@webskill/sdk 0.1.3 → 0.1.4

package/dist/{dist-DxGyAznR.js → dist-MTc2KB03.js}

@@ -1,4 +1,4 @@
-import { l as WebSkillError } from "./dist-DS1sfgHa.js";
+import { l as WebSkillError } from "./dist-DvoBsChX.js";
 
 //#region ../ui/dist/index.js
 /** 提交值按请求类型归形（WebFormBridge 与框架组件库共享单一来源） */
@@ -1040,8 +1040,7 @@ var LitRendererBridge = class {
 						values: formValues
 					}
 				});
-				if (input.type === "authorize" && !response.cancelled) response.value = true;
-				resolve(response);
+				resolve(this.#decodeValue(input, response));
 			}, { version: "v0.9.1" });
 			processor.onSurfaceCreated((surface) => {
 				const el = this.#doc.createElement("a2ui-surface");
@@ -1052,6 +1051,50 @@ var LitRendererBridge = class {
 			processor.processMessages(messages);
 		});
 	}
+	/**
+	* 按 InteractionRequest.type 解码提交值（绑定模型原样回传的是表单对象）：
+	* confirm 仅 confirmed===true 批准；select 还原原始 option 值（非字符串值经 JSON 编码比对）；
+	* form 的 number 字段转 number；ask 取 answer；authorize 提交即批准。
+	*/
+	#decodeValue(input, response) {
+		if (response.cancelled) return response;
+		const values = response.value;
+		switch (input.type) {
+			case "confirm": return {
+				...response,
+				value: values?.confirmed === true
+			};
+			case "ask": return {
+				...response,
+				value: values?.answer
+			};
+			case "select": {
+				const raw = values?.selected;
+				const option = input.options.find((o) => o.value === raw || JSON.stringify(o.value) === raw);
+				return {
+					...response,
+					value: option ? option.value : raw
+				};
+			}
+			case "form": {
+				if (typeof values !== "object" || values === null) return response;
+				const out = { ...values };
+				for (const field of input.fields) if (field.type === "number" && out[field.name] !== void 0) {
+					const n = Number(out[field.name]);
+					if (!Number.isNaN(n)) out[field.name] = n;
+				}
+				return {
+					...response,
+					value: out
+				};
+			}
+			case "authorize": return {
+				...response,
+				value: true
+			};
+			default: return response;
+		}
+	}
 };
 
 //#endregion

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
-import { L as SkillManifest, N as SkillDocument, S as FileSystemProvider, c as LlmClient, j as SkillCatalogEntry, u as LlmMessage, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
-import { ct as WebSkillRuntime, q as RuntimeRun } from "./index-CqMuvcb2.js";
-import { f as SkillManager } from "./index-CPuwsnmB.js";
+import { L as SkillManifest, N as SkillDocument, S as FileSystemProvider, c as LlmClient, j as SkillCatalogEntry, u as LlmMessage, v as UiBridge } from "./types-CgNC-oQu-DYrxhD3z.js";
+import { ct as WebSkillRuntime, q as RuntimeRun } from "./index-BSS3EWY-.js";
+import { f as SkillManager } from "./index-npFMt2Zw.js";
 //#region ../governance/dist/index.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';
@@ -311,11 +311,14 @@ interface EvaluationReport {
 }
 //#endregion
 //#region src/evaluation/evaluationRunner.d.ts
-/** 批量评估：顺序执行（单任务异常不中断批）；expected 参与判定；结构化报告 */
+/** 批量评估：顺序执行（单任务异常不中断批）；expected 参与判定；结构化报告。
+ *  注意：评估会真实执行技能脚本（试用路径）——必须显式 opt-in（allowExecution: true），
+ *  且沙箱执行器是能力面收敛而非安全边界，禁止对不可信候选技能直接跑评估。 */
 declare class EvaluationRunner {
   #private;
   constructor(deps: {
     runtime: WebSkillRuntime;
+    allowExecution?: boolean;
     now?: () => string;
     createId?: () => string;
   });

