@webskill/sdk 0.1.4 → 0.2.0

package/dist/{dist-BVXZF7H_.js → dist-Dj6QjHBn.js}

@@ -1,21 +1,20 @@
-import { D as verifyManifest, E as validateSkills, S as parseSkillPackManifest, T as resolveInsideRoot, _ as exportSkills, f as buildManifest, l as WebSkillError, n as SKILLS_LOCKFILE, o as SKILL_PACK_FILE, r as SKILL_MANIFEST_FILE, v as isValidSkillName, x as parseSkillMarkdown } from "./dist-DvoBsChX.js";
-import { M as normalizeToolContent, N as parseBridgeRequest, S as bridgeError, c as FsArtifactStore, j as networkUrlHost, k as isNetworkAllowed, l as FsMemoryStore, o as CapabilityApproval } from "./dist-DAn07zHu.js";
+import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, O as resolveArchiveLimits, T as readResponseWithLimit, b as isValidSkillName, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D0saNPi_.js";
+import { A as isNetworkAllowed, C as bridgeError, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, l as FsMemoryStore, o as CapabilityApproval } from "./dist-BS5OpedX.js";
+import { createRequire } from "node:module";
 import { unzipSync, zipSync } from "fflate";
-import { existsSync, promises, readFileSync } from "node:fs";
+import { existsSync, promises } from "node:fs";
 import path from "node:path";
+import { tmpdir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { format, promisify } from "node:util";
 import { Worker } from "node:worker_threads";
-import { parseSync } from "oxc-parser";
 import { createInterface } from "node:readline/promises";
 import { mkdtemp } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import * as tar from "tar";
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 
 //#region ../node/dist/index.js
-const toPlatform$4 = (p) => p.split("/").join(path.sep);
+const toPlatform$3 = (p) => p.split("/").join(path.sep);
 const toPosix = (p) => p.split(path.sep).join("/");
 const isEnoent = (e) => typeof e === "object" && e !== null && e.code === "ENOENT";
 /** realpath 最近现存祖先并拼回剩余段（写入目标尚不存在时的等价判定） */
@@ -47,41 +46,41 @@ var NodeFS = class {
 	/** root 模式：目标 realpath 必须落在 root realpath 前缀内（符号链接逃逸防护） */
 	async #assertContained(p) {
 		if (!this.#root) return;
-		const rootReal = await promises.realpath(toPlatform$4(this.#root));
-		const targetReal = await realpathNearest(toPlatform$4(p));
+		const rootReal = await promises.realpath(toPlatform$3(this.#root));
+		const targetReal = await realpathNearest(toPlatform$3(p));
 		if (targetReal !== rootReal && !targetReal.startsWith(rootReal + path.sep)) throw new WebSkillError("FS_PATH_OUTSIDE_ROOT", `Path escapes root via symbolic link: ${p} (resolves outside ${this.#root})`);
 	}
 	async readText(p) {
 		await this.#assertContained(p);
 		try {
-			return await promises.readFile(toPlatform$4(p), "utf8");
+			return await promises.readFile(toPlatform$3(p), "utf8");
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 	}
 	async writeText(p, content) {
 		await this.#assertContained(p);
-		const target = toPlatform$4(p);
+		const target = toPlatform$3(p);
 		await promises.mkdir(path.dirname(target), { recursive: true });
