@webskill/sdk 0.0.4 → 0.0.5

package/dist/browser.d.ts

@@ -1,4 +1,4 @@
-import { A as LlmClient, C as InteractionPolicy, It as FileStat, Jt as SkillInstallSource, Lt as FileSystemProvider, N as LlmResponse, P as LlmStreamEvent, Q as RenderResultRequest, St as bridgeError, T as InteractionResponse, Zt as SkillManifest, ct as ScriptExecutionContext, d as BridgeResponse, dt as ToolDefinition, kt as parseBridgeRequest, l as BridgeCapabilities, lt as ScriptExecutor, m as ExternalToolSource, p as ExternalSkillProvider, pt as ToolResult, rn as VerifyResult, tn as SkillsLockfile, u as BridgeRequest, vt as UiBridge, w as InteractionRequest } from "./index-CqDIreSE.js";
+import { A as InteractionResponse, F as LlmClient, Gt as FileSystemProvider, Lt as parseBridgeRequest, O as InteractionPolicy, Ot as bridgeError, R as LlmResponse, Wt as FileStat, Y as NetworkPolicy, _t as ToolDefinition, an as SkillManifest, c as ApprovalScope, d as BridgeCapabilities, dn as VerifyResult, ht as ScriptExecutor, it as RenderResultRequest, k as InteractionRequest, ln as SkillsLockfile, m as BridgeResponse, mt as ScriptExecutionContext, nn as SkillInstallSource, p as BridgeRequest, v as ExternalSkillProvider, wt as UiBridge, y as ExternalToolSource, yt as ToolResult, z as LlmStreamEvent } from "./index-BQDc-U1x.js";
 //#region ../browser/dist/index.d.ts
 //#region src/fs/featureDetection.d.ts
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -28,17 +28,22 @@ declare class OpfsProvider implements FileSystemProvider {
 //#region src/executor/workerBootstrap.d.ts
 /**
  * Worker 引导源码（字符串 → Blob URL → new Worker(url, {type:'module'})）。
- * 注意：内容为纯 JS，不能含反引号与 ${ 占位（外层用模板字符串内嵌）。
+ * 注意：内容为纯 JS，不能含反引号与 ${ 占位（外层用模板字符串内嵌）；
+ * isNetworkAllowed/networkUrlHost 经函数源码注入（匹配逻辑单一来源在
+ * runtime/sandbox/networkPolicy.ts，此处禁止复制实现）。
  *
  * 协议（宿主 ↔ Worker）：
- * - 宿主 → Worker：{type:'load', id, source} 请求加载脚本定义
- * - 宿主 → Worker：{type:'execute', id, skillName, runId, source, args} 请求执行
+ * - 宿主 → Worker：{type:'load', id, source, networkPolicy?} 请求加载脚本定义
+ * - 宿主 → Worker：{type:'execute', id, skillName, runId, source, args, networkPolicy?} 请求执行
  * - Worker → 宿主：{type:'load-result', id, ok, definition?, error?}
  * - Worker → 宿主：{type:'execute-result', id, ok, value?, stdout, stderr, error?}
  * - Worker → 宿主：{type:'bridge', request} 能力桥 RPC（readReference/writeArtifact/confirm）
  * - 宿主 → Worker：{type:'bridge-response', response}
+ * - Worker → 宿主：{type:'network-blocked', host} 网络阻断通知（宿主记 run.warning，URL 脱敏只记 host）
  *
  * .js 源码经 data: URL 动态 import；主线程从不 import 技能脚本。
+ * 网络管控：包装 fetch / XMLHttpRequest / WebSocket / EventSource，
+ * 策略默认 deny-all，由 load/execute 消息携带更新。
  */
 declare const WORKER_BOOTSTRAP_SOURCE: string;
 //#endregion
@@ -116,6 +121,12 @@ declare class BrowserWorkerScriptExecutor implements ScriptExecutor {
     fs: FileSystemProvider;
     workerFactory?: WorkerFactory;
     capabilities?: BridgeCapabilities;
+    /** 网络策略：默认 'deny-all'（白名单见 runtime/sandbox/networkPolicy） */
+    networkPolicy?: NetworkPolicy;
+    /** require-approval 模式的授权询问出口（缺失时 require-approval 一律拒绝） */
+    uiBridge?: UiBridge;
+    /** 授权粒度：默认 'once-per-run' */
+    approvalScope?: ApprovalScope;
     /** D4 opt-in：配置 esbuild-wasm 资产 URL 后 .ts 经宿主侧转译执行（未配置 .ts → TOOL_UNSUPPORTED） */
     typescript?: TypeScriptSupportOptions;
   });

package/dist/browser.js

@@ -1,4 +1,4 @@
-import { A as parseBridgeRequest, B as SkillDiscovery, C as bridgeError, H as WebSkillError, I as SKILLS_LOCKFILE, J as isValidSkillName, L as SKILL_MANIFEST_FILE, O as mergeCatalogEntries, U as buildCatalog, W as buildManifest, Z as parseSkillMarkdown, b as RUN_SNAPSHOT_SCHEMA_VERSION, c as FsRunSnapshotStore, et as resolveInsideRoot, g as ProgressiveRouter, h as OpenAiCompatibleClient, i as AgentLoop, k as normalizeToolContent, nt as verifyManifest, o as FsArtifactStore, p as MockLlmClient, s as FsMemoryStore, tt as validateSkills } from "./dist-COsE72Ct.js";
+import { A as mergeCatalogEntries, B as SKILL_MANIFEST_FILE, G as WebSkillError, K as buildCatalog, M as normalizeToolContent, N as parseBridgeRequest, U as SkillDiscovery, Z as isValidSkillName, _ as ProgressiveRouter, a as CapabilityApproval, at as verifyManifest, c as FsMemoryStore, et as parseSkillMarkdown, g as OpenAiCompatibleClient, i as AgentLoop, it as validateSkills, j as networkUrlHost, k as isNetworkAllowed, l as FsRunSnapshotStore, m as MockLlmClient, q as buildManifest, rt as resolveInsideRoot, s as FsArtifactStore, w as bridgeError, x as RUN_SNAPSHOT_SCHEMA_VERSION, z as SKILLS_LOCKFILE } from "./dist-D405AlPD.js";
 import { unzipSync } from "fflate";
 
 //#region ../browser/dist/index.js
@@ -134,23 +134,92 @@ var OpfsProvider = class {
 };
 /**
 * Worker 引导源码（字符串 → Blob URL → new Worker(url, {type:'module'})）。
-* 注意：内容为纯 JS，不能含反引号与 ${ 占位（外层用模板字符串内嵌）。
+* 注意：内容为纯 JS，不能含反引号与 ${ 占位（外层用模板字符串内嵌）；
+* isNetworkAllowed/networkUrlHost 经函数源码注入（匹配逻辑单一来源在
+* runtime/sandbox/networkPolicy.ts，此处禁止复制实现）。
 *
 * 协议（宿主 ↔ Worker）：
-* - 宿主 → Worker：{type:'load', id, source} 请求加载脚本定义
-* - 宿主 → Worker：{type:'execute', id, skillName, runId, source, args} 请求执行
+* - 宿主 → Worker：{type:'load', id, source, networkPolicy?} 请求加载脚本定义
+* - 宿主 → Worker：{type:'execute', id, skillName, runId, source, args, networkPolicy?} 请求执行
 * - Worker → 宿主：{type:'load-result', id, ok, definition?, error?}
 * - Worker → 宿主：{type:'execute-result', id, ok, value?, stdout, stderr, error?}
 * - Worker → 宿主：{type:'bridge', request} 能力桥 RPC（readReference/writeArtifact/confirm）
 * - 宿主 → Worker：{type:'bridge-response', response}
+* - Worker → 宿主：{type:'network-blocked', host} 网络阻断通知（宿主记 run.warning，URL 脱敏只记 host）
 *
 * .js 源码经 data: URL 动态 import；主线程从不 import 技能脚本。
+* 网络管控：包装 fetch / XMLHttpRequest / WebSocket / EventSource，
+* 策略默认 deny-all，由 load/execute 消息携带更新。
 */
 const WORKER_BOOTSTRAP_SOURCE = String.raw`
 'use strict';
 
 var pending = new Map();
 var bridgeSeq = 0;
+var networkPolicy = 'deny-all';
+
+${isNetworkAllowed.toString()}
+
+${networkUrlHost.toString()}
+
+function resolveUrl(raw) {
+  try {
+    return new URL(raw, self.location.href).href;
+  } catch (e) {
+    return String(raw);
+  }
+}
+
+function networkGate(rawUrl) {
+  var url = resolveUrl(rawUrl);
+  if (isNetworkAllowed(networkPolicy, url)) return null;
+  var host = networkUrlHost(url);
+  self.postMessage({ type: 'network-blocked', host: host });
+  var err = new Error('Network request blocked by sandbox network policy: ' + host);
+  err.code = 'NETWORK_BLOCKED';
+  return err;
+}
+
+if (typeof self.fetch === 'function') {
+  var originalFetch = self.fetch;
+  self.fetch = function (input, init) {
+    var raw = typeof input === 'string' ? input : input && input.url ? input.url : String(input);
+    var blocked = networkGate(raw);
+    if (blocked) return Promise.reject(blocked);
+    return originalFetch.call(this, input, init);
+  };
+}
+
+if (typeof XMLHttpRequest !== 'undefined') {
+  var originalXhrOpen = XMLHttpRequest.prototype.open;
+  XMLHttpRequest.prototype.open = function (method, url) {
+    var blocked = networkGate(url);
+    if (blocked) throw blocked;
+    return originalXhrOpen.apply(this, arguments);
+  };
+}
+
+if (typeof WebSocket !== 'undefined') {
+  var OriginalWebSocket = WebSocket;
+  self.WebSocket = function (url, protocols) {
+    var blocked = networkGate(url);
+    if (blocked) throw blocked;
+    return protocols === undefined
+      ? new OriginalWebSocket(url)
+      : new OriginalWebSocket(url, protocols);
+  };
+  self.WebSocket.prototype = OriginalWebSocket.prototype;
+}
+
+if (typeof EventSource !== 'undefined') {
+  var OriginalEventSource = EventSource;
+  self.EventSource = function (url, config) {
+    var blocked = networkGate(url);
+    if (blocked) throw blocked;
+    return config === undefined ? new OriginalEventSource(url) : new OriginalEventSource(url, config);
+  };
+  self.EventSource.prototype = OriginalEventSource.prototype;
+}
 
 function loadModule(source) {
   var url = 'data:text/javascript;charset=utf-8,' + encodeURIComponent(source);
@@ -212,6 +281,7 @@ self.onmessage = async function (event) {
   }
 
   if (msg.type === 'load') {
+    if (msg.networkPolicy !== undefined) networkPolicy = msg.networkPolicy;
     try {
       var mod = await loadModule(msg.source);
       self.postMessage({
@@ -225,12 +295,13 @@ self.onmessage = async function (event) {
         },
       });
     } catch (e) {
-      postError('load-result', msg.id, 'TOOL_EXECUTION_FAILED', String((e && e.message) || e));
+      postError('load-result', msg.id, (e && e.code) || 'TOOL_EXECUTION_FAILED', String((e && e.message) || e));
     }
     return;
   }
 
