@webskill/sdk 0.1.3 → 0.1.5

package/dist/{dist-Cm_j6Jol.js → dist-LIFS3ZjI.js}

@@ -1,15 +1,15 @@
-import { E as verifyManifest, T as validateSkills, _ as isValidSkillName, b as parseSkillMarkdown, d as buildManifest, g as exportSkills, l as WebSkillError, n as SKILLS_LOCKFILE, o as SKILL_PACK_FILE, r as SKILL_MANIFEST_FILE, w as resolveInsideRoot, x as parseSkillPackManifest } from "./dist-DS1sfgHa.js";
-import { M as normalizeToolContent, N as parseBridgeRequest, S as bridgeError, c as FsArtifactStore, j as networkUrlHost, k as isNetworkAllowed, l as FsMemoryStore, o as CapabilityApproval } from "./dist-DZobLFh6.js";
+import { A as validateSkills, C as parseSkillPackManifest, D as resolveArchiveLimits, O as resolveInsideRoot, S as parseSkillMarkdown, i as SKILL_MANIFEST_FILE, j as verifyManifest, k as unzipWithLimits, p as buildManifest, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, v as exportSkills, w as readResponseWithLimit, y as isValidSkillName } from "./dist-fZFZaf43.js";
+import { M as normalizeToolContent, N as parseBridgeRequest, S as bridgeError, c as FsArtifactStore, j as networkUrlHost, k as isNetworkAllowed, l as FsMemoryStore, o as CapabilityApproval } from "./dist-DuGN5x0v.js";
 import { unzipSync, zipSync } from "fflate";
 import { existsSync, promises, readFileSync } from "node:fs";
 import path from "node:path";
+import { tmpdir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { format, promisify } from "node:util";
 import { Worker } from "node:worker_threads";
 import { parseSync } from "oxc-parser";
 import { createInterface } from "node:readline/promises";
 import { mkdtemp } from "node:fs/promises";
-import { tmpdir } from "node:os";
 import * as tar from "tar";
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -18,10 +18,41 @@ import { createHash } from "node:crypto";
 const toPlatform$3 = (p) => p.split("/").join(path.sep);
 const toPosix = (p) => p.split(path.sep).join("/");
 const isEnoent = (e) => typeof e === "object" && e !== null && e.code === "ENOENT";
-/** 基于 node:fs/promises 的 FileSystemProvider；接受 `/` 风格路径，写入自动创建父目录 */
+/** realpath 最近现存祖先并拼回剩余段（写入目标尚不存在时的等价判定） */
+async function realpathNearest(platformPath) {
+	let current = platformPath;
+	const rest = [];
+	for (;;) try {
+		const real = await promises.realpath(current);
+		return rest.length === 0 ? real : [real, ...rest].join(path.sep);
+	} catch (e) {
+		if (!isEnoent(e)) throw e;
+		rest.unshift(path.basename(current));
+		const parent = path.dirname(current);
+		if (parent === current) return platformPath;
+		current = parent;
+	}
+}
+/**
+* 基于 node:fs/promises 的 FileSystemProvider；接受 `/` 风格路径，写入自动创建父目录。
+* 可选 root 模式：构造传入 root 后，read/write 操作先做 realpath 包含校验
+* （root 与目标都 realpath 后前缀比对），经符号链接逃逸 root → FS_PATH_OUTSIDE_ROOT。
+*/
 var NodeFS = class {
 	kind = "node";
+	#root;
+	constructor(deps = {}) {
+		this.#root = deps.root;
+	}
+	/** root 模式：目标 realpath 必须落在 root realpath 前缀内（符号链接逃逸防护） */
+	async #assertContained(p) {
+		if (!this.#root) return;
+		const rootReal = await promises.realpath(toPlatform$3(this.#root));
