@webskill/sdk 0.1.4 → 0.1.5

package/dist/{dist-BVXZF7H_.js → dist-LIFS3ZjI.js}

@@ -1,21 +1,21 @@
-import { D as verifyManifest, E as validateSkills, S as parseSkillPackManifest, T as resolveInsideRoot, _ as exportSkills, f as buildManifest, l as WebSkillError, n as SKILLS_LOCKFILE, o as SKILL_PACK_FILE, r as SKILL_MANIFEST_FILE, v as isValidSkillName, x as parseSkillMarkdown } from "./dist-DvoBsChX.js";
-import { M as normalizeToolContent, N as parseBridgeRequest, S as bridgeError, c as FsArtifactStore, j as networkUrlHost, k as isNetworkAllowed, l as FsMemoryStore, o as CapabilityApproval } from "./dist-DAn07zHu.js";
+import { A as validateSkills, C as parseSkillPackManifest, D as resolveArchiveLimits, O as resolveInsideRoot, S as parseSkillMarkdown, i as SKILL_MANIFEST_FILE, j as verifyManifest, k as unzipWithLimits, p as buildManifest, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, v as exportSkills, w as readResponseWithLimit, y as isValidSkillName } from "./dist-fZFZaf43.js";
+import { M as normalizeToolContent, N as parseBridgeRequest, S as bridgeError, c as FsArtifactStore, j as networkUrlHost, k as isNetworkAllowed, l as FsMemoryStore, o as CapabilityApproval } from "./dist-DuGN5x0v.js";
 import { unzipSync, zipSync } from "fflate";
 import { existsSync, promises, readFileSync } from "node:fs";
 import path from "node:path";
+import { tmpdir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { format, promisify } from "node:util";
 import { Worker } from "node:worker_threads";
 import { parseSync } from "oxc-parser";
 import { createInterface } from "node:readline/promises";
 import { mkdtemp } from "node:fs/promises";
-import { tmpdir } from "node:os";
 import * as tar from "tar";
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 
 //#region ../node/dist/index.js
-const toPlatform$4 = (p) => p.split("/").join(path.sep);
+const toPlatform$3 = (p) => p.split("/").join(path.sep);
 const toPosix = (p) => p.split(path.sep).join("/");
 const isEnoent = (e) => typeof e === "object" && e !== null && e.code === "ENOENT";
 /** realpath 最近现存祖先并拼回剩余段（写入目标尚不存在时的等价判定） */
@@ -47,41 +47,41 @@ var NodeFS = class {
 	/** root 模式：目标 realpath 必须落在 root realpath 前缀内（符号链接逃逸防护） */
 	async #assertContained(p) {
 		if (!this.#root) return;
-		const rootReal = await promises.realpath(toPlatform$4(this.#root));
-		const targetReal = await realpathNearest(toPlatform$4(p));
+		const rootReal = await promises.realpath(toPlatform$3(this.#root));
+		const targetReal = await realpathNearest(toPlatform$3(p));
 		if (targetReal !== rootReal && !targetReal.startsWith(rootReal + path.sep)) throw new WebSkillError("FS_PATH_OUTSIDE_ROOT", `Path escapes root via symbolic link: ${p} (resolves outside ${this.#root})`);
 	}
 	async readText(p) {
 		await this.#assertContained(p);
 		try {
-			return await promises.readFile(toPlatform$4(p), "utf8");
+			return await promises.readFile(toPlatform$3(p), "utf8");
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 	}
 	async writeText(p, content) {
 		await this.#assertContained(p);
-		const target = toPlatform$4(p);
+		const target = toPlatform$3(p);
 		await promises.mkdir(path.dirname(target), { recursive: true });
 		await promises.writeFile(target, content, "utf8");
 	}
 	async readBinary(p) {
 		await this.#assertContained(p);
 		try {
-			return await promises.readFile(toPlatform$4(p));
+			return await promises.readFile(toPlatform$3(p));
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 	}
 	async writeBinary(p, content) {
 		await this.#assertContained(p);
-		const target = toPlatform$4(p);