   if (msg.type === 'execute') {
+    if (msg.networkPolicy !== undefined) networkPolicy = msg.networkPolicy;
     var stdout = [];
     var stderr = [];
     var originals = {
@@ -543,6 +614,8 @@ var BrowserWorkerScriptExecutor = class {
 	#fs;
 	#workerFactory;
 	#capabilities;
+	#networkPolicy;
+	#approval;
 	#transpiler;
 	constructor(deps) {
 		this.#fs = deps.fs;
@@ -556,6 +629,11 @@ var BrowserWorkerScriptExecutor = class {
 			writeArtifact: deps.capabilities?.writeArtifact ?? true,
 			confirm: deps.capabilities?.confirm ?? true
 		};
+		this.#networkPolicy = deps.networkPolicy ?? "deny-all";
+		this.#approval = new CapabilityApproval({
+			...deps.uiBridge ? { uiBridge: deps.uiBridge } : {},
+			...deps.approvalScope ? { scope: deps.approvalScope } : {}
+		});
 	}
 	/** 定位 scripts/<name>.js；.ts → TOOL_UNSUPPORTED（D4）；冲突/缺失结构化报错 */
 	async #locateScript(skillRoot, scriptName) {
@@ -584,7 +662,8 @@ var BrowserWorkerScriptExecutor = class {
 			const data = await this.#request(worker, {
 				type: "load",
 				id: "load-1",
-				source: script.source
+				source: script.source,
+				networkPolicy: this.#networkPolicy
 			});
 			if (!data.ok) throw new WebSkillError("TOOL_EXECUTION_FAILED", `Failed to load script "${scriptName}": ${data.error?.message ?? "unknown error"}`);
 			return {
@@ -621,8 +700,9 @@ var BrowserWorkerScriptExecutor = class {
 				skillName: context.skillName,
 				runId: context.runId,
 				source: script.source,
-				args
-			}, timeoutMs, (bridgeRequest) => this.#handleBridge(bridgeRequest, context));
+				args,
+				networkPolicy: this.#networkPolicy
+			}, timeoutMs, (bridgeRequest) => this.#handleBridge(bridgeRequest, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!response.ok) {
 				const stderrSummary = response.stderr?.length ? ` | stderr: ${response.stderr.join(" | ").slice(0, 500)}` : "";
 				return {
@@ -656,8 +736,8 @@ var BrowserWorkerScriptExecutor = class {
 			worker.terminate();
 		}
 	}
-	/** 发消息并按 id 等回包；可选超时；onBridge 处理执行期间的能力桥请求 */
-	#request(worker, message, timeoutMs, onBridge) {
+	/** 发消息并按 id 等回包；可选超时；onBridge 处理执行期间的能力桥请求；onNetworkBlocked 收网络阻断通知 */
+	#request(worker, message, timeoutMs, onBridge, onNetworkBlocked) {
 		const id = String(message["id"]);
 		return new Promise((resolve, reject) => {
 			let settled = false;
@@ -670,6 +750,10 @@ var BrowserWorkerScriptExecutor = class {
 			worker.addEventListener("message", (event) => {
 				const data = event.data;
 				if (!data || typeof data !== "object") return;
+				if (data.type === "network-blocked") {
+					if (typeof data.host === "string") onNetworkBlocked?.(data.host);
+					return;
+				}
 				if (data.type === "bridge" && onBridge) {
 					const request = parseBridgeRequest(data.request);
 					const respond = (response) => worker.postMessage({
@@ -691,20 +775,36 @@ var BrowserWorkerScriptExecutor = class {
 			worker.postMessage(message);
 		});
 	}
-	/** 能力桥宿主侧处理：能力关闭即 TOOL_UNSUPPORTED；readReference/writeArtifact/confirm 委托 context */
+	/** 能力桥宿主侧处理：能力关闭/授权拒绝即 TOOL_UNSUPPORTED；判定逻辑共用 runtime/sandbox/approval */
 	async #handleBridge(request, context) {
-		const unsupported = (capability) => bridgeError(request.id, "TOOL_UNSUPPORTED", `Capability "${capability}" is disabled`);
+		const gate = async (capability, message, details) => {
+			const decision = await this.#approval.authorize({
+				runId: context.runId,
+				capability,
+				mode: this.#capabilities[capability],
+				message,
+				...details !== void 0 ? { details } : {}
+			});
+			if (decision === "allowed") return void 0;
+			return bridgeError(request.id, "TOOL_UNSUPPORTED", decision === "disabled" ? `Capability "${capability}" is disabled` : `Capability "${capability}" was denied by the user`);
+		};
 		try {
 			switch (request.kind) {
-				case "readReference":
-					if (!this.#capabilities.readReference) return unsupported("readReference");
+				case "readReference": {
+					const denied = await gate("readReference", `Script "${context.skillName}" wants to read reference "${request.path}"`, { path: request.path });
+					if (denied) return denied;
 					return {
 						id: request.id,
 						ok: true,
 						value: await context.readReference(request.path)
 					};
+				}
 				case "writeArtifact": {
-					if (!this.#capabilities.writeArtifact) return unsupported("writeArtifact");
+					const denied = await gate("writeArtifact", `Script "${context.skillName}" wants to write artifact "${request.path}"`, {
+						path: request.path,
+						mimeType: request.mimeType
+					});
+					if (denied) return denied;
 					const content = typeof request.content === "string" ? request.content : new Uint8Array(request.content);
 					const artifact = await context.writeArtifact(request.path, content, { ...request.mimeType ? { mimeType: request.mimeType } : {} });
 					return {
@@ -713,13 +813,16 @@ var BrowserWorkerScriptExecutor = class {
 						value: artifact
 					};
 				}
-				case "confirm":
-					if (!this.#capabilities.confirm || !context.confirm) return unsupported("confirm");
+				case "confirm": {
+					if (!context.confirm) return bridgeError(request.id, "TOOL_UNSUPPORTED", "Capability \"confirm\" is disabled");
+					const denied = await gate("confirm", `Script "${context.skillName}" asks for confirmation: ${request.message}`);
+					if (denied) return denied;
 					return {
 						id: request.id,
 						ok: true,
 						value: await context.confirm(request.message)
 					};
+				}
 			}
 		} catch (e) {
 			return bridgeError(request.id, e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED", messageOf(e));

package/dist/{dist-RcqvzAGF.js → dist-BM-VcQ90.js}

@@ -5,10 +5,11 @@ function shapeInteractionValue(model, values) {
 		case "ask": return values["answer"];
 		case "confirm": return values["confirmed"] === true;
 		case "select": return values["selected"];
+		case "authorize": return true;
 		case "form": return values;
 	}
 }
-/** 四类 InteractionRequest → 统一中间模型（框架无关） */
+/** 五类 InteractionRequest → 统一中间模型（框架无关） */
 function interactionToFormModel(request) {
 	switch (request.type) {
 		case "ask": return {
@@ -63,6 +64,14 @@ function interactionToFormModel(request) {
 			submitLabel: "Select",
 			cancelLabel: "Cancel"
 		};
+		case "authorize": return {
+			kind: "authorize",
+			title: "Authorization required",
+			message: request.message,
+			controls: [],
+			submitLabel: "Allow",
+			cancelLabel: "Deny"
+		};
 	}
 }
 const isEmpty = (v) => v === void 0 || v === "";
@@ -551,6 +560,15 @@ function toOpenUiLang(request) {
 				options: request.options
 			}];
 			break;
+		case "authorize":
+			title = "Authorization required";
+			fields = [{
+				name: "approved",
+				label: request.message,
+				control: "boolean",
+				defaultValue: false
+			}];
+			break;
 	}
 	lines.push(...fieldStatements(fields));
 	const children = fields.map((_, i) => `f${i}`);
@@ -617,7 +635,11 @@ function toA2uiMessages(request) {
 		components.push(text("title", request.title, "h3"));
 		children.push("title");
 	}
-	const message = request.type === "ask" || request.type === "confirm" || request.type === "select" ? request.message : void 0;
+	if (request.type === "authorize") {
+		components.push(text("title", "Authorization required", "h3"));
+		children.push("title");
+	}
+	const message = request.type === "ask" || request.type === "confirm" || request.type === "select" || request.type === "authorize" ? request.message : void 0;
 	if (message) {
 		components.push(text("message", message));
 		children.push("message");
@@ -632,7 +654,7 @@ function toA2uiMessages(request) {
 		label: request.message,
 		type: "boolean",
 		defaultValue: request.defaultValue ?? true
-	}] : [{
+	}] : request.type === "authorize" ? [] : [{
 		name: "selected",
 		label: request.message,
 		type: "select",
@@ -675,7 +697,7 @@ function toA2uiMessages(request) {
 		});
 		children.push(`field_${field.name}`);
 	}
-	components.push(text("submit_label", "Submit"));
+	components.push(text("submit_label", request.type === "authorize" ? "Allow" : "Submit"));
 	components.push({
 		id: "submit",
 		component: "Button",
@@ -686,7 +708,7 @@ function toA2uiMessages(request) {
 			context: { requestId: request.id }
 		} }
 	});
-	components.push(text("cancel_label", "Cancel"));
+	components.push(text("cancel_label", request.type === "authorize" ? "Deny" : "Cancel"));
 	components.push({
 		id: "cancel",
 		component: "Button",
@@ -15359,13 +15381,15 @@ var LitRendererBridge = class {
 				const surfaces = processor.getClientDataModel("v0.9.1")?.surfaces;
 				const formValues = typeof surfaces?.[surfaceId] === "object" && surfaces[surfaceId] !== null ? surfaces[surfaceId]["form"] ?? action.context : action.context;
 				cleanup(surfaceEl);
-				resolve(fromA2uiAction({
+				const response = fromA2uiAction({
 					...action,
 					context: {
 						...action.context,
 						values: formValues
 					}
-				}));
+				});
+				if (input.type === "authorize" && !response.cancelled) response.value = true;
+				resolve(response);
 			}, { version: "v0.9.1" });
 			processor.onSurfaceCreated((surface) => {
 				const el = this.#doc.createElement("a2ui-surface");