package/dist/governance.js

@@ -1,5 +1,5 @@
-import { T as validateSkills, _ as isValidSkillName, l as WebSkillError, w as resolveInsideRoot } from "./dist-DS1sfgHa.js";
-import { i as NodeFS } from "./dist-Cm_j6Jol.js";
+import { E as validateSkills, T as resolveInsideRoot, l as WebSkillError, u as assertSafePathSegment, v as isValidSkillName } from "./dist-DvoBsChX.js";
+import { i as NodeFS } from "./dist-BVXZF7H_.js";
 import path from "node:path";
 import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -115,9 +115,11 @@ var CandidateStore = class {
 	}
 	async save(candidate) {
 		validateCandidate(candidate);
+		assertSafePathSegment(candidate.id, "candidate id");
 		await this.#fs.writeText(`${dirOf$1(this.#root)}/${candidate.id}.json`, JSON.stringify(candidate, null, 2));
 	}
 	async get(id) {
+		assertSafePathSegment(id, "candidate id");
 		const path = `${dirOf$1(this.#root)}/${id}.json`;
 		if (!await this.#fs.exists(path)) throw new WebSkillError("GOVERNANCE_FAILED", `Candidate not found: ${id}`);
 		return JSON.parse(await this.#fs.readText(path));
@@ -370,7 +372,10 @@ var FsAuditLog = class {
 		return events;
 	}
 };
-const dirOf = (root, skillName) => `${root}/.webskill/versions/${skillName}`;
+const dirOf = (root, skillName) => {
+	assertSafePathSegment(skillName, "skill name");
+	return `${root}/.webskill/versions/${skillName}`;
+};
 /** 版本存储：manifest 快照 + parentVersionId 链；回滚 = 追加新版本（谱系不断） */
 var SkillVersionStore = class {
 	#root;
@@ -394,6 +399,7 @@ var SkillVersionStore = class {
 			reason: input.reason,
 			manifest: input.manifest
 		};
+		assertSafePathSegment(version.versionId, "version id");
 		await this.#fs.writeText(`${dirOf(this.#root, skillName)}/${version.versionId}.json`, JSON.stringify(version, null, 2));
 		return version;
 	}
@@ -408,6 +414,7 @@ var SkillVersionStore = class {
 		return out.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
 	}
 	async get(skillName, versionId) {
+		assertSafePathSegment(versionId, "version id");
 		const path = `${dirOf(this.#root, skillName)}/${versionId}.json`;
 		if (!await this.#fs.exists(path)) throw new WebSkillError("GOVERNANCE_FAILED", `Version "${versionId}" of skill "${skillName}" not found`);
 		return JSON.parse(await this.#fs.readText(path));
@@ -535,12 +542,14 @@ var SkillStatePolicy = class {
 		await this.#fs.writeText(fileOf(this.#root), JSON.stringify(data, null, 2));
 	}
 	async getState(skillName) {
+		assertSafePathSegment(skillName, "skill name");
 		return (await this.#load()).states[skillName] ?? "active";
 	}
 	async listStates() {
 		return { ...(await this.#load()).states };
 	}
 	async setState(skillName, state, input) {
+		assertSafePathSegment(skillName, "skill name");
 		const data = await this.#load();
 		data.states[skillName] = state;
 		if (state === "active") delete data.failures[skillName];
@@ -554,6 +563,7 @@ var SkillStatePolicy = class {
 	}
 	/** 失败计数；达阈值（默认 3）→ quarantined + 审计 */
 	async recordFailure(skillName, input = {}) {
+		assertSafePathSegment(skillName, "skill name");
 		const data = await this.#load();
 		const count = (data.failures[skillName] ?? 0) + 1;
 		data.failures[skillName] = count;
@@ -621,17 +631,22 @@ function matchExpected(expected, output, run) {
 	if (typeof expected === "string") return output.includes(expected);
 	return expected(output, run);
 }
-/** 批量评估：顺序执行（单任务异常不中断批）；expected 参与判定；结构化报告 */
+/** 批量评估：顺序执行（单任务异常不中断批）；expected 参与判定；结构化报告。
+*  注意：评估会真实执行技能脚本（试用路径）——必须显式 opt-in（allowExecution: true），
+*  且沙箱执行器是能力面收敛而非安全边界，禁止对不可信候选技能直接跑评估。 */
 var EvaluationRunner = class {
 	#runtime;
+	#allowExecution;
 	#now;
 	#createId;
 	constructor(deps) {
 		this.#runtime = deps.runtime;
+		this.#allowExecution = deps.allowExecution ?? false;
 		this.#now = deps.now;
 		this.#createId = deps.createId;
 	}
 	async run(tasks) {
+		if (!this.#allowExecution) throw new WebSkillError("GOVERNANCE_FAILED", "EvaluationRunner executes skill scripts; pass allowExecution: true to opt in (sandbox executors are capability-reducing, not a security boundary)");
 		const results = [];
 		for (const task of tasks) try {
 			const { output, run } = await this.#runtime.run(task.prompt);

package/dist/{index-CqMuvcb2.d.ts → index-BSS3EWY-.d.ts}

@@ -1,4 +1,4 @@
-import { A as SkillCatalog, C as JsonSchema, L as SkillManifest, M as SkillDiscovery, N as SkillDocument, P as SkillInstallSource, S as FileSystemProvider, U as ValidationReport, _ as RenderResultRequest, a as InteractionPolicy, b as DiscoveryResult, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, j as SkillCatalogEntry, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { A as SkillCatalog, C as JsonSchema, L as SkillManifest, M as SkillDiscovery, N as SkillDocument, P as SkillInstallSource, S as FileSystemProvider, U as ValidationReport, _ as RenderResultRequest, a as InteractionPolicy, b as DiscoveryResult, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, j as SkillCatalogEntry, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge } from "./types-CgNC-oQu-DYrxhD3z.js";
 //#region ../runtime/dist/index.d.ts
 //#region src/llm/openAiCompatibleClient.d.ts
 interface OpenAiCompatibleClientConfig {

package/dist/{index-CPuwsnmB.d.ts → index-npFMt2Zw.d.ts}

@@ -1,12 +1,19 @@
-import { C as JsonSchema, H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, S as FileSystemProvider, W as VerifyResult, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, x as FileStat } from "./types-CgNC-oQu-Dq_A1yA-.js";
-import { $ as ToolDefinition, N as NetworkPolicy, X as ScriptExecutionContext, Y as SchemaInferer, Z as ScriptExecutor, b as FsArtifactStore, d as BridgeCapabilities, tt as ToolResult, u as ApprovalScope, x as FsMemoryStore } from "./index-CqMuvcb2.js";
+import { C as JsonSchema, H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, S as FileSystemProvider, W as VerifyResult, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, x as FileStat } from "./types-CgNC-oQu-DYrxhD3z.js";
+import { $ as ToolDefinition, N as NetworkPolicy, X as ScriptExecutionContext, Y as SchemaInferer, Z as ScriptExecutor, b as FsArtifactStore, d as BridgeCapabilities, tt as ToolResult, u as ApprovalScope, x as FsMemoryStore } from "./index-BSS3EWY-.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts
 //#region src/fs/nodeFs.d.ts
-/** 基于 node:fs/promises 的 FileSystemProvider；接受 `/` 风格路径，写入自动创建父目录 */
+/**
+ * 基于 node:fs/promises 的 FileSystemProvider；接受 `/` 风格路径，写入自动创建父目录。
+ * 可选 root 模式：构造传入 root 后，read/write 操作先做 realpath 包含校验
+ * （root 与目标都 realpath 后前缀比对），经符号链接逃逸 root → FS_PATH_OUTSIDE_ROOT。
+ */
 declare class NodeFS implements FileSystemProvider {
   #private;
   readonly kind = "node";
+  constructor(deps?: {
+    root?: string;
+  });
   readText(p: string): Promise<string>;
   writeText(p: string, content: string): Promise<void>;
   readBinary(p: string): Promise<Uint8Array>;
@@ -50,6 +57,8 @@ interface SandboxOptions {
   capabilities?: BridgeCapabilities;
   /** 网络策略：默认 'deny-all'（白名单见 runtime/sandbox/networkPolicy） */
   networkPolicy?: NetworkPolicy;
+  /** 裸模块 allowlist（默认 []：一切 node: 内置模块全禁；按需放行如 ['node:path']） */
+  allowedModules?: string[];
   /** require-approval 模式的授权询问出口（缺失时 require-approval 一律拒绝） */
   uiBridge?: UiBridge;
   /** 授权粒度：默认 'once-per-run' */
@@ -60,6 +69,10 @@ interface SandboxOptions {
  * 每次执行独立 Worker（resourceLimits + env 白名单），loadDefinition 同样在
  * Worker 内完成（禁止主进程 import 不可信脚本）；超时 terminate（可杀同步死循环）。
  * 能力桥协议与浏览器同一来源（runtime/sandbox/bridgeProtocol）。
+ *
+ * 诚实标注：本执行器做的是**能力面收敛**（网络策略、模块 allowlist、资源限额、
+ * 超时强杀），**不是安全边界**——Worker 内脚本与宿主共享进程，仍有绕过手段；
+ * 禁止假定其可隔离不可信脚本。
  */
 declare class SandboxedScriptExecutor implements ScriptExecutor {
   #private;

