@webskill/sdk 0.1.0 → 0.1.2

package/dist/browser.d.ts

@@ -1,5 +1,5 @@
-import { H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, S as FileSystemProvider, W as VerifyResult, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, o as InteractionRequest, s as InteractionResponse, v as UiBridge, x as FileStat } from "./types-CgNC-oQu-DCklnS0h.js";
-import { K as ScriptExecutionContext, Y as ToolDefinition, Z as ToolResult, _ as ExternalToolSource, _t as parseBridgeRequest, c as ApprovalScope, d as BridgeRequest, f as BridgeResponse, g as ExternalSkillProvider, k as NetworkPolicy, l as BridgeCapabilities, ot as bridgeError, q as ScriptExecutor, rt as WebSkillApi } from "./index-S8uza3ld.js";
+import { H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, S as FileSystemProvider, W as VerifyResult, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, o as InteractionRequest, s as InteractionResponse, v as UiBridge, x as FileStat } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { K as ScriptExecutionContext, Y as ToolDefinition, Z as ToolResult, _ as ExternalToolSource, _t as parseBridgeRequest, c as ApprovalScope, d as BridgeRequest, f as BridgeResponse, g as ExternalSkillProvider, k as NetworkPolicy, l as BridgeCapabilities, ot as bridgeError, q as ScriptExecutor, rt as WebSkillApi } from "./index-fjRF4H5o.js";
 //#region ../browser/dist/index.d.ts
 //#region src/fs/featureDetection.d.ts
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */

package/dist/browser.js

@@ -1,6 +1,6 @@
-import { D as verifyManifest, E as validateSkills, S as parseSkillPackManifest, T as resolveInsideRoot, _ as exportSkills, c as SkillDiscovery, d as buildCatalog, f as buildManifest, i as SKILL_MANIFEST_FILE, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, v as isValidSkillName, x as parseSkillMarkdown } from "./memoryArtifactStore-C9lFVqPF-U8nXvqL9.js";
-import { A as normalizeToolContent, C as createWebSkillApi, D as isNetworkAllowed, O as mergeCatalogEntries, _ as RUN_SNAPSHOT_SCHEMA_VERSION, a as CapabilityApproval, b as bridgeError, c as FsMemoryStore, f as OpenAiCompatibleClient, i as AgentLoop, j as parseBridgeRequest, k as networkUrlHost, l as FsRunSnapshotStore, p as ProgressiveRouter, s as FsArtifactStore } from "./dist-CiYRkm71.js";
-import { n as MockLlmClient } from "./testing-pn3NhXSV.js";
+import { E as verifyManifest, T as validateSkills, _ as isValidSkillName, b as parseSkillMarkdown, d as buildManifest, g as exportSkills, l as WebSkillError, n as SKILLS_LOCKFILE, o as SKILL_PACK_FILE, r as SKILL_MANIFEST_FILE, s as SkillDiscovery, u as buildCatalog, w as resolveInsideRoot, x as parseSkillPackManifest } from "./dist-DS1sfgHa.js";
+import { A as normalizeToolContent, C as createWebSkillApi, D as isNetworkAllowed, O as mergeCatalogEntries, _ as RUN_SNAPSHOT_SCHEMA_VERSION, a as CapabilityApproval, b as bridgeError, c as FsMemoryStore, f as OpenAiCompatibleClient, i as AgentLoop, j as parseBridgeRequest, k as networkUrlHost, l as FsRunSnapshotStore, p as ProgressiveRouter, s as FsArtifactStore } from "./dist-DRsnVw6A.js";
+import { n as MockLlmClient } from "./testing-CbM6rJ-E.js";
 import { unzipSync } from "fflate";
 
 //#region ../browser/dist/index.js
@@ -499,6 +499,7 @@ var BrowserSkillManager = class {
 			} catch (e) {
 				throw new WebSkillError("INSTALL_FAILED", `Failed to read skill name from SKILL.md: ${messageOf$1(e)}`, e);
 			}
+			if (!isValidSkillName(name)) throw new WebSkillError("INSTALL_FAILED", `Invalid skill name in SKILL.md (path traversal rejected): ${JSON.stringify(name)}`);
 			const finalRoot = `${stagingRoot}/final`;
 			const finalDir = `${finalRoot}/${name}`;
 			await copyDir(fs, skillDir, finalDir);
@@ -540,6 +541,7 @@ var BrowserSkillManager = class {
 		try {
 			const versions = /* @__PURE__ */ new Map();
 			for (const entry of pack.manifest.skills) {
+				if (!isValidSkillName(entry.name)) throw new WebSkillError("INSTALL_FAILED", `Invalid skill name in skill pack manifest (path traversal rejected): ${JSON.stringify(entry.name)}`);
 				const skillDir = `${pack.contentDir}/${entry.name}`;
 				if (!await fs.exists(`${skillDir}/SKILL.md`)) throw new WebSkillError("INSTALL_FAILED", `Skill pack is missing a directory for skill "${entry.name}"`);
 				let name;