+		const target = toPlatform$3(p);
 		await promises.mkdir(path.dirname(target), { recursive: true });
 		await promises.writeFile(target, content);
 	}
 	async exists(p) {
 		try {
-			await promises.access(toPlatform$4(p));
+			await promises.access(toPlatform$3(p));
 			return true;
 		} catch {
 			return false;
@@ -89,7 +89,7 @@ var NodeFS = class {
 	}
 	async stat(p) {
 		try {
-			const s = await promises.stat(toPlatform$4(p));
+			const s = await promises.stat(toPlatform$3(p));
 			return {
 				path: toPosix(p),
 				type: s.isDirectory() ? "directory" : "file",
@@ -103,21 +103,21 @@ var NodeFS = class {
 	async list(p) {
 		let dirents;
 		try {
-			dirents = await promises.readdir(toPlatform$4(p), { withFileTypes: true });
+			dirents = await promises.readdir(toPlatform$3(p), { withFileTypes: true });
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 		return dirents.map((d) => ({
-			path: toPosix(path.join(toPlatform$4(p), d.name)),
+			path: toPosix(path.join(toPlatform$3(p), d.name)),
 			type: d.isDirectory() ? "directory" : "file"
 		}));
 	}
 	async mkdir(p) {
-		await promises.mkdir(toPlatform$4(p), { recursive: true });
+		await promises.mkdir(toPlatform$3(p), { recursive: true });
 	}
 	async remove(p, options) {
 		try {
-			await promises.rm(toPlatform$4(p), { recursive: options?.recursive ?? false });
+			await promises.rm(toPlatform$3(p), { recursive: options?.recursive ?? false });
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
@@ -128,7 +128,6 @@ var NodeFS = class {
 	}
 };
 const baseName$1 = (p) => p.split("/").pop() ?? p;
-const toPlatform$3 = (p) => p.split("/").join(path.sep);
 /**
 * 进程内脚本执行器。接口按沙箱语义设计（context 无隐式宿主访问），
 * worker_threads 沙箱见 deferred-items D1。
@@ -148,7 +147,22 @@ var NodeScriptExecutor = class {
 		return hasTs ? tsPath : jsPath;
 	}
 	async #loadModule(scriptPath) {
-		return await import(`${pathToFileURL(toPlatform$3(scriptPath)).href}?t=${Date.now()}`);
+		if (scriptPath.endsWith(".ts")) {
+			const source = await this.#fs.readText(scriptPath);
+			const dir = await promises.mkdtemp(path.join(tmpdir(), "webskill-ts-"));
+			try {
+				const file = path.join(dir, "script.ts");
+				await promises.writeFile(file, source);
+				return await import(`${pathToFileURL(file).href}?t=${Date.now()}`);
+			} finally {
+				await promises.rm(dir, {
+					recursive: true,
+					force: true
+				});
+			}
+		}
+		const source = await this.#fs.readText(scriptPath);
+		return await import(`data:text/javascript;charset=utf-8,${encodeURIComponent(`${source}\n//# ${Date.now()}`)}`);
 	}
 	async loadDefinition(skillRoot, scriptName) {
 		const scriptPath = await this.#locateScript(skillRoot, scriptName);
@@ -319,7 +333,8 @@ var SandboxedScriptExecutor = class {
 		const result = await this.#runWorker({
 			mode: "load",
 			scriptPath: toPlatform$2(scriptPath),
-			scriptName
+			scriptName,
+			scriptSource: await this.#fs.readText(scriptPath)
 		});
 		if (!result.ok) throw new WebSkillError("TOOL_EXECUTION_FAILED", `Failed to load script "${scriptName}": ${result.error?.message ?? "unknown error"}`);
 		return {
@@ -352,7 +367,8 @@ var SandboxedScriptExecutor = class {
 				scriptName,
 				skillName: context.skillName,
 				runId: context.runId,
-				args
+				args,
+				scriptSource: await this.#fs.readText(scriptPath)
 			}, timeoutMs, (request) => this.#handleBridge(request, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!result.ok) {
 				const stderrSummary = result.stderr?.length ? ` | stderr: ${result.stderr.join(" | ").slice(0, 500)}` : "";