package/dist/{dist-COsE72Ct.js → dist-D405AlPD.js}

@@ -259,6 +259,15 @@ function checkSkillRules(input) {
 		severity: "error",
 		message: `Unsupported script file in scripts/ of directory ${dirName}: ${fileName} (only .ts/.js and .schema.json sidecars allowed)`
 	});
+	const allowedTools = metadata?.["allowed-tools"];
+	if (Array.isArray(allowedTools)) {
+		const scriptNames = new Set((input.scriptFileNames ?? []).filter((f) => SCRIPT_EXTENSION_RE.test(f)).map((f) => f.replace(SCRIPT_EXTENSION_RE, "")));
+		for (const entry of allowedTools) if (typeof entry === "string" && !scriptNames.has(entry)) issues.push({
+			code: "SKILL_UNKNOWN_ALLOWED_TOOL",
+			severity: "warning",
+			message: `allowed-tools entry ${JSON.stringify(entry)} of directory ${dirName} does not match any script in scripts/`
+		});
+	}
 	return issues;
 }
 /** 由条目列表构建 Catalog，保证按名称排序 */
@@ -908,7 +917,7 @@ const ASK_USER_TOOL = {
 * 不暴露 fs 本体（沙箱语义，对齐 deferred-items D1）。
 */
 function createScriptContext(deps) {
-	const { fs, artifactStore, skillName, skillRoot, runId, confirm } = deps;
+	const { fs, artifactStore, skillName, skillRoot, runId, confirm, onWarning } = deps;
 	return {
 		skillName,
 		runId,
@@ -928,7 +937,8 @@ function createScriptContext(deps) {
 				mimeType: options?.mimeType
 			});
 		},
-		...confirm ? { confirm } : {}
+		...confirm ? { confirm } : {},
+		...onWarning ? { onWarning } : {}
 	};
 }
 /**
@@ -1310,6 +1320,91 @@ function bridgeError(id, code, message) {
 		}
 	};
 }
+/**
+* 判定 URL 是否被策略放行：
+* - 'deny-all'（默认）全拒；'allow-all' 全放
+* - { allow } 条目支持三种写法：
+*   - 精确域名 'api.example.com'（忽略端口与路径）
+*   - 通配 '*.example.com'（含 apex 与任意深度子域）
+*   - 源 'http://localhost:3000'（协议 + host + port 全等）
+* - URL 解析失败一律拒绝
+*/
+function isNetworkAllowed(policy, url) {
+	if (policy === "allow-all") return true;
+	if (policy === "deny-all" || !policy || typeof policy !== "object") return false;
+	var allow = policy.allow;
+	if (!Array.isArray(allow)) return false;
+	var parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return false;
+	}
+	var host = parsed.hostname.toLowerCase();
+	for (var i = 0; i < allow.length; i++) {
+		var entry = allow[i];
+		if (typeof entry !== "string" || entry === "") continue;
+		if (entry.indexOf("://") !== -1) {
+			try {
+				if (new URL(entry).origin === parsed.origin) return true;
+			} catch {}
+			continue;
+		}
+		var rule = entry.toLowerCase();
+		if (rule.indexOf("*.") === 0) {
+			var suffix = rule.slice(2);
+			if (host === suffix || host.endsWith("." + suffix)) return true;
+		} else if (host === rule) return true;
+	}
+	return false;
+}
+/** 阻断 trace 用的脱敏 host（解析失败返回占位，不记录完整 URL） */
+function networkUrlHost(url) {
+	try {
+		return new URL(url).hostname;
+	} catch {
+		return "(unparseable-url)";
+	}
+}
+/**
+* Per-capability 强制授权判定（宿主侧，browser/node 执行器共用单一来源）。
+* 'require-approval' 模式下经注入的 UiBridge 发 authorize 交互；
+* once-per-run（默认）在 run 内记忆已批准能力，every-call 每次调用都问。
+*/
+var CapabilityApproval = class {
+	#uiBridge;
+	#scope;
+	/** runId → 已批准能力集合（once-per-run 记忆） */
+	#approved = /* @__PURE__ */ new Map();
+	#seq = 0;
+	constructor(deps = {}) {
+		this.#uiBridge = deps.uiBridge;
+		this.#scope = deps.scope ?? "once-per-run";
+	}
+	async authorize(input) {
+		const { runId, capability, mode } = input;
+		if (mode === false) return "disabled";
+		if (mode !== "require-approval") return "allowed";
+		if (this.#scope === "once-per-run" && this.#approved.get(runId)?.has(capability)) return "allowed";
+		if (!this.#uiBridge) return "denied";
+		if ((await this.#uiBridge.request({
+			type: "authorize",
+			id: `authorize-${runId}-${capability}-${++this.#seq}`,
+			capability,
+			message: input.message,
+			...input.details !== void 0 ? { details: input.details } : {}
+		})).value !== true) return "denied";
+		if (this.#scope === "once-per-run") {
+			let set = this.#approved.get(runId);
+			if (!set) {
+				set = /* @__PURE__ */ new Set();
+				this.#approved.set(runId, set);
+			}
+			set.add(capability);
+		}
+		return "allowed";
+	}
+};
 /** 结构化 trace 记录器；时钟与 id 工厂可注入（golden trace 用固定值保证确定性） */
 var TraceRecorder = class {
 	#runId;
@@ -1938,6 +2033,13 @@ var AgentLoop = class {
 		if (!root) return "";
 		const executor = this.#deps.executor;
 		if (!executor) return "";
+		let allowedTools;
+		try {
+			const { metadata } = parseSkillMarkdown(await this.#deps.fs.readText(`${root}/SKILL.md`));
+			const raw = metadata["allowed-tools"];
+			if (raw !== void 0) if (Array.isArray(raw)) allowedTools = raw.filter((e) => typeof e === "string");
+			else state.trace.record("run.warning", { message: `Skill "${skillName}" has a non-array "allowed-tools" metadata entry; ignored` });
+		} catch {}
 		const loaded = [];
 		let scriptFiles = [];
 		try {
@@ -1948,6 +2050,7 @@ var AgentLoop = class {
 		for (const file of scriptFiles) {
 			const match = /^(.*)\.(ts|js)$/.exec(file);
 			if (!match?.[1]) continue;
+			if (allowedTools && !allowedTools.includes(match[1])) continue;
 			try {
 				const def = await executor.loadDefinition(root, match[1]);
 				await this.#enrichDefinition(root, match[1], def, state);
@@ -1982,10 +2085,12 @@ var AgentLoop = class {
 	async #handleScriptTool(call, skillName, scriptName, state) {
 		const root = this.#deps.skillIndex.get(skillName);
 		if (!root) return toolError("TOOL_NOT_FOUND", `Skill "${skillName}" is not in the catalog`);
-		let args = call.arguments;
+		if (!this.#deps.executor) return toolError("TOOL_UNSUPPORTED", `No script executor is configured; script tool "${call.name}" cannot run`);
 		const def = state.activatedTools.get(call.name);
-		const missing = (def?.inputSchema?.required ?? []).filter((key) => args[key] === void 0);
-		if (missing.length > 0 && this.#deps.uiBridge && this.#policy.missingParams === "user" && def?.inputSchema) try {
+		if (!def) return toolError("TOOL_NOT_FOUND", `Tool "${call.name}" is not available for skill "${skillName}"`);
+		let args = call.arguments;
+		const missing = (def.inputSchema?.required ?? []).filter((key) => args[key] === void 0);
+		if (missing.length > 0 && this.#deps.uiBridge && this.#policy.missingParams === "user" && def.inputSchema) try {
 			const value = await this.#interact(state, {
 				type: "form",
 				id: this.#nextInteractionId(state),
@@ -2003,14 +2108,14 @@ var AgentLoop = class {
 			if (e instanceof BridgeRequestError) return toolError("UI_UNAVAILABLE", `Parameter form failed: ${e.message}`);
 			throw e;
 		}
-		if (!this.#deps.executor) return toolError("TOOL_UNSUPPORTED", `No script executor is configured; script tool "${call.name}" cannot run`);
 		const context = createScriptContext({
 			fs: this.#deps.fs,
 			artifactStore: this.#deps.artifactStore,
 			skillName,
 			skillRoot: root,
 			runId: state.runId,
-			confirm: (message) => this.#confirm(message, state)
+			confirm: (message) => this.#confirm(message, state),
+			onWarning: (message) => state.trace.record("run.warning", { message })
 		});
 		try {
 			const before = new Set((await this.#deps.artifactStore.listArtifacts(state.runId)).map((a) => a.id));
@@ -2325,4 +2430,4 @@ var WebSkillRuntime = class {
 };
 
 //#endregion
-export { renderCatalogJson as $, parseBridgeRequest as A, SkillDiscovery as B, bridgeError as C, fromVercelStreamPart as D, fromVercelResult as E, MemoryFS as F, checkSkillRules as G, WebSkillError as H, SKILLS_LOCKFILE as I, isValidSkillName as J, computeDigest as K, SKILL_MANIFEST_FILE as L, schemaToForm as M, toLlmToolSpec as N, mergeCatalogEntries as O, toVercelToolSpecs as P, renderAvailableSkillsXml as Q, SKILL_NAME_MAX_LENGTH as R, WebSkillRuntime as S, createScriptContext as T, buildCatalog as U, SkillReader as V, buildManifest as W, normalizePath as X, jsonRenderer as Y, parseSkillMarkdown as Z, READ_SKILL_FILE_INPUT_SCHEMA as _, EventBus as a, RUN_SNAPSHOT_SCHEMA_VERSION as b, FsRunSnapshotStore as c, InMemoryStore as d, resolveInsideRoot as et, MemoryArtifactStore as f, ProgressiveRouter as g, OpenAiCompatibleClient as h, AgentLoop as i, resolveToolName as j, normalizeToolContent as k, FullDisclosureRouter as l, MockUiBridge as m, ASK_USER_TOOL as n, verifyManifest as nt, FsArtifactStore as o, MockLlmClient as p, escapeXml as q, ASK_USER_TOOL_NAME as r, xmlRenderer as rt, FsMemoryStore as s, ASK_USER_INPUT_SCHEMA as t, validateSkills as tt, HookRunner as u, READ_SKILL_FILE_TOOL as v, buildRenderResult as w, TraceRecorder as x, READ_SKILL_FILE_TOOL_NAME as y, SKILL_NAME_PATTERN as z };
+export { normalizePath as $, mergeCatalogEntries as A, SKILL_MANIFEST_FILE as B, WebSkillRuntime as C, fromVercelResult as D, createScriptContext as E, schemaToForm as F, WebSkillError as G, SKILL_NAME_PATTERN as H, toLlmToolSpec as I, checkSkillRules as J, buildCatalog as K, toVercelToolSpecs as L, normalizeToolContent as M, parseBridgeRequest as N, fromVercelStreamPart as O, resolveToolName as P, jsonRenderer as Q, MemoryFS as R, TraceRecorder as S, buildRenderResult as T, SkillDiscovery as U, SKILL_NAME_MAX_LENGTH as V, SkillReader as W, escapeXml as X, computeDigest as Y, isValidSkillName as Z, ProgressiveRouter as _, CapabilityApproval as a, verifyManifest as at, READ_SKILL_FILE_TOOL_NAME as b, FsMemoryStore as c, HookRunner as d, parseSkillMarkdown as et, InMemoryStore as f, OpenAiCompatibleClient as g, MockUiBridge as h, AgentLoop as i, validateSkills as it, networkUrlHost as j, isNetworkAllowed as k, FsRunSnapshotStore as l, MockLlmClient as m, ASK_USER_TOOL as n, renderCatalogJson as nt, EventBus as o, xmlRenderer as ot, MemoryArtifactStore as p, buildManifest as q, ASK_USER_TOOL_NAME as r, resolveInsideRoot as rt, FsArtifactStore as s, ASK_USER_INPUT_SCHEMA as t, renderAvailableSkillsXml as tt, FullDisclosureRouter as u, READ_SKILL_FILE_INPUT_SCHEMA as v, bridgeError as w, RUN_SNAPSHOT_SCHEMA_VERSION as x, READ_SKILL_FILE_TOOL as y, SKILLS_LOCKFILE as z };

