@webskill/sdk 0.0.4 → 0.0.6

package/dist/browser.d.ts

@@ -1,4 +1,4 @@
-import { A as LlmClient, C as InteractionPolicy, It as FileStat, Jt as SkillInstallSource, Lt as FileSystemProvider, N as LlmResponse, P as LlmStreamEvent, Q as RenderResultRequest, St as bridgeError, T as InteractionResponse, Zt as SkillManifest, ct as ScriptExecutionContext, d as BridgeResponse, dt as ToolDefinition, kt as parseBridgeRequest, l as BridgeCapabilities, lt as ScriptExecutor, m as ExternalToolSource, p as ExternalSkillProvider, pt as ToolResult, rn as VerifyResult, tn as SkillsLockfile, u as BridgeRequest, vt as UiBridge, w as InteractionRequest } from "./index-CqDIreSE.js";
+import { A as InteractionPolicy, B as LlmResponse, Et as UiBridge, Ht as parseBridgeRequest, L as LlmClient, M as InteractionResponse, Ot as WebSkillApi, V as LlmStreamEvent, Xt as FileSystemProvider, Yt as FileStat, Z as NetworkPolicy, _t as ScriptExecutor, b as ExternalToolSource, c as ApprovalScope, cn as SkillInstallSource, d as BridgeCapabilities, dn as SkillManifest, gn as SkillsLockfile, gt as ScriptExecutionContext, j as InteractionRequest, jt as bridgeError, m as BridgeResponse, ot as RenderResultRequest, p as BridgeRequest, vn as VerifyResult, xt as ToolResult, y as ExternalSkillProvider, yt as ToolDefinition } from "./index-DCifjtJx.js";
 //#region ../browser/dist/index.d.ts
 //#region src/fs/featureDetection.d.ts
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -28,17 +28,22 @@ declare class OpfsProvider implements FileSystemProvider {
 //#region src/executor/workerBootstrap.d.ts
 /**
  * Worker 引导源码（字符串 → Blob URL → new Worker(url, {type:'module'})）。
- * 注意：内容为纯 JS，不能含反引号与 ${ 占位（外层用模板字符串内嵌）。
+ * 注意：内容为纯 JS，不能含反引号与 ${ 占位（外层用模板字符串内嵌）；
+ * isNetworkAllowed/networkUrlHost 经函数源码注入（匹配逻辑单一来源在
+ * runtime/sandbox/networkPolicy.ts，此处禁止复制实现）。
  *
  * 协议（宿主 ↔ Worker）：
- * - 宿主 → Worker：{type:'load', id, source} 请求加载脚本定义
- * - 宿主 → Worker：{type:'execute', id, skillName, runId, source, args} 请求执行
+ * - 宿主 → Worker：{type:'load', id, source, networkPolicy?} 请求加载脚本定义
+ * - 宿主 → Worker：{type:'execute', id, skillName, runId, source, args, networkPolicy?} 请求执行
  * - Worker → 宿主：{type:'load-result', id, ok, definition?, error?}
  * - Worker → 宿主：{type:'execute-result', id, ok, value?, stdout, stderr, error?}
  * - Worker → 宿主：{type:'bridge', request} 能力桥 RPC（readReference/writeArtifact/confirm）
  * - 宿主 → Worker：{type:'bridge-response', response}
+ * - Worker → 宿主：{type:'network-blocked', host} 网络阻断通知（宿主记 run.warning，URL 脱敏只记 host）
  *
  * .js 源码经 data: URL 动态 import；主线程从不 import 技能脚本。
+ * 网络管控：包装 fetch / XMLHttpRequest / WebSocket / EventSource，
+ * 策略默认 deny-all，由 load/execute 消息携带更新。
  */
 declare const WORKER_BOOTSTRAP_SOURCE: string;
 //#endregion
@@ -80,6 +85,11 @@ declare class BrowserSkillManager {
   install(source: SkillInstallSource, options?: {
     expectedSha256?: string;
   }): Promise<SkillManifest>;
+  /**
+   * 浏览器导出（单技能与包集同构：始终产出含 webskill.skill-pack.json 的 zip 字节，
+   * 统一安装路径；保存/下载由应用层处理）。
+   */
+  exportArchive(names: string | string[]): Promise<Uint8Array>;
   uninstall(name: string): Promise<void>;
   verifyIntegrity(name: string): Promise<VerifyResult>;
   listInstalled(): Promise<SkillsLockfile>;
@@ -116,6 +126,12 @@ declare class BrowserWorkerScriptExecutor implements ScriptExecutor {