@@ -818,33 +834,33 @@ const messageOf$4 = (e) => e instanceof Error ? e.message : String(e);
 const toPlatform$1 = (p) => p.split("/").join(path.sep);
 const isZipArchive = (data) => data.length > 1 && data[0] === 80 && data[1] === 75;
 /**
-* zip 解包（fflate）。每个条目路径过 resolveInsideRoot：
+* zip 解包（fflate 流式，单条目/总解压体积上限）。每个条目路径过 resolveInsideRoot：
 * 拒绝 `..` 段、绝对路径、反斜杠穿越（zip-slip 防护）。
 */
-async function extractZipData(fs, data, destRoot) {
-	let entries;
-	try {
-		entries = unzipSync(data);
-	} catch (e) {
-		throw new WebSkillError("INSTALL_FAILED", `Failed to read zip archive: ${messageOf$4(e)}`, e);
-	}
-	for (const [entryPath, content] of Object.entries(entries)) {
+async function extractZipData(fs, data, destRoot, limits) {
+	for (const [entryPath, content] of await unzipWithLimits(data, limits)) {
 		const target = resolveInsideRoot(destRoot, entryPath);
 		if (entryPath.endsWith("/")) await fs.mkdir(target);
 		else await fs.writeBinary(target, content);
 	}
 }
 /**
-* tar/tar.gz 解包（tar 包）。先列条目逐一过 resolveInsideRoot 校验，
-* 再解包；符号链接/硬链接条目不跟随（跳过）。
+* tar/tar.gz 解包（tar 包）。先列条目逐一过 resolveInsideRoot 校验并累计
+* 单条目/总体积上限（声明 size 预检），再解包；符号链接/硬链接条目不跟随（跳过）。
 */
-async function extractTarFile(archivePath, destRoot) {
+async function extractTarFile(archivePath, destRoot, limits) {
+	const { maxEntryBytes, maxTotalBytes } = resolveArchiveLimits(limits);
 	try {
 		const entryPaths = [];
+		let total = 0;
 		await tar.t({
 			file: toPlatform$1(archivePath),
 			onentry: (entry) => {
 				entryPaths.push(entry.path);
+				const size = typeof entry.size === "number" ? entry.size : 0;
+				if (size > maxEntryBytes) throw new WebSkillError("INSTALL_FAILED", `Archive entry exceeds the ${maxEntryBytes}-byte limit: ${entry.path}`);
+				total += size;
+				if (total > maxTotalBytes) throw new WebSkillError("INSTALL_FAILED", `Archive contents exceed the ${maxTotalBytes}-byte total limit`);
 			}
 		});
 		for (const p of entryPaths) if (!p.replace(/\\/g, "/").split("/").every((s) => s === "" || s === ".")) resolveInsideRoot(destRoot, p);
@@ -951,28 +967,39 @@ const _execFileP = promisify(execFile);
 const messageOf$2 = (e) => e instanceof Error ? e.message : String(e);
 /**
 * 跨平台执行命令：Windows 下对 npm 等 cmd 包装的命令通过 cmd.exe 代理执行，
-* git 等原生 exe 不受影响。
+* git 等原生 exe 不受影响。默认 120s 超时（防挂死安装管线）。
 */
-async function execFileP(command, args) {
+async function execFileP(command, args, options = {}) {
+	const timeoutMs = options.timeoutMs ?? 12e4;
 	if (process.platform === "win32" && command === "npm") return _execFileP("cmd", [
 		"/c",
 		command,
 		...args
-	]);
-	return _execFileP(command, args);
+	], { timeout: timeoutMs });
+	return _execFileP(command, args, { timeout: timeoutMs });
 }
 /** 命令缺失/失败 → INSTALL_FAILED 结构化诊断 */
 function commandFailed(command, e) {
 	return new WebSkillError("INSTALL_FAILED", `Failed to run ${command}: ${e?.code === "ENOENT" ? `command "${command}" not found on this system` : messageOf$2(e)}`, e);
 }
-/** git 源：clone --depth 1 + rev-parse HEAD 记录 commit */
+/** git url 协议白名单：https:// 与 git@ SCP 形式；无 scheme 的本地路径放行（dev 工作流）；
+* 其余显式协议（ext::/file:// 等）一律拒绝 */
+function assertGitUrlSafe(url) {
+	if (url.startsWith("--")) throw new WebSkillError("INSTALL_FAILED", `Git url must not start with "--": ${JSON.stringify(url)}`);
+	if (url.startsWith("https://") || url.startsWith("git@")) return;
+	if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(url)) throw new WebSkillError("INSTALL_FAILED", `Git url protocol is not allowed (only https://, git@ SCP form, or plain local paths): ${JSON.stringify(url)}`);
+}
+/** git 源：clone --depth 1 + rev-parse HEAD 记录 commit；url/ref 前插 `--` 防选项注入 */