package/dist/{dist-Bvhbxrrt.js → dist-Ixnb-hNR.js}

@@ -1,4 +1,4 @@
-import { A as parseBridgeRequest, C as bridgeError, H as WebSkillError, I as SKILLS_LOCKFILE, J as isValidSkillName, L as SKILL_MANIFEST_FILE, W as buildManifest, Z as parseSkillMarkdown, et as resolveInsideRoot, k as normalizeToolContent, nt as verifyManifest, o as FsArtifactStore, s as FsMemoryStore, tt as validateSkills } from "./dist-COsE72Ct.js";
+import { B as SKILL_MANIFEST_FILE, G as WebSkillError, M as normalizeToolContent, N as parseBridgeRequest, Z as isValidSkillName, a as CapabilityApproval, at as verifyManifest, c as FsMemoryStore, et as parseSkillMarkdown, it as validateSkills, j as networkUrlHost, k as isNetworkAllowed, q as buildManifest, rt as resolveInsideRoot, s as FsArtifactStore, w as bridgeError, z as SKILLS_LOCKFILE } from "./dist-D405AlPD.js";
 import { existsSync, promises, readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -224,6 +224,11 @@ var NodeScriptExecutor = class {
 const baseName = (p) => p.split("/").pop() ?? p;
 const toPlatform$1 = (p) => p.split("/").join(path.sep);
 const messageOf$5 = (e) => e instanceof Error ? e.message : String(e);
+/**
+* 网络策略判定函数源码（注入 Worker；匹配逻辑单一来源在
+* runtime/sandbox/networkPolicy.ts，Worker 线程不走 vitest 别名故注入而非 import）
+*/
+const NETWORK_POLICY_LIB = `${isNetworkAllowed.toString()}\n${networkUrlHost.toString()}`;
 /** Worker 入口文件：src 为同目录 .ts；dist 为 dist/executor/ 下的 .js */
 function workerEntryPath() {
 	const dir = path.dirname(fileURLToPath(import.meta.url));
@@ -245,6 +250,8 @@ var SandboxedScriptExecutor = class {
 	#fs;
 	#options;
 	#capabilities;
+	#networkPolicy;
+	#approval;
 	constructor(fs, options = {}) {
 		this.#fs = fs;
 		this.#options = options;
@@ -253,6 +260,11 @@ var SandboxedScriptExecutor = class {
 			writeArtifact: options.capabilities?.writeArtifact ?? true,
 			confirm: options.capabilities?.confirm ?? true
 		};
+		this.#networkPolicy = options.networkPolicy ?? "deny-all";
+		this.#approval = new CapabilityApproval({
+			...options.uiBridge ? { uiBridge: options.uiBridge } : {},
+			...options.approvalScope ? { scope: options.approvalScope } : {}
+		});
 	}
 	async #locateScript(skillRoot, scriptName) {
 		const tsPath = `${skillRoot}/scripts/${scriptName}.ts`;
@@ -302,7 +314,7 @@ var SandboxedScriptExecutor = class {
 				skillName: context.skillName,
 				runId: context.runId,
 				args
-			}, timeoutMs, (request) => this.#handleBridge(request, context));
+			}, timeoutMs, (request) => this.#handleBridge(request, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!result.ok) {
 				const stderrSummary = result.stderr?.length ? ` | stderr: ${result.stderr.join(" | ").slice(0, 500)}` : "";
 				return {
@@ -335,12 +347,16 @@ var SandboxedScriptExecutor = class {
 		}
 	}
 	/** 起独立 Worker 执行任务；超时 terminate（同步死循环可杀）；非零退出码 → TOOL_EXECUTION_FAILED */
-	#runWorker(workerData, timeoutMs = 3e4, onBridge) {
+	#runWorker(workerData, timeoutMs = 3e4, onBridge, onNetworkBlocked) {
 		const envWhitelist = this.#options.envWhitelist ?? [];
 		const env = Object.fromEntries(envWhitelist.filter((key) => process.env[key] !== void 0).map((key) => [key, process.env[key]]));
 		return new Promise((resolve, reject) => {
 			const worker = new Worker(workerEntryPath(), {
-				workerData,
+				workerData: {
+					...workerData,
+					networkPolicy: this.#networkPolicy,
+					networkPolicyLib: NETWORK_POLICY_LIB
+				},
 				env,
 				resourceLimits: this.#options.resourceLimits ?? {
 					maxOldGenerationSizeMb: 64,
@@ -361,6 +377,10 @@ var SandboxedScriptExecutor = class {
 				fn();
 			};
 			worker.on("message", (msg) => {
+				if (msg?.type === "network-blocked") {
+					if (typeof msg.host === "string") onNetworkBlocked?.(msg.host);
+					return;
+				}
 				if (msg?.type === "bridge" && onBridge) {
 					const request = parseBridgeRequest(msg.request);
 					const respond = (response) => worker.postMessage({
@@ -382,20 +402,36 @@ var SandboxedScriptExecutor = class {
 			});
 		});
 	}
-	/** 能力桥宿主侧处理：能力关闭即 TOOL_UNSUPPORTED；委托 context */
+	/** 能力桥宿主侧处理：能力关闭/授权拒绝即 TOOL_UNSUPPORTED；判定逻辑共用 runtime/sandbox/approval */
 	async #handleBridge(request, context) {
-		const unsupported = (capability) => bridgeError(request.id, "TOOL_UNSUPPORTED", `Capability "${capability}" is disabled`);
+		const gate = async (capability, message, details) => {
+			const decision = await this.#approval.authorize({
+				runId: context.runId,
+				capability,
+				mode: this.#capabilities[capability],
+				message,
+				...details !== void 0 ? { details } : {}
+			});
+			if (decision === "allowed") return void 0;
+			return bridgeError(request.id, "TOOL_UNSUPPORTED", decision === "disabled" ? `Capability "${capability}" is disabled` : `Capability "${capability}" was denied by the user`);
+		};
 		try {
 			switch (request.kind) {
-				case "readReference":
-					if (!this.#capabilities.readReference) return unsupported("readReference");
+				case "readReference": {
+					const denied = await gate("readReference", `Script "${context.skillName}" wants to read reference "${request.path}"`, { path: request.path });
+					if (denied) return denied;
 					return {
 						id: request.id,
 						ok: true,
 						value: await context.readReference(request.path)
 					};
+				}
 				case "writeArtifact": {
-					if (!this.#capabilities.writeArtifact) return unsupported("writeArtifact");
+					const denied = await gate("writeArtifact", `Script "${context.skillName}" wants to write artifact "${request.path}"`, {
+						path: request.path,
+						mimeType: request.mimeType
+					});
+					if (denied) return denied;
 					const content = typeof request.content === "string" ? request.content : new Uint8Array(request.content);
 					const artifact = await context.writeArtifact(request.path, content, { ...request.mimeType ? { mimeType: request.mimeType } : {} });
 					return {
@@ -404,13 +440,16 @@ var SandboxedScriptExecutor = class {
 						value: artifact
 					};
 				}
-				case "confirm":
-					if (!this.#capabilities.confirm || !context.confirm) return unsupported("confirm");
+				case "confirm": {
+					if (!context.confirm) return bridgeError(request.id, "TOOL_UNSUPPORTED", "Capability \"confirm\" is disabled");
+					const denied = await gate("confirm", `Script "${context.skillName}" asks for confirmation: ${request.message}`);
+					if (denied) return denied;
 					return {
 						id: request.id,
 						ok: true,
 						value: await context.confirm(request.message)
 					};
+				}
 			}
 		} catch (e) {
 			return bridgeError(request.id, e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED", messageOf$5(e));
@@ -615,7 +654,8 @@ var FileMemoryStore = class extends FsMemoryStore {
 };
 /**
 * 命令行 UiBridge：ask→问答，confirm→y/n（带默认值），
-* form→逐字段提示（显示默认值与必填标记），select→编号列表。
+* form→逐字段提示（显示默认值与必填标记），select→编号列表，
+* authorize→授权询问（默认拒绝，仅显式 y/yes 批准）。
 * 输入/输出流可注入（测试用 PassThrough）。
 */
 var CliUiBridge = class {
@@ -659,6 +699,14 @@ var CliUiBridge = class {
 					value: option ? option.value : void 0
 				};
 			}
+			case "authorize": {
+				this.#write(`[authorization required: ${input.capability}]\n`);
+				const answer = (await this.#question(`${input.message} [y/N] `)).trim().toLowerCase();
+				return {
+					id: input.id,
+					value: answer === "y" || answer === "yes"
+				};
+			}
 		}
 	}
 	async progress(input) {

package/dist/governance.d.ts

@@ -1,5 +1,5 @@
-import { A as LlmClient, Gt as SkillCatalogEntry, Lt as FileSystemProvider, M as LlmMessage, Zt as SkillManifest, at as RuntimeRun, bt as WebSkillRuntime, vt as UiBridge } from "./index-CqDIreSE.js";
-import { d as SkillManager } from "./index-BsbfEiaC.js";
+import { $t as SkillCatalogEntry, Et as WebSkillRuntime, F as LlmClient, Gt as FileSystemProvider, L as LlmMessage, an as SkillManifest, dt as RuntimeRun, wt as UiBridge } from "./index-BQDc-U1x.js";
+import { d as SkillManager } from "./index-aEple804.js";
 //#region ../governance/dist/index.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';

package/dist/governance.js

@@ -1,5 +1,5 @@
-import { H as WebSkillError, J as isValidSkillName, et as resolveInsideRoot, tt as validateSkills } from "./dist-COsE72Ct.js";
-import { i as NodeFS } from "./dist-Bvhbxrrt.js";
+import { G as WebSkillError, Z as isValidSkillName, it as validateSkills, rt as resolveInsideRoot } from "./dist-D405AlPD.js";
+import { i as NodeFS } from "./dist-Ixnb-hNR.js";
 import path from "node:path";
 import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";