     fs: FileSystemProvider;
     workerFactory?: WorkerFactory;
     capabilities?: BridgeCapabilities;
+    /** 网络策略：默认 'deny-all'（白名单见 runtime/sandbox/networkPolicy） */
+    networkPolicy?: NetworkPolicy;
+    /** require-approval 模式的授权询问出口（缺失时 require-approval 一律拒绝） */
+    uiBridge?: UiBridge;
+    /** 授权粒度：默认 'once-per-run' */
+    approvalScope?: ApprovalScope;
     /** D4 opt-in：配置 esbuild-wasm 资产 URL 后 .ts 经宿主侧转译执行（未配置 .ts → TOOL_UNSUPPORTED） */
     typescript?: TypeScriptSupportOptions;
   });
@@ -129,6 +145,32 @@ declare class BrowserWorkerScriptExecutor implements ScriptExecutor {
   }): Promise<ToolResult>;
 }
 //#endregion
+//#region src/navigator.d.ts
+declare global {
+  /** 0.0.6：installWebSkillNavigator 显式装配后可用（不自动挂全局） */
+  interface Navigator {
+    webskill?: WebSkillApi;
+  }
+}
+/**
+ * navigator.webskill 显式装配：OPFS 默认存储 + BrowserWorkerScriptExecutor +
+ * BrowserSkillManager → createWebSkillApi；target 提供时挂 target.navigator
+ * （缺失则补空对象），否则挂真实 navigator.webskill。
+ * target 可注入（测试）；返回值即门面本体（挂载只是副作用）。
+ */
+declare function installWebSkillNavigator(config: {
+  roots?: string[];
+  llm: LlmClient;
+  typescript?: TypeScriptSupportOptions;
+  /** 测试注入：替换 OPFS 默认 fs（jsdom 无 OPFS） */
+  fs?: FileSystemProvider;
+  /** 安装目标根（默认与 roots[0] 一致） */
+  managedRoot?: string;
+  target?: {
+    navigator?: Record<string, unknown>;
+  };
+}): WebSkillApi;
+//#endregion
 //#region src/host/protocol.d.ts
 /** 主线程 → Worker 的 LLM 配置；mockResponses 供 E2E/测试注入确定性 Mock */
 interface LlmClientConfig {
@@ -292,4 +334,4 @@ declare class WorkerUiBridge implements UiBridge {
   onTextDelta(runId: string, delta: string): Promise<void>;
 }
 //#endregion
-export { type BridgeCapabilities, type BridgeRequest, type BridgeResponse, BrowserSkillManager, BrowserWorkerScriptExecutor, type LlmClientConfig, type MainToWorkerMessage, OpfsProvider, type SerializedError, TsTranspiler, type TypeScriptSupportOptions, WORKER_BOOTSTRAP_SOURCE, type WorkerEvent, type WorkerFactory, type WorkerLike, type WorkerRequest, WorkerRuntimeClient, type WorkerRuntimeClientDeps, type WorkerRuntimeHostOverrides, type WorkerScopeLike, WorkerUiBridge, bridgeError, extractZipWeb, isOpfsAvailable, parseBridgeRequest, parseMainMessage, parseWorkerEvent, sha256HexWeb, startWorkerRuntimeHost };
+export { type BridgeCapabilities, type BridgeRequest, type BridgeResponse, BrowserSkillManager, BrowserWorkerScriptExecutor, type LlmClientConfig, type MainToWorkerMessage, OpfsProvider, type SerializedError, TsTranspiler, type TypeScriptSupportOptions, WORKER_BOOTSTRAP_SOURCE, type WorkerEvent, type WorkerFactory, type WorkerLike, type WorkerRequest, WorkerRuntimeClient, type WorkerRuntimeClientDeps, type WorkerRuntimeHostOverrides, type WorkerScopeLike, WorkerUiBridge, bridgeError, extractZipWeb, installWebSkillNavigator, isOpfsAvailable, parseBridgeRequest, parseMainMessage, parseWorkerEvent, sha256HexWeb, startWorkerRuntimeHost };

package/dist/browser.js

@@ -1,4 +1,4 @@
-import { A as parseBridgeRequest, B as SkillDiscovery, C as bridgeError, H as WebSkillError, I as SKILLS_LOCKFILE, J as isValidSkillName, L as SKILL_MANIFEST_FILE, O as mergeCatalogEntries, U as buildCatalog, W as buildManifest, Z as parseSkillMarkdown, b as RUN_SNAPSHOT_SCHEMA_VERSION, c as FsRunSnapshotStore, et as resolveInsideRoot, g as ProgressiveRouter, h as OpenAiCompatibleClient, i as AgentLoop, k as normalizeToolContent, nt as verifyManifest, o as FsArtifactStore, p as MockLlmClient, s as FsMemoryStore, tt as validateSkills } from "./dist-COsE72Ct.js";