+		const targetReal = await realpathNearest(toPlatform$3(p));
+		if (targetReal !== rootReal && !targetReal.startsWith(rootReal + path.sep)) throw new WebSkillError("FS_PATH_OUTSIDE_ROOT", `Path escapes root via symbolic link: ${p} (resolves outside ${this.#root})`);
+	}
 	async readText(p) {
+		await this.#assertContained(p);
 		try {
 			return await promises.readFile(toPlatform$3(p), "utf8");
 		} catch (e) {
@@ -29,11 +60,13 @@ var NodeFS = class {
 		}
 	}
 	async writeText(p, content) {
+		await this.#assertContained(p);
 		const target = toPlatform$3(p);
 		await promises.mkdir(path.dirname(target), { recursive: true });
 		await promises.writeFile(target, content, "utf8");
 	}
 	async readBinary(p) {
+		await this.#assertContained(p);
 		try {
 			return await promises.readFile(toPlatform$3(p));
 		} catch (e) {
@@ -41,6 +74,7 @@ var NodeFS = class {
 		}
 	}
 	async writeBinary(p, content) {
+		await this.#assertContained(p);
 		const target = toPlatform$3(p);
 		await promises.mkdir(path.dirname(target), { recursive: true });
 		await promises.writeFile(target, content);
@@ -94,7 +128,6 @@ var NodeFS = class {
 	}
 };
 const baseName$1 = (p) => p.split("/").pop() ?? p;
-const toPlatform$2 = (p) => p.split("/").join(path.sep);
 /**
 * 进程内脚本执行器。接口按沙箱语义设计（context 无隐式宿主访问），
 * worker_threads 沙箱见 deferred-items D1。
@@ -114,7 +147,22 @@ var NodeScriptExecutor = class {
 		return hasTs ? tsPath : jsPath;
 	}
 	async #loadModule(scriptPath) {
-		return await import(`${pathToFileURL(toPlatform$2(scriptPath)).href}?t=${Date.now()}`);
+		if (scriptPath.endsWith(".ts")) {
+			const source = await this.#fs.readText(scriptPath);
+			const dir = await promises.mkdtemp(path.join(tmpdir(), "webskill-ts-"));
+			try {
+				const file = path.join(dir, "script.ts");
+				await promises.writeFile(file, source);
+				return await import(`${pathToFileURL(file).href}?t=${Date.now()}`);
+			} finally {
+				await promises.rm(dir, {
+					recursive: true,
+					force: true
+				});
+			}
+		}
+		const source = await this.#fs.readText(scriptPath);
+		return await import(`data:text/javascript;charset=utf-8,${encodeURIComponent(`${source}\n//# ${Date.now()}`)}`);
 	}
 	async loadDefinition(skillRoot, scriptName) {
 		const scriptPath = await this.#locateScript(skillRoot, scriptName);
@@ -223,14 +271,14 @@ var NodeScriptExecutor = class {
 	}
 };
 const baseName = (p) => p.split("/").pop() ?? p;
-const toPlatform$1 = (p) => p.split("/").join(path.sep);
+const toPlatform$2 = (p) => p.split("/").join(path.sep);
 const messageOf$5 = (e) => e instanceof Error ? e.message : String(e);
 /**
 * 网络策略判定函数源码（注入 Worker；匹配逻辑单一来源在
 * runtime/sandbox/networkPolicy.ts，Worker 线程不走 vitest 别名故注入而非 import）
 */
 const NETWORK_POLICY_LIB = `${isNetworkAllowed.toString()}\n${networkUrlHost.toString()}`;
-/** Worker 入口文件：src 为同目录 .ts；dist 为 dist/executor/ 下的 .js */
+/** Worker 入口文件：src 为同目录 .ts；node dist 为 dist/executor/；sdk dist 为平铺 dist/ */
 function workerEntryPath() {
 	const dir = path.dirname(fileURLToPath(import.meta.url));
 	const candidates = [