 async function stageGit(source, ctx) {
+	assertGitUrlSafe(source.url);
+	if (source.ref?.startsWith("--")) throw new WebSkillError("INSTALL_FAILED", `Git ref must not start with "--": ${JSON.stringify(source.ref)}`);
 	const skillDir = `${ctx.stagingRoot}/repo`;
 	const args = [
 		"clone",
 		"--depth",
 		"1",
 		...source.ref ? ["--branch", source.ref] : [],
+		"--",
 		source.url,
 		skillDir
 	];
@@ -1003,7 +1030,7 @@ function sha256Hex(data) {
 	return createHash("sha256").update(data).digest("hex");
 }
 const messageOf$1 = (e) => e instanceof Error ? e.message : String(e);
-/** http 源：下载归档（可选 expectedSha256 校验包体）→ 解包 → 定位技能根 */
+/** http 源：下载归档（Content-Length + 流式累计上限；可选 expectedSha256 校验包体）→ 解包 → 定位技能根/包集 */
 async function stageHttp(source, ctx, expectedSha256) {
 	const fetchImpl = ctx.fetchImpl ?? fetch;
 	let res;
@@ -1013,18 +1040,18 @@ async function stageHttp(source, ctx, expectedSha256) {
 		throw new WebSkillError("INSTALL_FAILED", `Download failed: ${messageOf$1(e)}`, e);
 	}
 	if (!res.ok) throw new WebSkillError("INSTALL_FAILED", `Download failed with HTTP ${res.status}`);
-	const data = new Uint8Array(await res.arrayBuffer());
+	const data = await readResponseWithLimit(res, ctx.archiveLimits);
 	if (expectedSha256 !== void 0) {
 		const actual = sha256Hex(data);
 		if (actual !== expectedSha256) throw new WebSkillError("INSTALL_FAILED", `Archive checksum mismatch: expected ${expectedSha256}, got ${actual}`);
 	}
 	const contentDir = `${ctx.stagingRoot}/content`;
 	await ctx.fs.mkdir(contentDir);
-	if (isZipArchive(data)) await extractZipData(ctx.fs, data, contentDir);
+	if (isZipArchive(data)) await extractZipData(ctx.fs, data, contentDir, ctx.archiveLimits);
 	else {
 		const archivePath = `${ctx.stagingRoot}/archive.tar`;
 		await ctx.fs.writeBinary(archivePath, data);
-		await extractTarFile(toPlatform$1(archivePath), toPlatform$1(contentDir));
+		await extractTarFile(toPlatform$1(archivePath), toPlatform$1(contentDir), ctx.archiveLimits);
 	}
 	const packFilePath = `${contentDir}/${SKILL_PACK_FILE}`;
 	if (await ctx.fs.exists(packFilePath)) return {
@@ -1056,16 +1083,27 @@ async function stageLocal(source, ctx) {
 		source
 	};
 }
-/** npm 源：npm pack → 解 tar.gz；技能根取包的 skill/ 子目录（存在时）否则包根 */
+/** npm 包名（@scope/name 或 name，小写字母数字 . _ - /）与版本（semver 或 dist-tag）正则 */
+const PACKAGE_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const VERSION_RE = /^[a-z0-9._~^>=<x*+-]+$/i;
+function assertNpmSpecSafe(source) {
+	const name = source.packageName;
+	const isLocalPath = name.startsWith("/") || name.startsWith("./") || name.startsWith("../");
+	if (name.startsWith("--") || !PACKAGE_NAME_RE.test(name) && !isLocalPath) throw new WebSkillError("INSTALL_FAILED", `Invalid npm package name: ${JSON.stringify(name)}`);
+	if (source.version !== void 0 && (!VERSION_RE.test(source.version) || source.version.startsWith("--"))) throw new WebSkillError("INSTALL_FAILED", `Invalid npm package version: ${JSON.stringify(source.version)}`);
+}
+/** npm 源：npm pack → 解 tar.gz；技能根取包的 skill/ 子目录（存在时）否则包根；spec 前插 `--` 防选项注入 */
 async function stageNpm(source, ctx) {
+	assertNpmSpecSafe(source);
 	const spec = source.version ? `${source.packageName}@${source.version}` : source.packageName;
 	let stdout;
 	try {
 		({stdout} = await execFileP("npm", [
 			"pack",
-			spec,
 			"--pack-destination",
-			ctx.stagingRoot
+			ctx.stagingRoot,
+			"--",
+			spec
 		]));
 	} catch (e) {
 		throw commandFailed("npm", e);
@@ -1166,15 +1204,13 @@ async function readManifest(fs, skillRoot) {