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { $ as exportSkills, A as SkillCatalog, B as SkillReader, C as JsonSchema, D as SKILL_NAME_MAX_LENGTH, E as SKILL_MANIFEST_FILE, F as SkillIssue, G as WebSkillError, H as SkillsLockfile, I as SkillLocation, J as buildManifest, K as WebSkillErrorCode, L as SkillManifest, M as SkillDiscovery, N as SkillDocument, O as SKILL_NAME_PATTERN, P as SkillInstallSource, Q as escapeXml, R as SkillMetadata, S as FileSystemProvider, T as SKILLS_LOCKFILE, U as ValidationReport, V as SkillSource, W as VerifyResult, X as checkSkillRules, Y as checkDependencyCycles, Z as computeDigest, _ as RenderResultRequest, a as InteractionPolicy, at as renderAvailableSkillsXml, b as DiscoveryResult, c as LlmClient, ct as validateSkills, d as LlmResponse, et as isValidSkillName, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, it as parseSkillPackManifest, j as SkillCatalogEntry, k as SKILL_PACK_FILE, l as LlmCompleteInput, lt as verifyManifest, m as LlmToolSpec, n as ArtifactStore, nt as normalizePath, o as InteractionRequest, ot as renderCatalogJson, p as LlmToolCall, q as buildCatalog, r as ChartSpec, rt as parseSkillMarkdown, s as InteractionResponse, st as resolveInsideRoot, t as Artifact, tt as jsonRenderer, u as LlmMessage, ut as xmlRenderer, v as UiBridge, w as MemoryFS, x as FileStat, y as CatalogRenderer, z as SkillPackManifest } from "./types-CgNC-oQu-Dq_A1yA-.js";
-import { $ as ToolDefinition, A as LifecycleHook, B as RUN_SNAPSHOT_SCHEMA_VERSION, C as FullDisclosureRouter, Ct as schemaToForm, D as HookRunnerOptions, E as HookRunner, F as OpenAiCompatibleClientConfig, G as RunTerminationReason, H as RunResult, I as ProgressiveRouter, J as RuntimeSession, K as RuntimePhase, L as READ_SKILL_FILE_INPUT_SCHEMA, M as LifecycleListener, N as NetworkPolicy, O as InstalledSkillManifest, P as OpenAiCompatibleClient, Q as SkillRouter, R as READ_SKILL_FILE_TOOL, S as FsRunSnapshotStore, St as resolveToolName, T as GoogleGenAiClientConfig, Tt as toVercelToolSpecs, U as RunSnapshot, V as RouteResult, W as RunSnapshotStore, X as ScriptExecutionContext, Y as SchemaInferer, Z as ScriptExecutor, _ as EventBus, _t as isNetworkAllowed, a as AgentLoopConfig, at as TraceRecorder, b as FsArtifactStore, bt as normalizeToolContent, c as AnthropicClientConfig, ct as WebSkillRuntime, d as BridgeCapabilities, dt as buildRenderResult, et as ToolResolution, f as BridgeCapability, ft as createScriptContext, g as CapabilityMode, gt as fromVercelStreamPart, h as CapabilityApproval, ht as fromVercelResult, i as AgentLoop, it as TraceEventType, j as LifecycleHookContext, k as LifecycleEvent, l as ApprovalDecision, lt as WebSkillRuntimeDeps, m as BridgeResponse, mt as extractChartSpec, n as ASK_USER_TOOL, nt as TraceClock, o as AgentLoopDeps, ot as VercelToolSpec, p as BridgeRequest, pt as createWebSkillApi, q as RuntimeRun, r as ASK_USER_TOOL_NAME, rt as TraceEvent, s as AnthropicClient, st as WebSkillApi, t as ASK_USER_INPUT_SCHEMA, tt as ToolResult, u as ApprovalScope, ut as bridgeError, v as ExternalSkillProvider, vt as mergeCatalogEntries, w as GoogleGenAiClient, wt as toLlmToolSpec, x as FsMemoryStore, xt as parseBridgeRequest, y as ExternalToolSource, yt as networkUrlHost, z as READ_SKILL_FILE_TOOL_NAME } from "./index-CqMuvcb2.js";
-export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, type SkillPackManifest, SkillReader, type SkillRouter, type SkillSource, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, renderAvailableSkillsXml, renderCatalogJson, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, validateSkills, verifyManifest, xmlRenderer };
+import { $ as escapeXml, A as SkillCatalog, B as SkillReader, C as JsonSchema, D as SKILL_NAME_MAX_LENGTH, E as SKILL_MANIFEST_FILE, F as SkillIssue, G as WebSkillError, H as SkillsLockfile, I as SkillLocation, J as buildCatalog, K as WebSkillErrorCode, L as SkillManifest, M as SkillDiscovery, N as SkillDocument, O as SKILL_NAME_PATTERN, P as SkillInstallSource, Q as computeDigest, R as SkillMetadata, S as FileSystemProvider, T as SKILLS_LOCKFILE, U as ValidationReport, V as SkillSource, W as VerifyResult, X as checkDependencyCycles, Y as buildManifest, Z as checkSkillRules, _ as RenderResultRequest, a as InteractionPolicy, at as parseSkillPackManifest, b as DiscoveryResult, c as LlmClient, ct as resolveInsideRoot, d as LlmResponse, dt as xmlRenderer, et as exportSkills, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, it as parseSkillMarkdown, j as SkillCatalogEntry, k as SKILL_PACK_FILE, l as LlmCompleteInput, lt as validateSkills, m as LlmToolSpec, n as ArtifactStore, nt as jsonRenderer, o as InteractionRequest, ot as renderAvailableSkillsXml, p as LlmToolCall, q as assertSafePathSegment, r as ChartSpec, rt as normalizePath, s as InteractionResponse, st as renderCatalogJson, t as Artifact, tt as isValidSkillName, u as LlmMessage, ut as verifyManifest, v as UiBridge, w as MemoryFS, x as FileStat, y as CatalogRenderer, z as SkillPackManifest } from "./types-CgNC-oQu-DYrxhD3z.js";