 		await promises.writeFile(target, content, "utf8");
 	}
 	async readBinary(p) {
 		await this.#assertContained(p);
 		try {
-			return await promises.readFile(toPlatform$4(p));
+			return await promises.readFile(toPlatform$3(p));
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 	}
 	async writeBinary(p, content) {
 		await this.#assertContained(p);
-		const target = toPlatform$4(p);
+		const target = toPlatform$3(p);
 		await promises.mkdir(path.dirname(target), { recursive: true });
 		await promises.writeFile(target, content);
 	}
 	async exists(p) {
 		try {
-			await promises.access(toPlatform$4(p));
+			await promises.access(toPlatform$3(p));
 			return true;
 		} catch {
 			return false;
@@ -89,7 +88,7 @@ var NodeFS = class {
 	}
 	async stat(p) {
 		try {
-			const s = await promises.stat(toPlatform$4(p));
+			const s = await promises.stat(toPlatform$3(p));
 			return {
 				path: toPosix(p),
 				type: s.isDirectory() ? "directory" : "file",
@@ -103,32 +102,39 @@ var NodeFS = class {
 	async list(p) {
 		let dirents;
 		try {
-			dirents = await promises.readdir(toPlatform$4(p), { withFileTypes: true });
+			dirents = await promises.readdir(toPlatform$3(p), { withFileTypes: true });
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 		return dirents.map((d) => ({
-			path: toPosix(path.join(toPlatform$4(p), d.name)),
+			path: toPosix(path.join(toPlatform$3(p), d.name)),
 			type: d.isDirectory() ? "directory" : "file"
 		}));
 	}
 	async mkdir(p) {
-		await promises.mkdir(toPlatform$4(p), { recursive: true });
+		await promises.mkdir(toPlatform$3(p), { recursive: true });
 	}
 	async remove(p, options) {
 		try {
-			await promises.rm(toPlatform$4(p), { recursive: options?.recursive ?? false });
+			await promises.rm(toPlatform$3(p), { recursive: options?.recursive ?? false });
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 	}
+	async rename(from, to) {
+		await promises.mkdir(path.dirname(toPlatform$3(to)), { recursive: true });
+		try {
+			await promises.rename(toPlatform$3(from), toPlatform$3(to));
+		} catch (e) {
+			throw this.#mapError(e, from);
+		}
+	}
 	#mapError(e, p) {
 		if (isEnoent(e)) return new WebSkillError("FS_NOT_FOUND", `Path not found: ${p}`);
 		return e;
 	}
 };
 const baseName$1 = (p) => p.split("/").pop() ?? p;
-const toPlatform$3 = (p) => p.split("/").join(path.sep);
 /**
 * 进程内脚本执行器。接口按沙箱语义设计（context 无隐式宿主访问），
 * worker_threads 沙箱见 deferred-items D1。
@@ -148,7 +154,22 @@ var NodeScriptExecutor = class {
 		return hasTs ? tsPath : jsPath;
 	}
 	async #loadModule(scriptPath) {
-		return await import(`${pathToFileURL(toPlatform$3(scriptPath)).href}?t=${Date.now()}`);
+		if (scriptPath.endsWith(".ts")) {
+			const source = await this.#fs.readText(scriptPath);
+			const dir = await promises.mkdtemp(path.join(tmpdir(), "webskill-ts-"));
+			try {
+				const file = path.join(dir, "script.ts");
+				await promises.writeFile(file, source);
+				return await import(`${pathToFileURL(file).href}?t=${Date.now()}`);
+			} finally {
+				await promises.rm(dir, {
+					recursive: true,
+					force: true