+import { D as createWebSkillApi, F as parseBridgeRequest, G as SKILL_PACK_FILE, H as SKILL_MANIFEST_FILE, J as WebSkillError, K as SkillDiscovery, M as mergeCatalogEntries, N as networkUrlHost, P as normalizeToolContent, V as SKILLS_LOCKFILE, X as buildManifest, Y as buildCatalog, _ as ProgressiveRouter, a as CapabilityApproval, at as parseSkillMarkdown, c as FsMemoryStore, dt as verifyManifest, g as OpenAiCompatibleClient, i as AgentLoop, j as isNetworkAllowed, l as FsRunSnapshotStore, lt as resolveInsideRoot, m as MockLlmClient, nt as isValidSkillName, ot as parseSkillPackManifest, s as FsArtifactStore, tt as exportSkills, ut as validateSkills, w as bridgeError, x as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-nXiR40hi.js";
 import { unzipSync } from "fflate";
 
 //#region ../browser/dist/index.js
@@ -134,23 +134,92 @@ var OpfsProvider = class {
 };
 /**
 * Worker 引导源码（字符串 → Blob URL → new Worker(url, {type:'module'})）。
-* 注意：内容为纯 JS，不能含反引号与 ${ 占位（外层用模板字符串内嵌）。
+* 注意：内容为纯 JS，不能含反引号与 ${ 占位（外层用模板字符串内嵌）；
+* isNetworkAllowed/networkUrlHost 经函数源码注入（匹配逻辑单一来源在
+* runtime/sandbox/networkPolicy.ts，此处禁止复制实现）。
 *
 * 协议（宿主 ↔ Worker）：
-* - 宿主 → Worker：{type:'load', id, source} 请求加载脚本定义
-* - 宿主 → Worker：{type:'execute', id, skillName, runId, source, args} 请求执行
+* - 宿主 → Worker：{type:'load', id, source, networkPolicy?} 请求加载脚本定义
+* - 宿主 → Worker：{type:'execute', id, skillName, runId, source, args, networkPolicy?} 请求执行
 * - Worker → 宿主：{type:'load-result', id, ok, definition?, error?}
 * - Worker → 宿主：{type:'execute-result', id, ok, value?, stdout, stderr, error?}
 * - Worker → 宿主：{type:'bridge', request} 能力桥 RPC（readReference/writeArtifact/confirm）
 * - 宿主 → Worker：{type:'bridge-response', response}
+* - Worker → 宿主：{type:'network-blocked', host} 网络阻断通知（宿主记 run.warning，URL 脱敏只记 host）
 *
 * .js 源码经 data: URL 动态 import；主线程从不 import 技能脚本。
+* 网络管控：包装 fetch / XMLHttpRequest / WebSocket / EventSource，
+* 策略默认 deny-all，由 load/execute 消息携带更新。
 */
 const WORKER_BOOTSTRAP_SOURCE = String.raw`
 'use strict';
 
 var pending = new Map();
 var bridgeSeq = 0;
+var networkPolicy = 'deny-all';
+
+${isNetworkAllowed.toString()}
+
+${networkUrlHost.toString()}
+
+function resolveUrl(raw) {
+  try {
+    return new URL(raw, self.location.href).href;
+  } catch (e) {
+    return String(raw);
+  }
+}
+
+function networkGate(rawUrl) {
+  var url = resolveUrl(rawUrl);
+  if (isNetworkAllowed(networkPolicy, url)) return null;
+  var host = networkUrlHost(url);
+  self.postMessage({ type: 'network-blocked', host: host });
+  var err = new Error('Network request blocked by sandbox network policy: ' + host);
+  err.code = 'NETWORK_BLOCKED';
+  return err;
+}
+
+if (typeof self.fetch === 'function') {
+  var originalFetch = self.fetch;
+  self.fetch = function (input, init) {
+    var raw = typeof input === 'string' ? input : input && input.url ? input.url : String(input);
+    var blocked = networkGate(raw);
+    if (blocked) return Promise.reject(blocked);
+    return originalFetch.call(this, input, init);
+  };
+}
+
+if (typeof XMLHttpRequest !== 'undefined') {
+  var originalXhrOpen = XMLHttpRequest.prototype.open;