@@ -239,13 +287,17 @@ function workerEntryPath() {
 		path.join(dir, "executor", "sandboxWorkerEntry.js")
 	];
 	for (const candidate of candidates) if (existsSync(candidate)) return candidate;
-	return candidates[0];
+	throw new WebSkillError("TOOL_EXECUTION_FAILED", `Sandbox worker entry not found (tried: ${candidates.join(", ")})`);
 }
 /**
 * D1：worker_threads 沙箱脚本执行器。
 * 每次执行独立 Worker（resourceLimits + env 白名单），loadDefinition 同样在
 * Worker 内完成（禁止主进程 import 不可信脚本）；超时 terminate（可杀同步死循环）。
 * 能力桥协议与浏览器同一来源（runtime/sandbox/bridgeProtocol）。
+*
+* 诚实标注：本执行器做的是**能力面收敛**（网络策略、模块 allowlist、资源限额、
+* 超时强杀），**不是安全边界**——Worker 内脚本与宿主共享进程，仍有绕过手段；
+* 禁止假定其可隔离不可信脚本。
 */
 var SandboxedScriptExecutor = class {
 	#fs;
@@ -280,8 +332,9 @@ var SandboxedScriptExecutor = class {
 		const skillName = baseName(skillRoot);
 		const result = await this.#runWorker({
 			mode: "load",
-			scriptPath: toPlatform$1(scriptPath),
-			scriptName
+			scriptPath: toPlatform$2(scriptPath),
+			scriptName,
+			scriptSource: await this.#fs.readText(scriptPath)
 		});
 		if (!result.ok) throw new WebSkillError("TOOL_EXECUTION_FAILED", `Failed to load script "${scriptName}": ${result.error?.message ?? "unknown error"}`);
 		return {
@@ -310,11 +363,12 @@ var SandboxedScriptExecutor = class {
 		try {
 			const result = await this.#runWorker({
 				mode: "execute",
-				scriptPath: toPlatform$1(scriptPath),
+				scriptPath: toPlatform$2(scriptPath),
 				scriptName,
 				skillName: context.skillName,
 				runId: context.runId,
-				args
+				args,
+				scriptSource: await this.#fs.readText(scriptPath)
 			}, timeoutMs, (request) => this.#handleBridge(request, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!result.ok) {
 				const stderrSummary = result.stderr?.length ? ` | stderr: ${result.stderr.join(" | ").slice(0, 500)}` : "";
@@ -356,7 +410,8 @@ var SandboxedScriptExecutor = class {
 				workerData: {
 					...workerData,
 					networkPolicy: this.#networkPolicy,
-					networkPolicyLib: NETWORK_POLICY_LIB
+					networkPolicyLib: NETWORK_POLICY_LIB,
+					allowedModules: this.#options.allowedModules ?? []
 				},
 				env,
 				resourceLimits: this.#options.resourceLimits ?? {
@@ -776,42 +831,42 @@ var CliUiBridge = class {
 	}
 };
 const messageOf$4 = (e) => e instanceof Error ? e.message : String(e);
-const toPlatform = (p) => p.split("/").join(path.sep);
+const toPlatform$1 = (p) => p.split("/").join(path.sep);
 const isZipArchive = (data) => data.length > 1 && data[0] === 80 && data[1] === 75;
 /**
-* zip 解包（fflate）。每个条目路径过 resolveInsideRoot：
+* zip 解包（fflate 流式，单条目/总解压体积上限）。每个条目路径过 resolveInsideRoot：
 * 拒绝 `..` 段、绝对路径、反斜杠穿越（zip-slip 防护）。
 */
-async function extractZipData(fs, data, destRoot) {
-	let entries;
-	try {
-		entries = unzipSync(data);
-	} catch (e) {
-		throw new WebSkillError("INSTALL_FAILED", `Failed to read zip archive: ${messageOf$4(e)}`, e);
-	}
-	for (const [entryPath, content] of Object.entries(entries)) {
+async function extractZipData(fs, data, destRoot, limits) {
+	for (const [entryPath, content] of await unzipWithLimits(data, limits)) {
