@webskill/sdk 0.0.1 → 0.0.3

package/dist/{dist-9fczg9Pa.js → dist-C1p26Ap9.js}

@@ -1,9 +1,10 @@
-import { D as normalizeToolContent, G as parseSkillMarkdown, H as isValidSkillName, J as resolveInsideRoot, O as parseBridgeRequest, R as WebSkillError, Y as validateSkills, o as FsArtifactStore, s as FsMemoryStore, x as bridgeError } from "./dist-B_ldNWwT.js";
+import { $ as validateSkills, B as WebSkillError, D as normalizeToolContent, F as SKILL_MANIFEST_FILE, H as buildManifest, K as isValidSkillName, O as parseBridgeRequest, P as SKILLS_LOCKFILE, Q as resolveInsideRoot, Y as parseSkillMarkdown, et as verifyManifest, o as FsArtifactStore, s as FsMemoryStore, x as bridgeError } from "./dist-hMMxARXK.js";
 import { existsSync, promises, readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { format, promisify } from "node:util";
 import { Worker } from "node:worker_threads";
+import { parseSync } from "oxc-parser";
 import { createInterface } from "node:readline/promises";
 import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -416,6 +417,178 @@ var SandboxedScriptExecutor = class {
 		}
 	}
 };
+const PLACEHOLDER_PREFIX = "Inferred placeholder (unsupported type: ";
+const placeholder = (text) => ({
+	type: "string",
+	description: `${PLACEHOLDER_PREFIX}${text})`,
+	"x-inferred": true
+});
+/** 主路径映射：基础类型/数组/嵌套对象/可选/字面量 union；其余降级 placeholder */
+var TypeMapper = class {
+	#decls = /* @__PURE__ */ new Map();
+	#source;
+	constructor(body, source) {
+		this.#source = source;
+		for (const node of body) {
+			if (node.type === "TSInterfaceDeclaration" || node.type === "TSTypeAliasDeclaration") this.#decls.set(node.id?.name, node);
+			if (node.type === "ExportNamedDeclaration" && (node.declaration?.type === "TSInterfaceDeclaration" || node.declaration?.type === "TSTypeAliasDeclaration")) this.#decls.set(node.declaration.id?.name, node.declaration);
+		}
+	}
+	objectSchema(t, seen) {
+		const mapped = this.map(t, seen);
+		return mapped?.type === "object" ? mapped : void 0;
+	}
+	map(t, seen) {
+		if (!t) return void 0;
+		switch (t.type) {
+			case "TSStringKeyword": return { type: "string" };
+			case "TSNumberKeyword": return { type: "number" };
+			case "TSBooleanKeyword": return { type: "boolean" };
+			case "TSAnyKeyword":
+			case "TSUnknownKeyword": return {};
+			case "TSArrayType": return {
+				type: "array",
+				items: this.map(t.elementType, seen) ?? {}
+			};
+			case "TSTypeLiteral": return this.#literalObject(t, seen);
+			case "TSLiteralType": return this.#literal(t);
+			case "TSUnionType": return this.#union(t, seen);
+			case "TSTypeReference": return this.#reference(t, seen);
+			case "TSParenthesizedType": return this.map(t.typeAnnotation, seen);
+			default: return placeholder(this.#text(t));
+		}
+	}
+	#literal(t) {
+		const value = t.literal?.value ?? t.value;
+		if (typeof value === "string") return {
+			type: "string",
+			enum: [value]
+		};
+		return placeholder(this.#text(t));
+	}
+	#union(t, seen) {
+		const values = [];
+		for (const member of t.types ?? []) {
+			const value = member.literal?.value ?? member.value;
+			if (member.type === "TSLiteralType" && typeof value === "string") values.push(value);
+			else return placeholder(this.#text(t));
+		}
+		return {
+			type: "string",
+			enum: values
+		};
+	}
+	#literalObject(t, seen) {
+		const properties = {};
+		const required = [];
+		for (const member of t.members ?? []) {
+			if (member.type !== "TSPropertySignature") continue;
+			const name = member.key?.name ?? member.key?.value;
+			if (typeof name !== "string") continue;
+			const annotation = member.typeAnnotation?.typeAnnotation;