+				});
+			}
+		}
+		const source = await this.#fs.readText(scriptPath);
+		return await import(`data:text/javascript;charset=utf-8,${encodeURIComponent(`${source}\n//# ${Date.now()}`)}`);
 	}
 	async loadDefinition(skillRoot, scriptName) {
 		const scriptPath = await this.#locateScript(skillRoot, scriptName);
@@ -319,7 +340,8 @@ var SandboxedScriptExecutor = class {
 		const result = await this.#runWorker({
 			mode: "load",
 			scriptPath: toPlatform$2(scriptPath),
-			scriptName
+			scriptName,
+			scriptSource: await this.#fs.readText(scriptPath)
 		});
 		if (!result.ok) throw new WebSkillError("TOOL_EXECUTION_FAILED", `Failed to load script "${scriptName}": ${result.error?.message ?? "unknown error"}`);
 		return {
@@ -352,7 +374,8 @@ var SandboxedScriptExecutor = class {
 				scriptName,
 				skillName: context.skillName,
 				runId: context.runId,
-				args
+				args,
+				scriptSource: await this.#fs.readText(scriptPath)
 			}, timeoutMs, (request) => this.#handleBridge(request, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!result.ok) {
 				const stderrSummary = result.stderr?.length ? ` | stderr: ${result.stderr.join(" | ").slice(0, 500)}` : "";
@@ -496,6 +519,16 @@ var SandboxedScriptExecutor = class {
 		}
 	}
 };
+const require_ = createRequire(import.meta.url);
+let parseSyncCache;
+function loadParseSync() {
+	if (!parseSyncCache) try {
+		parseSyncCache = require_("oxc-parser").parseSync;
+	} catch (e) {
+		throw new WebSkillError("TOOL_UNSUPPORTED", "The \"oxc-parser\" package is required for schema inference; install it first (npm i oxc-parser)", e);
+	}
+	return parseSyncCache;
+}
 const PLACEHOLDER_PREFIX = "Inferred placeholder (unsupported type: ";
 const placeholder = (text) => ({
 	type: "string",
@@ -545,7 +578,7 @@ var TypeMapper = class {
 		};
 		return placeholder(this.#text(t));
 	}
-	#union(t, seen) {
+	#union(t, _seen) {
 		const values = [];
 		for (const member of t.types ?? []) {
 			const value = member.literal?.value ?? member.value;
@@ -645,7 +678,7 @@ var OxcSchemaInferer = class {
 		let program;
 		let comments;
 		try {
-			const result = parseSync(options?.fileName ?? "script.ts", source);
+			const result = loadParseSync()(options?.fileName ?? "script.ts", source);
 			if (result.errors?.length > 0) return void 0;
 			program = result.program;
 			comments = result.comments ?? [];
@@ -661,7 +694,7 @@ var OxcSchemaInferer = class {
 		const jsdoc = comments.filter((c) => c.type === "Block" && typeof c.value === "string" && c.value.includes("@param") && typeof c.end === "number" && c.end <= runStart).sort((a, b) => b.end - a.end)[0];
 		if (!jsdoc) return void 0;
 		const reparse = (typeText) => {
-			const r = parseSync("__t.ts", `type __T = ${typeText};`);
+			const r = loadParseSync()("__t.ts", `type __T = ${typeText};`);
 			if (r.errors?.length > 0) return void 0;
 			return r.program.body.find((n) => n.type === "TSTypeAliasDeclaration")?.typeAnnotation;
 		};
@@ -817,38 +850,46 @@ var CliUiBridge = class {
 const messageOf$4 = (e) => e instanceof Error ? e.message : String(e);