 		const target = resolveInsideRoot(destRoot, entryPath);
 		if (entryPath.endsWith("/")) await fs.mkdir(target);
 		else await fs.writeBinary(target, content);
 	}
 }
 /**
-* tar/tar.gz 解包（tar 包）。先列条目逐一过 resolveInsideRoot 校验，
-* 再解包；符号链接/硬链接条目不跟随（跳过）。
+* tar/tar.gz 解包（tar 包）。先列条目逐一过 resolveInsideRoot 校验并累计
+* 单条目/总体积上限（声明 size 预检），再解包；符号链接/硬链接条目不跟随（跳过）。
 */
-async function extractTarFile(archivePath, destRoot) {
+async function extractTarFile(archivePath, destRoot, limits) {
+	const { maxEntryBytes, maxTotalBytes } = resolveArchiveLimits(limits);
 	try {
 		const entryPaths = [];
+		let total = 0;
 		await tar.t({
-			file: toPlatform(archivePath),
+			file: toPlatform$1(archivePath),
 			onentry: (entry) => {
 				entryPaths.push(entry.path);
+				const size = typeof entry.size === "number" ? entry.size : 0;
+				if (size > maxEntryBytes) throw new WebSkillError("INSTALL_FAILED", `Archive entry exceeds the ${maxEntryBytes}-byte limit: ${entry.path}`);
+				total += size;
+				if (total > maxTotalBytes) throw new WebSkillError("INSTALL_FAILED", `Archive contents exceed the ${maxTotalBytes}-byte total limit`);
 			}
 		});
 		for (const p of entryPaths) if (!p.replace(/\\/g, "/").split("/").every((s) => s === "" || s === ".")) resolveInsideRoot(destRoot, p);
 		await tar.x({
-			file: toPlatform(archivePath),
-			cwd: toPlatform(destRoot),
+			file: toPlatform$1(archivePath),
+			cwd: toPlatform$1(destRoot),
 			filter: (_p, entry) => !("type" in entry) || entry.type !== "SymbolicLink" && entry.type !== "Link"
 		});
 	} catch (e) {
@@ -830,8 +885,23 @@ async function listFiles(fs, root, prefix = "") {
 	}
 	return out;
 }
-/** 递归拷贝目录（含子目录与二进制文件） */
+const toPlatform = (p) => p.split("/").join(path.sep);
+/** lstat 扫描拒绝符号链接条目（与 tar 解包 filter 策略一致；虚拟 fs 路径不存在于真实 fs 时跳过） */
+async function assertNoSymlinks(platformRoot) {
+	let entries;
+	try {
+		entries = await promises.readdir(platformRoot, { withFileTypes: true });
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		if (entry.isSymbolicLink()) throw new WebSkillError("INSTALL_FAILED", `Refusing to copy symbolic link entry: ${platformRoot}${path.sep}${entry.name}`);
+		if (entry.isDirectory()) await assertNoSymlinks(`${platformRoot}${path.sep}${entry.name}`);
+	}
+}
+/** 递归拷贝目录（含子目录与二进制文件）；真实 fs 上先做符号链接扫描 */
 async function copyDir(fs, from, to) {
+	await assertNoSymlinks(toPlatform(from));
 	await fs.mkdir(to);
 	for (const entry of await fs.list(from)) {
 		const name = entry.path.split("/").pop() ?? "";
@@ -854,8 +924,8 @@ async function exportArchive(fs, skillRoot, options) {
 			for (const rel of await listFiles(fs, skillRoot)) files[rel] = await fs.readBinary(`${skillRoot}/${rel}`);
 			await fs.writeBinary(options.outPath, zipSync(files, { level: 6 }));
 		} else await tar.c({
-			file: toPlatform(options.outPath),
-			cwd: toPlatform(skillRoot)
+			file: toPlatform$1(options.outPath),
+			cwd: toPlatform$1(skillRoot)
 		}, ["."]);
 		return options.outPath;
 	} catch (e) {
@@ -876,7 +946,7 @@ async function readArchiveManifest(fs, archivePath) {
 	let manifestText;
 	try {
 		await tar.t({
