@webskill/sdk 0.1.2 → 0.1.4

package/dist/sandboxWorkerEntry.js

@@ -0,0 +1,214 @@
+import { register } from "node:module";
+import { pathToFileURL } from "node:url";
+import { isMainThread, parentPort, workerData } from "node:worker_threads";
+
+//#region ../node/dist/executor/sandboxWorkerEntry.js
+/**
+* D1 沙箱 Worker 入口（loader 文件形式，非内嵌字符串）。
+* 主线程经 workerData 传入任务；脚本源码路径直接 import（.ts 依赖
+* Node>=22.18 原生 type stripping，Worker 内同样生效）。
+* 能力桥 RPC（readReference/writeArtifact/confirm）经 parentPort 消息。
+*
+* 网络与模块管控：
+* - patch globalThis.fetch / globalThis.WebSocket（策略判定函数源码经 workerData
+*   注入，匹配逻辑单一来源在 runtime/sandbox/networkPolicy.ts——Worker 线程不走
+*   vitest 别名、也不应反向依赖宿主打包产物，故注入而非 import）。
+* - node: 内置模块 allowlist（module.register resolve 钩子）：默认全禁
+*   （含 fs/child_process/net 等），执行器配置可显式放行指定模块。
+*   能力面收敛，非安全边界（仍有绕过手段，禁止假定其可隔离不可信脚本）。
+* - 网络阻断时 postMessage {type:'network-blocked', host} → 宿主记 run.warning（URL 脱敏只记 host）。
+*/
+const port = parentPort;
+if (!port || isMainThread) throw new Error("sandboxWorkerEntry must run inside a worker thread");
+const pending = /* @__PURE__ */ new Map();
+let bridgeSeq = 0;
+function callCapability(kind, payload) {
+	const request = {
+		kind,
+		id: `br-${++bridgeSeq}`,
+		...payload
+	};
+	return new Promise((resolve, reject) => {
+		pending.set(request.id, {
+			resolve,
+			reject
+		});
+		port.postMessage({
+			type: "bridge",
+			request
+		});
+	}).then((response) => {
+		const r = response;
+		if (!r.ok) {
+			const err = new Error(r.error?.message ?? "capability call failed");
+			err.code = r.error?.code ?? "TOOL_EXECUTION_FAILED";
+			throw err;
+		}
+		return r.value;
+	});
+}
+async function loadModule(scriptPath) {
+	return await import(`${pathToFileURL(scriptPath).href}?t=${Date.now()}`);
+}
+function post(message) {
+	port.postMessage(message);
+}
+/**
+* 裸模块 allowlist 钩子（data: URL 注册）：
+* 默认禁止一切 node: 内置模块（含 fs/child_process/process/vm/module/worker_threads 等），
+* 仅 ALLOWED 清单（执行器配置注入）显式放行。网络裸模块语义合并统一：
+* allowlist 为空即全禁（含 node:net/http/https/dgram/tls）。
+*/
+const MODULE_HOOK_SOURCE = `
+var ALLOWED = new Set(%ALLOWED_MODULES%);
+var TOP_BUILTINS = new Set(['assert','async_hooks','buffer','child_process','cluster','console','constants','crypto','dgram','diagnostics_channel','dns','domain','events','fs','http','http2','https','inspector','module','net','os','path','perf_hooks','process','punycode','querystring','readline','repl','sea','sqlite','stream','string_decoder','sys','test','timers','tls','trace_events','tty','url','util','v8','vm','wasi','worker_threads','zlib']);
+function isAllowed(bare, name, top) {
+  return ALLOWED.has(bare) || ALLOWED.has(name) || ALLOWED.has('node:' + name) || ALLOWED.has(top) || ALLOWED.has('node:' + top);
+}
+export async function resolve(specifier, context, nextResolve) {
+  var bare = specifier.split('?')[0];
+  var name = bare.indexOf('node:') === 0 ? bare.slice(5) : bare;
+  var top = name.split('/')[0];
+  var isBuiltin = bare.indexOf('node:') === 0 || TOP_BUILTINS.has(top);
+  if (isBuiltin && !isAllowed(bare, name, top)) {
+    var err = new Error('Builtin module import blocked by sandbox module policy: ' + bare);
+    err.code = 'TOOL_UNSUPPORTED';
+    throw err;
+  }
+  return nextResolve(specifier, context);
+}
+`;
+function blockedError(host) {
+	const err = /* @__PURE__ */ new Error(`Network request blocked by sandbox network policy: ${host}`);
+	err.code = "NETWORK_BLOCKED";
+	return err;
+}
+/** patch 全局 fetch / WebSocket；注册裸网络模块 denylist（allow-all 之外均启用） */
+function setupNetworkGuards(task) {
+	const policy = task.networkPolicy ?? "deny-all";
+	if (!task.networkPolicyLib) return;
+	const { isNetworkAllowed, networkUrlHost } = new Function(`${task.networkPolicyLib}\nreturn { isNetworkAllowed: isNetworkAllowed, networkUrlHost: networkUrlHost };`)();