 		throw new WebSkillError("INTEGRITY_FAILED", `Skill manifest at ${path} is corrupted: ${e instanceof Error ? e.message : String(e)}`, e);
 	}
 }
-/** 按 manifest.files 逐文件重算 sha256 比对（core 纯逻辑校验） */
+/** walk 实际目录与 manifest 比对：hash 不一致 / 清单外新增 / 清单内缺失三类全空才 ok */
 async function verifyIntegrity(fs, skillRoot) {
 	const manifest = await readManifest(fs, skillRoot);
 	const actualHashes = /* @__PURE__ */ new Map();
-	for (const file of manifest.files) {
-		const path = `${skillRoot}/${file.path}`;
-		if (await fs.exists(path)) actualHashes.set(file.path, sha256Hex(await fs.readBinary(path)));
-	}
-	return verifyManifest(manifest, actualHashes);
+	const actualFiles = await walkFiles(fs, skillRoot);
+	for (const rel of actualFiles) actualHashes.set(rel, sha256Hex(await fs.readBinary(`${skillRoot}/${rel}`)));
+	return verifyManifest(manifest, actualHashes, actualFiles);
 }
 const messageOf = (e) => e instanceof Error ? e.message : String(e);
 const asInstallFailed = (e) => e instanceof WebSkillError && e.code === "INSTALL_FAILED" ? e : new WebSkillError("INSTALL_FAILED", `Install failed: ${messageOf(e)}`, e);
@@ -1188,12 +1224,16 @@ var SkillManager = class {
 	#fs;
 	#fetchImpl;
 	#schemaInference;
+	#archiveLimits;
+	#onChanged;
 	#schemaInferer = new OxcSchemaInferer();
 	constructor(deps) {
 		this.#managedRoot = deps.managedRoot.replace(/\/+$/, "");
 		this.#fs = deps.fs ?? new NodeFS();
 		this.#fetchImpl = deps.fetchImpl;
 		this.#schemaInference = deps.schemaInference ?? true;
+		this.#archiveLimits = deps.archiveLimits;
+		this.#onChanged = deps.onChanged;
 	}
 	async install(source, options) {
 		const fs = this.#fs;
@@ -1204,7 +1244,8 @@ var SkillManager = class {
 			const ctx = {
 				fs,
 				stagingRoot,
-				...this.#fetchImpl ? { fetchImpl: this.#fetchImpl } : {}
+				...this.#fetchImpl ? { fetchImpl: this.#fetchImpl } : {},
+				...this.#archiveLimits ? { archiveLimits: this.#archiveLimits } : {}
 			};
 			let staged;
 			switch (source.type) {
@@ -1268,6 +1309,7 @@ var SkillManager = class {
 				throw e;
 			}
 			targetDir = void 0;
+			this.#onChanged?.();
 			return manifest;
 		} catch (e) {
 			if (targetDir) await removeDirQuiet(fs, targetDir);
@@ -1346,6 +1388,7 @@ var SkillManager = class {
 				installed.length = 0;
 				throw e;
 			}
+			this.#onChanged?.();
 			return manifests;
 		} catch (e) {
 			for (const targetDir of installed) await removeDirQuiet(fs, targetDir);
@@ -1381,6 +1424,7 @@ var SkillManager = class {
 		try {
 			await this.#fs.remove(targetDir, { recursive: true });
 			await removeLockEntry(this.#fs, this.#managedRoot, name);
+			this.#onChanged?.();
 		} catch (e) {
 			throw new WebSkillError("UNINSTALL_FAILED", `Failed to uninstall "${name}": ${messageOf(e)}`, e);
 		}

package/dist/{dist-DvoBsChX.js → dist-fZFZaf43.js}

@@ -1,5 +1,5 @@
 import { parse } from "yaml";
-import { zipSync } from "fflate";
+import { Unzip, UnzipInflate, zipSync } from "fflate";
 
 //#region ../core/dist/index.js
 /**
@@ -39,16 +39,22 @@ async function buildManifest(input) {
 		files: input.files
 	};
 }
-/** 按 manifest.files 比对实际 hash（调用方负责计算 actualHashes） */
-function verifyManifest(manifest, actualHashes) {
+/** 按 manifest.files 比对实际 hash 与文件集（mismatches/extras/missing 三类全空才 ok） */
+function verifyManifest(manifest, actualHashes, actualFiles = [...actualHashes.keys()]) {
 	const mismatches = [];
+	const missing = [];
+	const listed = new Set(manifest.files.map((f) => f.path));
 	for (const file of manifest.files) {
 		const actual = actualHashes.get(file.path);
-		if (actual === void 0 || actual !== file.sha256) mismatches.push(file.path);