+  XMLHttpRequest.prototype.open = function (method, url) {
+    var blocked = networkGate(url);
+    if (blocked) throw blocked;
+    return originalXhrOpen.apply(this, arguments);
+  };
+}
+
+if (typeof WebSocket !== 'undefined') {
+  var OriginalWebSocket = WebSocket;
+  self.WebSocket = function (url, protocols) {
+    var blocked = networkGate(url);
+    if (blocked) throw blocked;
+    return protocols === undefined
+      ? new OriginalWebSocket(url)
+      : new OriginalWebSocket(url, protocols);
+  };
+  self.WebSocket.prototype = OriginalWebSocket.prototype;
+}
+
+if (typeof EventSource !== 'undefined') {
+  var OriginalEventSource = EventSource;
+  self.EventSource = function (url, config) {
+    var blocked = networkGate(url);
+    if (blocked) throw blocked;
+    return config === undefined ? new OriginalEventSource(url) : new OriginalEventSource(url, config);
+  };
+  self.EventSource.prototype = OriginalEventSource.prototype;
+}
 
 function loadModule(source) {
   var url = 'data:text/javascript;charset=utf-8,' + encodeURIComponent(source);
@@ -212,6 +281,7 @@ self.onmessage = async function (event) {
   }
 
   if (msg.type === 'load') {
+    if (msg.networkPolicy !== undefined) networkPolicy = msg.networkPolicy;
     try {
       var mod = await loadModule(msg.source);
       self.postMessage({
@@ -225,12 +295,13 @@ self.onmessage = async function (event) {
         },
       });
     } catch (e) {
-      postError('load-result', msg.id, 'TOOL_EXECUTION_FAILED', String((e && e.message) || e));
+      postError('load-result', msg.id, (e && e.code) || 'TOOL_EXECUTION_FAILED', String((e && e.message) || e));
     }
     return;
   }
 
   if (msg.type === 'execute') {
+    if (msg.networkPolicy !== undefined) networkPolicy = msg.networkPolicy;
     var stdout = [];
     var stderr = [];
     var originals = {
@@ -405,6 +476,11 @@ var BrowserSkillManager = class {
 			const contentDir = `${stagingRoot}/content`;
 			await fs.mkdir(contentDir);
 			await extractZipWeb(fs, data, contentDir);
+			const packFilePath = `${contentDir}/${SKILL_PACK_FILE}`;
+			if (await fs.exists(packFilePath)) return (await this.#installPack({
+				contentDir,
+				manifest: parseSkillPackManifest(await fs.readText(packFilePath))
+			}, source, stagingRoot))[0];
 			let skillDir = contentDir;
 			if (!await fs.exists(`${contentDir}/SKILL.md`)) {
 				const dirs = (await fs.list(contentDir)).filter((e) => e.type === "directory");
@@ -450,6 +526,77 @@ var BrowserSkillManager = class {
 			await removeDirQuiet(fs, stagingRoot);
 		}
 	}
+	/**
+	* 包集安装：逐技能走单技能管线（归一 → 汇总校验 → 落 managed root → manifest → digest 比对）。
+	* 任一失败整体回滚（删除本次已落目录；lockfile 在全部成功后才写入，天然零残留）。
+	*/
+	async #installPack(pack, source, stagingRoot) {
+		const fs = this.#fs;
+		const finalRoot = `${stagingRoot}/final`;
+		const installed = [];
+		try {
+			const versions = /* @__PURE__ */ new Map();
+			for (const entry of pack.manifest.skills) {
+				const skillDir = `${pack.contentDir}/${entry.name}`;
+				if (!await fs.exists(`${skillDir}/SKILL.md`)) throw new WebSkillError("INSTALL_FAILED", `Skill pack is missing a directory for skill "${entry.name}"`);
+				let name;
+				try {
+					const { metadata } = parseSkillMarkdown(await fs.readText(`${skillDir}/SKILL.md`));
+					name = metadata.name;