+	const gate = (rawUrl) => {
+		const url = String(rawUrl);
+		if (isNetworkAllowed(policy, url)) return null;
+		const host = networkUrlHost(url);
+		post({
+			type: "network-blocked",
+			host
+		});
+		return blockedError(host);
+	};
+	const originalFetch = globalThis["fetch"];
+	if (typeof originalFetch === "function") globalThis["fetch"] = (input, init) => {
+		const raw = typeof input === "string" ? input : input instanceof URL ? input.href : input?.url ?? String(input);
+		const blocked = gate(raw);
+		if (blocked) return Promise.reject(blocked);
+		return originalFetch(input, init);
+	};
+	const OriginalWebSocket = globalThis["WebSocket"];
+	if (typeof OriginalWebSocket === "function") globalThis["WebSocket"] = class extends OriginalWebSocket {
+		constructor(url, protocols) {
+			const blocked = gate(String(url));
+			if (blocked) throw blocked;
+			super(url, protocols);
+		}
+	};
+	register(`data:text/javascript,${encodeURIComponent(MODULE_HOOK_SOURCE.replace("%ALLOWED_MODULES%", JSON.stringify(task.allowedModules ?? [])))}`);
+}
+async function main() {
+	const task = workerData;
+	setupNetworkGuards(task);
+	port.on("message", (msg) => {
+		if (msg?.type === "bridge-response" && msg.response?.id) {
+			const entry = pending.get(msg.response.id);
+			if (entry) {
+				pending.delete(msg.response.id);
+				entry.resolve(msg.response);
+			}
+		}
+	});
+	if (task.mode === "load") {
+		try {
+			const mod = await loadModule(task.scriptPath);
+			post({
+				type: "load-result",
+				ok: true,
+				definition: {
+					description: typeof mod["description"] === "string" ? mod["description"] : void 0,
+					inputSchema: mod["inputSchema"] !== void 0 ? mod["inputSchema"] : void 0,
+					hasRun: typeof mod["run"] === "function"
+				}
+			});
+		} catch (e) {
+			post({
+				type: "load-result",
+				ok: false,
+				error: {
+					code: e?.code ?? "TOOL_EXECUTION_FAILED",
+					message: String(e?.message ?? e)
+				}
+			});
+		}
+		return;
+	}
+	const stdout = [];
+	const stderr = [];
+	const originals = {
+		log: console.log,
+		info: console.info,
+		debug: console.debug,
+		warn: console.warn,
+		error: console.error
+	};
+	console.log = console.info = console.debug = (...args) => stdout.push(args.map(String).join(" "));
+	console.warn = console.error = (...args) => stderr.push(args.map(String).join(" "));
+	try {
+		const mod = await loadModule(task.scriptPath);
+		if (typeof mod["run"] !== "function") throw new Error("Script does not export a run function");
+		const context = {
+			skillName: task.skillName ?? "",
+			runId: task.runId ?? "",
+			readReference: (path) => callCapability("readReference", { path }),
+			writeArtifact: (path, content, options) => callCapability("writeArtifact", {
+				path,
+				content: typeof content === "string" ? content : Array.from(content ?? []),
+				mimeType: options?.mimeType
+			}),
+			confirm: (message) => callCapability("confirm", { message })
+		};
+		const runFn = mod["run"];
+		const value = await runFn(task.args ?? {}, context);
+		post({
+			type: "execute-result",
+			ok: true,
+			value: value === void 0 ? null : value,
+			stdout,
+			stderr
+		});
+	} catch (e) {
+		const err = e;
+		post({
+			type: "execute-result",
+			ok: false,
+			error: {
+				code: err?.code ?? "TOOL_EXECUTION_FAILED",
+				message: String(err?.message ?? e)
+			},
+			stdout,
+			stderr
+		});
+	} finally {
+		console.log = originals.log;
+		console.info = originals.info;
+		console.debug = originals.debug;
+		console.warn = originals.warn;
+		console.error = originals.error;
+	}
+}
+main().then(() => process.exit(0), (e) => {
+	console.error(e);
+	process.exit(1);
+});
+
+//#endregion
+export {  };