 const toPlatform$1 = (p) => p.split("/").join(path.sep);
 const isZipArchive = (data) => data.length > 1 && data[0] === 80 && data[1] === 75;
+let tarModule$1;
+async function loadTar$1() {
+	tarModule$1 ??= await import("tar").catch((e) => {
+		throw new WebSkillError("TOOL_UNSUPPORTED", "The \"tar\" package is required for tar/tar.gz archives; install it first (npm i tar)", e);
+	});
+	return tarModule$1;
+}
 /**
-* zip 解包（fflate）。每个条目路径过 resolveInsideRoot：
+* zip 解包（fflate 流式，单条目/总解压体积上限）。每个条目路径过 resolveInsideRoot：
 * 拒绝 `..` 段、绝对路径、反斜杠穿越（zip-slip 防护）。
 */
-async function extractZipData(fs, data, destRoot) {
-	let entries;
-	try {
-		entries = unzipSync(data);
-	} catch (e) {
-		throw new WebSkillError("INSTALL_FAILED", `Failed to read zip archive: ${messageOf$4(e)}`, e);
-	}
-	for (const [entryPath, content] of Object.entries(entries)) {
+async function extractZipData(fs, data, destRoot, limits) {
+	for (const [entryPath, content] of await unzipWithLimits(data, limits)) {
 		const target = resolveInsideRoot(destRoot, entryPath);
 		if (entryPath.endsWith("/")) await fs.mkdir(target);
 		else await fs.writeBinary(target, content);
 	}
 }
 /**
-* tar/tar.gz 解包（tar 包）。先列条目逐一过 resolveInsideRoot 校验，
-* 再解包；符号链接/硬链接条目不跟随（跳过）。
+* tar/tar.gz 解包（tar 包）。先列条目逐一过 resolveInsideRoot 校验并累计
+* 单条目/总体积上限（声明 size 预检），再解包；符号链接/硬链接条目不跟随（跳过）。
 */
-async function extractTarFile(archivePath, destRoot) {
+async function extractTarFile(archivePath, destRoot, limits) {
+	const { maxEntryBytes, maxTotalBytes } = resolveArchiveLimits(limits);
 	try {
 		const entryPaths = [];
-		await tar.t({
+		let total = 0;
+		const tarMod = await loadTar$1();
+		await tarMod.t({
 			file: toPlatform$1(archivePath),
 			onentry: (entry) => {
 				entryPaths.push(entry.path);
+				const size = typeof entry.size === "number" ? entry.size : 0;
+				if (size > maxEntryBytes) throw new WebSkillError("INSTALL_FAILED", `Archive entry exceeds the ${maxEntryBytes}-byte limit: ${entry.path}`);
+				total += size;
+				if (total > maxTotalBytes) throw new WebSkillError("INSTALL_FAILED", `Archive contents exceed the ${maxTotalBytes}-byte total limit`);
 			}
 		});
 		for (const p of entryPaths) if (!p.replace(/\\/g, "/").split("/").every((s) => s === "" || s === ".")) resolveInsideRoot(destRoot, p);
-		await tar.x({
+		await tarMod.x({
 			file: toPlatform$1(archivePath),
 			cwd: toPlatform$1(destRoot),
 			filter: (_p, entry) => !("type" in entry) || entry.type !== "SymbolicLink" && entry.type !== "Link"
@@ -900,6 +941,13 @@ async function removeDirQuiet(fs, dir) {
 	} catch {}
 }
 const messageOf$3 = (e) => e instanceof Error ? e.message : String(e);
+let tarModule;
+async function loadTar() {
+	tarModule ??= await import("tar").catch((e) => {
+		throw new WebSkillError("TOOL_UNSUPPORTED", "The \"tar\" package is required for tar/tar.gz archives; install it first (npm i tar)", e);
+	});
+	return tarModule;
+}
 /** 导出技能目录全部文件（含 manifest）为 zip/tar 归档，返回 outPath */
 async function exportArchive(fs, skillRoot, options) {
 	try {