+		if (actual === void 0) missing.push(file.path);
+		else if (actual !== file.sha256) mismatches.push(file.path);
 	}
+	const extras = actualFiles.filter((p) => p !== "webskill.skill-manifest.json" && p !== "skills.lock.json" && !listed.has(p)).sort();
 	return {
-		ok: mismatches.length === 0,
-		mismatches
+		ok: mismatches.length === 0 && missing.length === 0 && extras.length === 0,
+		mismatches,
+		extras,
+		missing
 	};
 }
 const ROOT = "/";
@@ -407,6 +413,107 @@ function parseSkillPackManifest(text) {
 	}
 	return raw;
 }
+const DEFAULT_ARCHIVE_LIMITS = {
+	maxDownloadBytes: 64 * 1024 * 1024,
+	maxEntryBytes: 64 * 1024 * 1024,
+	maxTotalBytes: 256 * 1024 * 1024
+};
+function resolveArchiveLimits(limits) {
+	return {
+		...DEFAULT_ARCHIVE_LIMITS,
+		...limits
+	};
+}
+function concat(chunks, size) {
+	const out = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		out.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return out;
+}
+/** 流式解 zip（单条目/总双重上限）；返回 [path, content][]（目录条目以 / 结尾、内容为空） */
+async function unzipWithLimits(data, limits) {
+	const { maxEntryBytes, maxTotalBytes } = resolveArchiveLimits(limits);
+	let eocd = false;
+	const scanFrom = Math.max(0, data.length - 65557);
+	for (let i = data.length - 22; i >= scanFrom; i--) if (data[i] === 80 && data[i + 1] === 75 && data[i + 2] === 5 && data[i + 3] === 6) {
+		eocd = true;
+		break;
+	}
+	if (!eocd) throw new WebSkillError("INSTALL_FAILED", "Failed to read zip archive: missing end-of-central-directory record");
+	const entries = [];
+	let total = 0;
+	let failure;
+	const unzip = new Unzip();
+	unzip.register(UnzipInflate);
+	unzip.onfile = (file) => {
+		if (file.name.endsWith("/")) {
+			entries.push([file.name, /* @__PURE__ */ new Uint8Array(0)]);
+			return;
+		}
+		const chunks = [];
+		let size = 0;
+		file.ondata = (err, chunk, final) => {
+			if (err) {
+				failure = err;
+				return;
+			}
+			size += chunk.length;
+			if (size > maxEntryBytes) {
+				failure = new WebSkillError("INSTALL_FAILED", `Archive entry exceeds the ${maxEntryBytes}-byte limit: ${file.name}`);
+				return;
+			}
+			total += chunk.length;
+			if (total > maxTotalBytes) {
+				failure = new WebSkillError("INSTALL_FAILED", `Archive contents exceed the ${maxTotalBytes}-byte total limit`);
+				return;
+			}
+			chunks.push(chunk);
+			if (final) entries.push([file.name, concat(chunks, size)]);
+		};
+		file.start();
+	};
+	try {
+		unzip.push(data, true);
+	} catch (e) {
+		throw new WebSkillError("INSTALL_FAILED", `Failed to read zip archive: ${e instanceof Error ? e.message : String(e)}`, e);
+	}
+	await new Promise((resolve) => {
+		setTimeout(resolve, 0);
+	});
+	if (failure) {
+		if (failure instanceof WebSkillError) throw failure;
+		throw new WebSkillError("INSTALL_FAILED", `Failed to read zip archive: ${failure instanceof Error ? failure.message : String(failure)}`, failure);
+	}
+	return entries;
+}
+/** 下载响应体：Content-Length 预检 + 流式累计上限 */
+async function readResponseWithLimit(res, limits) {
+	const { maxDownloadBytes } = resolveArchiveLimits(limits);
+	const declared = res.headers.get("content-length");
+	if (declared !== null && Number(declared) > maxDownloadBytes) throw new WebSkillError("INSTALL_FAILED", `Download exceeds the ${maxDownloadBytes}-byte limit (Content-Length: ${declared})`);
+	if (!res.body) {
+		const buf = new Uint8Array(await res.arrayBuffer());
+		if (buf.length > maxDownloadBytes) throw new WebSkillError("INSTALL_FAILED", `Download exceeds the ${maxDownloadBytes}-byte limit`);
+		return buf;
+	}
+	const reader = res.body.getReader();
+	const chunks = [];