package/dist/{testing-CbM6rJ-E.js → testing-S8SN9Lc6.js}

@@ -1,4 +1,4 @@
-import { l as WebSkillError } from "./dist-DS1sfgHa.js";
+import { l as WebSkillError } from "./dist-DvoBsChX.js";
 
 //#region ../runtime/dist/testing.js
 /**

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { c as LlmClient, d as LlmResponse, f as LlmStreamEvent, h as MemoryStore, l as LlmCompleteInput, n as ArtifactStore, o as InteractionRequest, s as InteractionResponse, t as Artifact, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { c as LlmClient, d as LlmResponse, f as LlmStreamEvent, h as MemoryStore, l as LlmCompleteInput, n as ArtifactStore, o as InteractionRequest, s as InteractionResponse, t as Artifact, v as UiBridge } from "./types-CgNC-oQu-DYrxhD3z.js";
 //#region ../runtime/dist/testing.d.ts
 //#region src/llm/mockLlmClient.d.ts
 type MockLlmHandler = (input: LlmCompleteInput) => LlmResponse | Promise<LlmResponse>;

package/dist/testing.js

@@ -1,4 +1,4 @@
 import { t as MemoryArtifactStore } from "./memoryArtifactStore-C9lFVqPF-yFz6yJj0.js";
-import { n as MockLlmClient, r as MockUiBridge, t as InMemoryStore } from "./testing-CbM6rJ-E.js";
+import { n as MockLlmClient, r as MockUiBridge, t as InMemoryStore } from "./testing-S8SN9Lc6.js";
 
 export { InMemoryStore, MemoryArtifactStore, MockLlmClient, MockUiBridge };

