does
   not override it — pass your own `sessionStore` if you need another size.
-- `nextCursor` points further back in history. While it is set, the session list
-  shows a **Load earlier sessions** entry; when it is absent the list is at the
-  end and the entry disappears, so "no button" always means "nothing older".
+- `nextCursor` points further back in history, and the page it returns is
+  appended to the **end** of the list. While it is set, the session list shows a
+  **Load earlier sessions** entry **below** the existing rows; when it is absent
+  the list is at the end and the entry disappears, so "no button" always means
+  "nothing older".
 - Session files that cannot be parsed are skipped rather than failing the whole
   list. Their file names come back in `skipped` and are shown above the list, so
   a session you expected to see but cannot is always accounted for.
 
+If you supply your own `SessionStore`, its `list()` must return the page
+newest-first. This is a behavioural contract that the type system cannot check:
+a store that still returns ascending order will render the oldest session at the
+top.
+
 ## Embedding models
 
 - **As a component** inside an existing web app — mount `<Chatbot>` in your own

package/dist/index.d.ts

@@ -1379,6 +1379,11 @@ declare const chatbotDictionary: {
     'interaction.visionDelegation.rememberFallback': string;
     'interaction.visionDelegation.rememberSession': string;
     'interaction.visionDelegation.body': string;
+    'interaction.delegation.title': string;
+    'interaction.delegation.body': string;
+    'interaction.delegation.declineNote': string;
+    'interaction.delegation.concurrency': string;
+    'interaction.delegation.suggestedNote': string;
     'interaction.imageSource.title': string;
     'interaction.imageSource.pageImageBody': string;
     'interaction.imageSource.remoteImageBody': string;
@@ -1808,6 +1813,11 @@ declare const chatbotDictionary: {
     'interaction.visionDelegation.rememberFallback': string;
     'interaction.visionDelegation.rememberSession': string;
     'interaction.visionDelegation.body': string;
+    'interaction.delegation.title': string;
+    'interaction.delegation.body': string;
+    'interaction.delegation.declineNote': string;
+    'interaction.delegation.concurrency': string;
+    'interaction.delegation.suggestedNote': string;
     'interaction.imageSource.title': string;
     'interaction.imageSource.pageImageBody': string;
     'interaction.imageSource.remoteImageBody': string;
@@ -2240,6 +2250,11 @@ declare const useT: () => TranslateFn<{
     'interaction.visionDelegation.rememberFallback': string;
     'interaction.visionDelegation.rememberSession': string;
     'interaction.visionDelegation.body': string;
+    'interaction.delegation.title': string;
+    'interaction.delegation.body': string;
+    'interaction.delegation.declineNote': string;
+    'interaction.delegation.concurrency': string;
+    'interaction.delegation.suggestedNote': string;
     'interaction.imageSource.title': string;
     'interaction.imageSource.pageImageBody': string;
     'interaction.imageSource.remoteImageBody': string;
@@ -2669,6 +2684,11 @@ declare const useT: () => TranslateFn<{
     'interaction.visionDelegation.rememberFallback': string;
     'interaction.visionDelegation.rememberSession': string;
     'interaction.visionDelegation.body': string;
+    'interaction.delegation.title': string;
+    'interaction.delegation.body': string;
+    'interaction.delegation.declineNote': string;
+    'interaction.delegation.concurrency': string;
+    'interaction.delegation.suggestedNote': string;
     'interaction.imageSource.title': string;
     'interaction.imageSource.pageImageBody': string;
     'interaction.imageSource.remoteImageBody': string;
@@ -3208,6 +3228,6 @@ declare function ErrorCard({ code, message, loopLimits, onOpenSettings, onDismis
  * Version of the published `@webskill/chatbot` package, injected at build time.
  * @stable
  */
-declare const CHATBOT_VERSION = "0.19.0";
+declare const CHATBOT_VERSION = "0.20.0";
 //#endregion
