@webskill/sdk 0.1.3 → 0.1.5

package/dist/{dist-DS1sfgHa.js → dist-fZFZaf43.js}

@@ -1,5 +1,5 @@
 import { parse } from "yaml";
-import { zipSync } from "fflate";
+import { Unzip, UnzipInflate, zipSync } from "fflate";
 
 //#region ../core/dist/index.js
 /**
@@ -39,16 +39,22 @@ async function buildManifest(input) {
 		files: input.files
 	};
 }
-/** 按 manifest.files 比对实际 hash（调用方负责计算 actualHashes） */
-function verifyManifest(manifest, actualHashes) {
+/** 按 manifest.files 比对实际 hash 与文件集（mismatches/extras/missing 三类全空才 ok） */
+function verifyManifest(manifest, actualHashes, actualFiles = [...actualHashes.keys()]) {
 	const mismatches = [];
+	const missing = [];
+	const listed = new Set(manifest.files.map((f) => f.path));
 	for (const file of manifest.files) {
 		const actual = actualHashes.get(file.path);
-		if (actual === void 0 || actual !== file.sha256) mismatches.push(file.path);
+		if (actual === void 0) missing.push(file.path);
+		else if (actual !== file.sha256) mismatches.push(file.path);
 	}
+	const extras = actualFiles.filter((p) => p !== "webskill.skill-manifest.json" && p !== "skills.lock.json" && !listed.has(p)).sort();
 	return {
-		ok: mismatches.length === 0,
-		mismatches
+		ok: mismatches.length === 0 && missing.length === 0 && extras.length === 0,
+		mismatches,
+		extras,
+		missing
 	};
 }
 const ROOT = "/";
@@ -174,8 +180,20 @@ function normalizePath(path) {
 	return path.replace(/\\/g, "/").split("/").filter((s) => s !== "" && s !== ".").join("/");
 }
 /**
+* 外部标识（runId、candidateId、skillName、versionId 等）作为单一路径段使用前的统一校验：
+* 拒绝空串、`.`、`..`、含 `/` 或 `\`、含 `:`（Windows 盘符/ADS）。
+* 违规抛 FS_PATH_OUTSIDE_ROOT（kind 用于错误消息定位，如 "runId"）。
+*/
+function assertSafePathSegment(segment, kind) {
+	if (segment === "" || segment === "." || segment === ".." || segment.includes("/") || segment.includes("\\") || segment.includes(":")) throw new WebSkillError("FS_PATH_OUTSIDE_ROOT", `Invalid ${kind} (must be a single safe path segment): ${JSON.stringify(segment)}`);
+}
+/**
 * 将相对路径安全地解析到 root 之内。
 * 拒绝空路径、绝对路径（`/`、`\\`、`C:\` 形式）与任何 `..` 段。
+*
+* 注意：本函数仅做**词法**校验，不解析符号链接——root 内经符号链接指向
+* 外部的目标无法被词法检查拦截（realpath 防护见 NodeFS root 模式与
+* 安装管线的 lstat 符号链接扫描）。
 */
 function resolveInsideRoot(root, relativePath) {
 	const fail = (reason) => {
@@ -395,6 +413,107 @@ function parseSkillPackManifest(text) {
 	}
 	return raw;
 }
+const DEFAULT_ARCHIVE_LIMITS = {
+	maxDownloadBytes: 64 * 1024 * 1024,
+	maxEntryBytes: 64 * 1024 * 1024,
+	maxTotalBytes: 256 * 1024 * 1024
+};
+function resolveArchiveLimits(limits) {
+	return {
+		...DEFAULT_ARCHIVE_LIMITS,
+		...limits
+	};
+}
+function concat(chunks, size) {
+	const out = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		out.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return out;
+}
+/** 流式解 zip（单条目/总双重上限）；返回 [path, content][]（目录条目以 / 结尾、内容为空） */
+async function unzipWithLimits(data, limits) {
+	const { maxEntryBytes, maxTotalBytes } = resolveArchiveLimits(limits);
+	let eocd = false;
+	const scanFrom = Math.max(0, data.length - 65557);
+	for (let i = data.length - 22; i >= scanFrom; i--) if (data[i] === 80 && data[i + 1] === 75 && data[i + 2] === 5 && data[i + 3] === 6) {
+		eocd = true;
+		break;
+	}
+	if (!eocd) throw new WebSkillError("INSTALL_FAILED", "Failed to read zip archive: missing end-of-central-directory record");
+	const entries = [];
+	let total = 0;
+	let failure;
+	const unzip = new Unzip();
+	unzip.register(UnzipInflate);
+	unzip.onfile = (file) => {
+		if (file.name.endsWith("/")) {
+			entries.push([file.name, /* @__PURE__ */ new Uint8Array(0)]);
+			return;
+		}
+		const chunks = [];
+		let size = 0;
+		file.ondata = (err, chunk, final) => {
+			if (err) {
+				failure = err;
+				return;
+			}
+			size += chunk.length;
+			if (size > maxEntryBytes) {
+				failure = new WebSkillError("INSTALL_FAILED", `Archive entry exceeds the ${maxEntryBytes}-byte limit: ${file.name}`);
+				return;
+			}
+			total += chunk.length;
+			if (total > maxTotalBytes) {
+				failure = new WebSkillError("INSTALL_FAILED", `Archive contents exceed the ${maxTotalBytes}-byte total limit`);
+				return;
+			}
+			chunks.push(chunk);
+			if (final) entries.push([file.name, concat(chunks, size)]);
+		};
+		file.start();
+	};
+	try {
+		unzip.push(data, true);
+	} catch (e) {
+		throw new WebSkillError("INSTALL_FAILED", `Failed to read zip archive: ${e instanceof Error ? e.message : String(e)}`, e);
+	}
+	await new Promise((resolve) => {
+		setTimeout(resolve, 0);
+	});
+	if (failure) {
+		if (failure instanceof WebSkillError) throw failure;
+		throw new WebSkillError("INSTALL_FAILED", `Failed to read zip archive: ${failure instanceof Error ? failure.message : String(failure)}`, failure);
+	}
+	return entries;
+}
+/** 下载响应体：Content-Length 预检 + 流式累计上限 */
+async function readResponseWithLimit(res, limits) {
+	const { maxDownloadBytes } = resolveArchiveLimits(limits);
+	const declared = res.headers.get("content-length");
+	if (declared !== null && Number(declared) > maxDownloadBytes) throw new WebSkillError("INSTALL_FAILED", `Download exceeds the ${maxDownloadBytes}-byte limit (Content-Length: ${declared})`);
+	if (!res.body) {
+		const buf = new Uint8Array(await res.arrayBuffer());
+		if (buf.length > maxDownloadBytes) throw new WebSkillError("INSTALL_FAILED", `Download exceeds the ${maxDownloadBytes}-byte limit`);
+		return buf;
+	}
+	const reader = res.body.getReader();
+	const chunks = [];
+	let size = 0;
+	for (;;) {
+		const { value, done } = await reader.read();
+		if (done) break;
+		size += value.length;
+		if (size > maxDownloadBytes) {
+			await reader.cancel().catch(() => void 0);
+			throw new WebSkillError("INSTALL_FAILED", `Download exceeds the ${maxDownloadBytes}-byte limit`);
+		}
+		chunks.push(value);
+	}
+	return concat(chunks, size);
+}
 /** 由条目列表构建 Catalog，保证按名称排序 */
 function buildCatalog(entries) {
 	return { entries: [...entries].sort((a, b) => a.name.localeCompare(b.name)) };
@@ -511,6 +630,25 @@ var SkillDiscovery = class {
 			});
 		}
 		issues.push(...cycles.issues);
+		const admitted = new Set(entries.map((e) => e.name));
+		let changed = true;
+		while (changed) {
+			changed = false;
+			for (const entry of [...entries]) {
+				const missing = (adjacency.get(entry.name) ?? []).filter((d) => !admitted.has(d));
+				if (missing.length === 0) continue;
+				entries.splice(entries.indexOf(entry), 1);
+				admitted.delete(entry.name);
+				this.#index.delete(entry.name);
+				issues.push({
+					code: "SKILL_UNKNOWN_DEPENDENCY",
+					severity: "error",
+					message: `Skill "${entry.name}" was excluded: dependency ${JSON.stringify(missing[0])} is not in the final catalog`,
+					path: entry.root
+				});
+				changed = true;
+			}
+		}
 		entries.sort((a, b) => a.name.localeCompare(b.name));
 		return {
 			entries,
@@ -587,4 +725,4 @@ const xmlRenderer = {
 };
 