package/dist/{dist-CiYRkm71.js → dist-DRsnVw6A.js}

@@ -1,4 +1,5 @@
-import { C as renderAvailableSkillsXml, E as validateSkills, T as resolveInsideRoot, c as SkillDiscovery, d as buildCatalog, l as SkillReader, t as MemoryArtifactStore, u as WebSkillError, x as parseSkillMarkdown } from "./memoryArtifactStore-C9lFVqPF-U8nXvqL9.js";
+import { S as renderAvailableSkillsXml, T as validateSkills, b as parseSkillMarkdown, c as SkillReader, l as WebSkillError, s as SkillDiscovery, u as buildCatalog, w as resolveInsideRoot } from "./dist-DS1sfgHa.js";
+import { t as MemoryArtifactStore } from "./memoryArtifactStore-C9lFVqPF-yFz6yJj0.js";
 
 //#region ../runtime/dist/index.js
 const toOpenAiMessage = (msg) => {
@@ -421,7 +422,7 @@ const ASK_USER_TOOL = {
 * 不暴露 fs 本体（沙箱语义，对齐 deferred-items D1）。
 */
 function createScriptContext(deps) {
-	const { fs, artifactStore, skillName, skillRoot, runId, confirm, onWarning } = deps;
+	const { fs, artifactStore, skillName, skillRoot, runId, confirm, onWarning, onArtifactCreated } = deps;
 	return {
 		skillName,
 		runId,
@@ -429,17 +430,19 @@ function createScriptContext(deps) {
 			return fs.readText(resolveInsideRoot(skillRoot, `references/${relativePath}`));
 		},
 		async writeArtifact(path, content, options) {
-			return typeof content === "string" ? artifactStore.createTextArtifact({
+			const artifact = typeof content === "string" ? await artifactStore.createTextArtifact({
 				runId,
 				path,
 				content,
 				mimeType: options?.mimeType
-			}) : artifactStore.createBinaryArtifact({
+			}) : await artifactStore.createBinaryArtifact({
 				runId,
 				path,
 				content,
 				mimeType: options?.mimeType
 			});
+			onArtifactCreated?.(artifact);
+			return artifact;
 		},
 		...confirm ? { confirm } : {},
 		...onWarning ? { onWarning } : {}
@@ -1136,7 +1139,7 @@ var AgentLoop = class {
 		try {
 			const text = await state.reader.readSkillFile(skillName, pathArg);
 			let note = "";
-			if (pathArg === "SKILL.md" && !state.activated.has(skillName)) note = await this.#activateSkill(skillName, state);
+			if (pathArg === "SKILL.md" && !state.activated.has(skillName)) note = await this.#activateSkill(skillName, state, void 0, text);
 			return {
 				ok: true,
 				content: [{
@@ -1190,7 +1193,7 @@ var AgentLoop = class {
 		return toolError("SKILL_NOT_FOUND", `Skill not found via external providers: ${skillKey}`);
 	}
 	/** 首次读到 SKILL.md 时激活技能：加载其 scripts 工具定义，供后续轮次使用；dependencies 级联激活（via 记录来源） */
-	async #activateSkill(skillName, state, via) {
+	async #activateSkill(skillName, state, via, skillMdText) {
 		state.activated.add(skillName);
 		state.trace.record("skill.activated", { data: {
 			skillName,
@@ -1203,11 +1206,11 @@ var AgentLoop = class {
 		let allowedTools;
 		let dependencies = [];
 		try {
-			const { metadata } = parseSkillMarkdown(await this.#deps.fs.readText(`${root}/SKILL.md`));
+			const { metadata } = parseSkillMarkdown(skillMdText ?? await this.#deps.fs.readText(`${root}/SKILL.md`));
 			const rawDeps = metadata["dependencies"];
 			if (Array.isArray(rawDeps)) dependencies = rawDeps.filter((d) => typeof d === "string");
-			const raw = metadata["allowed-tools"];
-			if (raw !== void 0) if (Array.isArray(raw)) allowedTools = raw.filter((e) => typeof e === "string");
+			const rawAllowed = metadata["allowed-tools"];
+			if (rawAllowed !== void 0) if (Array.isArray(rawAllowed)) allowedTools = rawAllowed.filter((e) => typeof e === "string");
 			else state.trace.record("run.warning", { message: `Skill "${skillName}" has a non-array "allowed-tools" metadata entry; ignored` });
 		} catch {}
 		const executor = this.#deps.executor;
@@ -1290,6 +1293,7 @@ var AgentLoop = class {
 			if (e instanceof BridgeRequestError) return toolError("UI_UNAVAILABLE", `Parameter form failed: ${e.message}`);
 			throw e;
 		}
+		const createdIds = /* @__PURE__ */ new Set();
 		const context = createScriptContext({
 			fs: this.#deps.fs,
 			artifactStore: this.#deps.artifactStore,
@@ -1297,10 +1301,10 @@ var AgentLoop = class {
 			skillRoot: root,
 			runId: state.runId,
 			confirm: (message) => this.#confirm(message, state),
-			onWarning: (message) => state.trace.record("run.warning", { message })
+			onWarning: (message) => state.trace.record("run.warning", { message }),
+			onArtifactCreated: (artifact) => createdIds.add(artifact.id)
 		});
 		try {