 export { A2uiSurfaceHost, type A2uiSurfaceHostProps, A2uiSurfaceSnapshotHost, type A2uiSurfaceSnapshotHostProps, type AppearanceChange, CHATBOT_VERSION, type ChatAttachmentInput, type ChatAttachmentMeta, type ChatContentPart, ChatEngine, type ChatEngineOptions, type ChatEvent, type ChatInteractionRecord, type ChatLayout, type ChatMessage, type ChatRunPhase, type ChatSessionListResult, type ChatSessionMeta, type ChatTheme, type ChatThinking, type ChatTokenUsage, type ChatToolCall, Chatbot, type ChatbotConfig, type ChatbotGovernancePorts, type ChatbotHostAdapter, type ChatbotProps, ChatbotVisionDelegate, type ChatbotVisionDelegateOptions, CompositeUiBridge, type CompositeUiBridgeDeps, DEFAULT_RENDERER_CAPABILITIES, DEFAULT_RUNTIME_CONFIG_STORAGE_KEY, type DownloadableFile, type DwgHost, ErrorCard, type ErrorCardProps, InteractionCard, type InteractionCardProps, InterruptedBanner, type InterruptedBannerProps, type Locale, type LocalizedText, OpenUiSurfaceHost, type OpenUiSurfaceHostProps, OpenUiSurfaceSnapshotHost, type OpenUiSurfaceSnapshotHostProps, type QuickPrompt, type QuickPromptIconName, type RendererCapability, type RendererKind, type ResolvedChatLayout, ResultBlockList, type ResultBlockListProps, ResultBlocksPro, type ResultBlocksProProps, type RunSnapshot, type RuntimeAppearanceConfig, type RuntimeConfig, type RuntimeConfigStore, type RuntimeQuickPrompt, type RuntimeRendererId, type SandboxExecutorDeps, type SettingsSectionId, SkillBadges, SpecInteraction, type SpecInteractionProps, VercelPayloadPreview, type VercelPayloadPreviewProps, VercelSurfaceHost, type VercelSurfaceHostProps, VercelSurfaceSnapshotHost, type VercelSurfaceSnapshotHostProps, type VisionDelegationConsent, type VisionDelegationEndpoint, WEB_OFFICE_TEMPLATE_PREFIX, chatbotDictionary, configureA2uiMarkdown, createLocalStorageRuntimeConfigStore, createMemoryRuntimeConfigStore, isLlmEntryUsable, pickUsableLlmEntry, probeA2uiAvailability, probeOpenUiAvailability, sandboxExecutorDeps, useT };

package/dist/index.js

@@ -19,7 +19,7 @@ import { fromMarkdown } from "mdast-util-from-markdown";
 import { gfmFromMarkdown, gfmToMarkdown } from "mdast-util-gfm";
 import { gfm } from "micromark-extension-gfm";
 import { ActionBarPrimitive, AttachmentPrimitive, AuiProvider, ComposerPrimitive, ExternalThread, INTERNAL, MessagePrimitive, ThreadListItemPrimitive, ThreadListPrimitive, ThreadPrimitive, useAui, useAuiState, useMessagePartText } from "@assistant-ui/react";
-import { BEHAVIOR_RECORDS_KEY, DEFAULT_LOOP_LIMITS, DEFAULT_USER_PROFILE_LIMITS, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FsRunTraceStore, FsSessionStore, FsToolStepStore, FullDisclosureRouter, SPREADSHEET_LIMITS, SUPPORTED_DOCUMENT_MIME, SerializingMemoryStore, SkillDiscovery, USER_PROFILE_KEY, WebSkillError, WebSkillRuntime, applyUserProfileImport, assertRemoteUrlAllowed, assertSafePathSegment, atomicWriteText, diffUserProfile, exportUserProfile, extractedDocumentFormat, formatAttachmentText, isUnsupportedRunSnapshot, messageOf, readBehaviorRecords, readUserProfile, refineUserProfile, resolveInsideRoot, sanitizeUntrustedLine, summarizeRunUsage, summarizeToolCalls, textParts } from "@webskill/sdk";
+import { BEHAVIOR_RECORDS_KEY, DEFAULT_LOOP_LIMITS, DEFAULT_USER_PROFILE_LIMITS, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FsRunTraceStore, FsSessionStore, FsToolStepStore, FullDisclosureRouter, SPREADSHEET_LIMITS, SUPPORTED_DOCUMENT_MIME, SerializingMemoryStore, SkillDiscovery, SkillReader, USER_PROFILE_KEY, WebSkillError, WebSkillRuntime, applyUserProfileImport, assertRemoteUrlAllowed, assertSafePathSegment, atomicWriteText, diffUserProfile, exportUserProfile, extractedDocumentFormat, formatAttachmentText, isUnsupportedRunSnapshot, messageOf, readBehaviorRecords, readUserProfile, refineUserProfile, resolveInsideRoot, sanitizeUntrustedLine, summarizeRunUsage, summarizeToolCalls, textParts } from "@webskill/sdk";
 import { BrowserWorkerScriptExecutor, WebOfficePolicy, capturePhoto, checkCameraAvailability, checkDictationAvailability, compressImageToBudget, createEncryptedMemoryStore, createLlmClient, createWebOfficeToolSource, deleteMemoryEncryptionKey, openCamera, openMemoryEncryptionKey, probeChromeBuiltinAvailability, startDictation, toDocumentImage } from "@webskill/sdk/browser";