+			properties[name] = annotation ? this.map(annotation, seen) ?? {} : { type: "string" };
+			if (!member.optional) required.push(name);
+		}
+		return {
+			type: "object",
+			properties,
+			...required.length ? { required } : {}
+		};
+	}
+	#reference(t, seen) {
+		const name = t.typeName?.name ?? t.typeName?.left?.name;
+		const params = t.typeArguments?.params ?? t.typeParameters?.params ?? [];
+		if (name === "Array" && params.length === 1) return {
+			type: "array",
+			items: this.map(params[0], seen) ?? {}
+		};
+		if (name === "string" || name === "number" || name === "boolean") return { type: name };
+		if (!name || params.length > 0) return placeholder(this.#text(t));
+		if (seen.has(name)) return placeholder(`recursive reference ${name}`);
+		const decl = this.#decls.get(name);
+		if (!decl) return placeholder(this.#text(t));
+		const nextSeen = new Set(seen).add(name);
+		if (decl.type === "TSInterfaceDeclaration") return this.#literalObject({ members: decl.body?.body ?? [] }, nextSeen);
+		return this.map(decl.typeAnnotation, nextSeen) ?? placeholder(this.#text(t));
+	}
+	#text(t) {
+		if (typeof t.start === "number" && typeof t.end === "number") return this.#source.slice(t.start, t.end);
+		return String(t.type);
+	}
+};
+const findRunFunction = (body) => {
+	for (const node of body) {
+		if (node.type !== "ExportNamedDeclaration") continue;
+		const decl = node.declaration;
+		if (!decl) continue;
+		if (decl.type === "FunctionDeclaration" && decl.id?.name === "run") return decl;
+		if (decl.type === "VariableDeclaration") {
+			for (const d of decl.declarations ?? []) if (d.id?.name === "run" && (d.init?.type === "ArrowFunctionExpression" || d.init?.type === "FunctionExpression")) return d.init;
+		}
+	}
+};
+/** JSDoc 辅路径：@param {type} input.name - desc（点形式）与 @param {{...}} input（对象形式） */
+function inferFromJsDoc(jsdoc, mapper, reparse) {
+	const properties = {};
+	const required = [];
+	const objectForm = /@param\s+\{\{([\s\S]+?)\}\}\s+input(?:\s+-\s+(.*))?/.exec(jsdoc);
+	if (objectForm) {
+		const alias = reparse(`{${objectForm[1]}}`);
+		if (!alias) return void 0;
+		const schema = mapper.map(alias, /* @__PURE__ */ new Set());
+		return schema?.type === "object" ? schema : void 0;
+	}
+	const dotForm = /@param\s+\{([^}]+)\}\s+input\.(\w+)(?:\s+-\s+([^\n*]+))?/g;
+	let matched = false;
+	for (const m of jsdoc.matchAll(dotForm)) {
+		const [, typeText, name, desc] = m;
+		if (!typeText || !name) continue;
+		matched = true;
+		const alias = reparse(typeText.trim());
+		const schema = alias ? mapper.map(alias, /* @__PURE__ */ new Set()) ?? {} : { type: "string" };
+		if (desc?.trim()) schema.description = desc.trim();
+		properties[name] = schema;
+		required.push(name);
+	}
+	if (!matched) return void 0;
+	return {
+		type: "object",
+		properties,
+		required
+	};
+}
+/**
+* D2 Schema 推导（OXC 静态文本分析，宿主侧执行，不进沙箱）。
+* TS 类型标注为主路径，JSDoc @param 为辅路径；不支持类型降级 string 并标 'x-inferred'。
+*/
+var OxcSchemaInferer = class {
+	inferSchemaFromSource(source, options) {
+		let program;
+		let comments;
+		try {
+			const result = parseSync(options?.fileName ?? "script.ts", source);
+			if (result.errors?.length > 0) return void 0;
+			program = result.program;
+			comments = result.comments ?? [];
+		} catch {
+			return;
+		}
+		const runFn = findRunFunction(program.body ?? []);
+		if (!runFn) return void 0;
+		const annotation = (runFn.params?.[0] ?? runFn.params?.items?.[0])?.typeAnnotation?.typeAnnotation;
+		const mapper = new TypeMapper(program.body ?? [], source);
+		if (annotation) return mapper.objectSchema(annotation, /* @__PURE__ */ new Set());
+		const runStart = runFn.start ?? Number.MAX_SAFE_INTEGER;