+	let size = 0;
+	for (;;) {
+		const { value, done } = await reader.read();
+		if (done) break;
+		size += value.length;
+		if (size > maxDownloadBytes) {
+			await reader.cancel().catch(() => void 0);
+			throw new WebSkillError("INSTALL_FAILED", `Download exceeds the ${maxDownloadBytes}-byte limit`);
+		}
+		chunks.push(value);
+	}
+	return concat(chunks, size);
+}
 /** 由条目列表构建 Catalog，保证按名称排序 */
 function buildCatalog(entries) {
 	return { entries: [...entries].sort((a, b) => a.name.localeCompare(b.name)) };
@@ -523,6 +630,25 @@ var SkillDiscovery = class {
 			});
 		}
 		issues.push(...cycles.issues);
+		const admitted = new Set(entries.map((e) => e.name));
+		let changed = true;
+		while (changed) {
+			changed = false;
+			for (const entry of [...entries]) {
+				const missing = (adjacency.get(entry.name) ?? []).filter((d) => !admitted.has(d));
+				if (missing.length === 0) continue;
+				entries.splice(entries.indexOf(entry), 1);
+				admitted.delete(entry.name);
+				this.#index.delete(entry.name);
+				issues.push({
+					code: "SKILL_UNKNOWN_DEPENDENCY",
+					severity: "error",
+					message: `Skill "${entry.name}" was excluded: dependency ${JSON.stringify(missing[0])} is not in the final catalog`,
+					path: entry.root
+				});
+				changed = true;
+			}
+		}
 		entries.sort((a, b) => a.name.localeCompare(b.name));
 		return {
 			entries,
@@ -599,4 +725,4 @@ const xmlRenderer = {
 };
 
 //#endregion
-export { renderAvailableSkillsXml as C, verifyManifest as D, validateSkills as E, xmlRenderer as O, parseSkillPackManifest as S, resolveInsideRoot as T, exportSkills as _, SKILL_NAME_PATTERN as a, normalizePath as b, SkillReader as c, buildCatalog as d, buildManifest as f, escapeXml as g, computeDigest as h, SKILL_NAME_MAX_LENGTH as i, WebSkillError as l, checkSkillRules as m, SKILLS_LOCKFILE as n, SKILL_PACK_FILE as o, checkDependencyCycles as p, SKILL_MANIFEST_FILE as r, SkillDiscovery as s, MemoryFS as t, assertSafePathSegment as u, isValidSkillName as v, renderCatalogJson as w, parseSkillMarkdown as x, jsonRenderer as y };
+export { validateSkills as A, parseSkillPackManifest as C, resolveArchiveLimits as D, renderCatalogJson as E, xmlRenderer as M, resolveInsideRoot as O, parseSkillMarkdown as S, renderAvailableSkillsXml as T, escapeXml as _, SKILL_NAME_MAX_LENGTH as a, jsonRenderer as b, SkillDiscovery as c, assertSafePathSegment as d, buildCatalog as f, computeDigest as g, checkSkillRules as h, SKILL_MANIFEST_FILE as i, verifyManifest as j, unzipWithLimits as k, SkillReader as l, checkDependencyCycles as m, MemoryFS as n, SKILL_NAME_PATTERN as o, buildManifest as p, SKILLS_LOCKFILE as r, SKILL_PACK_FILE as s, DEFAULT_ARCHIVE_LIMITS as t, WebSkillError as u, exportSkills as v, readResponseWithLimit as w, normalizePath as x, isValidSkillName as y };

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
-import { L as SkillManifest, N as SkillDocument, S as FileSystemProvider, c as LlmClient, j as SkillCatalogEntry, u as LlmMessage, v as UiBridge } from "./types-CgNC-oQu-DYrxhD3z.js";
-import { ct as WebSkillRuntime, q as RuntimeRun } from "./index-BSS3EWY-.js";
-import { f as SkillManager } from "./index-npFMt2Zw.js";
+import { F as SkillDocument, N as SkillCatalogEntry, c as LlmClient, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CgNC-oQu-DEcIBJKG.js";
+import { $ as SkillStateGuard, lt as WebSkillRuntime, q as RuntimeRun } from "./index-COuOu6gw.js";
+import { f as SkillManager } from "./index-Bun1aEf4.js";
 //#region ../governance/dist/index.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';