 //#endregion
-export { renderCatalogJson as C, xmlRenderer as D, verifyManifest as E, renderAvailableSkillsXml as S, validateSkills as T, isValidSkillName as _, SKILL_NAME_PATTERN as a, parseSkillMarkdown as b, SkillReader as c, buildManifest as d, checkDependencyCycles as f, exportSkills as g, escapeXml as h, SKILL_NAME_MAX_LENGTH as i, WebSkillError as l, computeDigest as m, SKILLS_LOCKFILE as n, SKILL_PACK_FILE as o, checkSkillRules as p, SKILL_MANIFEST_FILE as r, SkillDiscovery as s, MemoryFS as t, buildCatalog as u, jsonRenderer as v, resolveInsideRoot as w, parseSkillPackManifest as x, normalizePath as y };
+export { validateSkills as A, parseSkillPackManifest as C, resolveArchiveLimits as D, renderCatalogJson as E, xmlRenderer as M, resolveInsideRoot as O, parseSkillMarkdown as S, renderAvailableSkillsXml as T, escapeXml as _, SKILL_NAME_MAX_LENGTH as a, jsonRenderer as b, SkillDiscovery as c, assertSafePathSegment as d, buildCatalog as f, computeDigest as g, checkSkillRules as h, SKILL_MANIFEST_FILE as i, verifyManifest as j, unzipWithLimits as k, SkillReader as l, checkDependencyCycles as m, MemoryFS as n, SKILL_NAME_PATTERN as o, buildManifest as p, SKILLS_LOCKFILE as r, SKILL_PACK_FILE as s, DEFAULT_ARCHIVE_LIMITS as t, WebSkillError as u, exportSkills as v, readResponseWithLimit as w, normalizePath as x, isValidSkillName as y };

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
-import { L as SkillManifest, N as SkillDocument, S as FileSystemProvider, c as LlmClient, j as SkillCatalogEntry, u as LlmMessage, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
-import { ct as WebSkillRuntime, q as RuntimeRun } from "./index-CqMuvcb2.js";
-import { f as SkillManager } from "./index-CPuwsnmB.js";
+import { F as SkillDocument, N as SkillCatalogEntry, c as LlmClient, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CgNC-oQu-DEcIBJKG.js";
+import { $ as SkillStateGuard, lt as WebSkillRuntime, q as RuntimeRun } from "./index-COuOu6gw.js";
+import { f as SkillManager } from "./index-Bun1aEf4.js";
 //#region ../governance/dist/index.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';
@@ -270,6 +270,12 @@ declare class SkillStatePolicy {
   }): Promise<SkillState>;
   canRoute(state: SkillState): boolean;
   canExecute(state: SkillState): boolean;
+  /**
+   * runtime SkillStateGuard 适配（0.1.5 一致拦截）：
+   * canRead：active/deprecated 放行；canActivate/canExecute 与 canRoute/canExecute 语义对齐；
+   * quarantined/disabled 三入口全拦截。
+   */
+  toSkillStateGuard(): SkillStateGuard;
   /** disabled → SKILL_DISABLED；quarantined → SKILL_QUARANTINED */
   assertExecutable(skillName: string): Promise<void>;
   /** runtime catalogFilter 实现：quarantined/deprecated/disabled 技能被路由过滤 */
@@ -311,11 +317,14 @@ interface EvaluationReport {
 }
 //#endregion
 //#region src/evaluation/evaluationRunner.d.ts
-/** 批量评估：顺序执行（单任务异常不中断批）；expected 参与判定；结构化报告 */
+/** 批量评估：顺序执行（单任务异常不中断批）；expected 参与判定；结构化报告。
+ *  注意：评估会真实执行技能脚本（试用路径）——必须显式 opt-in（allowExecution: true），
+ *  且沙箱执行器是能力面收敛而非安全边界，禁止对不可信候选技能直接跑评估。 */
 declare class EvaluationRunner {
   #private;
   constructor(deps: {
     runtime: WebSkillRuntime;
+    allowExecution?: boolean;
     now?: () => string;
     createId?: () => string;
   });

package/dist/governance.js

@@ -1,8 +1,8 @@
-import { T as validateSkills, _ as isValidSkillName, l as WebSkillError, w as resolveInsideRoot } from "./dist-DS1sfgHa.js";
-import { i as NodeFS } from "./dist-Cm_j6Jol.js";
+import { A as validateSkills, O as resolveInsideRoot, d as assertSafePathSegment, u as WebSkillError, y as isValidSkillName } from "./dist-fZFZaf43.js";
+import { i as NodeFS } from "./dist-LIFS3ZjI.js";
 import path from "node:path";
-import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
+import { mkdtemp } from "node:fs/promises";
 import { createHash } from "node:crypto";
 