+import { $ as ToolDefinition, A as LifecycleHook, B as RUN_SNAPSHOT_SCHEMA_VERSION, C as FullDisclosureRouter, Ct as schemaToForm, D as HookRunnerOptions, E as HookRunner, F as OpenAiCompatibleClientConfig, G as RunTerminationReason, H as RunResult, I as ProgressiveRouter, J as RuntimeSession, K as RuntimePhase, L as READ_SKILL_FILE_INPUT_SCHEMA, M as LifecycleListener, N as NetworkPolicy, O as InstalledSkillManifest, P as OpenAiCompatibleClient, Q as SkillRouter, R as READ_SKILL_FILE_TOOL, S as FsRunSnapshotStore, St as resolveToolName, T as GoogleGenAiClientConfig, Tt as toVercelToolSpecs, U as RunSnapshot, V as RouteResult, W as RunSnapshotStore, X as ScriptExecutionContext, Y as SchemaInferer, Z as ScriptExecutor, _ as EventBus, _t as isNetworkAllowed, a as AgentLoopConfig, at as TraceRecorder, b as FsArtifactStore, bt as normalizeToolContent, c as AnthropicClientConfig, ct as WebSkillRuntime, d as BridgeCapabilities, dt as buildRenderResult, et as ToolResolution, f as BridgeCapability, ft as createScriptContext, g as CapabilityMode, gt as fromVercelStreamPart, h as CapabilityApproval, ht as fromVercelResult, i as AgentLoop, it as TraceEventType, j as LifecycleHookContext, k as LifecycleEvent, l as ApprovalDecision, lt as WebSkillRuntimeDeps, m as BridgeResponse, mt as extractChartSpec, n as ASK_USER_TOOL, nt as TraceClock, o as AgentLoopDeps, ot as VercelToolSpec, p as BridgeRequest, pt as createWebSkillApi, q as RuntimeRun, r as ASK_USER_TOOL_NAME, rt as TraceEvent, s as AnthropicClient, st as WebSkillApi, t as ASK_USER_INPUT_SCHEMA, tt as ToolResult, u as ApprovalScope, ut as bridgeError, v as ExternalSkillProvider, vt as mergeCatalogEntries, w as GoogleGenAiClient, wt as toLlmToolSpec, x as FsMemoryStore, xt as parseBridgeRequest, y as ExternalToolSource, yt as networkUrlHost, z as READ_SKILL_FILE_TOOL_NAME } from "./index-BSS3EWY-.js";
+export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, type SkillPackManifest, SkillReader, type SkillRouter, type SkillSource, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, assertSafePathSegment, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, renderAvailableSkillsXml, renderCatalogJson, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, validateSkills, verifyManifest, xmlRenderer };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { C as renderCatalogJson, D as xmlRenderer, E as verifyManifest, S as renderAvailableSkillsXml, T as validateSkills, _ as isValidSkillName, a as SKILL_NAME_PATTERN, b as parseSkillMarkdown, c as SkillReader, d as buildManifest, f as checkDependencyCycles, g as exportSkills, h as escapeXml, i as SKILL_NAME_MAX_LENGTH, l as WebSkillError, m as computeDigest, n as SKILLS_LOCKFILE, o as SKILL_PACK_FILE, p as checkSkillRules, r as SKILL_MANIFEST_FILE, s as SkillDiscovery, t as MemoryFS, u as buildCatalog, v as jsonRenderer, w as resolveInsideRoot, x as parseSkillPackManifest, y as normalizePath } from "./dist-DS1sfgHa.js";
-import { A as mergeCatalogEntries, C as buildRenderResult, D as fromVercelResult, E as extractChartSpec, F as schemaToForm, I as toLlmToolSpec, L as toVercelToolSpecs, M as normalizeToolContent, N as parseBridgeRequest, O as fromVercelStreamPart, P as resolveToolName, S as bridgeError, T as createWebSkillApi, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as TraceRecorder, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as networkUrlHost, k as isNetworkAllowed, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as createScriptContext, x as WebSkillRuntime, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-DZobLFh6.js";
+import { C as renderAvailableSkillsXml, D as verifyManifest, E as validateSkills, O as xmlRenderer, S as parseSkillPackManifest, T as resolveInsideRoot, _ as exportSkills, a as SKILL_NAME_PATTERN, b as normalizePath, c as SkillReader, d as buildCatalog, f as buildManifest, g as escapeXml, h as computeDigest, i as SKILL_NAME_MAX_LENGTH, l as WebSkillError, m as checkSkillRules, n as SKILLS_LOCKFILE, o as SKILL_PACK_FILE, p as checkDependencyCycles, r as SKILL_MANIFEST_FILE, s as SkillDiscovery, t as MemoryFS, u as assertSafePathSegment, v as isValidSkillName, w as renderCatalogJson, x as parseSkillMarkdown, y as jsonRenderer } from "./dist-DvoBsChX.js";
+import { A as mergeCatalogEntries, C as buildRenderResult, D as fromVercelResult, E as extractChartSpec, F as schemaToForm, I as toLlmToolSpec, L as toVercelToolSpecs, M as normalizeToolContent, N as parseBridgeRequest, O as fromVercelStreamPart, P as resolveToolName, S as bridgeError, T as createWebSkillApi, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as TraceRecorder, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as networkUrlHost, k as isNetworkAllowed, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as createScriptContext, x as WebSkillRuntime, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-DAn07zHu.js";
 