@@ -907,7 +955,7 @@ async function exportArchive(fs, skillRoot, options) {
 			const files = {};
 			for (const rel of await listFiles(fs, skillRoot)) files[rel] = await fs.readBinary(`${skillRoot}/${rel}`);
 			await fs.writeBinary(options.outPath, zipSync(files, { level: 6 }));
-		} else await tar.c({
+		} else await (await loadTar()).c({
 			file: toPlatform$1(options.outPath),
 			cwd: toPlatform$1(skillRoot)
 		}, ["."]);
@@ -929,7 +977,7 @@ async function readArchiveManifest(fs, archivePath) {
 	}
 	let manifestText;
 	try {
-		await tar.t({
+		await (await loadTar()).t({
 			file: toPlatform$1(archivePath),
 			onentry: (entry) => {
 				if (entry.path === "webskill.skill-manifest.json" || entry.path.endsWith(`/${"webskill.skill-manifest.json"}`)) {
@@ -951,28 +999,39 @@ const _execFileP = promisify(execFile);
 const messageOf$2 = (e) => e instanceof Error ? e.message : String(e);
 /**
 * 跨平台执行命令：Windows 下对 npm 等 cmd 包装的命令通过 cmd.exe 代理执行，
-* git 等原生 exe 不受影响。
+* git 等原生 exe 不受影响。默认 120s 超时（防挂死安装管线）。
 */
-async function execFileP(command, args) {
+async function execFileP(command, args, options = {}) {
+	const timeoutMs = options.timeoutMs ?? 12e4;
 	if (process.platform === "win32" && command === "npm") return _execFileP("cmd", [
 		"/c",
 		command,
 		...args
-	]);
-	return _execFileP(command, args);
+	], { timeout: timeoutMs });
+	return _execFileP(command, args, { timeout: timeoutMs });
 }
 /** 命令缺失/失败 → INSTALL_FAILED 结构化诊断 */
 function commandFailed(command, e) {
 	return new WebSkillError("INSTALL_FAILED", `Failed to run ${command}: ${e?.code === "ENOENT" ? `command "${command}" not found on this system` : messageOf$2(e)}`, e);
 }
-/** git 源：clone --depth 1 + rev-parse HEAD 记录 commit */
+/** git url 协议白名单：https:// 与 git@ SCP 形式；无 scheme 的本地路径放行（dev 工作流）；
+* 其余显式协议（ext::/file:// 等）一律拒绝 */
+function assertGitUrlSafe(url) {
+	if (url.startsWith("--")) throw new WebSkillError("INSTALL_FAILED", `Git url must not start with "--": ${JSON.stringify(url)}`);
+	if (url.startsWith("https://") || url.startsWith("git@")) return;
+	if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(url)) throw new WebSkillError("INSTALL_FAILED", `Git url protocol is not allowed (only https://, git@ SCP form, or plain local paths): ${JSON.stringify(url)}`);
+}
+/** git 源：clone --depth 1 + rev-parse HEAD 记录 commit；url/ref 前插 `--` 防选项注入 */
 async function stageGit(source, ctx) {
+	assertGitUrlSafe(source.url);
+	if (source.ref?.startsWith("--")) throw new WebSkillError("INSTALL_FAILED", `Git ref must not start with "--": ${JSON.stringify(source.ref)}`);
 	const skillDir = `${ctx.stagingRoot}/repo`;
 	const args = [
 		"clone",
 		"--depth",
 		"1",
 		...source.ref ? ["--branch", source.ref] : [],
+		"--",
 		source.url,
 		skillDir
 	];
@@ -1003,7 +1062,7 @@ function sha256Hex(data) {
 	return createHash("sha256").update(data).digest("hex");
 }
 const messageOf$1 = (e) => e instanceof Error ? e.message : String(e);
-/** http 源：下载归档（可选 expectedSha256 校验包体）→ 解包 → 定位技能根 */
+/** http 源：下载归档（Content-Length + 流式累计上限；可选 expectedSha256 校验包体）→ 解包 → 定位技能根/包集 */