package/dist/{index-CqDIreSE.d.ts → index-BQDc-U1x.d.ts}

@@ -1,6 +1,6 @@
 //#region ../core/dist/index.d.ts
 //#region src/errors.d.ts
-type WebSkillErrorCode = 'FS_NOT_FOUND' | 'FS_PATH_OUTSIDE_ROOT' | 'SKILL_NOT_FOUND' | 'SKILL_INVALID_METADATA' | 'SKILL_INVALID_NAME' | 'SKILL_DUPLICATE_NAME' | 'SKILL_UNSUPPORTED_SCRIPT' | 'VALIDATION_FAILED' | 'TOOL_NOT_FOUND' | 'TOOL_EXECUTION_FAILED' | 'TOOL_UNSUPPORTED' | 'TOOL_SCHEMA_UNAVAILABLE' | 'RUN_TIMEOUT' | 'RUN_MAX_TURNS_EXCEEDED' | 'RUN_FAILED' | 'RUN_CANCELLED' | 'RUN_INTERACTION_TIMEOUT' | 'UI_UNAVAILABLE' | 'LLM_UNAVAILABLE' | 'LLM_REQUEST_FAILED' | 'INSTALL_FAILED' | 'UNINSTALL_FAILED' | 'EXPORT_FAILED' | 'INTEGRITY_FAILED' | 'FS_PERMISSION_DENIED' | 'MCP_ENDPOINT_UNAVAILABLE' | 'MCP_TOOL_NOT_FOUND' | 'CANDIDATE_INVALID' | 'APPROVAL_REQUIRED' | 'SKILL_QUARANTINED' | 'SKILL_DISABLED' | 'GOVERNANCE_FAILED' | 'RUN_SNAPSHOT_NOT_FOUND' | 'RUN_SNAPSHOT_EXPIRED' | 'RUN_SNAPSHOT_INCOMPATIBLE';
+type WebSkillErrorCode = 'FS_NOT_FOUND' | 'FS_PATH_OUTSIDE_ROOT' | 'SKILL_NOT_FOUND' | 'SKILL_INVALID_METADATA' | 'SKILL_INVALID_NAME' | 'SKILL_DUPLICATE_NAME' | 'SKILL_UNSUPPORTED_SCRIPT' | 'VALIDATION_FAILED' | 'TOOL_NOT_FOUND' | 'TOOL_EXECUTION_FAILED' | 'NETWORK_BLOCKED' | 'TOOL_UNSUPPORTED' | 'TOOL_SCHEMA_UNAVAILABLE' | 'RUN_TIMEOUT' | 'RUN_MAX_TURNS_EXCEEDED' | 'RUN_FAILED' | 'RUN_CANCELLED' | 'RUN_INTERACTION_TIMEOUT' | 'UI_UNAVAILABLE' | 'LLM_UNAVAILABLE' | 'LLM_REQUEST_FAILED' | 'INSTALL_FAILED' | 'UNINSTALL_FAILED' | 'EXPORT_FAILED' | 'INTEGRITY_FAILED' | 'FS_PERMISSION_DENIED' | 'MCP_ENDPOINT_UNAVAILABLE' | 'MCP_TOOL_NOT_FOUND' | 'CANDIDATE_INVALID' | 'APPROVAL_REQUIRED' | 'SKILL_QUARANTINED' | 'SKILL_DISABLED' | 'GOVERNANCE_FAILED' | 'RUN_SNAPSHOT_NOT_FOUND' | 'RUN_SNAPSHOT_EXPIRED' | 'RUN_SNAPSHOT_INCOMPATIBLE';
 /** 所有公开 API 抛出的结构化错误，code 供上层可编程处理 */
 declare class WebSkillError extends Error {
   readonly code: WebSkillErrorCode;
@@ -472,6 +472,8 @@ interface ScriptExecutionContext {
   }): Promise<Artifact>;
   /** 脚本主动请求人在环确认；策略见 InteractionPolicy.confirmations */
   confirm?(message: string): Promise<boolean>;
+  /** 宿主侧降级 warning 出口（网络阻断等；引擎接线到 run.warning trace） */
+  onWarning?(message: string): void;
 }
 /** Schema 推导 port：纯文本静态分析脚本源码 → JSON Schema（best-effort） */
 interface SchemaInferer {
@@ -547,6 +549,8 @@ declare function createScriptContext(deps: {
   runId: string;
   /** 提供时暴露 context.confirm（由引擎按交互策略实现） */
   confirm?: (message: string) => Promise<boolean>;
+  /** 宿主侧降级 warning 出口（网络阻断等；引擎接线到 run.warning trace） */
+  onWarning?: (message: string) => void;
 }): ScriptExecutionContext;
 //#endregion
 //#region src/interaction/types.d.ts
@@ -573,6 +577,13 @@ type InteractionRequest = {
     label: string;
     value: unknown;
   }>;
+} | {
+  /** 能力强制授权（require-approval）：与脚本自发 confirm 区分，UI 渲染为授权样式 */
+  type: 'authorize';
+  id: string;
+  capability: 'readReference' | 'writeArtifact' | 'confirm';
+  message: string;
+  details?: unknown;
 };
 interface InteractionResponse {
   id: string;
@@ -891,16 +902,72 @@ interface BridgeResponse {
     message: string;
   };
 }
+/**
+ * 能力模式：true 直通 / false 关闭（TOOL_UNSUPPORTED）/ 'require-approval' 调用前强制授权
+ * （布尔语义与现状完全兼容）
+ */
+type CapabilityMode = boolean | 'require-approval';
+/** 授权粒度：'once-per-run'（默认，run 内同类能力批准一次）/ 'every-call'（每次调用都问） */
+type ApprovalScope = 'once-per-run' | 'every-call';
 /** 三能力独立开关；缺省全开，显式 false 即关闭（TOOL_UNSUPPORTED） */
 interface BridgeCapabilities {
-  readReference?: boolean;
-  writeArtifact?: boolean;
-  confirm?: boolean;
+  readReference?: CapabilityMode;
+  writeArtifact?: CapabilityMode;
+  confirm?: CapabilityMode;
 }
 /** 入站校验：非法 kind / 缺 id / 缺字段 → undefined（调用方忽略并记 warning） */
 declare function parseBridgeRequest(data: unknown): BridgeRequest | undefined;
 declare function bridgeError(id: string, code: string, message: string): BridgeResponse;
 //#endregion
+//#region src/sandbox/networkPolicy.d.ts
+/**
+ * 网络策略类型 + 匹配逻辑（单一来源：browser worker 经函数字符串注入、
+ * node worker 直接 import，禁止各自重复实现）。
+ *
+ * 注意：isNetworkAllowed 会被 toString() 内嵌进浏览器 Worker bootstrap，
+ * 函数体必须自包含（不引用模块内其它符号），且不得使用模板字符串/反引号。
+ */
+type NetworkPolicy = 'deny-all' | 'allow-all' | {
+  allow: string[];
+};
+/**
+ * 判定 URL 是否被策略放行：
+ * - 'deny-all'（默认）全拒；'allow-all' 全放
+ * - { allow } 条目支持三种写法：
+ *   - 精确域名 'api.example.com'（忽略端口与路径）
+ *   - 通配 '*.example.com'（含 apex 与任意深度子域）
+ *   - 源 'http://localhost:3000'（协议 + host + port 全等）
+ * - URL 解析失败一律拒绝
+ */
+declare function isNetworkAllowed(policy: NetworkPolicy, url: string): boolean;
+/** 阻断 trace 用的脱敏 host（解析失败返回占位，不记录完整 URL） */
+declare function networkUrlHost(url: string): string;
+//#endregion
+//#region src/sandbox/approval.d.ts
+/** 桥消息对应的三类能力 */
+type BridgeCapability = 'readReference' | 'writeArtifact' | 'confirm';
+/** allowed 放行；denied 用户拒绝/无法询问；disabled 能力关闭（两者都回 TOOL_UNSUPPORTED，仅消息不同） */
+type ApprovalDecision = 'allowed' | 'denied' | 'disabled';
+/**
+ * Per-capability 强制授权判定（宿主侧，browser/node 执行器共用单一来源）。
+ * 'require-approval' 模式下经注入的 UiBridge 发 authorize 交互；
+ * once-per-run（默认）在 run 内记忆已批准能力，every-call 每次调用都问。
+ */
+declare class CapabilityApproval {
+  #private;
+  constructor(deps?: {
+    uiBridge?: UiBridge;
+    scope?: ApprovalScope;
+  });
+  authorize(input: {
+    runId: string;
+    capability: BridgeCapability;
+    mode: CapabilityMode;
+    message: string;
+    details?: unknown;
+  }): Promise<ApprovalDecision>;
+}
+//#endregion
 //#region src/trace/traceRecorder.d.ts
 interface TraceClock {
   now?: () => string;
@@ -1103,4 +1170,4 @@ declare class WebSkillRuntime {
   resumeRun(runId: string): Promise<RunResult>;
 }
 //#endregion
-export { RouteResult as $, SkillReader as $t, LlmClient as A, resolveToolName as At, MockLlmHandler as B, SKILLS_LOCKFILE as Bt, InteractionPolicy as C, buildRenderResult as Ct, LifecycleHook as D, mergeCatalogEntries as Dt, LifecycleEvent as E, fromVercelStreamPart as Et, LlmToolCall as F, DiscoveryResult as Ft, OpenAiCompatibleClientConfig as G, SkillCatalogEntry as Gt, MockUiAnswer as H, SKILL_NAME_MAX_LENGTH as Ht, LlmToolSpec as I, FileStat as It, READ_SKILL_FILE_TOOL as J, SkillInstallSource as Jt, ProgressiveRouter as K, SkillDiscovery as Kt, MemoryArtifactStore as L, FileSystemProvider as Lt, LlmMessage as M, toLlmToolSpec as Mt, LlmResponse as N, toVercelToolSpecs as Nt, LifecycleHookContext as O, normalizeToolContent as Ot, LlmStreamEvent as P, CatalogRenderer as Pt, RenderResultRequest as Q, SkillMetadata as Qt, MemoryStore as R, JsonSchema as Rt, InMemoryStore as S, bridgeError as St, InteractionResponse as T, fromVercelResult as Tt, MockUiBridge as U, SKILL_NAME_PATTERN as Ut, MockLlmQueueItem as V, SKILL_MANIFEST_FILE as Vt, OpenAiCompatibleClient as W, SkillCatalog as Wt, RUN_SNAPSHOT_SCHEMA_VERSION as X, SkillLocation as Xt, READ_SKILL_FILE_TOOL_NAME as Y, SkillIssue as Yt, RenderBlock as Z, SkillManifest as Zt, FsMemoryStore as _, resolveInsideRoot as _n, TraceRecorder as _t, AgentLoopConfig as a, WebSkillErrorCode as an, RuntimeRun as at, HookRunner as b, xmlRenderer as bn, WebSkillRuntime as bt, ArtifactStore as c, checkSkillRules as cn, ScriptExecutionContext as ct, BridgeResponse as d, isValidSkillName as dn, ToolDefinition as dt, SkillSource as en, RunResult as et, EventBus as f, jsonRenderer as fn, ToolResolution as ft, FsArtifactStore as g, renderCatalogJson as gn, TraceEventType as gt, FormField as h, renderAvailableSkillsXml as hn, TraceEvent as ht, AgentLoop as i, WebSkillError as in, RuntimePhase as it, LlmCompleteInput as j, schemaToForm as jt, LifecycleListener as k, parseBridgeRequest as kt, BridgeCapabilities as l, computeDigest as ln, ScriptExecutor as lt, ExternalToolSource as m, parseSkillMarkdown as mn, TraceClock as mt, ASK_USER_TOOL as n, ValidationReport as nn, RunSnapshotStore as nt, AgentLoopDeps as o, buildCatalog as on, RuntimeSession as ot, ExternalSkillProvider as p, normalizePath as pn, ToolResult as pt, READ_SKILL_FILE_INPUT_SCHEMA as q, SkillDocument as qt, ASK_USER_TOOL_NAME as r, VerifyResult as rn, RunTerminationReason as rt, Artifact as s, buildManifest as sn, SchemaInferer as st, ASK_USER_INPUT_SCHEMA as t, SkillsLockfile as tn, RunSnapshot as tt, BridgeRequest as u, escapeXml as un, SkillRouter as ut, FsRunSnapshotStore as v, validateSkills as vn, UiBridge as vt, InteractionRequest as w, createScriptContext as wt, HookRunnerOptions as x, WebSkillRuntimeDeps as xt, FullDisclosureRouter as y, verifyManifest as yn, VercelToolSpec as yt, MockLlmClient as z, MemoryFS as zt };
+export { READ_SKILL_FILE_INPUT_SCHEMA as $, SkillCatalogEntry as $t, InteractionResponse as A, createScriptContext as At, LlmToolCall as B, toLlmToolSpec as Bt, FsRunSnapshotStore as C, renderAvailableSkillsXml as Cn, TraceRecorder as Ct, InMemoryStore as D, verifyManifest as Dn, WebSkillRuntimeDeps as Dt, HookRunnerOptions as E, validateSkills as En, WebSkillRuntime as Et, LlmClient as F, networkUrlHost as Ft, MockLlmHandler as G, FileSystemProvider as Gt, MemoryArtifactStore as H, CatalogRenderer as Ht, LlmCompleteInput as I, normalizeToolContent as It, MockUiBridge as J, SKILLS_LOCKFILE as Jt, MockLlmQueueItem as K, JsonSchema as Kt, LlmMessage as L, parseBridgeRequest as Lt, LifecycleHook as M, fromVercelStreamPart as Mt, LifecycleHookContext as N, isNetworkAllowed as Nt, InteractionPolicy as O, xmlRenderer as On, bridgeError as Ot, LifecycleListener as P, mergeCatalogEntries as Pt, ProgressiveRouter as Q, SkillCatalog as Qt, LlmResponse as R, resolveToolName as Rt, FsMemoryStore as S, parseSkillMarkdown as Sn, TraceEventType as St, HookRunner as T, resolveInsideRoot as Tn, VercelToolSpec as Tt, MemoryStore as U, DiscoveryResult as Ut, LlmToolSpec as V, toVercelToolSpecs as Vt, MockLlmClient as W, FileStat as Wt, OpenAiCompatibleClient as X, SKILL_NAME_MAX_LENGTH as Xt, NetworkPolicy as Y, SKILL_MANIFEST_FILE as Yt, OpenAiCompatibleClientConfig as Z, SKILL_NAME_PATTERN as Zt, EventBus as _, computeDigest as _n, ToolDefinition as _t, AgentLoopConfig as a, SkillManifest as an, RouteResult as at, FormField as b, jsonRenderer as bn, TraceClock as bt, ApprovalScope as c, SkillSource as cn, RunSnapshotStore as ct, BridgeCapabilities as d, VerifyResult as dn, RuntimeRun as dt, SkillDiscovery as en, READ_SKILL_FILE_TOOL as et, BridgeCapability as f, WebSkillError as fn, RuntimeSession as ft, CapabilityMode as g, checkSkillRules as gn, SkillRouter as gt, CapabilityApproval as h, buildManifest as hn, ScriptExecutor as ht, AgentLoop as i, SkillLocation as in, RenderResultRequest as it, LifecycleEvent as j, fromVercelResult as jt, InteractionRequest as k, buildRenderResult as kt, Artifact as l, SkillsLockfile as ln, RunTerminationReason as lt, BridgeResponse as m, buildCatalog as mn, ScriptExecutionContext as mt, ASK_USER_TOOL as n, SkillInstallSource as nn, RUN_SNAPSHOT_SCHEMA_VERSION as nt, AgentLoopDeps as o, SkillMetadata as on, RunResult as ot, BridgeRequest as p, WebSkillErrorCode as pn, SchemaInferer as pt, MockUiAnswer as q, MemoryFS as qt, ASK_USER_TOOL_NAME as r, SkillIssue as rn, RenderBlock as rt, ApprovalDecision as s, SkillReader as sn, RunSnapshot as st, ASK_USER_INPUT_SCHEMA as t, SkillDocument as tn, READ_SKILL_FILE_TOOL_NAME as tt, ArtifactStore as u, ValidationReport as un, RuntimePhase as ut, ExternalSkillProvider as v, escapeXml as vn, ToolResolution as vt, FullDisclosureRouter as w, renderCatalogJson as wn, UiBridge as wt, FsArtifactStore as x, normalizePath as xn, TraceEvent as xt, ExternalToolSource as y, isValidSkillName as yn, ToolResult as yt, LlmStreamEvent as z, schemaToForm as zt };