-			const before = new Set((await this.#deps.artifactStore.listArtifacts(state.runId)).map((a) => a.id));
 			const result = await this.#deps.executor.execute({
 				skillRoot: root,
 				scriptName,
@@ -1308,8 +1312,10 @@ var AgentLoop = class {
 				context,
 				timeoutMs: state.toolTimeoutMs
 			});
-			const fresh = (await this.#deps.artifactStore.listArtifacts(state.runId)).filter((a) => !before.has(a.id));
-			if (fresh.length > 0) result.artifacts = [...result.artifacts ?? [], ...fresh];
+			if (createdIds.size > 0) {
+				const fresh = (await this.#deps.artifactStore.listArtifacts(state.runId)).filter((a) => createdIds.has(a.id));
+				if (fresh.length > 0) result.artifacts = [...result.artifacts ?? [], ...fresh];
+			}
 			await this.#bumpSkillStat(skillName, result.ok ? "successes" : "failures", state);
 			return result;
 		} catch (e) {
@@ -1623,6 +1629,16 @@ var WebSkillRuntime = class {
 function createWebSkillApi(deps) {
 	const { fs, roots } = deps;
 	let runtime;
+	const discoveries = /* @__PURE__ */ new Map();
+	const discoveryFor = (paths) => {
+		const key = paths.join("");
+		let discovery = discoveries.get(key);
+		if (!discovery) {
+			discovery = new SkillDiscovery(fs, paths);
+			discoveries.set(key, discovery);
+		}
+		return discovery;
+	};
 	const lazyRuntime = () => {
 		runtime ??= new WebSkillRuntime({
 			fs,
@@ -1640,11 +1656,11 @@ function createWebSkillApi(deps) {
 	};
 	return {
 		async discover(path) {
-			const { entries } = await new SkillDiscovery(fs, [path]).discover();
+			const { entries } = await discoveryFor([path]).discover();
 			return buildCatalog(entries);
 		},
 		async read(name) {
-			const { entries } = await new SkillDiscovery(fs, roots).discover();
+			const { entries } = await discoveryFor(roots).discover();
 			const entry = entries.find((e) => e.name === name);
 			if (!entry) throw new WebSkillError("SKILL_NOT_FOUND", `Unknown skill: ${name}`);
 			const skillMdPath = `${entry.root}/SKILL.md`;
@@ -1679,13 +1695,21 @@ function createWebSkillApi(deps) {
 		}
 	};
 }
-/** install URL 分派：http(s)…​.zip → http；…​.git → git（无 git 能力的 manager 自行 TOOL_UNSUPPORTED）；其余 → local */
+/** install URL 分派：http(s)…​.zip → http；…​.git → git（无 git 能力的 manager 自行 TOOL_UNSUPPORTED）；
+* 其余 http(s) URL → INSTALL_FAILED（不静默当 local）；非 URL → local */
 function sourceFromUrl(url) {
 	const bare = url.split("?")[0] ?? url;
-	if (/^https?:\/\//.test(url) && bare.endsWith(".zip")) return {
-		type: "http",
-		url
-	};
+	if (/^https?:\/\//.test(url)) {
+		if (bare.endsWith(".zip")) return {
+			type: "http",
+			url
+		};
+		if (bare.endsWith(".git")) return {
+			type: "git",
+			url
+		};
+		throw new WebSkillError("INSTALL_FAILED", `Unsupported install URL "${url}" (supported: http(s) URLs ending in .zip or .git, or local paths)`);
+	}
 	if (bare.endsWith(".git")) return {
 		type: "git",
 		url
@@ -1758,7 +1782,12 @@ var FsMemoryStore = class {
 	async get(scope, key) {
 		const path = this.#keyPath(scope, key);
 		if (!await this.#fs.exists(path)) return void 0;
-		return JSON.parse(await this.#fs.readText(path));
+		try {
+			return JSON.parse(await this.#fs.readText(path));
+		} catch {
+			await this.#fs.remove(path);
+			return;
+		}
 	}
 	async set(scope, key, value) {
 		await this.#fs.writeText(this.#keyPath(scope, key), JSON.stringify(value, null, 2));
@@ -1775,10 +1804,14 @@ var FsMemoryStore = class {
 			if (entry.type !== "file" || !entry.path.endsWith(".json")) continue;
 			const fileName = entry.path.split("/").pop() ?? "";
 			const key = decodeURIComponent(fileName.replace(/\.json$/, ""));
-			out.push({
-				key,
-				value: JSON.parse(await this.#fs.readText(entry.path))
-			});
+			try {
+				out.push({
+					key,
+					value: JSON.parse(await this.#fs.readText(entry.path))
+				});
+			} catch {
+				await this.#fs.remove(entry.path);
+			}
 		}
 		return out.sort((a, b) => a.key.localeCompare(b.key));
 	}
@@ -1826,7 +1859,12 @@ var FsArtifactStore = class {
 		const indexPath = `${this.#root}/${runId}/${INDEX_FILE}`;
 		if (!await this.#fs.exists(indexPath)) return [];
 		const raw = await this.#fs.readText(indexPath);
-		return JSON.parse(raw).artifacts ?? [];
+		try {
+			return JSON.parse(raw).artifacts ?? [];
+		} catch {
+			await this.#fs.remove(indexPath);
+			return [];
+		}
 	}
 	#artifactPath(runId, artifactPath) {
 		return resolveInsideRoot(`${this.#root}/${runId}`, artifactPath);