 async function stageHttp(source, ctx, expectedSha256) {
 	const fetchImpl = ctx.fetchImpl ?? fetch;
 	let res;
@@ -1013,18 +1072,18 @@ async function stageHttp(source, ctx, expectedSha256) {
 		throw new WebSkillError("INSTALL_FAILED", `Download failed: ${messageOf$1(e)}`, e);
 	}
 	if (!res.ok) throw new WebSkillError("INSTALL_FAILED", `Download failed with HTTP ${res.status}`);
-	const data = new Uint8Array(await res.arrayBuffer());
+	const data = await readResponseWithLimit(res, ctx.archiveLimits);
 	if (expectedSha256 !== void 0) {
 		const actual = sha256Hex(data);
 		if (actual !== expectedSha256) throw new WebSkillError("INSTALL_FAILED", `Archive checksum mismatch: expected ${expectedSha256}, got ${actual}`);
 	}
 	const contentDir = `${ctx.stagingRoot}/content`;
 	await ctx.fs.mkdir(contentDir);
-	if (isZipArchive(data)) await extractZipData(ctx.fs, data, contentDir);
+	if (isZipArchive(data)) await extractZipData(ctx.fs, data, contentDir, ctx.archiveLimits);
 	else {
 		const archivePath = `${ctx.stagingRoot}/archive.tar`;
 		await ctx.fs.writeBinary(archivePath, data);
-		await extractTarFile(toPlatform$1(archivePath), toPlatform$1(contentDir));
+		await extractTarFile(toPlatform$1(archivePath), toPlatform$1(contentDir), ctx.archiveLimits);
 	}
 	const packFilePath = `${contentDir}/${SKILL_PACK_FILE}`;
 	if (await ctx.fs.exists(packFilePath)) return {
@@ -1056,16 +1115,27 @@ async function stageLocal(source, ctx) {
 		source
 	};
 }
-/** npm 源：npm pack → 解 tar.gz；技能根取包的 skill/ 子目录（存在时）否则包根 */
+/** npm 包名（@scope/name 或 name，小写字母数字 . _ - /）与版本（semver 或 dist-tag）正则 */
+const PACKAGE_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
+const VERSION_RE = /^[a-z0-9._~^>=<x*+-]+$/i;
+function assertNpmSpecSafe(source) {
+	const name = source.packageName;
+	const isLocalPath = name.startsWith("/") || name.startsWith("./") || name.startsWith("../");
+	if (name.startsWith("--") || !PACKAGE_NAME_RE.test(name) && !isLocalPath) throw new WebSkillError("INSTALL_FAILED", `Invalid npm package name: ${JSON.stringify(name)}`);
+	if (source.version !== void 0 && (!VERSION_RE.test(source.version) || source.version.startsWith("--"))) throw new WebSkillError("INSTALL_FAILED", `Invalid npm package version: ${JSON.stringify(source.version)}`);
+}
+/** npm 源：npm pack → 解 tar.gz；技能根取包的 skill/ 子目录（存在时）否则包根；spec 前插 `--` 防选项注入 */
 async function stageNpm(source, ctx) {
+	assertNpmSpecSafe(source);
 	const spec = source.version ? `${source.packageName}@${source.version}` : source.packageName;
 	let stdout;
 	try {
 		({stdout} = await execFileP("npm", [
 			"pack",
-			spec,
 			"--pack-destination",
-			ctx.stagingRoot
+			ctx.stagingRoot,
+			"--",
+			spec
 		]));
 	} catch (e) {
 		throw commandFailed("npm", e);
@@ -1113,15 +1183,19 @@ async function readLockfile(fs, managedRoot) {
 async function upsertLockEntry(fs, managedRoot, name, entry) {
 	const lockfile = await readLockfile(fs, managedRoot);
 	lockfile.skills[name] = entry;
-	await fs.writeText(`${managedRoot}/${SKILLS_LOCKFILE}`, JSON.stringify(lockfile, null, 2));
+	await writeLockfileAtomic(fs, managedRoot, lockfile);