-			file: toPlatform(archivePath),
+			file: toPlatform$1(archivePath),
 			onentry: (entry) => {
 				if (entry.path === "webskill.skill-manifest.json" || entry.path.endsWith(`/${"webskill.skill-manifest.json"}`)) {
 					const chunks = [];
@@ -897,28 +967,39 @@ const _execFileP = promisify(execFile);
 const messageOf$2 = (e) => e instanceof Error ? e.message : String(e);
 /**
 * 跨平台执行命令：Windows 下对 npm 等 cmd 包装的命令通过 cmd.exe 代理执行，
-* git 等原生 exe 不受影响。
+* git 等原生 exe 不受影响。默认 120s 超时（防挂死安装管线）。
 */
-async function execFileP(command, args) {
+async function execFileP(command, args, options = {}) {
+	const timeoutMs = options.timeoutMs ?? 12e4;
 	if (process.platform === "win32" && command === "npm") return _execFileP("cmd", [
 		"/c",
 		command,
 		...args
-	]);
-	return _execFileP(command, args);
+	], { timeout: timeoutMs });
+	return _execFileP(command, args, { timeout: timeoutMs });
 }
 /** 命令缺失/失败 → INSTALL_FAILED 结构化诊断 */
 function commandFailed(command, e) {
 	return new WebSkillError("INSTALL_FAILED", `Failed to run ${command}: ${e?.code === "ENOENT" ? `command "${command}" not found on this system` : messageOf$2(e)}`, e);
 }
-/** git 源：clone --depth 1 + rev-parse HEAD 记录 commit */
+/** git url 协议白名单：https:// 与 git@ SCP 形式；无 scheme 的本地路径放行（dev 工作流）；
+* 其余显式协议（ext::/file:// 等）一律拒绝 */
+function assertGitUrlSafe(url) {
+	if (url.startsWith("--")) throw new WebSkillError("INSTALL_FAILED", `Git url must not start with "--": ${JSON.stringify(url)}`);
+	if (url.startsWith("https://") || url.startsWith("git@")) return;
+	if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(url)) throw new WebSkillError("INSTALL_FAILED", `Git url protocol is not allowed (only https://, git@ SCP form, or plain local paths): ${JSON.stringify(url)}`);
+}
+/** git 源：clone --depth 1 + rev-parse HEAD 记录 commit；url/ref 前插 `--` 防选项注入 */
 async function stageGit(source, ctx) {
+	assertGitUrlSafe(source.url);
+	if (source.ref?.startsWith("--")) throw new WebSkillError("INSTALL_FAILED", `Git ref must not start with "--": ${JSON.stringify(source.ref)}`);
 	const skillDir = `${ctx.stagingRoot}/repo`;
 	const args = [
 		"clone",
 		"--depth",
 		"1",
 		...source.ref ? ["--branch", source.ref] : [],
+		"--",
 		source.url,
 		skillDir
 	];
@@ -949,7 +1030,7 @@ function sha256Hex(data) {
 	return createHash("sha256").update(data).digest("hex");
 }
 const messageOf$1 = (e) => e instanceof Error ? e.message : String(e);
-/** http 源：下载归档（可选 expectedSha256 校验包体）→ 解包 → 定位技能根 */
+/** http 源：下载归档（Content-Length + 流式累计上限；可选 expectedSha256 校验包体）→ 解包 → 定位技能根/包集 */
 async function stageHttp(source, ctx, expectedSha256) {
 	const fetchImpl = ctx.fetchImpl ?? fetch;
 	let res;
@@ -959,18 +1040,18 @@ async function stageHttp(source, ctx, expectedSha256) {
 		throw new WebSkillError("INSTALL_FAILED", `Download failed: ${messageOf$1(e)}`, e);
 	}
 	if (!res.ok) throw new WebSkillError("INSTALL_FAILED", `Download failed with HTTP ${res.status}`);
-	const data = new Uint8Array(await res.arrayBuffer());
+	const data = await readResponseWithLimit(res, ctx.archiveLimits);