 import { JsonRenderSpecSurface, NativeSpecSurface, OpenUiSpecSurface, ReactBridgeState, SpecInteractionChannel, SurfaceFormTextsProvider, UiSurfaceSnapshotList, probeJsonRenderAvailability } from "@webskill/sdk/ui-react";
 import { A2UI_SPEC_FORM_PATH, collectFormScopes, createUiCatalogToolSource, fromA2uiSpecAction, fromA2uiSurfaceAction, interactionToFormModel, interactionToUiSpec, loadOpenUiPeers, loadWebSkillLitCatalog, renderMiniChart, shapeInteractionValue, toA2uiSpecMessages, toA2uiSurfaceAction, toVercelToolInvocation, uiCatalog } from "@webskill/sdk/ui";
@@ -26512,6 +26512,11 @@ const chatbotDictionary = defineDictionary({
 		"interaction.visionDelegation.rememberFallback": "Don’t ask again for this endpoint",
 		"interaction.visionDelegation.rememberSession": "Don’t ask again in this conversation",
 		"interaction.visionDelegation.body": "The model you selected cannot read images. Send the {images} image(s) produced by “{source}” to “{label}” at {host} to be described? If you decline, nothing is sent and the turn continues without them.",
+		"interaction.delegation.title": "Run parts of this task in parallel?",
+		"interaction.delegation.body": "Sub-agents can work on independent parts of this task at the same time. What they do is not recorded in this conversation, so this conversation can no longer be saved as a new skill.",
+		"interaction.delegation.declineNote": "If you decline, the assistant does the work itself in this conversation and will not ask again.",
+		"interaction.delegation.concurrency": "Run at most",
+		"interaction.delegation.suggestedNote": "The assistant suggested {count}.",
 		"interaction.imageSource.title": "Put a picture into the document?",
 		"interaction.imageSource.pageImageBody": "Allow the assistant to copy a picture from the page into the document it is building? The picture is saved with this conversation until you delete it.",
 		"interaction.imageSource.remoteImageBody": "Allow the assistant to download an image from {url} and put it into the document it is building? Fetching it tells that server your network address and when you asked for it.",
@@ -26941,6 +26946,11 @@ const chatbotDictionary = defineDictionary({
 		"interaction.visionDelegation.rememberFallback": "以后不再为该端点询问",
 		"interaction.visionDelegation.rememberSession": "本次对话不再询问，默认同意",
 		"interaction.visionDelegation.body": "你选中的模型看不了图片。是否把「{source}」产出的 {images} 张图发往「{label}」（{host}）请它描述？不同意则什么都不会发出，这一轮就当没看到图。",
+		"interaction.delegation.title": "把这件任务拆成几个并行去做？",
+		"interaction.delegation.body": "子助手可以同时处理这件任务里互不相干的部分。它们做过什么不会记进本次会话，因此这次会话之后就存不成新技能了。",
+		"interaction.delegation.declineNote": "不同意则助手自己在本次会话里做完，之后也不会再问。",
+		"interaction.delegation.concurrency": "最多同时跑",
+		"interaction.delegation.suggestedNote": "助手建议 {count} 个。",
 		"interaction.imageSource.title": "把图片放进文档？",
 		"interaction.imageSource.pageImageBody": "允许助手把当前页面上的一张图放进它正在生成的文档吗？该图会随本次会话保存，直到你删除这次会话。",
 		"interaction.imageSource.remoteImageBody": "允许助手从 {url} 下载一张图片放进它正在生成的文档吗？下载会把你的网络地址与访问时间告知该服务器。",
@@ -27377,6 +27387,24 @@ function redactInteractionValues(value, request) {
 */
 const CHATBOT_PROFILE_USER_ID = "local";
 /**
+* 并发子 agent 的宿主硬上限（0.23.0 分册 19 FR-19.16）。
+*
+* 它是模型建议值与用户选定值之上的天花板：模型建议 50、用户随手确认了，
+* 仍然只有这么多能同时跑。并发子 agent 会同时抢模型配额、页面操作通道与用户注意力，
+* 这个数字不是保守，是止损点。
+*/
+const DELEGATION_MAX_CONCURRENCY = 4;
+/**
+* 从确认卡的响应里读用户选定的并发数。
+*
+* 卡回的是 `{ concurrency: n }`（渲染层带了选择器）或 `true`（宿主用的是通用授权渲染，
+* 没有选择器）。后一种情况沿用建议值——用户点了同意，但没有表达过别的数字。
+*/
+function readChosenConcurrency(value, fallback, max) {
+	const raw = typeof value === "object" && value !== null ? value["concurrency"] : void 0;
+	return Math.min(Math.max(1, typeof raw === "number" && Number.isFinite(raw) ? Math.floor(raw) : fallback), Math.max(1, max));
+}
+/**
 * 终止原因 → 稳定错误码（FR-21.2）。不再全部压平为 RUN_FAILED：
 * “跑超时了”与“模型没配对”对用户是两件事，得给不同的下一步。
 */
@@ -27441,6 +27469,29 @@ const MAX_DOCUMENT_IMAGE_BYTES = 8e6;
 */
 const WEB_OFFICE_TEMPLATE_PREFIX = "weboffice:";
 /**
+* 技能自带文件作模板时的取件号前缀（0.23.0 分册 23 · FR-23.2）。
+*
+* 形态是 `skill:<技能名>/<技能目录内的相对路径>`。技能名的字符集
+* （`SKILL_NAME_PATTERN`）既不含 `/` 也不含 `:`，所以前缀之后的第一个 `/`
+* 就是唯一的分隔点，不需要第二个分隔符。
+*
+* 与 `WEB_OFFICE_TEMPLATE_PREFIX` 不同，这个常量**不进公开导出**：宿主不需要拼它，