 //#region ../governance/dist/index.js
@@ -115,9 +115,11 @@ var CandidateStore = class {
 	}
 	async save(candidate) {
 		validateCandidate(candidate);
+		assertSafePathSegment(candidate.id, "candidate id");
 		await this.#fs.writeText(`${dirOf$1(this.#root)}/${candidate.id}.json`, JSON.stringify(candidate, null, 2));
 	}
 	async get(id) {
+		assertSafePathSegment(id, "candidate id");
 		const path = `${dirOf$1(this.#root)}/${id}.json`;
 		if (!await this.#fs.exists(path)) throw new WebSkillError("GOVERNANCE_FAILED", `Candidate not found: ${id}`);
 		return JSON.parse(await this.#fs.readText(path));
@@ -370,7 +372,10 @@ var FsAuditLog = class {
 		return events;
 	}
 };
-const dirOf = (root, skillName) => `${root}/.webskill/versions/${skillName}`;
+const dirOf = (root, skillName) => {
+	assertSafePathSegment(skillName, "skill name");
+	return `${root}/.webskill/versions/${skillName}`;
+};
 /** 版本存储：manifest 快照 + parentVersionId 链；回滚 = 追加新版本（谱系不断） */
 var SkillVersionStore = class {
 	#root;
@@ -394,6 +399,7 @@ var SkillVersionStore = class {
 			reason: input.reason,
 			manifest: input.manifest
 		};
+		assertSafePathSegment(version.versionId, "version id");
 		await this.#fs.writeText(`${dirOf(this.#root, skillName)}/${version.versionId}.json`, JSON.stringify(version, null, 2));
 		return version;
 	}
@@ -408,6 +414,7 @@ var SkillVersionStore = class {
 		return out.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
 	}
 	async get(skillName, versionId) {
+		assertSafePathSegment(versionId, "version id");
 		const path = `${dirOf(this.#root, skillName)}/${versionId}.json`;
 		if (!await this.#fs.exists(path)) throw new WebSkillError("GOVERNANCE_FAILED", `Version "${versionId}" of skill "${skillName}" not found`);
 		return JSON.parse(await this.#fs.readText(path));
@@ -535,12 +542,14 @@ var SkillStatePolicy = class {
 		await this.#fs.writeText(fileOf(this.#root), JSON.stringify(data, null, 2));
 	}
 	async getState(skillName) {
+		assertSafePathSegment(skillName, "skill name");
 		return (await this.#load()).states[skillName] ?? "active";
 	}
 	async listStates() {
 		return { ...(await this.#load()).states };
 	}
 	async setState(skillName, state, input) {
+		assertSafePathSegment(skillName, "skill name");
 		const data = await this.#load();
 		data.states[skillName] = state;
 		if (state === "active") delete data.failures[skillName];
@@ -554,6 +563,7 @@ var SkillStatePolicy = class {
 	}
 	/** 失败计数；达阈值（默认 3）→ quarantined + 审计 */
 	async recordFailure(skillName, input = {}) {
+		assertSafePathSegment(skillName, "skill name");
 		const data = await this.#load();
 		const count = (data.failures[skillName] ?? 0) + 1;
 		data.failures[skillName] = count;
@@ -580,6 +590,21 @@ var SkillStatePolicy = class {
 	canExecute(state) {
 		return state === "active" || state === "deprecated";
 	}
+	/**
+	* runtime SkillStateGuard 适配（0.1.5 一致拦截）：
+	* canRead：active/deprecated 放行；canActivate/canExecute 与 canRoute/canExecute 语义对齐；
+	* quarantined/disabled 三入口全拦截。
+	*/
+	toSkillStateGuard() {
+		return {
+			canRead: async (skillName) => {
+				const state = await this.getState(skillName);
+				return state === "active" || state === "deprecated";
+			},
+			canActivate: async (skillName) => this.canRoute(await this.getState(skillName)),
+			canExecute: async (skillName) => this.canExecute(await this.getState(skillName))
+		};
+	}
 	/** disabled → SKILL_DISABLED；quarantined → SKILL_QUARANTINED */
 	async assertExecutable(skillName) {
 		const state = await this.getState(skillName);
@@ -621,17 +646,22 @@ function matchExpected(expected, output, run) {
 	if (typeof expected === "string") return output.includes(expected);
 	return expected(output, run);
 }
-/** 批量评估：顺序执行（单任务异常不中断批）；expected 参与判定；结构化报告 */
+/** 批量评估：顺序执行（单任务异常不中断批）；expected 参与判定；结构化报告。
+*  注意：评估会真实执行技能脚本（试用路径）——必须显式 opt-in（allowExecution: true），
+*  且沙箱执行器是能力面收敛而非安全边界，禁止对不可信候选技能直接跑评估。 */
 var EvaluationRunner = class {
 	#runtime;
+	#allowExecution;
 	#now;
 	#createId;
 	constructor(deps) {
 		this.#runtime = deps.runtime;
+		this.#allowExecution = deps.allowExecution ?? false;
 		this.#now = deps.now;
 		this.#createId = deps.createId;
 	}
 	async run(tasks) {
+		if (!this.#allowExecution) throw new WebSkillError("GOVERNANCE_FAILED", "EvaluationRunner executes skill scripts; pass allowExecution: true to opt in (sandbox executors are capability-reducing, not a security boundary)");
 		const results = [];
 		for (const task of tasks) try {
 			const { output, run } = await this.#runtime.run(task.prompt);