+					versions.set(name, typeof metadata["version"] === "string" ? metadata["version"] : void 0);
+				} catch (e) {
+					throw new WebSkillError("INSTALL_FAILED", `Failed to read skill name from SKILL.md of pack entry "${entry.name}": ${messageOf$1(e)}`, e);
+				}
+				if (name !== entry.name) throw new WebSkillError("INSTALL_FAILED", `Skill pack entry "${entry.name}" does not match the SKILL.md name "${name}"`);
+				await copyDir(fs, skillDir, `${finalRoot}/${name}`);
+			}
+			const report = await validateSkills(fs, [finalRoot]);
+			if (!report.ok) {
+				const errors = report.issues.filter((i) => i.severity === "error");
+				throw new WebSkillError("INSTALL_FAILED", `Skill pack failed validation: ${errors.map((i) => i.message).join("; ")}`, errors);
+			}
+			const manifests = [];
+			for (const entry of pack.manifest.skills) {
+				const targetDir = `${this.#managedRoot}/${entry.name}`;
+				if (await fs.exists(targetDir)) await fs.remove(targetDir, { recursive: true });
+				await copyDir(fs, `${finalRoot}/${entry.name}`, targetDir);
+				installed.push(targetDir);
+				const manifest = await this.#createManifest(targetDir, {
+					name: entry.name,
+					...versions.get(entry.name) ? { version: versions.get(entry.name) } : {},
+					source
+				});
+				if (manifest.integrity.digest !== entry.digest) throw new WebSkillError("INSTALL_FAILED", `Skill "${entry.name}" digest mismatch: expected ${entry.digest}, got ${manifest.integrity.digest}`);
+				manifests.push(manifest);
+			}
+			for (const manifest of manifests) await this.#upsertLockEntry(manifest.name, {
+				digest: manifest.integrity.digest,
+				installedAt: manifest.installedAt,
+				source
+			});
+			return manifests;
+		} catch (e) {
+			for (const targetDir of installed) await removeDirQuiet(fs, targetDir);
+			throw asInstallFailed(e);
+		}
+	}
+	/**
+	* 浏览器导出（单技能与包集同构：始终产出含 webskill.skill-pack.json 的 zip 字节，
+	* 统一安装路径；保存/下载由应用层处理）。
+	*/
+	async exportArchive(names) {
+		const list = Array.isArray(names) ? names : [names];
+		if (list.length === 0) throw new WebSkillError("EXPORT_FAILED", "exportArchive requires at least one skill name");
+		const roots = list.map((name) => {
+			if (!isValidSkillName(name)) throw new WebSkillError("EXPORT_FAILED", `Invalid skill name (path traversal rejected): ${JSON.stringify(name)}`);
+			return `${this.#managedRoot}/${name}`;
+		});
+		for (const [index, root] of roots.entries()) if (!await this.#fs.exists(root)) throw new WebSkillError("EXPORT_FAILED", `Skill "${list[index]}" is not installed`);
+		return exportSkills(this.#fs, {
+			roots,
+			manifestBuilder: (root) => this.#readManifest(root)
+		});
+	}
 	async uninstall(name) {
 		if (!isValidSkillName(name)) throw new WebSkillError("UNINSTALL_FAILED", `Invalid skill name (path traversal rejected): ${JSON.stringify(name)}`);
 		const targetDir = `${this.#managedRoot}/${name}`;
@@ -543,6 +690,8 @@ var BrowserWorkerScriptExecutor = class {
 	#fs;
 	#workerFactory;
 	#capabilities;
+	#networkPolicy;
+	#approval;
 	#transpiler;
 	constructor(deps) {
 		this.#fs = deps.fs;
@@ -556,6 +705,11 @@ var BrowserWorkerScriptExecutor = class {
 			writeArtifact: deps.capabilities?.writeArtifact ?? true,
 			confirm: deps.capabilities?.confirm ?? true
 		};
+		this.#networkPolicy = deps.networkPolicy ?? "deny-all";
+		this.#approval = new CapabilityApproval({