+		const jsdoc = comments.filter((c) => c.type === "Block" && typeof c.value === "string" && c.value.includes("@param") && typeof c.end === "number" && c.end <= runStart).sort((a, b) => b.end - a.end)[0];
+		if (!jsdoc) return void 0;
+		const reparse = (typeText) => {
+			const r = parseSync("__t.ts", `type __T = ${typeText};`);
+			if (r.errors?.length > 0) return void 0;
+			return r.program.body.find((n) => n.type === "TSTypeAliasDeclaration")?.typeAnnotation;
+		};
+		return inferFromJsDoc(jsdoc.value, mapper, reparse);
+	}
+};
 /**
 * FileArtifactStore：兼容别名，语义同阶段 2-4。
 * 实现已上移到 runtime 的 FsArtifactStore；node 侧保留 NodeFS 默认值。
@@ -623,10 +796,6 @@ async function removeDirQuiet(fs, dir) {
 		if (await fs.exists(dir)) await fs.remove(dir, { recursive: true });
 	} catch {}
 }
-/** 技能目录内的安装清单文件名（不参与 files 列表与 digest） */
-const SKILL_MANIFEST_FILE = "webskill.skill-manifest.json";
-/** managed root 下的锁定文件名（不参与 files 列表与 digest） */
-const SKILLS_LOCKFILE = "skills.lock.json";
 const messageOf$3 = (e) => e instanceof Error ? e.message : String(e);
 /** 导出技能目录全部文件（含 manifest）为 zip/tar 归档，返回 outPath */
 async function exportArchive(fs, skillRoot, options) {
@@ -651,7 +820,7 @@ async function readArchiveManifest(fs, archivePath) {
 	const data = await fs.readBinary(archivePath);
 	if (isZipArchive(data)) {
 		const entries = unzipSync(data);
-		const key = Object.keys(entries).find((k) => k === "webskill.skill-manifest.json" || k.endsWith(`/webskill.skill-manifest.json`));
+		const key = Object.keys(entries).find((k) => k === "webskill.skill-manifest.json" || k.endsWith(`/${"webskill.skill-manifest.json"}`));
 		if (!key) throw notFound();
 		return JSON.parse(new TextDecoder().decode(entries[key]));
 	}
@@ -660,7 +829,7 @@ async function readArchiveManifest(fs, archivePath) {
 		await tar.t({
 			file: toPlatform(archivePath),
 			onentry: (entry) => {
-				if (entry.path === "webskill.skill-manifest.json" || entry.path.endsWith(`/webskill.skill-manifest.json`)) {
+				if (entry.path === "webskill.skill-manifest.json" || entry.path.endsWith(`/${"webskill.skill-manifest.json"}`)) {
 					const chunks = [];
 					entry.on("data", (chunk) => chunks.push(chunk));
 					entry.on("end", () => {
@@ -730,10 +899,6 @@ async function stageGit(source, ctx) {
 function sha256Hex(data) {
 	return createHash("sha256").update(data).digest("hex");
 }
-/** 整体 digest：逐文件 "<path>:<sha256>\n" 拼接串（文件按 path 排序）的 sha256 */
-function computeDigest(files) {
-	return sha256Hex([...files].sort((a, b) => a.path.localeCompare(b.path)).map((f) => `${f.path}:${f.sha256}\n`).join(""));
-}
 const messageOf$1 = (e) => e instanceof Error ? e.message : String(e);
 /** http 源：下载归档（可选 expectedSha256 校验包体）→ 解包 → 定位技能根 */
 async function stageHttp(source, ctx, expectedSha256) {
@@ -868,18 +1033,14 @@ async function createManifest(fs, skillRoot, input) {
 			sha256: sha256Hex(content)
 		});
 	}
-	const manifest = {
-		schemaVersion: 1,
+	const manifest = await buildManifest({
 		name: input.name,
 		...input.version !== void 0 ? { version: input.version } : {},
 		source: input.source,
 		installedAt: input.installedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-		integrity: {
-			algorithm: "sha256",
-			digest: computeDigest(files)
-		},
-		files
-	};
+		files,
+		sha256: sha256Hex
+	});
 	await fs.writeText(`${skillRoot}/${SKILL_MANIFEST_FILE}`, JSON.stringify(manifest, null, 2));
 	return manifest;
 }
@@ -893,22 +1054,15 @@ async function readManifest(fs, skillRoot) {
 		throw new WebSkillError("INTEGRITY_FAILED", `Skill manifest at ${path} is corrupted: ${e instanceof Error ? e.message : String(e)}`, e);