package/dist/{index-CPuwsnmB.d.ts → index-Bun1aEf4.d.ts}

@@ -1,12 +1,19 @@
-import { C as JsonSchema, H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, S as FileSystemProvider, W as VerifyResult, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, x as FileStat } from "./types-CgNC-oQu-Dq_A1yA-.js";
-import { $ as ToolDefinition, N as NetworkPolicy, X as ScriptExecutionContext, Y as SchemaInferer, Z as ScriptExecutor, b as FsArtifactStore, d as BridgeCapabilities, tt as ToolResult, u as ApprovalScope, x as FsMemoryStore } from "./index-CqMuvcb2.js";
+import { C as FileStat, I as SkillInstallSource, K as VerifyResult, T as JsonSchema, W as SkillsLockfile, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CgNC-oQu-DEcIBJKG.js";
+import { N as NetworkPolicy, X as ScriptExecutionContext, Y as SchemaInferer, Z as ScriptExecutor, b as FsArtifactStore, d as BridgeCapabilities, et as ToolDefinition, nt as ToolResult, u as ApprovalScope, x as FsMemoryStore } from "./index-COuOu6gw.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts
 //#region src/fs/nodeFs.d.ts
-/** 基于 node:fs/promises 的 FileSystemProvider；接受 `/` 风格路径，写入自动创建父目录 */
+/**
+ * 基于 node:fs/promises 的 FileSystemProvider；接受 `/` 风格路径，写入自动创建父目录。
+ * 可选 root 模式：构造传入 root 后，read/write 操作先做 realpath 包含校验
+ * （root 与目标都 realpath 后前缀比对），经符号链接逃逸 root → FS_PATH_OUTSIDE_ROOT。
+ */
 declare class NodeFS implements FileSystemProvider {
   #private;
   readonly kind = "node";
+  constructor(deps?: {
+    root?: string;
+  });
   readText(p: string): Promise<string>;
   writeText(p: string, content: string): Promise<void>;
   readBinary(p: string): Promise<Uint8Array>;
@@ -50,6 +57,8 @@ interface SandboxOptions {
   capabilities?: BridgeCapabilities;
   /** 网络策略：默认 'deny-all'（白名单见 runtime/sandbox/networkPolicy） */
   networkPolicy?: NetworkPolicy;
+  /** 裸模块 allowlist（默认 []：一切 node: 内置模块全禁；按需放行如 ['node:path']） */
+  allowedModules?: string[];
   /** require-approval 模式的授权询问出口（缺失时 require-approval 一律拒绝） */
   uiBridge?: UiBridge;
   /** 授权粒度：默认 'once-per-run' */
@@ -60,6 +69,10 @@ interface SandboxOptions {
  * 每次执行独立 Worker（resourceLimits + env 白名单），loadDefinition 同样在
  * Worker 内完成（禁止主进程 import 不可信脚本）；超时 terminate（可杀同步死循环）。
  * 能力桥协议与浏览器同一来源（runtime/sandbox/bridgeProtocol）。
+ *
+ * 诚实标注：本执行器做的是**能力面收敛**（网络策略、模块 allowlist、资源限额、
+ * 超时强杀），**不是安全边界**——Worker 内脚本与宿主共享进程，仍有绕过手段；
+ * 禁止假定其可隔离不可信脚本。
  */
 declare class SandboxedScriptExecutor implements ScriptExecutor {
   #private;
@@ -145,6 +158,10 @@ declare class SkillManager {
     fetchImpl?: typeof fetch;
     /** D2 安装期 schema 预推导（默认 true，可关） */
     schemaInference?: boolean;
+    /** 归档体积三重上限（缺省 DEFAULT_ARCHIVE_LIMITS） */
+    archiveLimits?: ArchiveLimits;
+    /** install/uninstall 成功后的变更回调（宿主接线缓存失效，如 WebSkillRuntime.invalidate） */
+    onChanged?: () => void;
   });
   install(source: SkillInstallSource, options?: {
     expectedSha256?: string;