-export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, AnthropicClient, CapabilityApproval, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, renderAvailableSkillsXml, renderCatalogJson, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, validateSkills, verifyManifest, xmlRenderer };
+export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, AnthropicClient, CapabilityApproval, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, assertSafePathSegment, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, renderAvailableSkillsXml, renderCatalogJson, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, validateSkills, verifyManifest, xmlRenderer };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
-import { C as JsonSchema, N as SkillDocument, j as SkillCatalogEntry, m as LlmToolSpec } from "./types-CgNC-oQu-Dq_A1yA-.js";
-import { tt as ToolResult, v as ExternalSkillProvider, vt as mergeCatalogEntries, y as ExternalToolSource } from "./index-CqMuvcb2.js";
+import { C as JsonSchema, N as SkillDocument, j as SkillCatalogEntry, m as LlmToolSpec } from "./types-CgNC-oQu-DYrxhD3z.js";
+import { tt as ToolResult, v as ExternalSkillProvider, vt as mergeCatalogEntries, y as ExternalToolSource } from "./index-BSS3EWY-.js";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/dist/mcp.js

@@ -1,5 +1,5 @@
-import { l as WebSkillError } from "./dist-DS1sfgHa.js";
-import { A as mergeCatalogEntries, M as normalizeToolContent } from "./dist-DZobLFh6.js";
+import { l as WebSkillError } from "./dist-DvoBsChX.js";
+import { A as mergeCatalogEntries, M as normalizeToolContent } from "./dist-DAn07zHu.js";
 import { fromJSONSchema } from "zod";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";

package/dist/node.d.ts

@@ -1,4 +1,4 @@
-import { E as SKILL_MANIFEST_FILE, H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, T as SKILLS_LOCKFILE, W as VerifyResult } from "./types-CgNC-oQu-Dq_A1yA-.js";
-import { ft as createScriptContext } from "./index-CqMuvcb2.js";
-import { _ as readArchiveManifest, a as LlmEnvConfig, c as OxcSchemaInferer, d as SandboxedScriptExecutor, f as SkillManager, g as probeLlmCapabilities, h as loadLlmConfigFromEnv, i as LlmCapabilities, l as ProviderEnvConfig, m as loadGoogleConfigFromEnv, n as FileArtifactStore, o as NodeFS, p as loadAnthropicConfigFromEnv, r as FileMemoryStore, s as NodeScriptExecutor, t as CliUiBridge, u as SandboxOptions } from "./index-CPuwsnmB.js";
+import { E as SKILL_MANIFEST_FILE, H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, T as SKILLS_LOCKFILE, W as VerifyResult } from "./types-CgNC-oQu-DYrxhD3z.js";
+import { ft as createScriptContext } from "./index-BSS3EWY-.js";
+import { _ as readArchiveManifest, a as LlmEnvConfig, c as OxcSchemaInferer, d as SandboxedScriptExecutor, f as SkillManager, g as probeLlmCapabilities, h as loadLlmConfigFromEnv, i as LlmCapabilities, l as ProviderEnvConfig, m as loadGoogleConfigFromEnv, n as FileArtifactStore, o as NodeFS, p as loadAnthropicConfigFromEnv, r as FileMemoryStore, s as NodeScriptExecutor, t as CliUiBridge, u as SandboxOptions } from "./index-npFMt2Zw.js";
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, type LlmCapabilities, type LlmEnvConfig, NodeFS, NodeScriptExecutor, OxcSchemaInferer, type ProviderEnvConfig, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, type SandboxOptions, SandboxedScriptExecutor, type SkillInstallSource, SkillManager, type SkillManifest, type SkillsLockfile, type VerifyResult, createScriptContext, loadAnthropicConfigFromEnv, loadGoogleConfigFromEnv, loadLlmConfigFromEnv, probeLlmCapabilities, readArchiveManifest };

package/dist/node.js

@@ -1,5 +1,5 @@
-import { n as SKILLS_LOCKFILE, r as SKILL_MANIFEST_FILE } from "./dist-DS1sfgHa.js";
-import { w as createScriptContext } from "./dist-DZobLFh6.js";
-import { a as NodeScriptExecutor, c as SkillManager, d as loadLlmConfigFromEnv, f as probeLlmCapabilities, i as NodeFS, l as loadAnthropicConfigFromEnv, n as FileArtifactStore, o as OxcSchemaInferer, p as readArchiveManifest, r as FileMemoryStore, s as SandboxedScriptExecutor, t as CliUiBridge, u as loadGoogleConfigFromEnv } from "./dist-Cm_j6Jol.js";
+import { n as SKILLS_LOCKFILE, r as SKILL_MANIFEST_FILE } from "./dist-DvoBsChX.js";
+import { w as createScriptContext } from "./dist-DAn07zHu.js";
+import { a as NodeScriptExecutor, c as SkillManager, d as loadLlmConfigFromEnv, f as probeLlmCapabilities, i as NodeFS, l as loadAnthropicConfigFromEnv, n as FileArtifactStore, o as OxcSchemaInferer, p as readArchiveManifest, r as FileMemoryStore, s as SandboxedScriptExecutor, t as CliUiBridge, u as loadGoogleConfigFromEnv } from "./dist-BVXZF7H_.js";
 