package/dist/{index-BsbfEiaC.d.ts → index-aEple804.d.ts}

@@ -1,4 +1,4 @@
-import { It as FileStat, Jt as SkillInstallSource, Lt as FileSystemProvider, Q as RenderResultRequest, Rt as JsonSchema, T as InteractionResponse, Zt as SkillManifest, _ as FsMemoryStore, ct as ScriptExecutionContext, dt as ToolDefinition, g as FsArtifactStore, l as BridgeCapabilities, lt as ScriptExecutor, pt as ToolResult, rn as VerifyResult, st as SchemaInferer, tn as SkillsLockfile, vt as UiBridge, w as InteractionRequest } from "./index-CqDIreSE.js";
+import { A as InteractionResponse, Gt as FileSystemProvider, Kt as JsonSchema, S as FsMemoryStore, Wt as FileStat, Y as NetworkPolicy, _t as ToolDefinition, an as SkillManifest, c as ApprovalScope, d as BridgeCapabilities, dn as VerifyResult, ht as ScriptExecutor, it as RenderResultRequest, k as InteractionRequest, ln as SkillsLockfile, mt as ScriptExecutionContext, nn as SkillInstallSource, pt as SchemaInferer, wt as UiBridge, x as FsArtifactStore, yt as ToolResult } from "./index-BQDc-U1x.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts
 //#region src/fs/nodeFs.d.ts
@@ -47,6 +47,12 @@ interface SandboxOptions {
   /** env 白名单（仅这些变量传入 Worker；默认空） */
   envWhitelist?: string[];
   capabilities?: BridgeCapabilities;
+  /** 网络策略：默认 'deny-all'（白名单见 runtime/sandbox/networkPolicy） */
+  networkPolicy?: NetworkPolicy;
+  /** require-approval 模式的授权询问出口（缺失时 require-approval 一律拒绝） */
+  uiBridge?: UiBridge;
+  /** 授权粒度：默认 'once-per-run' */
+  approvalScope?: ApprovalScope;
 }
 /**
  * D1：worker_threads 沙箱脚本执行器。
@@ -105,7 +111,8 @@ declare class FileMemoryStore extends FsMemoryStore {
 //#region src/ui/cliUiBridge.d.ts
 /**
  * 命令行 UiBridge：ask→问答，confirm→y/n（带默认值），
- * form→逐字段提示（显示默认值与必填标记），select→编号列表。
+ * form→逐字段提示（显示默认值与必填标记），select→编号列表，
+ * authorize→授权询问（默认拒绝，仅显式 y/yes 批准）。
  * 输入/输出流可注入（测试用 PassThrough）。
  */
 declare class CliUiBridge implements UiBridge {