package/dist/{index-CqMuvcb2.d.ts → index-COuOu6gw.d.ts}

@@ -1,4 +1,4 @@
-import { A as SkillCatalog, C as JsonSchema, L as SkillManifest, M as SkillDiscovery, N as SkillDocument, P as SkillInstallSource, S as FileSystemProvider, U as ValidationReport, _ as RenderResultRequest, a as InteractionPolicy, b as DiscoveryResult, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, j as SkillCatalogEntry, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { F as SkillDocument, G as ValidationReport, I as SkillInstallSource, M as SkillCatalog, N as SkillCatalogEntry, P as SkillDiscovery, S as DiscoveryResult, T as JsonSchema, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CgNC-oQu-DEcIBJKG.js";
 //#region ../runtime/dist/index.d.ts
 //#region src/llm/openAiCompatibleClient.d.ts
 interface OpenAiCompatibleClientConfig {
@@ -263,6 +263,14 @@ interface AgentLoopConfig {
   temperature?: number;
   /** 设为 'off' 时完成 run 不调用 uiBridge.renderResult */
   renderResult?: 'off';
+  /** 工具结果回喂上限（字节，默认 100_000；超长头尾保留 + 完整内容落 artifact） */
+  toolResultMaxBytes?: number;
+}
+/** 技能状态拦截 port（治理装配；无注入默认全放行） */
+interface SkillStateGuard {
+  canRead?(skillName: string): boolean | Promise<boolean>;
+  canActivate?(skillName: string): boolean | Promise<boolean>;
+  canExecute?(skillName: string): boolean | Promise<boolean>;
 }
 interface RuntimeSession {
   id: string;
@@ -657,6 +665,8 @@ interface AgentLoopDeps {
   skillProviders?: ExternalSkillProvider[];
   /** Catalog 过滤钩子（治理状态拦截路由，如 quarantined/deprecated 过滤） */
   catalogFilter?: (entries: SkillCatalogEntry[]) => SkillCatalogEntry[] | Promise<SkillCatalogEntry[]>;
+  /** 技能状态拦截（read/activate/execute 三入口一致执行；无注入默认全放行） */
+  skillStateGuard?: SkillStateGuard;
   /** D3：interrupt 点快照存储（无配置则行为与现状完全一致） */
   snapshotStore?: RunSnapshotStore;
 }
@@ -719,6 +729,8 @@ interface WebSkillRuntimeDeps {
   }) => Promise<void>;
   /** D3：interrupt 点快照存储（配置后 interrupted run 可 resumeRun 恢复） */
   snapshotStore?: RunSnapshotStore;
+  /** 技能状态拦截 port（治理 SkillStatePolicy.toSkillStateGuard 装配；无注入默认全放行） */
+  skillStateGuard?: SkillStateGuard;
 }
 /**
  * runtime 门面：组合 discovery / router / agent loop / lifecycle
@@ -730,6 +742,11 @@ declare class WebSkillRuntime {
   get session(): RuntimeSession;
   /** 生命周期事件总线（只读观测） */
   get events(): EventBus;
+  /**
+   * Catalog 缓存失效：下次 run/discover 重新扫描技能目录。
+   * 与 SkillManager onChanged 接线：`new SkillManager({ ..., onChanged: () => runtime.invalidate() })`。
+   */
+  invalidate(): void;
   discover(): Promise<DiscoveryResult>;
   run(userPrompt: string): Promise<RunResult>;
   /** D3：列出可恢复的 interrupted run（供 UI 展示"未完成任务"） */
@@ -743,4 +760,4 @@ declare class WebSkillRuntime {
   resumeRun(runId: string): Promise<RunResult>;
 }
 //#endregion
-export { ToolDefinition as $, LifecycleHook as A, RUN_SNAPSHOT_SCHEMA_VERSION as B, FullDisclosureRouter as C, schemaToForm as Ct, HookRunnerOptions as D, HookRunner as E, OpenAiCompatibleClientConfig as F, RunTerminationReason as G, RunResult as H, ProgressiveRouter as I, RuntimeSession as J, RuntimePhase as K, READ_SKILL_FILE_INPUT_SCHEMA as L, LifecycleListener as M, NetworkPolicy as N, InstalledSkillManifest as O, OpenAiCompatibleClient as P, SkillRouter as Q, READ_SKILL_FILE_TOOL as R, FsRunSnapshotStore as S, resolveToolName as St, GoogleGenAiClientConfig as T, toVercelToolSpecs as Tt, RunSnapshot as U, RouteResult as V, RunSnapshotStore as W, ScriptExecutionContext as X, SchemaInferer as Y, ScriptExecutor as Z, EventBus as _, isNetworkAllowed as _t, AgentLoopConfig as a, TraceRecorder as at, FsArtifactStore as b, normalizeToolContent as bt, AnthropicClientConfig as c, WebSkillRuntime as ct, BridgeCapabilities as d, buildRenderResult as dt, ToolResolution as et, BridgeCapability as f, createScriptContext as ft, CapabilityMode as g, fromVercelStreamPart as gt, CapabilityApproval as h, fromVercelResult as ht, AgentLoop as i, TraceEventType as it, LifecycleHookContext as j, LifecycleEvent as k, ApprovalDecision as l, WebSkillRuntimeDeps as lt, BridgeResponse as m, extractChartSpec as mt, ASK_USER_TOOL as n, TraceClock as nt, AgentLoopDeps as o, VercelToolSpec as ot, BridgeRequest as p, createWebSkillApi as pt, RuntimeRun as q, ASK_USER_TOOL_NAME as r, TraceEvent as rt, AnthropicClient as s, WebSkillApi as st, ASK_USER_INPUT_SCHEMA as t, ToolResult as tt, ApprovalScope as u, bridgeError as ut, ExternalSkillProvider as v, mergeCatalogEntries as vt, GoogleGenAiClient as w, toLlmToolSpec as wt, FsMemoryStore as x, parseBridgeRequest as xt, ExternalToolSource as y, networkUrlHost as yt, READ_SKILL_FILE_TOOL_NAME as z };
+export { SkillStateGuard as $, LifecycleHook as A, RUN_SNAPSHOT_SCHEMA_VERSION as B, FullDisclosureRouter as C, resolveToolName as Ct, HookRunnerOptions as D, HookRunner as E, toVercelToolSpecs as Et, OpenAiCompatibleClientConfig as F, RunTerminationReason as G, RunResult as H, ProgressiveRouter as I, RuntimeSession as J, RuntimePhase as K, READ_SKILL_FILE_INPUT_SCHEMA as L, LifecycleListener as M, NetworkPolicy as N, InstalledSkillManifest as O, OpenAiCompatibleClient as P, SkillRouter as Q, READ_SKILL_FILE_TOOL as R, FsRunSnapshotStore as S, parseBridgeRequest as St, GoogleGenAiClientConfig as T, toLlmToolSpec as Tt, RunSnapshot as U, RouteResult as V, RunSnapshotStore as W, ScriptExecutionContext as X, SchemaInferer as Y, ScriptExecutor as Z, EventBus as _, fromVercelStreamPart as _t, AgentLoopConfig as a, TraceEventType as at, FsArtifactStore as b, networkUrlHost as bt, AnthropicClientConfig as c, WebSkillApi as ct, BridgeCapabilities as d, bridgeError as dt, ToolDefinition as et, BridgeCapability as f, buildRenderResult as ft, CapabilityMode as g, fromVercelResult as gt, CapabilityApproval as h, extractChartSpec as ht, AgentLoop as i, TraceEvent as it, LifecycleHookContext as j, LifecycleEvent as k, ApprovalDecision as l, WebSkillRuntime as lt, BridgeResponse as m, createWebSkillApi as mt, ASK_USER_TOOL as n, ToolResult as nt, AgentLoopDeps as o, TraceRecorder as ot, BridgeRequest as p, createScriptContext as pt, RuntimeRun as q, ASK_USER_TOOL_NAME as r, TraceClock as rt, AnthropicClient as s, VercelToolSpec as st, ASK_USER_INPUT_SCHEMA as t, ToolResolution as tt, ApprovalScope as u, WebSkillRuntimeDeps as ut, ExternalSkillProvider as v, isNetworkAllowed as vt, GoogleGenAiClient as w, schemaToForm as wt, FsMemoryStore as x, normalizeToolContent as xt, ExternalToolSource as y, mergeCatalogEntries as yt, READ_SKILL_FILE_TOOL_NAME as z };