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, NodeFS, NodeScriptExecutor, OxcSchemaInferer, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SandboxedScriptExecutor, SkillManager, createScriptContext, loadAnthropicConfigFromEnv, loadGoogleConfigFromEnv, loadLlmConfigFromEnv, probeLlmCapabilities, readArchiveManifest };

package/dist/sandboxWorkerEntry.d.ts

@@ -0,0 +1 @@
+export {}

package/dist/sandboxWorkerEntry.js

@@ -0,0 +1,214 @@
+import { register } from "node:module";
+import { pathToFileURL } from "node:url";
+import { isMainThread, parentPort, workerData } from "node:worker_threads";
+
+//#region ../node/dist/executor/sandboxWorkerEntry.js
+/**
+* D1 沙箱 Worker 入口（loader 文件形式，非内嵌字符串）。
+* 主线程经 workerData 传入任务；脚本源码路径直接 import（.ts 依赖
+* Node>=22.18 原生 type stripping，Worker 内同样生效）。
+* 能力桥 RPC（readReference/writeArtifact/confirm）经 parentPort 消息。
+*
+* 网络与模块管控：
+* - patch globalThis.fetch / globalThis.WebSocket（策略判定函数源码经 workerData
+*   注入，匹配逻辑单一来源在 runtime/sandbox/networkPolicy.ts——Worker 线程不走
+*   vitest 别名、也不应反向依赖宿主打包产物，故注入而非 import）。
+* - node: 内置模块 allowlist（module.register resolve 钩子）：默认全禁
+*   （含 fs/child_process/net 等），执行器配置可显式放行指定模块。
+*   能力面收敛，非安全边界（仍有绕过手段，禁止假定其可隔离不可信脚本）。
+* - 网络阻断时 postMessage {type:'network-blocked', host} → 宿主记 run.warning（URL 脱敏只记 host）。
+*/
+const port = parentPort;
+if (!port || isMainThread) throw new Error("sandboxWorkerEntry must run inside a worker thread");
+const pending = /* @__PURE__ */ new Map();
+let bridgeSeq = 0;
+function callCapability(kind, payload) {
+	const request = {
+		kind,
+		id: `br-${++bridgeSeq}`,
+		...payload
+	};
+	return new Promise((resolve, reject) => {
+		pending.set(request.id, {
+			resolve,
+			reject
+		});
+		port.postMessage({
+			type: "bridge",
+			request
+		});
+	}).then((response) => {
+		const r = response;
+		if (!r.ok) {
+			const err = new Error(r.error?.message ?? "capability call failed");
+			err.code = r.error?.code ?? "TOOL_EXECUTION_FAILED";
+			throw err;
+		}
+		return r.value;
+	});
+}
+async function loadModule(scriptPath) {
+	return await import(`${pathToFileURL(scriptPath).href}?t=${Date.now()}`);
+}
+function post(message) {
+	port.postMessage(message);
+}
+/**
+* 裸模块 allowlist 钩子（data: URL 注册）：
+* 默认禁止一切 node: 内置模块（含 fs/child_process/process/vm/module/worker_threads 等），
+* 仅 ALLOWED 清单（执行器配置注入）显式放行。网络裸模块语义合并统一：
+* allowlist 为空即全禁（含 node:net/http/https/dgram/tls）。
+*/
+const MODULE_HOOK_SOURCE = `
+var ALLOWED = new Set(%ALLOWED_MODULES%);
+var TOP_BUILTINS = new Set(['assert','async_hooks','buffer','child_process','cluster','console','constants','crypto','dgram','diagnostics_channel','dns','domain','events','fs','http','http2','https','inspector','module','net','os','path','perf_hooks','process','punycode','querystring','readline','repl','sea','sqlite','stream','string_decoder','sys','test','timers','tls','trace_events','tty','url','util','v8','vm','wasi','worker_threads','zlib']);
+function isAllowed(bare, name, top) {
+  return ALLOWED.has(bare) || ALLOWED.has(name) || ALLOWED.has('node:' + name) || ALLOWED.has(top) || ALLOWED.has('node:' + top);
+}
+export async function resolve(specifier, context, nextResolve) {
+  var bare = specifier.split('?')[0];
+  var name = bare.indexOf('node:') === 0 ? bare.slice(5) : bare;
+  var top = name.split('/')[0];
+  var isBuiltin = bare.indexOf('node:') === 0 || TOP_BUILTINS.has(top);
+  if (isBuiltin && !isAllowed(bare, name, top)) {
+    var err = new Error('Builtin module import blocked by sandbox module policy: ' + bare);
+    err.code = 'TOOL_UNSUPPORTED';
+    throw err;
+  }
+  return nextResolve(specifier, context);
+}
+`;
+function blockedError(host) {
+	const err = /* @__PURE__ */ new Error(`Network request blocked by sandbox network policy: ${host}`);
+	err.code = "NETWORK_BLOCKED";
+	return err;
+}
+/** patch 全局 fetch / WebSocket；注册裸网络模块 denylist（allow-all 之外均启用） */
+function setupNetworkGuards(task) {
+	const policy = task.networkPolicy ?? "deny-all";
+	if (!task.networkPolicyLib) return;
+	const { isNetworkAllowed, networkUrlHost } = new Function(`${task.networkPolicyLib}\nreturn { isNetworkAllowed: isNetworkAllowed, networkUrlHost: networkUrlHost };`)();
+	const gate = (rawUrl) => {
+		const url = String(rawUrl);
+		if (isNetworkAllowed(policy, url)) return null;
+		const host = networkUrlHost(url);
+		post({
+			type: "network-blocked",
+			host
+		});
+		return blockedError(host);
+	};
+	const originalFetch = globalThis["fetch"];
+	if (typeof originalFetch === "function") globalThis["fetch"] = (input, init) => {
+		const raw = typeof input === "string" ? input : input instanceof URL ? input.href : input?.url ?? String(input);
+		const blocked = gate(raw);
+		if (blocked) return Promise.reject(blocked);
+		return originalFetch(input, init);
+	};
+	const OriginalWebSocket = globalThis["WebSocket"];
+	if (typeof OriginalWebSocket === "function") globalThis["WebSocket"] = class extends OriginalWebSocket {
+		constructor(url, protocols) {
+			const blocked = gate(String(url));
+			if (blocked) throw blocked;
+			super(url, protocols);
+		}
+	};
+	register(`data:text/javascript,${encodeURIComponent(MODULE_HOOK_SOURCE.replace("%ALLOWED_MODULES%", JSON.stringify(task.allowedModules ?? [])))}`);
+}
+async function main() {
+	const task = workerData;
+	setupNetworkGuards(task);
+	port.on("message", (msg) => {
+		if (msg?.type === "bridge-response" && msg.response?.id) {
+			const entry = pending.get(msg.response.id);
+			if (entry) {
+				pending.delete(msg.response.id);
+				entry.resolve(msg.response);
+			}
+		}
+	});
+	if (task.mode === "load") {
+		try {
+			const mod = await loadModule(task.scriptPath);
+			post({
+				type: "load-result",
+				ok: true,
+				definition: {
+					description: typeof mod["description"] === "string" ? mod["description"] : void 0,
+					inputSchema: mod["inputSchema"] !== void 0 ? mod["inputSchema"] : void 0,
+					hasRun: typeof mod["run"] === "function"
+				}
+			});
+		} catch (e) {
+			post({
+				type: "load-result",
+				ok: false,
+				error: {
+					code: e?.code ?? "TOOL_EXECUTION_FAILED",
+					message: String(e?.message ?? e)
+				}
+			});
+		}
+		return;
+	}
+	const stdout = [];
+	const stderr = [];
+	const originals = {
+		log: console.log,
+		info: console.info,
+		debug: console.debug,
+		warn: console.warn,
+		error: console.error
+	};
+	console.log = console.info = console.debug = (...args) => stdout.push(args.map(String).join(" "));
+	console.warn = console.error = (...args) => stderr.push(args.map(String).join(" "));
+	try {
+		const mod = await loadModule(task.scriptPath);
+		if (typeof mod["run"] !== "function") throw new Error("Script does not export a run function");
+		const context = {
+			skillName: task.skillName ?? "",
+			runId: task.runId ?? "",
+			readReference: (path) => callCapability("readReference", { path }),
+			writeArtifact: (path, content, options) => callCapability("writeArtifact", {
+				path,
+				content: typeof content === "string" ? content : Array.from(content ?? []),
+				mimeType: options?.mimeType
+			}),
+			confirm: (message) => callCapability("confirm", { message })
+		};
+		const runFn = mod["run"];
+		const value = await runFn(task.args ?? {}, context);
+		post({
+			type: "execute-result",
+			ok: true,
+			value: value === void 0 ? null : value,
+			stdout,
+			stderr
+		});
+	} catch (e) {
+		const err = e;
+		post({
+			type: "execute-result",
+			ok: false,
+			error: {
+				code: err?.code ?? "TOOL_EXECUTION_FAILED",
+				message: String(err?.message ?? e)
+			},
+			stdout,
+			stderr
+		});
+	} finally {
+		console.log = originals.log;
+		console.info = originals.info;
+		console.debug = originals.debug;
+		console.warn = originals.warn;
+		console.error = originals.error;
+	}
+}
+main().then(() => process.exit(0), (e) => {
+	console.error(e);
+	process.exit(1);
+});
+
+//#endregion
+export {  };