 	if (expectedSha256 !== void 0) {
 		const actual = sha256Hex(data);
 		if (actual !== expectedSha256) throw new WebSkillError("INSTALL_FAILED", `Archive checksum mismatch: expected ${expectedSha256}, got ${actual}`);
 	}
 	const contentDir = `${ctx.stagingRoot}/content`;
 	await ctx.fs.mkdir(contentDir);
-	if (isZipArchive(data)) await extractZipData(ctx.fs, data, contentDir);
+	if (isZipArchive(data)) await extractZipData(ctx.fs, data, contentDir, ctx.archiveLimits);
 	else {
 		const archivePath = `${ctx.stagingRoot}/archive.tar`;
 		await ctx.fs.writeBinary(archivePath, data);
-		await extractTarFile(toPlatform(archivePath), toPlatform(contentDir));
+		await extractTarFile(toPlatform$1(archivePath), toPlatform$1(contentDir), ctx.archiveLimits);
 	}
 	const packFilePath = `${contentDir}/${SKILL_PACK_FILE}`;
 	if (await ctx.fs.exists(packFilePath)) return {
@@ -1002,16 +1083,27 @@ async function stageLocal(source, ctx) {
 		source
 	};
 }
-/** npm 源：npm pack → 解 tar.gz；技能根取包的 skill/ 子目录（存在时）否则包根 */
+/** npm 包名（@scope/name 或 name，小写字母数字 . _ - /）与版本（semver 或 dist-tag）正则 */
+const PACKAGE_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const VERSION_RE = /^[a-z0-9._~^>=<x*+-]+$/i;
+function assertNpmSpecSafe(source) {
+	const name = source.packageName;
+	const isLocalPath = name.startsWith("/") || name.startsWith("./") || name.startsWith("../");
+	if (name.startsWith("--") || !PACKAGE_NAME_RE.test(name) && !isLocalPath) throw new WebSkillError("INSTALL_FAILED", `Invalid npm package name: ${JSON.stringify(name)}`);
+	if (source.version !== void 0 && (!VERSION_RE.test(source.version) || source.version.startsWith("--"))) throw new WebSkillError("INSTALL_FAILED", `Invalid npm package version: ${JSON.stringify(source.version)}`);
+}
+/** npm 源：npm pack → 解 tar.gz；技能根取包的 skill/ 子目录（存在时）否则包根；spec 前插 `--` 防选项注入 */
 async function stageNpm(source, ctx) {
+	assertNpmSpecSafe(source);
 	const spec = source.version ? `${source.packageName}@${source.version}` : source.packageName;
 	let stdout;
 	try {
 		({stdout} = await execFileP("npm", [
 			"pack",
-			spec,
 			"--pack-destination",
-			ctx.stagingRoot
+			ctx.stagingRoot,
+			"--",
+			spec
 		]));
 	} catch (e) {
 		throw commandFailed("npm", e);
@@ -1021,7 +1113,7 @@ async function stageNpm(source, ctx) {
 	if (!tarball || !await ctx.fs.exists(tgzPath)) throw new WebSkillError("INSTALL_FAILED", `npm pack output not found in staging directory: ${tarball ?? "(empty output)"}`);
 	const pkgDir = `${ctx.stagingRoot}/pkg`;
 	await ctx.fs.mkdir(pkgDir);
-	await extractTarFile(toPlatform(tgzPath), toPlatform(pkgDir));
+	await extractTarFile(toPlatform$1(tgzPath), toPlatform$1(pkgDir));
 	const pkgRoot = `${pkgDir}/package`;
 	const skillDir = await ctx.fs.exists(`${pkgRoot}/skill/SKILL.md`) ? `${pkgRoot}/skill` : pkgRoot;
 	let packageName = source.packageName;
@@ -1112,15 +1204,13 @@ async function readManifest(fs, skillRoot) {
 		throw new WebSkillError("INTEGRITY_FAILED", `Skill manifest at ${path} is corrupted: ${e instanceof Error ? e.message : String(e)}`, e);
 	}
 }
-/** 按 manifest.files 逐文件重算 sha256 比对（core 纯逻辑校验） */