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { $ as exportSkills, A as SkillCatalog, B as SkillReader, C as JsonSchema, D as SKILL_NAME_MAX_LENGTH, E as SKILL_MANIFEST_FILE, F as SkillIssue, G as WebSkillError, H as SkillsLockfile, I as SkillLocation, J as buildManifest, K as WebSkillErrorCode, L as SkillManifest, M as SkillDiscovery, N as SkillDocument, O as SKILL_NAME_PATTERN, P as SkillInstallSource, Q as escapeXml, R as SkillMetadata, S as FileSystemProvider, T as SKILLS_LOCKFILE, U as ValidationReport, V as SkillSource, W as VerifyResult, X as checkSkillRules, Y as checkDependencyCycles, Z as computeDigest, _ as RenderResultRequest, a as InteractionPolicy, at as renderAvailableSkillsXml, b as DiscoveryResult, c as LlmClient, ct as validateSkills, d as LlmResponse, et as isValidSkillName, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, it as parseSkillPackManifest, j as SkillCatalogEntry, k as SKILL_PACK_FILE, l as LlmCompleteInput, lt as verifyManifest, m as LlmToolSpec, n as ArtifactStore, nt as normalizePath, o as InteractionRequest, ot as renderCatalogJson, p as LlmToolCall, q as buildCatalog, r as ChartSpec, rt as parseSkillMarkdown, s as InteractionResponse, st as resolveInsideRoot, t as Artifact, tt as jsonRenderer, u as LlmMessage, ut as xmlRenderer, v as UiBridge, w as MemoryFS, x as FileStat, y as CatalogRenderer, z as SkillPackManifest } from "./types-CgNC-oQu-Dq_A1yA-.js";
-import { $ as ToolDefinition, A as LifecycleHook, B as RUN_SNAPSHOT_SCHEMA_VERSION, C as FullDisclosureRouter, Ct as schemaToForm, D as HookRunnerOptions, E as HookRunner, F as OpenAiCompatibleClientConfig, G as RunTerminationReason, H as RunResult, I as ProgressiveRouter, J as RuntimeSession, K as RuntimePhase, L as READ_SKILL_FILE_INPUT_SCHEMA, M as LifecycleListener, N as NetworkPolicy, O as InstalledSkillManifest, P as OpenAiCompatibleClient, Q as SkillRouter, R as READ_SKILL_FILE_TOOL, S as FsRunSnapshotStore, St as resolveToolName, T as GoogleGenAiClientConfig, Tt as toVercelToolSpecs, U as RunSnapshot, V as RouteResult, W as RunSnapshotStore, X as ScriptExecutionContext, Y as SchemaInferer, Z as ScriptExecutor, _ as EventBus, _t as isNetworkAllowed, a as AgentLoopConfig, at as TraceRecorder, b as FsArtifactStore, bt as normalizeToolContent, c as AnthropicClientConfig, ct as WebSkillRuntime, d as BridgeCapabilities, dt as buildRenderResult, et as ToolResolution, f as BridgeCapability, ft as createScriptContext, g as CapabilityMode, gt as fromVercelStreamPart, h as CapabilityApproval, ht as fromVercelResult, i as AgentLoop, it as TraceEventType, j as LifecycleHookContext, k as LifecycleEvent, l as ApprovalDecision, lt as WebSkillRuntimeDeps, m as BridgeResponse, mt as extractChartSpec, n as ASK_USER_TOOL, nt as TraceClock, o as AgentLoopDeps, ot as VercelToolSpec, p as BridgeRequest, pt as createWebSkillApi, q as RuntimeRun, r as ASK_USER_TOOL_NAME, rt as TraceEvent, s as AnthropicClient, st as WebSkillApi, t as ASK_USER_INPUT_SCHEMA, tt as ToolResult, u as ApprovalScope, ut as bridgeError, v as ExternalSkillProvider, vt as mergeCatalogEntries, w as GoogleGenAiClient, wt as toLlmToolSpec, x as FsMemoryStore, xt as parseBridgeRequest, y as ExternalToolSource, yt as networkUrlHost, z as READ_SKILL_FILE_TOOL_NAME } from "./index-CqMuvcb2.js";
-export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, type SkillPackManifest, SkillReader, type SkillRouter, type SkillSource, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, renderAvailableSkillsXml, renderCatalogJson, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, validateSkills, verifyManifest, xmlRenderer };
+import { $ as checkSkillRules, A as SKILL_NAME_PATTERN, B as SkillMetadata, C as FileStat, D as SKILLS_LOCKFILE, E as MemoryFS, F as SkillDocument, G as ValidationReport, H as SkillReader, I as SkillInstallSource, J as WebSkillErrorCode, K as VerifyResult, L as SkillIssue, M as SkillCatalog, N as SkillCatalogEntry, O as SKILL_MANIFEST_FILE, P as SkillDiscovery, Q as checkDependencyCycles, R as SkillLocation, S as DiscoveryResult, T as JsonSchema, U as SkillSource, V as SkillPackManifest, W as SkillsLockfile, X as buildCatalog, Y as assertSafePathSegment, Z as buildManifest, _ as RenderResultRequest, a as InteractionPolicy, at as normalizePath, b as CatalogRenderer, c as LlmClient, ct as readResponseWithLimit, d as LlmResponse, dt as resolveArchiveLimits, et as computeDigest, f as LlmStreamEvent, ft as resolveInsideRoot, g as RenderBlock, gt as xmlRenderer, h as MemoryStore, ht as verifyManifest, i as FormField, it as jsonRenderer, j as SKILL_PACK_FILE, k as SKILL_NAME_MAX_LENGTH, l as LlmCompleteInput, lt as renderAvailableSkillsXml, m as LlmToolSpec, mt as validateSkills, n as ArtifactStore, nt as exportSkills, o as InteractionRequest, ot as parseSkillMarkdown, p as LlmToolCall, pt as unzipWithLimits, q as WebSkillError, r as ChartSpec, rt as isValidSkillName, s as InteractionResponse, st as parseSkillPackManifest, t as Artifact, tt as escapeXml, u as LlmMessage, ut as renderCatalogJson, v as UiBridge, w as FileSystemProvider, x as DEFAULT_ARCHIVE_LIMITS, y as ArchiveLimits, z as SkillManifest } from "./types-CgNC-oQu-DEcIBJKG.js";