+* 拼它的是模型，而模型看到的是工具描述里那句话（设计 24 §10 的零契约变更）。
+*/
+const SKILL_FILE_PREFIX = "skill:";
+/** 模板取件号里所有"指名道姓"的前缀：认出来就只走它自己那条通路，不回落到本地取件 */
+const PREFIXED_TEMPLATE_IDS = [SKILL_FILE_PREFIX, WEB_OFFICE_TEMPLATE_PREFIX];
+/** `skill:quotation/assets/tpl.xlsx` → `{ skill: 'quotation', path: 'assets/tpl.xlsx' }` */
+function parseSkillFileId(id) {
+	const rest = id.slice(6);
+	const cut = rest.indexOf("/");
+	if (cut <= 0 || cut === rest.length - 1) return void 0;
+	return {
+		skill: rest.slice(0, cut),
+		path: rest.slice(cut + 1)
+	};
+}
+/**
 * 图片附件的指认说明（0.21.0 分册 22 · FR-22.4b）。
 *
 * 文本、docx、xlsx、PDF 进上下文时都带 `--- Attachment: … ---` 标签，唯独图片是一片裸图：
@@ -27589,6 +27640,8 @@ var ChatEngine = class {
 	#ready;
 	/** 已装配的 runtime（cancel 等同步委托用；未装配时为 undefined） */
 	#runtime;
+	/** 技能名 → 技能根目录，`skill:` 取件号用（0.23.0 分册 23）。惰性建，技能仓变更时清 */
+	#skillIndex;
 	/**
 	* 每轮 `send()` 开头刷新的运行时配置快照（0.15.0 分册 15 · FR-15.6）。
 	* 只给那些必须同步回答、又不能等到重建运行时的开关用。
@@ -27951,6 +28004,94 @@ var ChatEngine = class {
 		throw new WebSkillError("VALIDATION_FAILED", `image reference "${kind}:${rest}" has no known prefix; expected artifact:, upload: or remote:`);
 	}
 	/**
+	* 技能生成里被指认的那个附件（0.23.0 分册 20 FR-20.2）。
+	*
+	* **只在当前会话的消息里查**：候选集合恰好等于用户自己这次会话上传的东西，
+	* 别的会话的 id 在这里查不到，也就谈不上被复制进技能包（AC-20.4）。
+	* 路径一寸都不来自模型——它给的是 id，路径从附件记录里取，与 `#uploadOfRun` 同一范式。
+	*
+	* 落到哪条附件上仍走 `findAttachmentByRef`：模型上下文里最显眼的是文件名而不是
+	* `att-…` 随机串，只认 id 的结果就是这条能力形同虚设。
+	*/
+	async #skillAttachment(id) {
+		const sessionId = this.#currentSessionId;
+		if (sessionId === void 0) return void 0;
+		const messages = (await this.#sessions.get(sessionId).catch(() => void 0))?.messages ?? [];
+		for (let i = messages.length - 1; i >= 0; i -= 1) {
+			const message = messages[i];
+			if (message?.role !== "user") continue;
+			const hit = findAttachmentByRef(message.attachments ?? [], id);
+			if (hit === void 0) continue;
+			return {
+				bytes: await this.#adapter.storage.readBinary(resolveInsideRoot(this.attachmentsRoot, hit.path)),
+				name: hit.name,
+				contentType: hit.contentType
+			};
+		}
+	}
+	/**
+	* `skill:<技能名>/<路径>` 的取件（0.23.0 分册 23 FR-23.1）。
+	*
+	* 这条通路**不经过** `DownloadedFilePolicy`，所以既不弹授权卡也不列下载目录——
+	* 是结构性的，不是"记得别弹"（FR-23.8）。路径越界由 `SkillReader` 内建的
+	* `resolveInsideRoot` 挡（FR-23.5）。
+	*
+	* 取不到一律**抛**而不是返回 `undefined`：模板工具对 `undefined` 会回一句
+	* 「换个下载 id 再试」，那正是本册要根除的那句话（FR-23.9）。
+	*/
+	async #readSkillTemplate(id, fs) {
+		const parsed = parseSkillFileId(id);
+		if (!parsed) throw new WebSkillError("TOOL_UNSUPPORTED", `Malformed skill file id "${id}". Use "${SKILL_FILE_PREFIX}<skill name>/<path inside the skill>", for example "${SKILL_FILE_PREFIX}quotation/assets/template.xlsx".`);
+		const { skill, path } = parsed;
+		let index = await this.#skillFileIndex(fs);
+		if (!index.has(skill)) {
+			this.#skillIndex = void 0;
+			index = await this.#skillFileIndex(fs);
+		}
+		if (!index.has(skill)) throw new WebSkillError("SKILL_NOT_FOUND", `No installed skill is named "${skill}". Skill file ids look like "${SKILL_FILE_PREFIX}<skill name>/<path>".`);
+		const canRead = this.#options.governance?.skillStateGuard?.canRead;
+		if (canRead && await canRead(skill) === false) throw new WebSkillError("SKILL_DISABLED", `The skill "${skill}" is currently disabled or quarantined, so its files cannot be read. Tell the user instead of trying another path.`);
+		try {
+			const bytes = await new SkillReader(fs, index).readSkillBinary(skill, path);
+			return {
+				name: path.split("/").pop() ?? path,
+				bytes
+			};
+		} catch (error) {
+			throw new WebSkillError(error instanceof WebSkillError ? error.code : "TOOL_EXECUTION_FAILED", `The skill "${skill}" has no readable file at "${path}": ${messageOf(error)}`);
+		}
+	}
+	/** 技能名 → 技能根目录。惰性建：不用这种取件号的会话一次目录 IO 都不多花 */
+	async #skillFileIndex(fs) {
+		this.#skillIndex ??= (async () => {
+			const result = await new SkillDiscovery(fs, this.#adapter.skillRoots).discover();
+			return new Map(result.entries.map((entry) => [entry.name, entry.root]));
+		})();
+		return await this.#skillIndex;
+	}
+	/**
+	* 技能根目录下有没有非 Markdown 的资源文件（0.23.0 分册 23 FR-23.3 / AC-23.8）。
+	*
+	* 一个都没有时工具描述里不提 `skill:` 取件号——凭空多一种读不到东西的说法，
+	* 只会让模型多烧一轮。只列目录、不读也不解析 SKILL.md：这里要的是一个是/否。