package/dist/{types-CgNC-oQu-Dq_A1yA-.d.ts → types-CgNC-oQu-DYrxhD3z.d.ts}

@@ -146,9 +146,19 @@ declare class MemoryFS implements FileSystemProvider {
 //#region src/fs/pathSecurity.d.ts
 /** 统一分隔符为 `/`，去除 `.` 段与重复分隔符（不解析 `..`） */
 declare function normalizePath(path: string): string;
+/**
+ * 外部标识（runId、candidateId、skillName、versionId 等）作为单一路径段使用前的统一校验：
+ * 拒绝空串、`.`、`..`、含 `/` 或 `\`、含 `:`（Windows 盘符/ADS）。
+ * 违规抛 FS_PATH_OUTSIDE_ROOT（kind 用于错误消息定位，如 "runId"）。
+ */
+declare function assertSafePathSegment(segment: string, kind: string): void;
 /**
  * 将相对路径安全地解析到 root 之内。
  * 拒绝空路径、绝对路径（`/`、`\\`、`C:\` 形式）与任何 `..` 段。
+ *
+ * 注意：本函数仅做**词法**校验，不解析符号链接——root 内经符号链接指向
+ * 外部的目标无法被词法检查拦截（realpath 防护见 NodeFS root 模式与
+ * 安装管线的 lstat 符号链接扫描）。
  */
 declare function resolveInsideRoot(root: string, relativePath: string): string;
 //#endregion
@@ -536,4 +546,4 @@ interface MemoryStore {
   clear(scope?: string): Promise<void>;
 }
 //#endregion
-export { exportSkills as $, SkillCatalog as A, SkillReader as B, JsonSchema as C, SKILL_NAME_MAX_LENGTH as D, SKILL_MANIFEST_FILE as E, SkillIssue as F, WebSkillError as G, SkillsLockfile as H, SkillLocation as I, buildManifest as J, WebSkillErrorCode as K, SkillManifest as L, SkillDiscovery as M, SkillDocument as N, SKILL_NAME_PATTERN as O, SkillInstallSource as P, escapeXml as Q, SkillMetadata as R, FileSystemProvider as S, SKILLS_LOCKFILE as T, ValidationReport as U, SkillSource as V, VerifyResult as W, checkSkillRules as X, checkDependencyCycles as Y, computeDigest as Z, RenderResultRequest as _, InteractionPolicy as a, renderAvailableSkillsXml as at, DiscoveryResult as b, LlmClient as c, validateSkills as ct, LlmResponse as d, isValidSkillName as et, LlmStreamEvent as f, RenderBlock as g, MemoryStore as h, FormField as i, parseSkillPackManifest as it, SkillCatalogEntry as j, SKILL_PACK_FILE as k, LlmCompleteInput as l, verifyManifest as lt, LlmToolSpec as m, ArtifactStore as n, normalizePath as nt, InteractionRequest as o, renderCatalogJson as ot, LlmToolCall as p, buildCatalog as q, ChartSpec as r, parseSkillMarkdown as rt, InteractionResponse as s, resolveInsideRoot as st, Artifact as t, jsonRenderer as tt, LlmMessage as u, xmlRenderer as ut, UiBridge as v, MemoryFS as w, FileStat as x, CatalogRenderer as y, SkillPackManifest as z };
+export { escapeXml as $, SkillCatalog as A, SkillReader as B, JsonSchema as C, SKILL_NAME_MAX_LENGTH as D, SKILL_MANIFEST_FILE as E, SkillIssue as F, WebSkillError as G, SkillsLockfile as H, SkillLocation as I, buildCatalog as J, WebSkillErrorCode as K, SkillManifest as L, SkillDiscovery as M, SkillDocument as N, SKILL_NAME_PATTERN as O, SkillInstallSource as P, computeDigest as Q, SkillMetadata as R, FileSystemProvider as S, SKILLS_LOCKFILE as T, ValidationReport as U, SkillSource as V, VerifyResult as W, checkDependencyCycles as X, buildManifest as Y, checkSkillRules as Z, RenderResultRequest as _, InteractionPolicy as a, parseSkillPackManifest as at, DiscoveryResult as b, LlmClient as c, resolveInsideRoot as ct, LlmResponse as d, xmlRenderer as dt, exportSkills as et, LlmStreamEvent as f, RenderBlock as g, MemoryStore as h, FormField as i, parseSkillMarkdown as it, SkillCatalogEntry as j, SKILL_PACK_FILE as k, LlmCompleteInput as l, validateSkills as lt, LlmToolSpec as m, ArtifactStore as n, jsonRenderer as nt, InteractionRequest as o, renderAvailableSkillsXml as ot, LlmToolCall as p, assertSafePathSegment as q, ChartSpec as r, normalizePath as rt, InteractionResponse as s, renderCatalogJson as st, Artifact as t, isValidSkillName as tt, LlmMessage as u, verifyManifest as ut, UiBridge as v, MemoryFS as w, FileStat as x, CatalogRenderer as y, SkillPackManifest as z };

package/dist/ui-react.d.ts

@@ -1,4 +1,4 @@
-import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-DYrxhD3z.js";
 //#region ../ui-react/dist/index.d.ts
 //#region src/bridgeState.d.ts
 /**

package/dist/ui-react.js

@@ -1,4 +1,4 @@
-import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-DxGyAznR.js";
+import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-MTc2KB03.js";
 import { useLayoutEffect, useRef, useState, useSyncExternalStore } from "react";
 import { jsx, jsxs } from "react/jsx-runtime";
 

package/dist/ui-vue.d.ts

@@ -1,4 +1,4 @@
-import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-DYrxhD3z.js";
 import { PropType } from "vue";
 //#region ../ui-vue/dist/index.d.ts
 //#region src/bridgeState.d.ts

package/dist/ui-vue.js

@@ -1,4 +1,4 @@
-import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-DxGyAznR.js";
+import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-MTc2KB03.js";
 import { defineComponent, h, reactive, ref } from "vue";
 