 	}
 }
-/** 按 manifest.files 逐文件重算 sha256 比对 */
+/** 按 manifest.files 逐文件重算 sha256 比对（core 纯逻辑校验） */
 async function verifyIntegrity(fs, skillRoot) {
 	const manifest = await readManifest(fs, skillRoot);
-	const mismatches = [];
+	const actualHashes = /* @__PURE__ */ new Map();
 	for (const file of manifest.files) {
 		const path = `${skillRoot}/${file.path}`;
-		if (!await fs.exists(path)) {
-			mismatches.push(file.path);
-			continue;
-		}
-		if (sha256Hex(await fs.readBinary(path)) !== file.sha256) mismatches.push(file.path);
+		if (await fs.exists(path)) actualHashes.set(file.path, sha256Hex(await fs.readBinary(path)));
 	}
-	return {
-		ok: mismatches.length === 0,
-		mismatches
-	};
+	return verifyManifest(manifest, actualHashes);
 }
 const messageOf = (e) => e instanceof Error ? e.message : String(e);
 const asInstallFailed = (e) => e instanceof WebSkillError && e.code === "INSTALL_FAILED" ? e : new WebSkillError("INSTALL_FAILED", `Install failed: ${messageOf(e)}`, e);
@@ -920,10 +1074,13 @@ var SkillManager = class {
 	#managedRoot;
 	#fs;
 	#fetchImpl;
+	#schemaInference;
+	#schemaInferer = new OxcSchemaInferer();
 	constructor(deps) {
 		this.#managedRoot = deps.managedRoot.replace(/\/+$/, "");
 		this.#fs = deps.fs ?? new NodeFS();
 		this.#fetchImpl = deps.fetchImpl;
+		this.#schemaInference = deps.schemaInference ?? true;
 	}
 	async install(source, options) {
 		const fs = this.#fs;
@@ -950,6 +1107,7 @@ var SkillManager = class {
 				case "npm":
 					staged = await stageNpm(source, ctx);
 					break;
+				case "archive": throw new WebSkillError("TOOL_UNSUPPORTED", "The \"archive\" install source is only supported by the browser skill manager");
 			}
 			let name;
 			let version;
@@ -971,6 +1129,7 @@ var SkillManager = class {
 			targetDir = `${this.#managedRoot}/${name}`;
 			if (await fs.exists(targetDir)) await fs.remove(targetDir, { recursive: true });
 			await copyDir(fs, finalDir, targetDir);
+			await this.#inferSkillSchemas(targetDir);
 			const manifest = await createManifest(fs, targetDir, {
 				name,
 				...version ? { version } : {},
@@ -990,6 +1149,28 @@ var SkillManager = class {
 			await removeDirQuiet(fs, stagingRoot);
 		}
 	}
+	/**
+	* D2 安装期预推导：scripts/ 下无显式 inputSchema 导出且无 sidecar 的脚本，
+	* 经 OXC 推导写 sidecar（计入 manifest.files；重装重新生成）
+	*/
+	async #inferSkillSchemas(skillRoot) {
+		if (!this.#schemaInference) return;
+		const fs = this.#fs;
+		const scriptsDir = `${skillRoot}/scripts`;
+		if (!await fs.exists(scriptsDir)) return;
+		for (const entry of await fs.list(scriptsDir)) {
+			if (entry.type !== "file") continue;
+			const match = /^(.*)\.(ts|js)$/.exec(entry.path.split("/").pop() ?? "");
+			if (!match?.[1]) continue;
+			const scriptName = match[1];
+			const sidecar = `${scriptsDir}/${scriptName}.schema.json`;
+			if (await fs.exists(sidecar)) continue;
+			const source = await fs.readText(entry.path);
+			if (/export\s+(?:const|let|var)\s+inputSchema/.test(source)) continue;
+			const inferred = this.#schemaInferer.inferSchemaFromSource(source, { fileName: `${scriptName}.${match[2]}` });
+			if (inferred) await fs.writeText(sidecar, JSON.stringify(inferred, null, 2));
+		}
+	}
 	async uninstall(name) {
 		if (!isValidSkillName(name)) throw new WebSkillError("UNINSTALL_FAILED", `Invalid skill name (path traversal rejected): ${JSON.stringify(name)}`);
 		const targetDir = `${this.#managedRoot}/${name}`;
@@ -1099,7 +1280,8 @@ async function doProbeLlmCapabilities(config) {
 			}),
 			signal: AbortSignal.timeout(15e3)
 		});
-		if (res.ok) return {
+		const contentType = res.headers.get("content-type") ?? "";