+	*
+	* **漏判的方向是安全的**：资源放在 assets/references 之外的子目录时这里看不见，
+	* 结果是描述里少一句，而 SKILL.md 自己会写明该用什么号（FR-23.4）——那是第二条、
+	* 也是更可靠的一条告知通路。反过来（一个技能都没有却说有）才是要防的。
+	*/
+	async #hasSkillResources(fs) {
+		const isResource = (stat) => stat.type === "file" && !stat.path.toLowerCase().endsWith(".md");
+		const list = async (path) => await fs.list(path).catch(() => []);
+		for (const root of this.#adapter.skillRoots) for (const dir of await list(root)) {
+			if (dir.type !== "directory") continue;
+			const entries = await list(dir.path);
+			if (!entries.some((e) => e.type === "file" && e.path.endsWith("/SKILL.md"))) continue;
+			if (entries.some(isResource)) return true;
+			for (const sub of ["assets", "references"]) if ((await list(`${dir.path}/${sub}`)).some(isResource)) return true;
+		}
+		return false;
+	}
+	/**
 	* 这一次 run 属于哪个会话。
 	*
 	* 进行中读内存，已结束读 trace——与 `#skillNamesOfRun` 同一范式。
@@ -28180,6 +28321,7 @@ var ChatEngine = class {
 		this.#handles.clear();
 		this.#maxHistoryMessages = void 0;
 		this.#contextWindow = void 0;
+		this.#skillIndex = void 0;
 	}
 	/**
 	* 技能仓变更后调用（安装/卸载/发布）：作废 runtime 缓存的技能目录，下次 send 重新扫描。
@@ -28190,6 +28332,7 @@ var ChatEngine = class {
 	* @experimental
 	*/
 	invalidateSkills() {
+		this.#skillIndex = void 0;
 		this.#ready?.then((runtime) => runtime.invalidate(), () => void 0);
 	}
 	/**
@@ -28933,6 +29076,96 @@ var ChatEngine = class {
 		};
 	}
 	/**
+	* 会话级委派同意（0.23.0 分册 19 FR-19.10~19.14）。
+	*
+	* 记在**会话**上而不是引擎实例上：切到另一个会话是另一件任务，
+	* 上一件任务里同意过并发委派不代表这一件也同意。
+	*/
+	#delegationConsent = /* @__PURE__ */ new Map();
+	/** 用户在确认卡里选定的并发数；没问过或被拒时为 1（拒绝后根本不会走到委派） */
+	#delegationConcurrency() {
+		const sessionId = this.#currentSessionId;
+		if (sessionId === void 0) return 1;
+		return this.#delegationConsent.get(sessionId)?.concurrency ?? 1;
+	}
+	/**
+	* 首次委派前问一次，之后沿用本会话的答案（FR-19.12）。
+	* `suggested` 是模型给的建议值，`hardLimit` 是宿主经 `policy` 设的天花板（FR-19.16）。
+	*/
+	async #askDelegationConsent(suggested, hardLimit) {
+		const sessionId = this.#currentSessionId ?? "";
+		const remembered = this.#delegationConsent.get(sessionId);
+		if (remembered !== void 0) return remembered;
+		const max = Math.max(1, Math.floor(hardLimit));
+		const preset = Math.min(Math.max(1, Math.floor(suggested)), max);
+		this.#delegationAskSeq += 1;
+		const response = await this.#uiBridge.request({
+			type: "authorize",
+			id: `delegation-consent-${this.#delegationAskSeq}`,
+			capability: "confirm",
+			message: `Run parts of this task as parallel sub-agents? What they do is not recorded in this conversation, so this conversation can no longer be saved as a new skill. At most ${preset} sub-agent(s) would run at the same time.`,
+			details: {
+				kind: "delegation",
+				suggestedConcurrency: preset,
+				maxConcurrency: max
+			}
+		});
+		const decision = response.cancelled === true || response.value === false ? {
+			approved: false,
+			concurrency: 1
+		} : {
+			approved: true,
+			concurrency: readChosenConcurrency(response.value, preset, max)
+		};
+		this.#delegationConsent.set(sessionId, decision);
+		return decision;
+	}
+	#delegationAskSeq = 0;
+	/**
+	* 委派工具源 + 会话级确认闸门（0.23.0 分册 19）。
+	*
+	* 闸门套在**工具调用外层**而不是 `runner` 里：`runner` 已经在编排器的排队与
+	* 预算发放之后，那时再问用户，被拒的那次已经占了一个名额与一份轮数额度。
+	*/
+	#delegationToolSource(deps, loopConfig) {
+		const source = createDelegationToolSource({
+			runner: createChatbotSubAgentRunner({
+				deps,
+				loopConfig,
+				uiBridge: this.#uiBridge
+			}),
+			parentBudget: () => this.#parentBudget(loopConfig),
+			policy: this.#delegationPolicy(loopConfig),
+			concurrencyLimit: () => Math.min(this.#delegationConcurrency(), DELEGATION_MAX_CONCURRENCY),
+			todos: this.#todoStore
+		});
+		return {
+			...source,
+			call: async (name, args) => {
+				const suggested = args["suggestedConcurrency"];
+				if (!(await this.#askDelegationConsent(typeof suggested === "number" && Number.isFinite(suggested) ? suggested : 1, DELEGATION_MAX_CONCURRENCY)).approved) return {
+					ok: false,
+					content: [],
+					error: {
+						code: "DELEGATION_DECLINED",
+						message: "The user declined delegation for this conversation. Do this work yourself in this conversation and do not call delegate_task again."