package/dist/{memoryArtifactStore-C9lFVqPF-U8nXvqL9.js → dist-DS1sfgHa.js}

@@ -587,51 +587,4 @@ const xmlRenderer = {
 };
 
 //#endregion
-//#region ../runtime/dist/memoryArtifactStore-C9lFVqPF.js
-/** 内存 ArtifactStore：测试与浏览器降级用；索引随进程生命周期存在 */
-var MemoryArtifactStore = class {
-	#byRun = /* @__PURE__ */ new Map();
-	#seq = 0;
-	async createTextArtifact(input) {
-		return this.#record({
-			runId: input.runId,
-			path: input.path,
-			type: "text",
-			size: new TextEncoder().encode(input.content).length,
-			mimeType: input.mimeType,
-			metadata: input.metadata
-		});
-	}
-	async createBinaryArtifact(input) {
-		return this.#record({
-			runId: input.runId,
-			path: input.path,
-			type: "binary",
-			size: input.content.length,
-			mimeType: input.mimeType,
-			metadata: input.metadata
-		});
-	}
-	async listArtifacts(runId) {
-		return [...this.#byRun.get(runId) ?? []];
-	}
-	#record(input) {
-		const artifact = {
-			id: `art-${++this.#seq}`,
-			runId: input.runId,
-			path: input.path,
-			type: input.type,
-			mimeType: input.mimeType,
-			size: input.size,
-			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-			metadata: input.metadata
-		};
-		const list = this.#byRun.get(input.runId) ?? [];
-		list.push(artifact);
-		this.#byRun.set(input.runId, list);
-		return artifact;
-	}
-};
-
-//#endregion
-export { renderAvailableSkillsXml as C, verifyManifest as D, validateSkills as E, xmlRenderer as O, parseSkillPackManifest as S, resolveInsideRoot as T, exportSkills as _, SKILL_NAME_MAX_LENGTH as a, normalizePath as b, SkillDiscovery as c, buildCatalog as d, buildManifest as f, escapeXml as g, computeDigest as h, SKILL_MANIFEST_FILE as i, SkillReader as l, checkSkillRules as m, MemoryFS as n, SKILL_NAME_PATTERN as o, checkDependencyCycles as p, SKILLS_LOCKFILE as r, SKILL_PACK_FILE as s, MemoryArtifactStore as t, WebSkillError as u, isValidSkillName as v, renderCatalogJson as w, parseSkillMarkdown as x, jsonRenderer as y };
+export { renderCatalogJson as C, xmlRenderer as D, verifyManifest as E, renderAvailableSkillsXml as S, validateSkills as T, isValidSkillName as _, SKILL_NAME_PATTERN as a, parseSkillMarkdown as b, SkillReader as c, buildManifest as d, checkDependencyCycles as f, exportSkills as g, escapeXml as h, SKILL_NAME_MAX_LENGTH as i, WebSkillError as l, computeDigest as m, SKILLS_LOCKFILE as n, SKILL_PACK_FILE as o, checkSkillRules as p, SKILL_MANIFEST_FILE as r, SkillDiscovery as s, MemoryFS as t, buildCatalog as u, jsonRenderer as v, resolveInsideRoot as w, parseSkillPackManifest as x, normalizePath as y };