+			...deps.uiBridge ? { uiBridge: deps.uiBridge } : {},
+			...deps.approvalScope ? { scope: deps.approvalScope } : {}
+		});
 	}
 	/** 定位 scripts/<name>.js；.ts → TOOL_UNSUPPORTED（D4）；冲突/缺失结构化报错 */
 	async #locateScript(skillRoot, scriptName) {
@@ -584,7 +738,8 @@ var BrowserWorkerScriptExecutor = class {
 			const data = await this.#request(worker, {
 				type: "load",
 				id: "load-1",
-				source: script.source
+				source: script.source,
+				networkPolicy: this.#networkPolicy
 			});
 			if (!data.ok) throw new WebSkillError("TOOL_EXECUTION_FAILED", `Failed to load script "${scriptName}": ${data.error?.message ?? "unknown error"}`);
 			return {
@@ -621,8 +776,9 @@ var BrowserWorkerScriptExecutor = class {
 				skillName: context.skillName,
 				runId: context.runId,
 				source: script.source,
-				args
-			}, timeoutMs, (bridgeRequest) => this.#handleBridge(bridgeRequest, context));
+				args,
+				networkPolicy: this.#networkPolicy
+			}, timeoutMs, (bridgeRequest) => this.#handleBridge(bridgeRequest, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!response.ok) {
 				const stderrSummary = response.stderr?.length ? ` | stderr: ${response.stderr.join(" | ").slice(0, 500)}` : "";
 				return {
@@ -656,8 +812,8 @@ var BrowserWorkerScriptExecutor = class {
 			worker.terminate();
 		}
 	}
-	/** 发消息并按 id 等回包；可选超时；onBridge 处理执行期间的能力桥请求 */
-	#request(worker, message, timeoutMs, onBridge) {
+	/** 发消息并按 id 等回包；可选超时；onBridge 处理执行期间的能力桥请求；onNetworkBlocked 收网络阻断通知 */
+	#request(worker, message, timeoutMs, onBridge, onNetworkBlocked) {
 		const id = String(message["id"]);
 		return new Promise((resolve, reject) => {
 			let settled = false;
@@ -670,6 +826,10 @@ var BrowserWorkerScriptExecutor = class {
 			worker.addEventListener("message", (event) => {
 				const data = event.data;
 				if (!data || typeof data !== "object") return;
+				if (data.type === "network-blocked") {
+					if (typeof data.host === "string") onNetworkBlocked?.(data.host);
+					return;
+				}
 				if (data.type === "bridge" && onBridge) {
 					const request = parseBridgeRequest(data.request);
 					const respond = (response) => worker.postMessage({
@@ -691,20 +851,36 @@ var BrowserWorkerScriptExecutor = class {
 			worker.postMessage(message);
 		});
 	}
-	/** 能力桥宿主侧处理：能力关闭即 TOOL_UNSUPPORTED；readReference/writeArtifact/confirm 委托 context */
+	/** 能力桥宿主侧处理：能力关闭/授权拒绝即 TOOL_UNSUPPORTED；判定逻辑共用 runtime/sandbox/approval */
 	async #handleBridge(request, context) {
-		const unsupported = (capability) => bridgeError(request.id, "TOOL_UNSUPPORTED", `Capability "${capability}" is disabled`);
+		const gate = async (capability, message, details) => {
+			const decision = await this.#approval.authorize({
+				runId: context.runId,
+				capability,
+				mode: this.#capabilities[capability],
+				message,
+				...details !== void 0 ? { details } : {}
+			});
+			if (decision === "allowed") return void 0;
+			return bridgeError(request.id, "TOOL_UNSUPPORTED", decision === "disabled" ? `Capability "${capability}" is disabled` : `Capability "${capability}" was denied by the user`);
+		};
 		try {
 			switch (request.kind) {
-				case "readReference":
-					if (!this.#capabilities.readReference) return unsupported("readReference");
+				case "readReference": {