+					}
+				};
+				return source.call(name, args);
+			}
+		};
+	}
+	/**
+	* 子 agent 的自身上限（FR-19.2/19.3）。**不再有内建的 8 轮**：
+	* 缺省即不收紧，只受父级剩余预算约束；宿主在设置里调小 maxTurns 时才会收紧。
+	*/
+	#delegationPolicy(loopConfig) {
+		return {
+			...loopConfig.maxTurns !== void 0 ? { maxTurns: loopConfig.maxTurns } : {},
+			...loopConfig.totalTimeoutMs !== void 0 ? { timeoutMs: loopConfig.totalTimeoutMs } : {}
+		};
+	}
+	/**
 	* 浏览器内置模型自动进模型列表（FR-14.1，B4-01/FR-27.2 调整）。
 	* **只要浏览器支持 Prompt API**（含「模型未就绪」model-not-ready）就加入条目；
 	* API 完全不存在（api-missing / unsupported-browser）才不加——不可用只在列表里
@@ -29003,6 +29236,8 @@ var ChatEngine = class {
 			fs
 		});
 		const readDocumentBytes = async (id, context) => {
+			const prefix = PREFIXED_TEMPLATE_IDS.find((p) => id.startsWith(p));
+			if (prefix) throw new WebSkillError("TOOL_UNSUPPORTED", `The id "${id}" names a ${prefix === "skill:" ? "file bundled with a skill" : "document open in an online viewer"}. It can only be used as a template (inspect_template / fill_template), not read here.`);
 			const attachment = this.#runAttachments.find((a) => a.id === id);
 			if (attachment) {
 				const bytes = await this.#adapter.storage.readBinary(`${this.attachmentsRoot}/${attachment.path}`);
@@ -29024,19 +29259,33 @@ var ChatEngine = class {
 			};
 		};
 		/**
-		* 模板字节比 `read_document` 多认一条取件号：`weboffice:<handle>`（0.22.0 分册 42 FR-42.12）。
+		* 模板字节比 `read_document` 多认两条取件号：`weboffice:<handle>`（0.22.0 分册 42 FR-42.12）
+		* 与 `skill:<技能名>/<路径>`（0.23.0 分册 23 FR-23.1）。
+		*
+		* **前缀先认，认出来就只走它自己那条路，取不到即抛、不回落**（FR-23.13）。
+		* 顺序不能倒过来：`readDocumentBytes` 的末段对认不出的号是**抛**而不是返回
+		* `undefined`，所以「先穷尽本地再看前缀」时前缀判断根本执行不到——0.22.0 的
+		* `weboffice:` 在接了下载端口的宿主里就是这么失效的（设计 24 §1 实测）。
 		*
-		* 多的只是**取件**这一段——拿到字节之后走的与本地模板是同一条路（FR-42.12 后半句）。
-		* 前缀是显式的：不去猜某个 id 会不会恰好是个 weboffice handle，猜错的代价是
-		* 拿了另一份文档冒充用户指的那一份。前缀不匹配时连问都不问，直接当作没有。
+		* 不回落同样是硬的：带前缀的号是指名的那一份，回落等于拿另一份文档冒充它。
 		*/
 		const readTemplateBytes = async (id, context) => {
-			const local = await readDocumentBytes(id, context);
-			if (local) return local;
-			const online = this.#adapter.webOfficeTemplateSource;
-			if (!online || !id.startsWith("weboffice:")) return void 0;
-			return await online.read(id.slice(10), context);
+			if (id.startsWith("skill:")) return await this.#readSkillTemplate(id, fs);
+			if (id.startsWith("weboffice:")) {
+				const online = this.#adapter.webOfficeTemplateSource;
+				if (!online) throw new WebSkillError("TOOL_UNSUPPORTED", `Cannot read "${id}": this conversation has no online document source attached.`);
+				return await online.read(id.slice(10), context);
+			}
+			return await readDocumentBytes(id, context);
 		};
+		/**
+		* 模板取件号里那些**宿主接了才存在**的说法（0.22.0 FR-42.12、0.23.0 FR-23.3）。
+		*
+		* 无条件写死的后果是模型反复尝试一个在这个宿主里永远读不到的号。技能那一句
+		* 还多一道闸：一个带资源的技能都没装时不提（AC-23.8）。探测只在真有模板工具时做。
+		*/
+		const hasTemplateEngine = Boolean(this.#adapter.xlsxTemplateEngine || this.#adapter.docxTemplateEngine);
+		const templateIdHints = [...this.#adapter.webOfficeTemplateSource ? [`For a document open in an online WPS/WebOffice viewer, use "${WEB_OFFICE_TEMPLATE_PREFIX}<handle>" with the handle from list_weboffice_documents.`] : [], ...hasTemplateEngine && await this.#hasSkillResources(fs) ? [`For a file that ships inside an installed skill, use "${SKILL_FILE_PREFIX}<skill name>/<path inside the skill>", for example "${SKILL_FILE_PREFIX}quotation/assets/template.xlsx".`] : []];
 		const baseTools = [
 			...pageSkillSource ? [pageSkillSource] : [],
 			createSpreadsheetToolSource({
@@ -29057,6 +29306,7 @@ var ChatEngine = class {
 				ui: this.#uiBridge,
 				...this.#options.skillCandidates ? { sink: this.#options.skillCandidates } : {},
 				sessionId: () => this.#currentSessionId,
+				resolveAttachment: (id) => this.#skillAttachment(id),
 				...toolStepStore ? { steps: toolStepStore } : {},
 				messages: { confirmSkill: (draft) => translateText(rc.appearance.locale, "skillGeneration.confirm", {
 					name: draft.name,
@@ -29090,7 +29340,7 @@ var ChatEngine = class {
 			}),
 			...this.#adapter.xlsxTemplateEngine || this.#adapter.docxTemplateEngine ? [createTemplateToolSource({
 				files: { read: readTemplateBytes },
-				...this.#adapter.webOfficeTemplateSource ? { idHint: `For a document open in an online WPS/WebOffice viewer, use "${WEB_OFFICE_TEMPLATE_PREFIX}<handle>" with the handle from list_weboffice_documents.` } : {},
+				...templateIdHints.length > 0 ? { idHint: templateIdHints.join(" ") } : {},
 				...this.#adapter.xlsxTemplateEngine ? { xlsx: this.#adapter.xlsxTemplateEngine } : {},
 				...this.#adapter.docxTemplateEngine ? { docx: this.#adapter.docxTemplateEngine } : {},
 				writeArtifact: (path, content, mimeType, context) => {
@@ -29183,15 +29433,7 @@ var ChatEngine = class {