+		if (res.ok && !contentType.includes("text/event-stream")) return {
 			available: true,
 			nonStreaming: true
 		};
@@ -1119,4 +1301,4 @@ async function doProbeLlmCapabilities(config) {
 }
 
 //#endregion
-export { NodeScriptExecutor as a, SandboxedScriptExecutor as c, probeLlmCapabilities as d, readArchiveManifest as f, NodeFS as i, SkillManager as l, FileArtifactStore as n, SKILLS_LOCKFILE as o, FileMemoryStore as r, SKILL_MANIFEST_FILE as s, CliUiBridge as t, loadLlmConfigFromEnv as u };
+export { NodeScriptExecutor as a, SkillManager as c, readArchiveManifest as d, NodeFS as i, loadLlmConfigFromEnv as l, FileArtifactStore as n, OxcSchemaInferer as o, FileMemoryStore as r, SandboxedScriptExecutor as s, CliUiBridge as t, probeLlmCapabilities as u };

package/dist/{dist-B_ldNWwT.js → dist-hMMxARXK.js}

@@ -12,6 +12,41 @@ var WebSkillError = class extends Error {
 		this.details = details;
 	}
 };
+/** 技能目录内的安装清单文件名（不参与 files 列表与 digest） */
+const SKILL_MANIFEST_FILE = "webskill.skill-manifest.json";
+/** managed root 下的锁定文件名（不参与 files 列表与 digest） */
+const SKILLS_LOCKFILE = "skills.lock.json";
+/** 整体 digest：逐文件 "<path>:<sha256>\n" 拼接串（文件按 path 排序）的 sha256（hash 由调用方提供，可为 WebCrypto 异步实现） */
+async function computeDigest(files, sha256) {
+	return sha256([...files].sort((a, b) => a.path.localeCompare(b.path)).map((f) => `${f.path}:${f.sha256}\n`).join(""));
+}
+/** 由逐文件清单构建 manifest（digest 由 computeDigest 计算） */
+async function buildManifest(input) {
+	return {
+		schemaVersion: 1,
+		name: input.name,
+		...input.version !== void 0 ? { version: input.version } : {},
+		source: input.source,
+		installedAt: input.installedAt,
+		integrity: {
+			algorithm: "sha256",
+			digest: await computeDigest(input.files, input.sha256)
+		},
+		files: input.files
+	};
+}
+/** 按 manifest.files 比对实际 hash（调用方负责计算 actualHashes） */
+function verifyManifest(manifest, actualHashes) {
+	const mismatches = [];
+	for (const file of manifest.files) {
+		const actual = actualHashes.get(file.path);
+		if (actual === void 0 || actual !== file.sha256) mismatches.push(file.path);
+	}
+	return {
+		ok: mismatches.length === 0,
+		mismatches
+	};
+}
 const ROOT = "/";
 /** 内存文件系统：路径一律规范化为 `/` 分隔，写入自动创建父目录 */
 var MemoryFS = class {
@@ -182,6 +217,8 @@ function isValidSkillName(name) {
 	return name.length <= 64 && SKILL_NAME_PATTERN.test(name);
 }
 const SCRIPT_EXTENSION_RE = /\.(ts|js)$/;
+/** D2 schema sidecar（scripts/<name>.schema.json）属于协议内文件，不算非法脚本 */
+const SCHEMA_SIDECAR_RE = /\.schema\.json$/;
 /**
 * 技能合规规则的唯一实现。SkillDiscovery 与 validateSkills 都必须调用本函数，
 * 禁止各自重复实现规则（避免两套规则漂移）。
@@ -217,10 +254,10 @@ function checkSkillRules(input) {
 			message: `Duplicate skill name ${JSON.stringify(metadata.name)}`
 		});
 	}
-	for (const fileName of input.scriptFileNames ?? []) if (!SCRIPT_EXTENSION_RE.test(fileName)) issues.push({
+	for (const fileName of input.scriptFileNames ?? []) if (!SCRIPT_EXTENSION_RE.test(fileName) && !SCHEMA_SIDECAR_RE.test(fileName)) issues.push({
 		code: "SKILL_UNSUPPORTED_SCRIPT",
 		severity: "error",
-		message: `Unsupported script file in scripts/ of directory ${dirName}: ${fileName} (only .ts/.js allowed)`
+		message: `Unsupported script file in scripts/ of directory ${dirName}: ${fileName} (only .ts/.js and .schema.json sidecars allowed)`
 	});
 	return issues;
 }
@@ -1329,7 +1366,10 @@ var AgentLoop = class {
 	#config;
 	#policy;
 	constructor(deps, config = {}) {
-		this.#deps = deps;
+		this.#deps = {
+			...deps,
+			artifactStore: deps.artifactStore ?? new MemoryArtifactStore()
+		};
 		this.#config = {
 			maxTurns: config.maxTurns ?? 10,
 			totalTimeoutMs: config.totalTimeoutMs ?? 12e4,