 //#region ../ui-vue/dist/index.js

package/dist/ui.d.ts

@@ -1,5 +1,5 @@
-import { _ as RenderResultRequest, g as RenderBlock, o as InteractionRequest, r as ChartSpec, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
-import { st as buildRenderResult } from "./index-fjRF4H5o.js";
+import { _ as RenderResultRequest, g as RenderBlock, o as InteractionRequest, r as ChartSpec, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-DYrxhD3z.js";
+import { dt as buildRenderResult } from "./index-BSS3EWY-.js";
 //#region ../ui/dist/index.d.ts
 //#region src/model/formModel.d.ts
 interface FormModel {

package/dist/ui.js

@@ -1,4 +1,4 @@
-import { x as buildRenderResult } from "./dist-DRsnVw6A.js";
-import { C as renderRenderResult, D as toVercelToolInvocation, E as toOpenUiLang, S as renderMiniMarkdown, T as toA2uiMessages, _ as fromOpenUiAction, a as CHART_PALETTE, b as renderBlocks, c as OPENUI_SUBMIT_ACTION, d as WEBSKILL_STYLES_CSS, f as WebFormBridge, g as fromA2uiAction, h as ensureStyles, i as A2UI_VERSION, l as VERCEL_INTERACTION_TOOL_NAME, m as collectValues, n as A2UI_CANCEL_ACTION, o as LitRendererBridge, p as chartToTable, r as A2UI_SUBMIT_ACTION, s as OPENUI_CANCEL_ACTION, t as A2UI_BASIC_CATALOG_ID, u as VercelUiBridge, v as fromVercelToolResult, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-DxGyAznR.js";
+import { C as buildRenderResult } from "./dist-DAn07zHu.js";
+import { C as renderRenderResult, D as toVercelToolInvocation, E as toOpenUiLang, S as renderMiniMarkdown, T as toA2uiMessages, _ as fromOpenUiAction, a as CHART_PALETTE, b as renderBlocks, c as OPENUI_SUBMIT_ACTION, d as WEBSKILL_STYLES_CSS, f as WebFormBridge, g as fromA2uiAction, h as ensureStyles, i as A2UI_VERSION, l as VERCEL_INTERACTION_TOOL_NAME, m as collectValues, n as A2UI_CANCEL_ACTION, o as LitRendererBridge, p as chartToTable, r as A2UI_SUBMIT_ACTION, s as OPENUI_CANCEL_ACTION, t as A2UI_BASIC_CATALOG_ID, u as VercelUiBridge, v as fromVercelToolResult, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-MTc2KB03.js";
 
 export { A2UI_BASIC_CATALOG_ID, A2UI_CANCEL_ACTION, A2UI_SUBMIT_ACTION, A2UI_VERSION, CHART_PALETTE, LitRendererBridge, OPENUI_CANCEL_ACTION, OPENUI_SUBMIT_ACTION, VERCEL_INTERACTION_TOOL_NAME, VercelUiBridge, WEBSKILL_STYLES_CSS, WebFormBridge, buildRenderResult, chartToTable, collectValues, ensureStyles, fromA2uiAction, fromOpenUiAction, fromVercelToolResult, interactionToFormModel, renderBlocks, renderMiniChart, renderMiniMarkdown, renderRenderResult, shapeInteractionValue, toA2uiMessages, toOpenUiLang, toVercelToolInvocation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webskill/sdk",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "WebSkill — browser/Node agent skill runtime (skills, tools, MCP, governance, UI)",
   "license": "MIT",
   "type": "module",