package/dist/index.d.ts

@@ -1,2 +1,2 @@
-import { $ as RouteResult, $t as SkillReader, A as LlmClient, At as resolveToolName, B as MockLlmHandler, Bt as SKILLS_LOCKFILE, C as InteractionPolicy, Ct as buildRenderResult, D as LifecycleHook, Dt as mergeCatalogEntries, E as LifecycleEvent, Et as fromVercelStreamPart, F as LlmToolCall, Ft as DiscoveryResult, G as OpenAiCompatibleClientConfig, Gt as SkillCatalogEntry, H as MockUiAnswer, Ht as SKILL_NAME_MAX_LENGTH, I as LlmToolSpec, It as FileStat, J as READ_SKILL_FILE_TOOL, Jt as SkillInstallSource, K as ProgressiveRouter, Kt as SkillDiscovery, L as MemoryArtifactStore, Lt as FileSystemProvider, M as LlmMessage, Mt as toLlmToolSpec, N as LlmResponse, Nt as toVercelToolSpecs, O as LifecycleHookContext, Ot as normalizeToolContent, P as LlmStreamEvent, Pt as CatalogRenderer, Q as RenderResultRequest, Qt as SkillMetadata, R as MemoryStore, Rt as JsonSchema, S as InMemoryStore, St as bridgeError, T as InteractionResponse, Tt as fromVercelResult, U as MockUiBridge, Ut as SKILL_NAME_PATTERN, V as MockLlmQueueItem, Vt as SKILL_MANIFEST_FILE, W as OpenAiCompatibleClient, Wt as SkillCatalog, X as RUN_SNAPSHOT_SCHEMA_VERSION, Xt as SkillLocation, Y as READ_SKILL_FILE_TOOL_NAME, Yt as SkillIssue, Z as RenderBlock, Zt as SkillManifest, _ as FsMemoryStore, _n as resolveInsideRoot, _t as TraceRecorder, a as AgentLoopConfig, an as WebSkillErrorCode, at as RuntimeRun, b as HookRunner, bn as xmlRenderer, bt as WebSkillRuntime, c as ArtifactStore, cn as checkSkillRules, ct as ScriptExecutionContext, d as BridgeResponse, dn as isValidSkillName, dt as ToolDefinition, en as SkillSource, et as RunResult, f as EventBus, fn as jsonRenderer, ft as ToolResolution, g as FsArtifactStore, gn as renderCatalogJson, gt as TraceEventType, h as FormField, hn as renderAvailableSkillsXml, ht as TraceEvent, i as AgentLoop, in as WebSkillError, it as RuntimePhase, j as LlmCompleteInput, jt as schemaToForm, k as LifecycleListener, kt as parseBridgeRequest, l as BridgeCapabilities, ln as computeDigest, lt as ScriptExecutor, m as ExternalToolSource, mn as parseSkillMarkdown, mt as TraceClock, n as ASK_USER_TOOL, nn as ValidationReport, nt as RunSnapshotStore, o as AgentLoopDeps, on as buildCatalog, ot as RuntimeSession, p as ExternalSkillProvider, pn as normalizePath, pt as ToolResult, q as READ_SKILL_FILE_INPUT_SCHEMA, qt as SkillDocument, r as ASK_USER_TOOL_NAME, rn as VerifyResult, rt as RunTerminationReason, s as Artifact, sn as buildManifest, st as SchemaInferer, t as ASK_USER_INPUT_SCHEMA, tn as SkillsLockfile, tt as RunSnapshot, u as BridgeRequest, un as escapeXml, ut as SkillRouter, v as FsRunSnapshotStore, vn as validateSkills, vt as UiBridge, w as InteractionRequest, wt as createScriptContext, x as HookRunnerOptions, xt as WebSkillRuntimeDeps, y as FullDisclosureRouter, yn as verifyManifest, yt as VercelToolSpec, z as MockLlmClient, zt as MemoryFS } from "./index-CqDIreSE.js";
-export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeRequest, type BridgeResponse, type CatalogRenderer, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, HookRunner, type HookRunnerOptions, InMemoryStore, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryArtifactStore, MemoryFS, type MemoryStore, MockLlmClient, type MockLlmHandler, type MockLlmQueueItem, type MockUiAnswer, MockUiBridge, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, SkillReader, type SkillRouter, type SkillSource, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkSkillRules, computeDigest, createScriptContext, escapeXml, fromVercelResult, fromVercelStreamPart, isValidSkillName, jsonRenderer, mergeCatalogEntries, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, renderAvailableSkillsXml, renderCatalogJson, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, validateSkills, verifyManifest, xmlRenderer };
+import { $ as READ_SKILL_FILE_INPUT_SCHEMA, $t as SkillCatalogEntry, A as InteractionResponse, At as createScriptContext, B as LlmToolCall, Bt as toLlmToolSpec, C as FsRunSnapshotStore, Cn as renderAvailableSkillsXml, Ct as TraceRecorder, D as InMemoryStore, Dn as verifyManifest, Dt as WebSkillRuntimeDeps, E as HookRunnerOptions, En as validateSkills, Et as WebSkillRuntime, F as LlmClient, Ft as networkUrlHost, G as MockLlmHandler, Gt as FileSystemProvider, H as MemoryArtifactStore, Ht as CatalogRenderer, I as LlmCompleteInput, It as normalizeToolContent, J as MockUiBridge, Jt as SKILLS_LOCKFILE, K as MockLlmQueueItem, Kt as JsonSchema, L as LlmMessage, Lt as parseBridgeRequest, M as LifecycleHook, Mt as fromVercelStreamPart, N as LifecycleHookContext, Nt as isNetworkAllowed, O as InteractionPolicy, On as xmlRenderer, Ot as bridgeError, P as LifecycleListener, Pt as mergeCatalogEntries, Q as ProgressiveRouter, Qt as SkillCatalog, R as LlmResponse, Rt as resolveToolName, S as FsMemoryStore, Sn as parseSkillMarkdown, St as TraceEventType, T as HookRunner, Tn as resolveInsideRoot, Tt as VercelToolSpec, U as MemoryStore, Ut as DiscoveryResult, V as LlmToolSpec, Vt as toVercelToolSpecs, W as MockLlmClient, Wt as FileStat, X as OpenAiCompatibleClient, Xt as SKILL_NAME_MAX_LENGTH, Y as NetworkPolicy, Yt as SKILL_MANIFEST_FILE, Z as OpenAiCompatibleClientConfig, Zt as SKILL_NAME_PATTERN, _ as EventBus, _n as computeDigest, _t as ToolDefinition, a as AgentLoopConfig, an as SkillManifest, at as RouteResult, b as FormField, bn as jsonRenderer, bt as TraceClock, c as ApprovalScope, cn as SkillSource, ct as RunSnapshotStore, d as BridgeCapabilities, dn as VerifyResult, dt as RuntimeRun, en as SkillDiscovery, et as READ_SKILL_FILE_TOOL, f as BridgeCapability, fn as WebSkillError, ft as RuntimeSession, g as CapabilityMode, gn as checkSkillRules, gt as SkillRouter, h as CapabilityApproval, hn as buildManifest, ht as ScriptExecutor, i as AgentLoop, in as SkillLocation, it as RenderResultRequest, j as LifecycleEvent, jt as fromVercelResult, k as InteractionRequest, kt as buildRenderResult, l as Artifact, ln as SkillsLockfile, lt as RunTerminationReason, m as BridgeResponse, mn as buildCatalog, mt as ScriptExecutionContext, n as ASK_USER_TOOL, nn as SkillInstallSource, nt as RUN_SNAPSHOT_SCHEMA_VERSION, o as AgentLoopDeps, on as SkillMetadata, ot as RunResult, p as BridgeRequest, pn as WebSkillErrorCode, pt as SchemaInferer, q as MockUiAnswer, qt as MemoryFS, r as ASK_USER_TOOL_NAME, rn as SkillIssue, rt as RenderBlock, s as ApprovalDecision, sn as SkillReader, st as RunSnapshot, t as ASK_USER_INPUT_SCHEMA, tn as SkillDocument, tt as READ_SKILL_FILE_TOOL_NAME, u as ArtifactStore, un as ValidationReport, ut as RuntimePhase, v as ExternalSkillProvider, vn as escapeXml, vt as ToolResolution, w as FullDisclosureRouter, wn as renderCatalogJson, wt as UiBridge, x as FsArtifactStore, xn as normalizePath, xt as TraceEvent, y as ExternalToolSource, yn as isValidSkillName, yt as ToolResult, z as LlmStreamEvent, zt as schemaToForm } from "./index-BQDc-U1x.js";
+export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, type ApprovalDecision, type ApprovalScope, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, HookRunner, type HookRunnerOptions, InMemoryStore, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryArtifactStore, MemoryFS, type MemoryStore, MockLlmClient, type MockLlmHandler, type MockLlmQueueItem, type MockUiAnswer, MockUiBridge, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, SkillReader, type SkillRouter, type SkillSource, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkSkillRules, computeDigest, createScriptContext, escapeXml, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, renderAvailableSkillsXml, renderCatalogJson, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, validateSkills, verifyManifest, xmlRenderer };

package/dist/index.js

@@ -1,3 +1,3 @@
-import { $ as renderCatalogJson, A as parseBridgeRequest, B as SkillDiscovery, C as bridgeError, D as fromVercelStreamPart, E as fromVercelResult, F as MemoryFS, G as checkSkillRules, H as WebSkillError, I as SKILLS_LOCKFILE, J as isValidSkillName, K as computeDigest, L as SKILL_MANIFEST_FILE, M as schemaToForm, N as toLlmToolSpec, O as mergeCatalogEntries, P as toVercelToolSpecs, Q as renderAvailableSkillsXml, R as SKILL_NAME_MAX_LENGTH, S as WebSkillRuntime, T as createScriptContext, U as buildCatalog, V as SkillReader, W as buildManifest, X as normalizePath, Y as jsonRenderer, Z as parseSkillMarkdown, _ as READ_SKILL_FILE_INPUT_SCHEMA, a as EventBus, b as RUN_SNAPSHOT_SCHEMA_VERSION, c as FsRunSnapshotStore, d as InMemoryStore, et as resolveInsideRoot, f as MemoryArtifactStore, g as ProgressiveRouter, h as OpenAiCompatibleClient, i as AgentLoop, j as resolveToolName, k as normalizeToolContent, l as FullDisclosureRouter, m as MockUiBridge, n as ASK_USER_TOOL, nt as verifyManifest, o as FsArtifactStore, p as MockLlmClient, q as escapeXml, r as ASK_USER_TOOL_NAME, rt as xmlRenderer, s as FsMemoryStore, t as ASK_USER_INPUT_SCHEMA, tt as validateSkills, u as HookRunner, v as READ_SKILL_FILE_TOOL, w as buildRenderResult, x as TraceRecorder, y as READ_SKILL_FILE_TOOL_NAME, z as SKILL_NAME_PATTERN } from "./dist-COsE72Ct.js";
+import { $ as normalizePath, A as mergeCatalogEntries, B as SKILL_MANIFEST_FILE, C as WebSkillRuntime, D as fromVercelResult, E as createScriptContext, F as schemaToForm, G as WebSkillError, H as SKILL_NAME_PATTERN, I as toLlmToolSpec, J as checkSkillRules, K as buildCatalog, L as toVercelToolSpecs, M as normalizeToolContent, N as parseBridgeRequest, O as fromVercelStreamPart, P as resolveToolName, Q as jsonRenderer, R as MemoryFS, S as TraceRecorder, T as buildRenderResult, U as SkillDiscovery, V as SKILL_NAME_MAX_LENGTH, W as SkillReader, X as escapeXml, Y as computeDigest, Z as isValidSkillName, _ as ProgressiveRouter, a as CapabilityApproval, at as verifyManifest, b as READ_SKILL_FILE_TOOL_NAME, c as FsMemoryStore, d as HookRunner, et as parseSkillMarkdown, f as InMemoryStore, g as OpenAiCompatibleClient, h as MockUiBridge, i as AgentLoop, it as validateSkills, j as networkUrlHost, k as isNetworkAllowed, l as FsRunSnapshotStore, m as MockLlmClient, n as ASK_USER_TOOL, nt as renderCatalogJson, o as EventBus, ot as xmlRenderer, p as MemoryArtifactStore, q as buildManifest, r as ASK_USER_TOOL_NAME, rt as resolveInsideRoot, s as FsArtifactStore, t as ASK_USER_INPUT_SCHEMA, tt as renderAvailableSkillsXml, u as FullDisclosureRouter, v as READ_SKILL_FILE_INPUT_SCHEMA, w as bridgeError, x as RUN_SNAPSHOT_SCHEMA_VERSION, y as READ_SKILL_FILE_TOOL, z as SKILLS_LOCKFILE } from "./dist-D405AlPD.js";
 
-export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, HookRunner, InMemoryStore, MemoryArtifactStore, MemoryFS, MockLlmClient, MockUiBridge, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkSkillRules, computeDigest, createScriptContext, escapeXml, fromVercelResult, fromVercelStreamPart, isValidSkillName, jsonRenderer, mergeCatalogEntries, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, renderAvailableSkillsXml, renderCatalogJson, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, validateSkills, verifyManifest, xmlRenderer };
+export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, CapabilityApproval, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, HookRunner, InMemoryStore, MemoryArtifactStore, MemoryFS, MockLlmClient, MockUiBridge, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkSkillRules, computeDigest, createScriptContext, escapeXml, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, renderAvailableSkillsXml, renderCatalogJson, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, validateSkills, verifyManifest, xmlRenderer };

package/dist/mcp.d.ts

@@ -1,4 +1,4 @@
-import { Dt as mergeCatalogEntries, Gt as SkillCatalogEntry, I as LlmToolSpec, Rt as JsonSchema, m as ExternalToolSource, p as ExternalSkillProvider, pt as ToolResult, qt as SkillDocument } from "./index-CqDIreSE.js";
+import { $t as SkillCatalogEntry, Kt as JsonSchema, Pt as mergeCatalogEntries, V as LlmToolSpec, tn as SkillDocument, v as ExternalSkillProvider, y as ExternalToolSource, yt as ToolResult } from "./index-BQDc-U1x.js";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/dist/mcp.js