@@ -1344,7 +1384,8 @@ var AgentLoop = class {
 		};
 	}
 	async run(input) {
-		const { llm, artifactStore } = this.#deps;
+		const llm = this.#deps.llm;
+		const artifactStore = this.#deps.artifactStore;
 		const now = this.#deps.clock?.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
 		const runId = input.runId ?? `run-${Math.random().toString(36).slice(2, 10)}`;
 		const trace = new TraceRecorder(runId, this.#deps.clock);
@@ -1734,6 +1775,8 @@ var AgentLoop = class {
 		await this.#writeActivationMemory(skillName, state);
 		const root = this.#deps.skillIndex.get(skillName);
 		if (!root) return "";
+		const executor = this.#deps.executor;
+		if (!executor) return "";
 		const loaded = [];
 		let scriptFiles = [];
 		try {
@@ -1745,13 +1788,36 @@ var AgentLoop = class {
 			const match = /^(.*)\.(ts|js)$/.exec(file);
 			if (!match?.[1]) continue;
 			try {
-				const def = await this.#deps.executor.loadDefinition(root, match[1]);
+				const def = await executor.loadDefinition(root, match[1]);
+				await this.#enrichDefinition(root, match[1], def, state);
 				state.activatedTools.set(def.name, def);
 				loaded.push(def.name);
 			} catch {}
 		}
 		return loaded.length ? `\n\nActivated tools: ${loaded.join(", ")}` : "";
 	}
+	/**
+	* D2 Schema 兜底链（同一 run 内激活时只算一次）：
+	* 显式 inputSchema > sidecar scripts/<name>.schema.json > schemaInferer 推导 > schemaUnavailable
+	*/
+	async #enrichDefinition(skillRoot, scriptName, def, state) {
+		if (def.inputSchema) return;
+		const sidecar = `${skillRoot}/scripts/${scriptName}.schema.json`;
+		if (await this.#deps.fs.exists(sidecar)) try {
+			def.inputSchema = JSON.parse(await this.#deps.fs.readText(sidecar));
+			return;
+		} catch (e) {
+			state.trace.record("run.warning", { message: `Failed to parse schema sidecar ${sidecar}: ${messageOf(e)}` });
+		}
+		if (!this.#deps.schemaInferer) return;
+		for (const ext of ["ts", "js"]) {
+			const scriptPath = `${skillRoot}/scripts/${scriptName}.${ext}`;
+			if (!await this.#deps.fs.exists(scriptPath)) continue;
+			const inferred = this.#deps.schemaInferer.inferSchemaFromSource(await this.#deps.fs.readText(scriptPath), { fileName: `${scriptName}.${ext}` });
+			if (inferred) def.inputSchema = inferred;
+			return;
+		}
+	}
 	async #handleScriptTool(call, skillName, scriptName, state) {
 		const root = this.#deps.skillIndex.get(skillName);
 		if (!root) return toolError("TOOL_NOT_FOUND", `Skill "${skillName}" is not in the catalog`);
@@ -1776,6 +1842,7 @@ var AgentLoop = class {
 			if (e instanceof BridgeRequestError) return toolError("UI_UNAVAILABLE", `Parameter form failed: ${e.message}`);
 			throw e;
 		}
+		if (!this.#deps.executor) return toolError("TOOL_UNSUPPORTED", `No script executor is configured; script tool "${call.name}" cannot run`);
 		const context = createScriptContext({
 			fs: this.#deps.fs,
 			artifactStore: this.#deps.artifactStore,
@@ -1937,6 +2004,7 @@ var WebSkillRuntime = class {
 		const result = await new AgentLoop({
 			llm: this.#deps.llm,
 			executor: this.#deps.executor,
+			schemaInferer: this.#deps.schemaInferer,
 			artifactStore: this.#deps.artifactStore,
 			fs: this.#deps.fs,
 			skillIndex: cache.index,
@@ -1972,4 +2040,4 @@ var WebSkillRuntime = class {
 };
 
 //#endregion