+/** walk 实际目录与 manifest 比对：hash 不一致 / 清单外新增 / 清单内缺失三类全空才 ok */
 async function verifyIntegrity(fs, skillRoot) {
 	const manifest = await readManifest(fs, skillRoot);
 	const actualHashes = /* @__PURE__ */ new Map();
-	for (const file of manifest.files) {
-		const path = `${skillRoot}/${file.path}`;
-		if (await fs.exists(path)) actualHashes.set(file.path, sha256Hex(await fs.readBinary(path)));
-	}
-	return verifyManifest(manifest, actualHashes);
+	const actualFiles = await walkFiles(fs, skillRoot);
+	for (const rel of actualFiles) actualHashes.set(rel, sha256Hex(await fs.readBinary(`${skillRoot}/${rel}`)));
+	return verifyManifest(manifest, actualHashes, actualFiles);
 }
 const messageOf = (e) => e instanceof Error ? e.message : String(e);
 const asInstallFailed = (e) => e instanceof WebSkillError && e.code === "INSTALL_FAILED" ? e : new WebSkillError("INSTALL_FAILED", `Install failed: ${messageOf(e)}`, e);
@@ -1134,12 +1224,16 @@ var SkillManager = class {
 	#fs;
 	#fetchImpl;
 	#schemaInference;
+	#archiveLimits;
+	#onChanged;
 	#schemaInferer = new OxcSchemaInferer();
 	constructor(deps) {
 		this.#managedRoot = deps.managedRoot.replace(/\/+$/, "");
 		this.#fs = deps.fs ?? new NodeFS();
 		this.#fetchImpl = deps.fetchImpl;
 		this.#schemaInference = deps.schemaInference ?? true;
+		this.#archiveLimits = deps.archiveLimits;
+		this.#onChanged = deps.onChanged;
 	}
 	async install(source, options) {
 		const fs = this.#fs;
@@ -1150,7 +1244,8 @@ var SkillManager = class {
 			const ctx = {
 				fs,
 				stagingRoot,
-				...this.#fetchImpl ? { fetchImpl: this.#fetchImpl } : {}
+				...this.#fetchImpl ? { fetchImpl: this.#fetchImpl } : {},
+				...this.#archiveLimits ? { archiveLimits: this.#archiveLimits } : {}
 			};
 			let staged;
 			switch (source.type) {
@@ -1187,21 +1282,34 @@ var SkillManager = class {
 				const errors = report.issues.filter((i) => i.severity === "error");
 				throw new WebSkillError("INSTALL_FAILED", `Skill "${name}" failed validation: ${errors.map((i) => i.message).join("; ")}`, errors);
 			}
-			targetDir = `${this.#managedRoot}/${name}`;
-			if (await fs.exists(targetDir)) await fs.remove(targetDir, { recursive: true });
-			await copyDir(fs, finalDir, targetDir);
-			await this.#inferSkillSchemas(targetDir);
-			const manifest = await createManifest(fs, targetDir, {
+			await this.#inferSkillSchemas(finalDir);
+			const manifest = await createManifest(fs, finalDir, {
 				name,
 				...version ? { version } : {},
 				source: staged.source
 			});
-			await upsertLockEntry(fs, this.#managedRoot, name, {
-				digest: manifest.integrity.digest,
-				installedAt: manifest.installedAt,
-				source: staged.source
-			});
+			targetDir = `${this.#managedRoot}/${name}`;
+			const backupDir = `${stagingRoot}/backup`;
+			const hadPrevious = await fs.exists(targetDir);
+			if (hadPrevious) await copyDir(fs, targetDir, backupDir);
+			let committed = false;
+			try {
+				if (hadPrevious) await fs.remove(targetDir, { recursive: true });
+				await copyDir(fs, finalDir, targetDir);