 	return lockfile;
 }
 async function removeLockEntry(fs, managedRoot, name) {
 	const lockfile = await readLockfile(fs, managedRoot);
 	delete lockfile.skills[name];
-	await fs.writeText(`${managedRoot}/${SKILLS_LOCKFILE}`, JSON.stringify(lockfile, null, 2));
+	await writeLockfileAtomic(fs, managedRoot, lockfile);
 	return lockfile;
 }
+/** 原子写：先写临时文件再 rename（进程崩溃不留下半写 lockfile） */
+async function writeLockfileAtomic(fs, managedRoot, lockfile) {
+	await atomicWriteText(fs, `${managedRoot}/${SKILLS_LOCKFILE}`, JSON.stringify(lockfile, null, 2));
+}
 const EXCLUDED_FILES = /* @__PURE__ */ new Set([SKILL_MANIFEST_FILE, SKILLS_LOCKFILE]);
 /** 递归收集技能目录内的文件（相对路径，posix 分隔） */
 async function walkFiles(fs, root, prefix = "") {
@@ -1166,15 +1240,13 @@ async function readManifest(fs, skillRoot) {
 		throw new WebSkillError("INTEGRITY_FAILED", `Skill manifest at ${path} is corrupted: ${e instanceof Error ? e.message : String(e)}`, e);
 	}
 }
-/** 按 manifest.files 逐文件重算 sha256 比对（core 纯逻辑校验） */
+/** walk 实际目录与 manifest 比对：hash 不一致 / 清单外新增 / 清单内缺失三类全空才 ok */
 async function verifyIntegrity(fs, skillRoot) {
 	const manifest = await readManifest(fs, skillRoot);
 	const actualHashes = /* @__PURE__ */ new Map();
-	for (const file of manifest.files) {
-		const path = `${skillRoot}/${file.path}`;
-		if (await fs.exists(path)) actualHashes.set(file.path, sha256Hex(await fs.readBinary(path)));
-	}
-	return verifyManifest(manifest, actualHashes);
+	const actualFiles = await walkFiles(fs, skillRoot);
+	for (const rel of actualFiles) actualHashes.set(rel, sha256Hex(await fs.readBinary(`${skillRoot}/${rel}`)));
+	return verifyManifest(manifest, actualHashes, actualFiles);
 }
 const messageOf = (e) => e instanceof Error ? e.message : String(e);
 const asInstallFailed = (e) => e instanceof WebSkillError && e.code === "INSTALL_FAILED" ? e : new WebSkillError("INSTALL_FAILED", `Install failed: ${messageOf(e)}`, e);
@@ -1188,12 +1260,20 @@ var SkillManager = class {
 	#fs;
 	#fetchImpl;
 	#schemaInference;
+	#archiveLimits;
+	#onChanged;
 	#schemaInferer = new OxcSchemaInferer();
 	constructor(deps) {
 		this.#managedRoot = deps.managedRoot.replace(/\/+$/, "");
 		this.#fs = deps.fs ?? new NodeFS();
 		this.#fetchImpl = deps.fetchImpl;
 		this.#schemaInference = deps.schemaInference ?? true;
+		this.#archiveLimits = deps.archiveLimits;
+		this.#onChanged = deps.onChanged;
+	}
+	/** 托管根目录（治理发布归档捕获等只读场景） */
+	get managedRoot() {
+		return this.#managedRoot;
 	}
 	async install(source, options) {
 		const fs = this.#fs;
@@ -1204,7 +1284,8 @@ var SkillManager = class {
 			const ctx = {
 				fs,
 				stagingRoot,
-				...this.#fetchImpl ? { fetchImpl: this.#fetchImpl } : {}
+				...this.#fetchImpl ? { fetchImpl: this.#fetchImpl } : {},
+				...this.#archiveLimits ? { archiveLimits: this.#archiveLimits } : {}
 			};
 			let staged;
 			switch (source.type) {
@@ -1268,6 +1349,7 @@ var SkillManager = class {
 				throw e;
 			}
 			targetDir = void 0;
+			this.#onChanged?.();
 			return manifest;
 		} catch (e) {
 			if (targetDir) await removeDirQuiet(fs, targetDir);