 		};
 		const runtime = new WebSkillRuntime({
 			...deps,
-			externalTools: [...baseTools, ...rc?.agentCapabilities.delegation === true ? [createDelegationToolSource({
-				runner: createChatbotSubAgentRunner({
-					deps,
-					loopConfig,
-					uiBridge: this.#uiBridge
-				}),
-				parentBudget: () => this.#parentBudget(loopConfig),
-				todos: this.#todoStore
-			})] : []]
+			externalTools: [...baseTools, ...rc?.agentCapabilities.delegation === true ? [this.#delegationToolSource(deps, loopConfig)] : []]
 		});
 		runtime.events.on("*", (event) => {
 			this.#runSessions.set(event.runId, event.sessionId);
@@ -29588,7 +29830,7 @@ const useWebSkillThreadList = ({ sessions, currentId, isLoading, thread, onSwitc
 		id: mainThreadId,
 		createdAt: ""
 	};
-	const items = useClientLookup((pending ? [...sessions, pending] : sessions).map((session) => withKey(session.id, ThreadListItemClient({
+	const items = useClientLookup((pending ? [pending, ...sessions] : sessions).map((session) => withKey(session.id, ThreadListItemClient({
 		session,
 		onSwitchTo: () => session.id === "__webskill_new_thread__" ? onCreate() : onSwitchTo(session.id),
 		onRename: (title) => onRename(session.id, title),
@@ -30328,14 +30570,6 @@ function AssistantUiSessionList({ className = "", onNavigate, onCollapse, hasEar
 					className: "min-h-0 flex-1 overflow-y-auto px-2 pb-3",
 					role: "list",
 					children: [
-						hasEarlier && onLoadEarlier ? /* @__PURE__ */ jsx("button", {
-							type: "button",
-							"data-testid": "load-earlier-sessions",
-							disabled: loadingEarlier,
-							onClick: onLoadEarlier,
-							className: "mb-1 w-full rounded-md px-2.5 py-2 text-sm text-muted transition-colors hover:bg-subtle hover:text-ink disabled:opacity-60",
-							children: loadingEarlier ? t("session.loading") : t("session.loadEarlier")
-						}) : null,
 						skipped.length > 0 ? /* @__PURE__ */ jsx("p", {
 							role: "status",
 							"data-testid": "session-skipped",
@@ -30379,7 +30613,15 @@ function AssistantUiSessionList({ className = "", onNavigate, onCollapse, hasEar
 									onEndRename: () => setRenamingId(void 0)
 								});
 							}
-						})
+						}),
+						hasEarlier && onLoadEarlier ? /* @__PURE__ */ jsx("button", {
+							type: "button",
+							"data-testid": "load-earlier-sessions",
+							disabled: loadingEarlier,
+							onClick: onLoadEarlier,
+							className: "mt-1 w-full rounded-md px-2.5 py-2 text-sm text-muted transition-colors hover:bg-subtle hover:text-ink disabled:opacity-60",
+							children: loadingEarlier ? t("session.loading") : t("session.loadEarlier")
+						}) : null
 					]
 				})
 			]
@@ -30623,6 +30865,25 @@ function webOfficeDetails(details) {
 	};
 }
 /**
+* 并发委派确认卡的载荷（0.23.0 分册 19 FR-19.10/19.14）。
+*
+* 与其他授权卡不同，这张卡带一个**旋钮**：用户不只是同不同意，还要定下同时跑几个。
+* `max` 是宿主硬上限，`suggested` 是模型的建议值（已被引擎截到 `max` 以内）——
+* 面板里出现一个选不了的数字，比不出现更糟。
+*/
+function delegationDetails(details) {
+	if (typeof details !== "object" || details === null) return void 0;
+	const record = details;
+	if (record["kind"] !== "delegation") return void 0;
+	const suggested = record["suggestedConcurrency"];
+	const max = record["maxConcurrency"];
+	if (typeof max !== "number" || !Number.isFinite(max) || max < 1) return void 0;
+	return {
+		suggested: Math.min(Math.max(1, typeof suggested === "number" && Number.isFinite(suggested) ? Math.floor(suggested) : 1), Math.floor(max)),
+		max: Math.floor(max)
+	};
+}
+/**
 * 视觉委派告知卡的载荷（0.21.0 分册 17）。
 *
 * 端点的 `label` 与 `host` 都要：前者是用户在设置里给它起的名字，后者是它**真实的去处**。
@@ -30726,6 +30987,7 @@ function localizedAuthorizeMessage(request, t) {
 			size: formatBytes(details.file.size)
 		})}`;
 	}
+	if (request.capability === "confirm" && delegationDetails(request.details) !== void 0) return t("interaction.delegation.body");
 	if (request.capability === "readReference" || request.capability === "readAsset" || request.capability === "writeArtifact" || request.capability === "fetchData" || request.capability === "confirm") {
 		const details = sandboxDetails(request.details);
 		if (details === void 0) return void 0;
@@ -43726,8 +43988,10 @@ function ActiveInteractionCard({ request, bridge }) {
 	const webOffice = isAuthorize && request.capability === "readWebOfficeDocument" ? webOfficeDetails(request.details) : void 0;
 	const visionDelegation = isAuthorize && request.capability === "delegateVision" ? visionDelegationDetails(request.details) : void 0;
 	const imageSource = isAuthorize && request.capability === "readImageSource" ? imageSourceDetails(request.details) : void 0;
+	const delegation = isAuthorize && request.capability === "confirm" ? delegationDetails(request.details) : void 0;
+	const [concurrency, setConcurrency] = useState(void 0);