-export { schemaToForm as A, checkSkillRules as B, createScriptContext as C, normalizeToolContent as D, mergeCatalogEntries as E, SKILL_NAME_PATTERN as F, parseSkillMarkdown as G, isValidSkillName as H, SkillDiscovery as I, resolveInsideRoot as J, renderAvailableSkillsXml as K, SkillReader as L, toVercelToolSpecs as M, MemoryFS as N, parseBridgeRequest as O, SKILL_NAME_MAX_LENGTH as P, WebSkillError as R, buildRenderResult as S, fromVercelStreamPart as T, jsonRenderer as U, escapeXml as V, normalizePath as W, xmlRenderer as X, validateSkills as Y, READ_SKILL_FILE_TOOL as _, EventBus as a, WebSkillRuntime as b, FullDisclosureRouter as c, MemoryArtifactStore as d, MockLlmClient as f, READ_SKILL_FILE_INPUT_SCHEMA as g, ProgressiveRouter as h, AgentLoop as i, toLlmToolSpec as j, resolveToolName as k, HookRunner as l, OpenAiCompatibleClient as m, ASK_USER_TOOL as n, FsArtifactStore as o, MockUiBridge as p, renderCatalogJson as q, ASK_USER_TOOL_NAME as r, FsMemoryStore as s, ASK_USER_INPUT_SCHEMA as t, InMemoryStore as u, READ_SKILL_FILE_TOOL_NAME as v, fromVercelResult as w, bridgeError as x, TraceRecorder as y, buildCatalog as z };
+export { validateSkills as $, schemaToForm as A, WebSkillError as B, createScriptContext as C, normalizeToolContent as D, mergeCatalogEntries as E, SKILL_MANIFEST_FILE as F, escapeXml as G, buildManifest as H, SKILL_NAME_MAX_LENGTH as I, normalizePath as J, isValidSkillName as K, SKILL_NAME_PATTERN as L, toVercelToolSpecs as M, MemoryFS as N, parseBridgeRequest as O, SKILLS_LOCKFILE as P, resolveInsideRoot as Q, SkillDiscovery as R, buildRenderResult as S, fromVercelStreamPart as T, checkSkillRules as U, buildCatalog as V, computeDigest as W, renderAvailableSkillsXml as X, parseSkillMarkdown as Y, renderCatalogJson as Z, READ_SKILL_FILE_TOOL as _, EventBus as a, WebSkillRuntime as b, FullDisclosureRouter as c, MemoryArtifactStore as d, verifyManifest as et, MockLlmClient as f, READ_SKILL_FILE_INPUT_SCHEMA as g, ProgressiveRouter as h, AgentLoop as i, toLlmToolSpec as j, resolveToolName as k, HookRunner as l, OpenAiCompatibleClient as m, ASK_USER_TOOL as n, FsArtifactStore as o, MockUiBridge as p, jsonRenderer as q, ASK_USER_TOOL_NAME as r, FsMemoryStore as s, ASK_USER_INPUT_SCHEMA as t, xmlRenderer as tt, InMemoryStore as u, READ_SKILL_FILE_TOOL_NAME as v, fromVercelResult as w, bridgeError as x, TraceRecorder as y, SkillReader as z };

package/dist/governance.d.ts

@@ -1,5 +1,5 @@
-import { Mt as FileSystemProvider, Rt as SkillCatalogEntry, ht as WebSkillRuntime, j as LlmMessage, k as LlmClient, pt as UiBridge, tt as RuntimeRun } from "./index-88KNOnbr.js";
-import { f as SkillManager, p as SkillManifest } from "./index-Bq-bTWh3.js";
+import { Nt as FileSystemProvider, Vt as SkillCatalogEntry, gt as WebSkillRuntime, j as LlmMessage, k as LlmClient, mt as UiBridge, qt as SkillManifest, tt as RuntimeRun } from "./index-DnI0BTEp.js";
+import { d as SkillManager } from "./index-D65Jk0ju.js";
 //#region ../governance/dist/index.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';

package/dist/governance.js

@@ -1,5 +1,5 @@
-import { H as isValidSkillName, J as resolveInsideRoot, R as WebSkillError, Y as validateSkills } from "./dist-B_ldNWwT.js";
-import { i as NodeFS } from "./dist-9fczg9Pa.js";
+import { $ as validateSkills, B as WebSkillError, K as isValidSkillName, Q as resolveInsideRoot } from "./dist-hMMxARXK.js";
+import { i as NodeFS } from "./dist-C1p26Ap9.js";
 import path from "node:path";
 import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";

package/dist/{index-Bq-bTWh3.d.ts → index-D65Jk0ju.d.ts}

@@ -1,4 +1,4 @@
-import { C as InteractionRequest, Mt as FileSystemProvider, X as RenderResultRequest, _ as FsMemoryStore, ct as ToolResult, g as FsArtifactStore, it as ScriptExecutor, jt as FileStat, l as BridgeCapabilities, ot as ToolDefinition, pt as UiBridge, rt as ScriptExecutionContext, w as InteractionResponse } from "./index-88KNOnbr.js";