package/dist/{testing-CbM6rJ-E.js → testing-S8SN9Lc6.js}

@@ -1,4 +1,4 @@
-import { l as WebSkillError } from "./dist-DS1sfgHa.js";
+import { l as WebSkillError } from "./dist-DvoBsChX.js";
 
 //#region ../runtime/dist/testing.js
 /**

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { c as LlmClient, d as LlmResponse, f as LlmStreamEvent, h as MemoryStore, l as LlmCompleteInput, n as ArtifactStore, o as InteractionRequest, s as InteractionResponse, t as Artifact, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { c as LlmClient, d as LlmResponse, f as LlmStreamEvent, h as MemoryStore, l as LlmCompleteInput, n as ArtifactStore, o as InteractionRequest, s as InteractionResponse, t as Artifact, v as UiBridge } from "./types-CgNC-oQu-DYrxhD3z.js";
 //#region ../runtime/dist/testing.d.ts
 //#region src/llm/mockLlmClient.d.ts
 type MockLlmHandler = (input: LlmCompleteInput) => LlmResponse | Promise<LlmResponse>;

package/dist/testing.js

@@ -1,4 +1,4 @@
 import { t as MemoryArtifactStore } from "./memoryArtifactStore-C9lFVqPF-yFz6yJj0.js";
-import { n as MockLlmClient, r as MockUiBridge, t as InMemoryStore } from "./testing-CbM6rJ-E.js";
+import { n as MockLlmClient, r as MockUiBridge, t as InMemoryStore } from "./testing-S8SN9Lc6.js";
 
 export { InMemoryStore, MemoryArtifactStore, MockLlmClient, MockUiBridge };