 	const traceEvidence = isAuthorize ? traceEvidenceDetails(request.details) : void 0;
-	const localized = pageAction !== void 0 || downloadedFile !== void 0 || webOffice !== void 0 || visionDelegation !== void 0 || imageSource !== void 0;
+	const localized = pageAction !== void 0 || downloadedFile !== void 0 || webOffice !== void 0 || visionDelegation !== void 0 || imageSource !== void 0 || delegation !== void 0;
 	const spec = interactionToUiSpec(request.type === "authorize" && localized ? {
 		...request,
 		message: ""
@@ -43753,6 +44017,13 @@ function ActiveInteractionCard({ request, bridge }) {
 			return;
 		}
 		const value = shapeInteractionValue(interactionToFormModel(request), event.value ?? {});
+		if (delegation !== void 0) {
+			bridge.resolve({
+				id: request.id,
+				value: { concurrency: concurrency ?? delegation.suggested }
+			});
+			return;
+		}
 		bridge.resolve({
 			id: request.id,
 			value,
@@ -43961,6 +44232,41 @@ function ActiveInteractionCard({ request, bridge }) {
 							}), t(imageSource.rememberLabelKey ?? "interaction.imageSource.rememberFallback")]
 						}) : null
 					] }) : null,
+					delegation ? /* @__PURE__ */ jsxs(Fragment$1, { children: [
+						/* @__PURE__ */ jsx("p", {
+							"data-testid": "interaction-delegation-title",
+							className: "text-sm font-medium text-ink",
+							children: t("interaction.delegation.title")
+						}),
+						/* @__PURE__ */ jsx("p", {
+							"data-testid": "interaction-delegation-body",
+							className: "text-sm text-ink",
+							children: t("interaction.delegation.body")
+						}),
+						/* @__PURE__ */ jsx("p", {
+							"data-testid": "interaction-delegation-decline",
+							className: "text-sm text-muted",
+							children: t("interaction.delegation.declineNote")
+						}),
+						/* @__PURE__ */ jsxs("label", {
+							className: "flex flex-wrap items-center gap-2 text-sm text-ink",
+							children: [t("interaction.delegation.concurrency"), /* @__PURE__ */ jsx("select", {
+								"data-testid": "interaction-delegation-concurrency",
+								className: "rounded-md border border-border bg-canvas px-2 py-1 text-sm text-ink",
+								value: String(concurrency ?? delegation.suggested),
+								onChange: (event) => setConcurrency(Number(event.currentTarget.value)),
+								children: Array.from({ length: delegation.max }, (_, index) => index + 1).map((n) => /* @__PURE__ */ jsx("option", {
+									value: String(n),
+									children: n
+								}, n))
+							})]
+						}),
+						/* @__PURE__ */ jsx("p", {
+							"data-testid": "interaction-delegation-suggested",
+							className: "text-xs text-muted",
+							children: t("interaction.delegation.suggestedNote", { count: String(delegation.suggested) })
+						})
+					] }) : null,
 					traceEvidence ? /* @__PURE__ */ jsxs("div", {
 						"data-testid": "interaction-trace-evidence",
 						children: [/* @__PURE__ */ jsx("div", {
@@ -44971,7 +45277,7 @@ function Chatbot({ adapter, config, locale: localeProp, theme: themeProp, render
 		if (!sessionsCursor || loadingEarlierSessions) return;
 		setLoadingEarlierSessions(true);
 		engine.listSessions({ cursor: sessionsCursor }).then((page) => {
-			setSessions((prev) => [...page.items, ...prev]);
+			setSessions((prev) => [...prev, ...page.items]);
 			setSessionsCursor(page.nextCursor);
 		}).catch((e) => setError({ message: toErrorMessage(e) })).finally(() => setLoadingEarlierSessions(false));
 	}, [
@@ -45306,7 +45612,7 @@ function VercelPayloadPreview({ bridge }) {
 * Version of the published `@webskill/chatbot` package, injected at build time.
 * @stable
 */
-const CHATBOT_VERSION = "0.19.0";
+const CHATBOT_VERSION = "0.20.0";
 
 //#endregion
 export { A2uiSurfaceHost, A2uiSurfaceSnapshotHost, CHATBOT_VERSION, ChatEngine, Chatbot, ChatbotVisionDelegate, CompositeUiBridge, DEFAULT_RENDERER_CAPABILITIES, DEFAULT_RUNTIME_CONFIG_STORAGE_KEY, ErrorCard, InteractionCard, InterruptedBanner, OpenUiSurfaceHost, OpenUiSurfaceSnapshotHost, ResultBlockList, ResultBlocksPro, SkillBadges, SpecInteraction, VercelPayloadPreview, VercelSurfaceHost, VercelSurfaceSnapshotHost, WEB_OFFICE_TEMPLATE_PREFIX, chatbotDictionary, configureA2uiMarkdown, createLocalStorageRuntimeConfigStore, createMemoryRuntimeConfigStore, isLlmEntryUsable, pickUsableLlmEntry, probeA2uiAvailability, probeOpenUiAvailability, sandboxExecutorDeps, useT };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webskill/chatbot",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -38,7 +38,7 @@
     "@a2ui/web_core": "^0.10.5",
     "@lit/context": "^1.1.0",
     "@openuidev/react-lang": "0.2.8",
-    "@webskill/sdk": "^0.22.0",
+    "@webskill/sdk": "^0.23.0",
     "mermaid": "^12.0.0",
     "react": ">=19.0.0",
     "react-dom": ">=19.0.0",