+				committed = true;
+				await upsertLockEntry(fs, this.#managedRoot, name, {
+					digest: manifest.integrity.digest,
+					installedAt: manifest.installedAt,
+					source: staged.source
+				});
+			} catch (e) {
+				if (committed) await removeDirQuiet(fs, targetDir);
+				if (hadPrevious) await copyDir(fs, backupDir, targetDir);
+				targetDir = void 0;
+				throw e;
+			}
 			targetDir = void 0;
+			this.#onChanged?.();
 			return manifest;
 		} catch (e) {
 			if (targetDir) await removeDirQuiet(fs, targetDir);
@@ -1243,11 +1351,7 @@ var SkillManager = class {
 			}
 			const manifests = [];
 			for (const entry of pack.manifest.skills) {
-				const targetDir = `${this.#managedRoot}/${entry.name}`;
-				if (await fs.exists(targetDir)) await fs.remove(targetDir, { recursive: true });
-				await copyDir(fs, `${finalRoot}/${entry.name}`, targetDir);
-				installed.push(targetDir);
-				const manifest = await createManifest(fs, targetDir, {
+				const manifest = await createManifest(fs, `${finalRoot}/${entry.name}`, {
 					name: entry.name,
 					...versions.get(entry.name) ? { version: versions.get(entry.name) } : {},
 					source
@@ -1255,11 +1359,36 @@ var SkillManager = class {
 				if (manifest.integrity.digest !== entry.digest) throw new WebSkillError("INSTALL_FAILED", `Skill "${entry.name}" digest mismatch: expected ${entry.digest}, got ${manifest.integrity.digest}`);
 				manifests.push(manifest);
 			}
-			for (const manifest of manifests) await upsertLockEntry(fs, this.#managedRoot, manifest.name, {
-				digest: manifest.integrity.digest,
-				installedAt: manifest.installedAt,
-				source
-			});
+			const swapped = [];
+			try {
+				for (const manifest of manifests) {
+					const targetDir = `${this.#managedRoot}/${manifest.name}`;
+					const backupDir = `${stagingRoot}/backup/${manifest.name}`;
+					if (await fs.exists(targetDir)) {
+						await copyDir(fs, targetDir, backupDir);
+						await fs.remove(targetDir, { recursive: true });
+					}
+					await copyDir(fs, `${finalRoot}/${manifest.name}`, targetDir);
+					installed.push(targetDir);
+					swapped.push({
+						targetDir,
+						backupDir
+					});
+				}
+				for (const manifest of manifests) await upsertLockEntry(fs, this.#managedRoot, manifest.name, {
+					digest: manifest.integrity.digest,
+					installedAt: manifest.installedAt,
+					source
+				});
+			} catch (e) {
+				for (const { targetDir, backupDir } of swapped) {
+					await removeDirQuiet(fs, targetDir);
+					if (await fs.exists(backupDir)) await copyDir(fs, backupDir, targetDir);
+				}
+				installed.length = 0;
+				throw e;
+			}
+			this.#onChanged?.();
 			return manifests;
 		} catch (e) {
 			for (const targetDir of installed) await removeDirQuiet(fs, targetDir);
@@ -1295,6 +1424,7 @@ var SkillManager = class {
 		try {
 			await this.#fs.remove(targetDir, { recursive: true });
 			await removeLockEntry(this.#fs, this.#managedRoot, name);
+			this.#onChanged?.();
 		} catch (e) {
 			throw new WebSkillError("UNINSTALL_FAILED", `Failed to uninstall "${name}": ${messageOf(e)}`, e);
 		}