@@ -1,4 +1,4 @@
-import { H as WebSkillError, O as mergeCatalogEntries, k as normalizeToolContent } from "./dist-COsE72Ct.js";
+import { A as mergeCatalogEntries, G as WebSkillError, M as normalizeToolContent } from "./dist-D405AlPD.js";
 import { fromJSONSchema } from "zod";
 
 //#region ../mcp/dist/index.js

package/dist/node.d.ts

@@ -1,3 +1,3 @@
-import { Bt as SKILLS_LOCKFILE, Jt as SkillInstallSource, Vt as SKILL_MANIFEST_FILE, Zt as SkillManifest, rn as VerifyResult, tn as SkillsLockfile, wt as createScriptContext } from "./index-CqDIreSE.js";
-import { a as LlmEnvConfig, c as OxcSchemaInferer, d as SkillManager, f as loadLlmConfigFromEnv, i as LlmCapabilities, l as SandboxOptions, m as readArchiveManifest, n as FileArtifactStore, o as NodeFS, p as probeLlmCapabilities, r as FileMemoryStore, s as NodeScriptExecutor, t as CliUiBridge, u as SandboxedScriptExecutor } from "./index-BsbfEiaC.js";
+import { At as createScriptContext, Jt as SKILLS_LOCKFILE, Yt as SKILL_MANIFEST_FILE, an as SkillManifest, dn as VerifyResult, ln as SkillsLockfile, nn as SkillInstallSource } from "./index-BQDc-U1x.js";
+import { a as LlmEnvConfig, c as OxcSchemaInferer, d as SkillManager, f as loadLlmConfigFromEnv, i as LlmCapabilities, l as SandboxOptions, m as readArchiveManifest, n as FileArtifactStore, o as NodeFS, p as probeLlmCapabilities, r as FileMemoryStore, s as NodeScriptExecutor, t as CliUiBridge, u as SandboxedScriptExecutor } from "./index-aEple804.js";
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, type LlmCapabilities, type LlmEnvConfig, NodeFS, NodeScriptExecutor, OxcSchemaInferer, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, type SandboxOptions, SandboxedScriptExecutor, SkillManager, type SkillManifest, type SkillInstallSource as SkillSource, type SkillsLockfile, type VerifyResult, createScriptContext, loadLlmConfigFromEnv, probeLlmCapabilities, readArchiveManifest };

package/dist/node.js

@@ -1,4 +1,4 @@
-import { I as SKILLS_LOCKFILE, L as SKILL_MANIFEST_FILE, T as createScriptContext } from "./dist-COsE72Ct.js";
-import { a as NodeScriptExecutor, c as SkillManager, d as readArchiveManifest, i as NodeFS, l as loadLlmConfigFromEnv, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as SandboxedScriptExecutor, t as CliUiBridge, u as probeLlmCapabilities } from "./dist-Bvhbxrrt.js";
+import { B as SKILL_MANIFEST_FILE, E as createScriptContext, z as SKILLS_LOCKFILE } from "./dist-D405AlPD.js";
+import { a as NodeScriptExecutor, c as SkillManager, d as readArchiveManifest, i as NodeFS, l as loadLlmConfigFromEnv, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as SandboxedScriptExecutor, t as CliUiBridge, u as probeLlmCapabilities } from "./dist-Ixnb-hNR.js";
 
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, NodeFS, NodeScriptExecutor, OxcSchemaInferer, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SandboxedScriptExecutor, SkillManager, createScriptContext, loadLlmConfigFromEnv, probeLlmCapabilities, readArchiveManifest };

package/dist/ui-react.d.ts

@@ -1,4 +1,4 @@
-import { Q as RenderResultRequest, T as InteractionResponse, vt as UiBridge, w as InteractionRequest } from "./index-CqDIreSE.js";
+import { A as InteractionResponse, it as RenderResultRequest, k as InteractionRequest, wt as UiBridge } from "./index-BQDc-U1x.js";
 //#region ../ui-react/dist/index.d.ts
 //#region src/bridgeState.d.ts
 /**

package/dist/ui-react.js

@@ -1,4 +1,4 @@
-import { _ as interactionToFormModel, f as collectValues, x as shapeInteractionValue, y as renderMiniMarkdown } from "./dist-RcqvzAGF.js";
+import { _ as interactionToFormModel, f as collectValues, x as shapeInteractionValue, y as renderMiniMarkdown } from "./dist-BM-VcQ90.js";
 import { useLayoutEffect, useRef, useState, useSyncExternalStore } from "react";
 import { jsx, jsxs } from "react/jsx-runtime";
 
@@ -145,7 +145,7 @@ function InteractionForm({ bridge }) {
 				className: "webskill-form__title",
 				children: model.title
 			}) : null,
-			model.message && model.kind === "form" ? /* @__PURE__ */ jsx("p", {
+			model.message && (model.kind === "form" || model.kind === "authorize") ? /* @__PURE__ */ jsx("p", {
 				className: "webskill-form__message",
 				children: model.message
 			}) : null,

package/dist/ui-vue.d.ts

@@ -1,4 +1,4 @@
-import { Q as RenderResultRequest, T as InteractionResponse, vt as UiBridge, w as InteractionRequest } from "./index-CqDIreSE.js";
+import { A as InteractionResponse, it as RenderResultRequest, k as InteractionRequest, wt as UiBridge } from "./index-BQDc-U1x.js";
 import { PropType } from "vue";
 //#region ../ui-vue/dist/index.d.ts
 //#region src/bridgeState.d.ts

package/dist/ui-vue.js

@@ -1,4 +1,4 @@
-import { _ as interactionToFormModel, f as collectValues, x as shapeInteractionValue, y as renderMiniMarkdown } from "./dist-RcqvzAGF.js";
+import { _ as interactionToFormModel, f as collectValues, x as shapeInteractionValue, y as renderMiniMarkdown } from "./dist-BM-VcQ90.js";
 import { defineComponent, h, reactive, ref } from "vue";
 
 //#region ../ui-vue/dist/index.js
@@ -112,7 +112,7 @@ const InteractionForm = defineComponent({
 				}
 			}, [
 				model.title ? h("div", { class: "webskill-form__title" }, model.title) : null,
-				model.message && model.kind === "form" ? h("p", { class: "webskill-form__message" }, model.message) : null,
+				model.message && (model.kind === "form" || model.kind === "authorize") ? h("p", { class: "webskill-form__message" }, model.message) : null,
 				...model.controls.map((control) => h("div", { key: control.name }, [renderControl(control), invalid.value.includes(control.name) ? h("div", { class: "webskill-form__error" }, "This field is required") : null])),
 				h("div", { class: "webskill-form__actions" }, [h("button", {
 					type: "submit",

package/dist/ui.d.ts

@@ -1,8 +1,8 @@
-import { Ct as buildRenderResult, Q as RenderResultRequest, T as InteractionResponse, Z as RenderBlock, vt as UiBridge, w as InteractionRequest } from "./index-CqDIreSE.js";
+import { A as InteractionResponse, it as RenderResultRequest, k as InteractionRequest, kt as buildRenderResult, rt as RenderBlock, wt as UiBridge } from "./index-BQDc-U1x.js";
 //#region ../ui/dist/index.d.ts
 //#region src/model/formModel.d.ts
 interface FormModel {
-  kind: 'ask' | 'confirm' | 'form' | 'select';
+  kind: 'ask' | 'confirm' | 'form' | 'select' | 'authorize';
   title?: string;
   message?: string;
   controls: ControlModel[];
@@ -23,7 +23,7 @@ interface ControlModel {
 }
 /** 提交值按请求类型归形（WebFormBridge 与框架组件库共享单一来源） */
 declare function shapeInteractionValue(model: FormModel, values: Record<string, unknown>): unknown;
-/** 四类 InteractionRequest → 统一中间模型（框架无关） */
+/** 五类 InteractionRequest → 统一中间模型（框架无关） */
 declare function interactionToFormModel(request: InteractionRequest): FormModel;
 //#endregion
 //#region src/model/collectValues.d.ts

package/dist/ui.js

@@ -1,4 +1,4 @@
-import { w as buildRenderResult } from "./dist-COsE72Ct.js";
-import { C as toOpenUiLang, S as toA2uiMessages, _ as interactionToFormModel, a as LitRendererBridge, b as renderRenderResult, c as VERCEL_INTERACTION_TOOL_NAME, d as WebFormBridge, f as collectValues, g as fromVercelToolResult, h as fromOpenUiAction, i as A2UI_VERSION, l as VercelUiBridge, m as fromA2uiAction, n as A2UI_CANCEL_ACTION, o as OPENUI_CANCEL_ACTION, p as ensureStyles, r as A2UI_SUBMIT_ACTION, s as OPENUI_SUBMIT_ACTION, t as A2UI_BASIC_CATALOG_ID, u as WEBSKILL_STYLES_CSS, v as renderBlocks, w as toVercelToolInvocation, x as shapeInteractionValue, y as renderMiniMarkdown } from "./dist-RcqvzAGF.js";
+import { T as buildRenderResult } from "./dist-D405AlPD.js";
+import { C as toOpenUiLang, S as toA2uiMessages, _ as interactionToFormModel, a as LitRendererBridge, b as renderRenderResult, c as VERCEL_INTERACTION_TOOL_NAME, d as WebFormBridge, f as collectValues, g as fromVercelToolResult, h as fromOpenUiAction, i as A2UI_VERSION, l as VercelUiBridge, m as fromA2uiAction, n as A2UI_CANCEL_ACTION, o as OPENUI_CANCEL_ACTION, p as ensureStyles, r as A2UI_SUBMIT_ACTION, s as OPENUI_SUBMIT_ACTION, t as A2UI_BASIC_CATALOG_ID, u as WEBSKILL_STYLES_CSS, v as renderBlocks, w as toVercelToolInvocation, x as shapeInteractionValue, y as renderMiniMarkdown } from "./dist-BM-VcQ90.js";
 
 export { A2UI_BASIC_CATALOG_ID, A2UI_CANCEL_ACTION, A2UI_SUBMIT_ACTION, A2UI_VERSION, LitRendererBridge, OPENUI_CANCEL_ACTION, OPENUI_SUBMIT_ACTION, VERCEL_INTERACTION_TOOL_NAME, VercelUiBridge, WEBSKILL_STYLES_CSS, WebFormBridge, buildRenderResult, collectValues, ensureStyles, fromA2uiAction, fromOpenUiAction, fromVercelToolResult, interactionToFormModel, renderBlocks, renderMiniMarkdown, renderRenderResult, shapeInteractionValue, toA2uiMessages, toOpenUiLang, toVercelToolInvocation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webskill/sdk",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "WebSkill — browser/Node agent skill runtime (skills, tools, MCP, governance, UI)",
   "license": "MIT",
   "type": "module",