+					const denied = await gate("readReference", `Script "${context.skillName}" wants to read reference "${request.path}"`, { path: request.path });
+					if (denied) return denied;
 					return {
 						id: request.id,
 						ok: true,
 						value: await context.readReference(request.path)
 					};
+				}
 				case "writeArtifact": {
-					if (!this.#capabilities.writeArtifact) return unsupported("writeArtifact");
+					const denied = await gate("writeArtifact", `Script "${context.skillName}" wants to write artifact "${request.path}"`, {
+						path: request.path,
+						mimeType: request.mimeType
+					});
+					if (denied) return denied;
 					const content = typeof request.content === "string" ? request.content : new Uint8Array(request.content);
 					const artifact = await context.writeArtifact(request.path, content, { ...request.mimeType ? { mimeType: request.mimeType } : {} });
 					return {
@@ -713,19 +889,50 @@ var BrowserWorkerScriptExecutor = class {
 						value: artifact
 					};
 				}
-				case "confirm":
-					if (!this.#capabilities.confirm || !context.confirm) return unsupported("confirm");
+				case "confirm": {
+					if (!context.confirm) return bridgeError(request.id, "TOOL_UNSUPPORTED", "Capability \"confirm\" is disabled");
+					const denied = await gate("confirm", `Script "${context.skillName}" asks for confirmation: ${request.message}`);
+					if (denied) return denied;
 					return {
 						id: request.id,
 						ok: true,
 						value: await context.confirm(request.message)
 					};
+				}
 			}
 		} catch (e) {
 			return bridgeError(request.id, e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED", messageOf(e));
 		}
 	}
 };
+/**
+* navigator.webskill 显式装配：OPFS 默认存储 + BrowserWorkerScriptExecutor +
+* BrowserSkillManager → createWebSkillApi；target 提供时挂 target.navigator
+* （缺失则补空对象），否则挂真实 navigator.webskill。
+* target 可注入（测试）；返回值即门面本体（挂载只是副作用）。
+*/
+function installWebSkillNavigator(config) {
+	const roots = config.roots ?? ["/skills"];
+	const fs = config.fs ?? new OpfsProvider();
+	const executor = new BrowserWorkerScriptExecutor({
+		fs,
+		...config.typescript ? { typescript: config.typescript } : {}
+	});
+	const skillManager = new BrowserSkillManager({
+		fs,
+		managedRoot: config.managedRoot ?? roots[0] ?? "/skills"
+	});
+	const api = createWebSkillApi({
+		fs,
+		roots,
+		llm: config.llm,
+		executor,
+		skillManager
+	});
+	const nav = config.target ? config.target.navigator ??= {} : navigator;
+	nav["webskill"] = api;
+	return api;
+}
 const isRecord = (v) => typeof v === "object" && v !== null;
 const isNonEmptyString = (v) => typeof v === "string" && v !== "";
 /** Worker 侧入站校验：非法消息返回 undefined（忽略） */
@@ -1234,4 +1441,4 @@ var WorkerRuntimeClient = class {
 };
 
 //#endregion
-export { BrowserSkillManager, BrowserWorkerScriptExecutor, OpfsProvider, TsTranspiler, WORKER_BOOTSTRAP_SOURCE, WorkerRuntimeClient, WorkerUiBridge, bridgeError, extractZipWeb, isOpfsAvailable, parseBridgeRequest, parseMainMessage, parseWorkerEvent, sha256HexWeb, startWorkerRuntimeHost };
+export { BrowserSkillManager, BrowserWorkerScriptExecutor, OpfsProvider, TsTranspiler, WORKER_BOOTSTRAP_SOURCE, WorkerRuntimeClient, WorkerUiBridge, bridgeError, extractZipWeb, installWebSkillNavigator, isOpfsAvailable, parseBridgeRequest, parseMainMessage, parseWorkerEvent, sha256HexWeb, startWorkerRuntimeHost };