package/dist/{types-CgNC-oQu-Dq_A1yA-.d.ts → types-CgNC-oQu-DYrxhD3z.d.ts}

@@ -146,9 +146,19 @@ declare class MemoryFS implements FileSystemProvider {
 //#region src/fs/pathSecurity.d.ts
 /** 统一分隔符为 `/`，去除 `.` 段与重复分隔符（不解析 `..`） */
 declare function normalizePath(path: string): string;
+/**
+ * 外部标识（runId、candidateId、skillName、versionId 等）作为单一路径段使用前的统一校验：
+ * 拒绝空串、`.`、`..`、含 `/` 或 `\`、含 `:`（Windows 盘符/ADS）。
+ * 违规抛 FS_PATH_OUTSIDE_ROOT（kind 用于错误消息定位，如 "runId"）。
+ */
+declare function assertSafePathSegment(segment: string, kind: string): void;
 /**
  * 将相对路径安全地解析到 root 之内。
  * 拒绝空路径、绝对路径（`/`、`\\`、`C:\` 形式）与任何 `..` 段。
+ *
+ * 注意：本函数仅做**词法**校验，不解析符号链接——root 内经符号链接指向
+ * 外部的目标无法被词法检查拦截（realpath 防护见 NodeFS root 模式与
+ * 安装管线的 lstat 符号链接扫描）。
  */
 declare function resolveInsideRoot(root: string, relativePath: string): string;
 //#endregion
@@ -536,4 +546,4 @@ interface MemoryStore {
   clear(scope?: string): Promise<void>;
 }
 //#endregion
-export { exportSkills as $, SkillCatalog as A, SkillReader as B, JsonSchema as C, SKILL_NAME_MAX_LENGTH as D, SKILL_MANIFEST_FILE as E, SkillIssue as F, WebSkillError as G, SkillsLockfile as H, SkillLocation as I, buildManifest as J, WebSkillErrorCode as K, SkillManifest as L, SkillDiscovery as M, SkillDocument as N, SKILL_NAME_PATTERN as O, SkillInstallSource as P, escapeXml as Q, SkillMetadata as R, FileSystemProvider as S, SKILLS_LOCKFILE as T, ValidationReport as U, SkillSource as V, VerifyResult as W, checkSkillRules as X, checkDependencyCycles as Y, computeDigest as Z, RenderResultRequest as _, InteractionPolicy as a, renderAvailableSkillsXml as at, DiscoveryResult as b, LlmClient as c, validateSkills as ct, LlmResponse as d, isValidSkillName as et, LlmStreamEvent as f, RenderBlock as g, MemoryStore as h, FormField as i, parseSkillPackManifest as it, SkillCatalogEntry as j, SKILL_PACK_FILE as k, LlmCompleteInput as l, verifyManifest as lt, LlmToolSpec as m, ArtifactStore as n, normalizePath as nt, InteractionRequest as o, renderCatalogJson as ot, LlmToolCall as p, buildCatalog as q, ChartSpec as r, parseSkillMarkdown as rt, InteractionResponse as s, resolveInsideRoot as st, Artifact as t, jsonRenderer as tt, LlmMessage as u, xmlRenderer as ut, UiBridge as v, MemoryFS as w, FileStat as x, CatalogRenderer as y, SkillPackManifest as z };
+export { escapeXml as $, SkillCatalog as A, SkillReader as B, JsonSchema as C, SKILL_NAME_MAX_LENGTH as D, SKILL_MANIFEST_FILE as E, SkillIssue as F, WebSkillError as G, SkillsLockfile as H, SkillLocation as I, buildCatalog as J, WebSkillErrorCode as K, SkillManifest as L, SkillDiscovery as M, SkillDocument as N, SKILL_NAME_PATTERN as O, SkillInstallSource as P, computeDigest as Q, SkillMetadata as R, FileSystemProvider as S, SKILLS_LOCKFILE as T, ValidationReport as U, SkillSource as V, VerifyResult as W, checkDependencyCycles as X, buildManifest as Y, checkSkillRules as Z, RenderResultRequest as _, InteractionPolicy as a, parseSkillPackManifest as at, DiscoveryResult as b, LlmClient as c, resolveInsideRoot as ct, LlmResponse as d, xmlRenderer as dt, exportSkills as et, LlmStreamEvent as f, RenderBlock as g, MemoryStore as h, FormField as i, parseSkillMarkdown as it, SkillCatalogEntry as j, SKILL_PACK_FILE as k, LlmCompleteInput as l, validateSkills as lt, LlmToolSpec as m, ArtifactStore as n, jsonRenderer as nt, InteractionRequest as o, renderAvailableSkillsXml as ot, LlmToolCall as p, assertSafePathSegment as q, ChartSpec as r, normalizePath as rt, InteractionResponse as s, renderCatalogJson as st, Artifact as t, isValidSkillName as tt, LlmMessage as u, verifyManifest as ut, UiBridge as v, MemoryFS as w, FileStat as x, CatalogRenderer as y, SkillPackManifest as z };

package/dist/ui-react.d.ts

@@ -1,4 +1,4 @@
-import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-DYrxhD3z.js";
 //#region ../ui-react/dist/index.d.ts
 //#region src/bridgeState.d.ts
 /**

package/dist/ui-react.js

@@ -1,4 +1,4 @@
-import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-DxGyAznR.js";
+import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-MTc2KB03.js";
 import { useLayoutEffect, useRef, useState, useSyncExternalStore } from "react";
 import { jsx, jsxs } from "react/jsx-runtime";
 

package/dist/ui-vue.d.ts

@@ -1,4 +1,4 @@
-import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-DYrxhD3z.js";
 import { PropType } from "vue";
 //#region ../ui-vue/dist/index.d.ts
 //#region src/bridgeState.d.ts

package/dist/ui-vue.js

@@ -1,4 +1,4 @@
-import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-DxGyAznR.js";
+import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-MTc2KB03.js";
 import { defineComponent, h, reactive, ref } from "vue";
 
 //#region ../ui-vue/dist/index.js