+import { $ as SkillStateGuard, A as LifecycleHook, B as RUN_SNAPSHOT_SCHEMA_VERSION, C as FullDisclosureRouter, Ct as resolveToolName, D as HookRunnerOptions, E as HookRunner, Et as toVercelToolSpecs, F as OpenAiCompatibleClientConfig, G as RunTerminationReason, H as RunResult, I as ProgressiveRouter, J as RuntimeSession, K as RuntimePhase, L as READ_SKILL_FILE_INPUT_SCHEMA, M as LifecycleListener, N as NetworkPolicy, O as InstalledSkillManifest, P as OpenAiCompatibleClient, Q as SkillRouter, R as READ_SKILL_FILE_TOOL, S as FsRunSnapshotStore, St as parseBridgeRequest, T as GoogleGenAiClientConfig, Tt as toLlmToolSpec, U as RunSnapshot, V as RouteResult, W as RunSnapshotStore, X as ScriptExecutionContext, Y as SchemaInferer, Z as ScriptExecutor, _ as EventBus, _t as fromVercelStreamPart, a as AgentLoopConfig, at as TraceEventType, b as FsArtifactStore, bt as networkUrlHost, c as AnthropicClientConfig, ct as WebSkillApi, d as BridgeCapabilities, dt as bridgeError, et as ToolDefinition, f as BridgeCapability, ft as buildRenderResult, g as CapabilityMode, gt as fromVercelResult, h as CapabilityApproval, ht as extractChartSpec, i as AgentLoop, it as TraceEvent, j as LifecycleHookContext, k as LifecycleEvent, l as ApprovalDecision, lt as WebSkillRuntime, m as BridgeResponse, mt as createWebSkillApi, n as ASK_USER_TOOL, nt as ToolResult, o as AgentLoopDeps, ot as TraceRecorder, p as BridgeRequest, pt as createScriptContext, q as RuntimeRun, r as ASK_USER_TOOL_NAME, rt as TraceClock, s as AnthropicClient, st as VercelToolSpec, t as ASK_USER_INPUT_SCHEMA, tt as ToolResolution, u as ApprovalScope, ut as WebSkillRuntimeDeps, v as ExternalSkillProvider, vt as isNetworkAllowed, w as GoogleGenAiClient, wt as schemaToForm, x as FsMemoryStore, xt as normalizeToolContent, y as ExternalToolSource, yt as mergeCatalogEntries, z as READ_SKILL_FILE_TOOL_NAME } from "./index-COuOu6gw.js";
+export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type ArchiveLimits, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, DEFAULT_ARCHIVE_LIMITS, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, type SkillPackManifest, SkillReader, type SkillRouter, type SkillSource, type SkillStateGuard, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, assertSafePathSegment, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { C as renderCatalogJson, D as xmlRenderer, E as verifyManifest, S as renderAvailableSkillsXml, T as validateSkills, _ as isValidSkillName, a as SKILL_NAME_PATTERN, b as parseSkillMarkdown, c as SkillReader, d as buildManifest, f as checkDependencyCycles, g as exportSkills, h as escapeXml, i as SKILL_NAME_MAX_LENGTH, l as WebSkillError, m as computeDigest, n as SKILLS_LOCKFILE, o as SKILL_PACK_FILE, p as checkSkillRules, r as SKILL_MANIFEST_FILE, s as SkillDiscovery, t as MemoryFS, u as buildCatalog, v as jsonRenderer, w as resolveInsideRoot, x as parseSkillPackManifest, y as normalizePath } from "./dist-DS1sfgHa.js";
-import { A as mergeCatalogEntries, C as buildRenderResult, D as fromVercelResult, E as extractChartSpec, F as schemaToForm, I as toLlmToolSpec, L as toVercelToolSpecs, M as normalizeToolContent, N as parseBridgeRequest, O as fromVercelStreamPart, P as resolveToolName, S as bridgeError, T as createWebSkillApi, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as TraceRecorder, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as networkUrlHost, k as isNetworkAllowed, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as createScriptContext, x as WebSkillRuntime, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-DZobLFh6.js";
+import { A as validateSkills, C as parseSkillPackManifest, D as resolveArchiveLimits, E as renderCatalogJson, M as xmlRenderer, O as resolveInsideRoot, S as parseSkillMarkdown, T as renderAvailableSkillsXml, _ as escapeXml, a as SKILL_NAME_MAX_LENGTH, b as jsonRenderer, c as SkillDiscovery, d as assertSafePathSegment, f as buildCatalog, g as computeDigest, h as checkSkillRules, i as SKILL_MANIFEST_FILE, j as verifyManifest, k as unzipWithLimits, l as SkillReader, m as checkDependencyCycles, n as MemoryFS, o as SKILL_NAME_PATTERN, p as buildManifest, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, t as DEFAULT_ARCHIVE_LIMITS, u as WebSkillError, v as exportSkills, w as readResponseWithLimit, x as normalizePath, y as isValidSkillName } from "./dist-fZFZaf43.js";
+import { A as mergeCatalogEntries, C as buildRenderResult, D as fromVercelResult, E as extractChartSpec, F as schemaToForm, I as toLlmToolSpec, L as toVercelToolSpecs, M as normalizeToolContent, N as parseBridgeRequest, O as fromVercelStreamPart, P as resolveToolName, S as bridgeError, T as createWebSkillApi, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as TraceRecorder, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as networkUrlHost, k as isNetworkAllowed, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as createScriptContext, x as WebSkillRuntime, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-DuGN5x0v.js";
 