@@ -270,6 +270,12 @@ declare class SkillStatePolicy {
   }): Promise<SkillState>;
   canRoute(state: SkillState): boolean;
   canExecute(state: SkillState): boolean;
+  /**
+   * runtime SkillStateGuard 适配（0.1.5 一致拦截）：
+   * canRead：active/deprecated 放行；canActivate/canExecute 与 canRoute/canExecute 语义对齐；
+   * quarantined/disabled 三入口全拦截。
+   */
+  toSkillStateGuard(): SkillStateGuard;
   /** disabled → SKILL_DISABLED；quarantined → SKILL_QUARANTINED */
   assertExecutable(skillName: string): Promise<void>;
   /** runtime catalogFilter 实现：quarantined/deprecated/disabled 技能被路由过滤 */

package/dist/governance.js

@@ -1,8 +1,8 @@
-import { E as validateSkills, T as resolveInsideRoot, l as WebSkillError, u as assertSafePathSegment, v as isValidSkillName } from "./dist-DvoBsChX.js";
-import { i as NodeFS } from "./dist-BVXZF7H_.js";
+import { A as validateSkills, O as resolveInsideRoot, d as assertSafePathSegment, u as WebSkillError, y as isValidSkillName } from "./dist-fZFZaf43.js";
+import { i as NodeFS } from "./dist-LIFS3ZjI.js";
 import path from "node:path";
-import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
+import { mkdtemp } from "node:fs/promises";
 import { createHash } from "node:crypto";
 
 //#region ../governance/dist/index.js
@@ -590,6 +590,21 @@ var SkillStatePolicy = class {
 	canExecute(state) {
 		return state === "active" || state === "deprecated";
 	}
+	/**
+	* runtime SkillStateGuard 适配（0.1.5 一致拦截）：
+	* canRead：active/deprecated 放行；canActivate/canExecute 与 canRoute/canExecute 语义对齐；
+	* quarantined/disabled 三入口全拦截。
+	*/
+	toSkillStateGuard() {
+		return {
+			canRead: async (skillName) => {
+				const state = await this.getState(skillName);
+				return state === "active" || state === "deprecated";
+			},
+			canActivate: async (skillName) => this.canRoute(await this.getState(skillName)),
+			canExecute: async (skillName) => this.canExecute(await this.getState(skillName))
+		};
+	}
 	/** disabled → SKILL_DISABLED；quarantined → SKILL_QUARANTINED */
 	async assertExecutable(skillName) {
 		const state = await this.getState(skillName);

package/dist/{index-npFMt2Zw.d.ts → index-Bun1aEf4.d.ts}

@@ -1,5 +1,5 @@
-import { C as JsonSchema, H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, S as FileSystemProvider, W as VerifyResult, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, x as FileStat } from "./types-CgNC-oQu-DYrxhD3z.js";
-import { $ as ToolDefinition, N as NetworkPolicy, X as ScriptExecutionContext, Y as SchemaInferer, Z as ScriptExecutor, b as FsArtifactStore, d as BridgeCapabilities, tt as ToolResult, u as ApprovalScope, x as FsMemoryStore } from "./index-BSS3EWY-.js";
+import { C as FileStat, I as SkillInstallSource, K as VerifyResult, T as JsonSchema, W as SkillsLockfile, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CgNC-oQu-DEcIBJKG.js";
+import { N as NetworkPolicy, X as ScriptExecutionContext, Y as SchemaInferer, Z as ScriptExecutor, b as FsArtifactStore, d as BridgeCapabilities, et as ToolDefinition, nt as ToolResult, u as ApprovalScope, x as FsMemoryStore } from "./index-COuOu6gw.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts
 //#region src/fs/nodeFs.d.ts
@@ -158,6 +158,10 @@ declare class SkillManager {
     fetchImpl?: typeof fetch;
     /** D2 安装期 schema 预推导（默认 true，可关） */
     schemaInference?: boolean;
+    /** 归档体积三重上限（缺省 DEFAULT_ARCHIVE_LIMITS） */
+    archiveLimits?: ArchiveLimits;
+    /** install/uninstall 成功后的变更回调（宿主接线缓存失效，如 WebSkillRuntime.invalidate） */
+    onChanged?: () => void;
   });
   install(source: SkillInstallSource, options?: {
     expectedSha256?: string;