+import { $t as VerifyResult, C as InteractionRequest, Mt as FileStat, Nt as FileSystemProvider, Pt as JsonSchema, Wt as SkillInstallSource, X as RenderResultRequest, Zt as SkillsLockfile, _ as FsMemoryStore, at as ScriptExecutor, g as FsArtifactStore, it as ScriptExecutionContext, l as BridgeCapabilities, lt as ToolResult, mt as UiBridge, qt as SkillManifest, rt as SchemaInferer, st as ToolDefinition, w as InteractionResponse } from "./index-DnI0BTEp.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts
 //#region src/fs/nodeFs.d.ts
@@ -67,6 +67,17 @@ declare class SandboxedScriptExecutor implements ScriptExecutor {
   }): Promise<ToolResult>;
 }
 //#endregion
+//#region src/schema/oxcSchemaInferer.d.ts
+/**
+ * D2 Schema 推导（OXC 静态文本分析，宿主侧执行，不进沙箱）。
+ * TS 类型标注为主路径，JSDoc @param 为辅路径；不支持类型降级 string 并标 'x-inferred'。
+ */
+declare class OxcSchemaInferer implements SchemaInferer {
+  inferSchemaFromSource(source: string, options?: {
+    fileName?: string;
+  }): JsonSchema | undefined;
+}
+//#endregion
 //#region src/artifacts/fileArtifactStore.d.ts
 /**
  * FileArtifactStore：兼容别名，语义同阶段 2-4。
@@ -112,56 +123,6 @@ declare class CliUiBridge implements UiBridge {
   renderResult(input: RenderResultRequest): Promise<void>;
 }
 //#endregion
-//#region src/skillManagement/types.d.ts
-type SkillSource = {
-  type: 'local';
-  path: string;
-} | {
-  type: 'http';
-  url: string;
-} | {
-  type: 'git';
-  url: string;
-  ref?: string;
-  commit?: string;
-} | {
-  type: 'npm';
-  packageName: string;
-  version?: string;
-};
-interface SkillManifest {
-  schemaVersion: 1;
-  name: string;
-  version?: string;
-  source: SkillSource;
-  installedAt: string;
-  integrity: {
-    algorithm: 'sha256';
-    digest: string;
-  };
-  files: Array<{
-    path: string;
-    size: number;
-    sha256: string;
-  }>;
-}
-interface SkillsLockfile {
-  schemaVersion: 1;
-  skills: Record<string, {
-    digest: string;
-    installedAt: string;
-    source: SkillSource;
-  }>;
-}
-interface VerifyResult {
-  ok: boolean;
-  mismatches: string[];
-}
-/** 技能目录内的安装清单文件名（不参与 files 列表与 digest） */
-declare const SKILL_MANIFEST_FILE = "webskill.skill-manifest.json";
-/** managed root 下的锁定文件名（不参与 files 列表与 digest） */
-declare const SKILLS_LOCKFILE = "skills.lock.json";
-//#endregion
 //#region src/skillManagement/skillManager.d.ts
 /**
  * 技能管理门面：统一安装管线（staging → 解析 name → 校验 → 拷贝 → manifest → lockfile），
@@ -173,8 +134,10 @@ declare class SkillManager {
     managedRoot: string;
     fs?: FileSystemProvider;
     fetchImpl?: typeof fetch;
+    /** D2 安装期 schema 预推导（默认 true，可关） */
+    schemaInference?: boolean;
   });
-  install(source: SkillSource, options?: {
+  install(source: SkillInstallSource, options?: {
     expectedSha256?: string;
   }): Promise<SkillManifest>;
   uninstall(name: string): Promise<void>;
@@ -216,4 +179,4 @@ interface LlmCapabilities {
  */
 declare function probeLlmCapabilities(config: LlmEnvConfig): Promise<LlmCapabilities>;
 //#endregion
-export { loadLlmConfigFromEnv as _, LlmEnvConfig as a, SKILLS_LOCKFILE as c, SandboxedScriptExecutor as d, SkillManager as f, VerifyResult as g, SkillsLockfile as h, LlmCapabilities as i, SKILL_MANIFEST_FILE as l, SkillSource as m, FileArtifactStore as n, NodeFS as o, SkillManifest as p, FileMemoryStore as r, NodeScriptExecutor as s, CliUiBridge as t, SandboxOptions as u, probeLlmCapabilities as v, readArchiveManifest as y };
+export { LlmEnvConfig as a, OxcSchemaInferer as c, SkillManager as d, loadLlmConfigFromEnv as f, LlmCapabilities as i, SandboxOptions as l, readArchiveManifest as m, FileArtifactStore as n, NodeFS as o, probeLlmCapabilities as p, FileMemoryStore as r, NodeScriptExecutor as s, CliUiBridge as t, SandboxedScriptExecutor as u };