-export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, AnthropicClient, CapabilityApproval, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, renderAvailableSkillsXml, renderCatalogJson, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, validateSkills, verifyManifest, xmlRenderer };
+export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, AnthropicClient, CapabilityApproval, DEFAULT_ARCHIVE_LIMITS, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, assertSafePathSegment, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
-import { C as JsonSchema, N as SkillDocument, j as SkillCatalogEntry, m as LlmToolSpec } from "./types-CgNC-oQu-Dq_A1yA-.js";
-import { tt as ToolResult, v as ExternalSkillProvider, vt as mergeCatalogEntries, y as ExternalToolSource } from "./index-CqMuvcb2.js";
+import { F as SkillDocument, N as SkillCatalogEntry, T as JsonSchema, m as LlmToolSpec } from "./types-CgNC-oQu-DEcIBJKG.js";
+import { nt as ToolResult, v as ExternalSkillProvider, y as ExternalToolSource, yt as mergeCatalogEntries } from "./index-COuOu6gw.js";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/dist/mcp.js

@@ -1,5 +1,5 @@
-import { l as WebSkillError } from "./dist-DS1sfgHa.js";
-import { A as mergeCatalogEntries, M as normalizeToolContent } from "./dist-DZobLFh6.js";
+import { u as WebSkillError } from "./dist-fZFZaf43.js";
+import { A as mergeCatalogEntries, M as normalizeToolContent } from "./dist-DuGN5x0v.js";
 import { fromJSONSchema } from "zod";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
@@ -44,6 +44,8 @@ var MessageChannelTransport = class {
 	onmessage;
 	#port;
 	#allowedOrigins;
+	/** 用户显式传入 allowedOrigins（区别于 window 环境自动推导）：空 origin 默认拒绝 */
+	#explicitOrigins;
 	#strictOrigin;
 	#connectionTimeoutMs;
 	#state = "idle";
@@ -53,6 +55,7 @@ var MessageChannelTransport = class {
 		this.#port = port;
 		this.#strictOrigin = options.strictOrigin ?? false;
 		this.#connectionTimeoutMs = options.connectionTimeoutMs ?? 0;
+		this.#explicitOrigins = options.allowedOrigins !== void 0;
 		if (options.allowedOrigins !== void 0) this.#allowedOrigins = options.allowedOrigins;
 		else {
 			const origin = currentOrigin();
@@ -92,7 +95,10 @@ var MessageChannelTransport = class {
 	#originAllowed(origin) {
 		if (this.#allowedOrigins === void 0) return true;
 		if (this.#allowedOrigins.includes("*")) return true;
-		if (origin === void 0 || origin === "") return !this.#strictOrigin;
+		if (origin === void 0 || origin === "") {
+			if (this.#explicitOrigins) return false;
+			return !this.#strictOrigin;
+		}
 		return this.#allowedOrigins.includes(origin);
 	}
 	#onInbound(event) {

package/dist/node.d.ts

@@ -1,4 +1,4 @@
-import { E as SKILL_MANIFEST_FILE, H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, T as SKILLS_LOCKFILE, W as VerifyResult } from "./types-CgNC-oQu-Dq_A1yA-.js";
-import { ft as createScriptContext } from "./index-CqMuvcb2.js";
-import { _ as readArchiveManifest, a as LlmEnvConfig, c as OxcSchemaInferer, d as SandboxedScriptExecutor, f as SkillManager, g as probeLlmCapabilities, h as loadLlmConfigFromEnv, i as LlmCapabilities, l as ProviderEnvConfig, m as loadGoogleConfigFromEnv, n as FileArtifactStore, o as NodeFS, p as loadAnthropicConfigFromEnv, r as FileMemoryStore, s as NodeScriptExecutor, t as CliUiBridge, u as SandboxOptions } from "./index-CPuwsnmB.js";
+import { D as SKILLS_LOCKFILE, I as SkillInstallSource, K as VerifyResult, O as SKILL_MANIFEST_FILE, W as SkillsLockfile, z as SkillManifest } from "./types-CgNC-oQu-DEcIBJKG.js";
+import { pt as createScriptContext } from "./index-COuOu6gw.js";
+import { _ as readArchiveManifest, a as LlmEnvConfig, c as OxcSchemaInferer, d as SandboxedScriptExecutor, f as SkillManager, g as probeLlmCapabilities, h as loadLlmConfigFromEnv, i as LlmCapabilities, l as ProviderEnvConfig, m as loadGoogleConfigFromEnv, n as FileArtifactStore, o as NodeFS, p as loadAnthropicConfigFromEnv, r as FileMemoryStore, s as NodeScriptExecutor, t as CliUiBridge, u as SandboxOptions } from "./index-Bun1aEf4.js";
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, type LlmCapabilities, type LlmEnvConfig, NodeFS, NodeScriptExecutor, OxcSchemaInferer, type ProviderEnvConfig, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, type SandboxOptions, SandboxedScriptExecutor, type SkillInstallSource, SkillManager, type SkillManifest, type SkillsLockfile, type VerifyResult, createScriptContext, loadAnthropicConfigFromEnv, loadGoogleConfigFromEnv, loadLlmConfigFromEnv, probeLlmCapabilities, readArchiveManifest };

package/dist/node.js

@@ -1,5 +1,5 @@
-import { n as SKILLS_LOCKFILE, r as SKILL_MANIFEST_FILE } from "./dist-DS1sfgHa.js";
-import { w as createScriptContext } from "./dist-DZobLFh6.js";
-import { a as NodeScriptExecutor, c as SkillManager, d as loadLlmConfigFromEnv, f as probeLlmCapabilities, i as NodeFS, l as loadAnthropicConfigFromEnv, n as FileArtifactStore, o as OxcSchemaInferer, p as readArchiveManifest, r as FileMemoryStore, s as SandboxedScriptExecutor, t as CliUiBridge, u as loadGoogleConfigFromEnv } from "./dist-Cm_j6Jol.js";
+import { i as SKILL_MANIFEST_FILE, r as SKILLS_LOCKFILE } from "./dist-fZFZaf43.js";
+import { w as createScriptContext } from "./dist-DuGN5x0v.js";
+import { a as NodeScriptExecutor, c as SkillManager, d as loadLlmConfigFromEnv, f as probeLlmCapabilities, i as NodeFS, l as loadAnthropicConfigFromEnv, n as FileArtifactStore, o as OxcSchemaInferer, p as readArchiveManifest, r as FileMemoryStore, s as SandboxedScriptExecutor, t as CliUiBridge, u as loadGoogleConfigFromEnv } from "./dist-LIFS3ZjI.js";
 
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, NodeFS, NodeScriptExecutor, OxcSchemaInferer, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SandboxedScriptExecutor, SkillManager, createScriptContext, loadAnthropicConfigFromEnv, loadGoogleConfigFromEnv, loadLlmConfigFromEnv, probeLlmCapabilities, readArchiveManifest };

package/dist/sandboxWorkerEntry.d.ts

@@ -0,0 +1 @@
+export {}