@@ -1346,6 +1428,7 @@ var SkillManager = class {
 				installed.length = 0;
 				throw e;
 			}
+			this.#onChanged?.();
 			return manifests;
 		} catch (e) {
 			for (const targetDir of installed) await removeDirQuiet(fs, targetDir);
@@ -1381,6 +1464,7 @@ var SkillManager = class {
 		try {
 			await this.#fs.remove(targetDir, { recursive: true });
 			await removeLockEntry(this.#fs, this.#managedRoot, name);
+			this.#onChanged?.();
 		} catch (e) {
 			throw new WebSkillError("UNINSTALL_FAILED", `Failed to uninstall "${name}": ${messageOf(e)}`, e);
 		}
@@ -1414,142 +1498,6 @@ var SkillManager = class {
 		return options.outPath;
 	}
 };
-/** 解析 .env（简单 KEY=VALUE 行解析，不引依赖）；文件缺失返回 undefined */
-function readEnvVars(dotenvPath) {
-	let raw;
-	try {
-		raw = readFileSync(dotenvPath, "utf8");
-	} catch {
-		return;
-	}
-	const vars = /* @__PURE__ */ new Map();
-	for (const line of raw.split(/\r?\n/)) {
-		const trimmed = line.trim();
-		if (trimmed === "" || trimmed.startsWith("#")) continue;
-		const eq = trimmed.indexOf("=");
-		if (eq <= 0) continue;
-		const key = trimmed.slice(0, eq).trim();
-		let value = trimmed.slice(eq + 1).trim();
-		if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
-		vars.set(key, value);
-	}
-	return vars;
-}
-/**
-* 读取 VITE_BASE_URL / VITE_API_KEY / VITE_MODEL_NAME；缺项返回 undefined 供测试 skip 判断。
-*/
-function loadLlmConfigFromEnv(dotenvPath = ".env") {
-	const vars = readEnvVars(dotenvPath);
-	if (!vars) return void 0;
-	const baseUrl = vars.get("VITE_BASE_URL");
-	const apiKey = vars.get("VITE_API_KEY");
-	const model = vars.get("VITE_MODEL_NAME");
-	if (!baseUrl || !apiKey || !model) return void 0;
-	return {
-		baseUrl,
-		apiKey,
-		model
-	};
-}
-/** ANTHROPIC_API_KEY / ANTHROPIC_MODEL（可选 ANTHROPIC_BASE_URL）；缺项返回 undefined */
-function loadAnthropicConfigFromEnv(dotenvPath = ".env") {
-	const vars = readEnvVars(dotenvPath);
-	if (!vars) return void 0;
-	const apiKey = vars.get("ANTHROPIC_API_KEY");
-	const model = vars.get("ANTHROPIC_MODEL");
-	if (!apiKey || !model) return void 0;
-	const baseUrl = vars.get("ANTHROPIC_BASE_URL");
-	return {
-		apiKey,
-		model,
-		...baseUrl ? { baseUrl } : {}
-	};
-}
-/** GOOGLE_API_KEY / GOOGLE_MODEL（可选 GOOGLE_BASE_URL）；缺项返回 undefined */
-function loadGoogleConfigFromEnv(dotenvPath = ".env") {
-	const vars = readEnvVars(dotenvPath);
-	if (!vars) return void 0;
-	const apiKey = vars.get("GOOGLE_API_KEY");
-	const model = vars.get("GOOGLE_MODEL");
-	if (!apiKey || !model) return void 0;
-	const baseUrl = vars.get("GOOGLE_BASE_URL");
-	return {
-		apiKey,
-		model,
-		...baseUrl ? { baseUrl } : {}
-	};
-}
-let capabilitiesCache;
-/**
-* 探测 LLM 能力（结果模块级缓存）：
-* - available：GET /models 可达（与 checkAvailability 同语义）
-* - nonStreaming：最小非流式 chat completion（max_tokens=1，短超时）；
-*   HTTP 400/404 或明确不支持非流式的错误 → false
-* - streaming 能力由 available 推断（SSE 解析在 SDK 侧实现）
-* 环境变量 VITE_LLM_NON_STREAMING=0 可显式强制 nonStreaming=false（模拟流式-only 回归）。
-*/
-function probeLlmCapabilities(config) {
-	capabilitiesCache ??= doProbeLlmCapabilities(config);
-	return capabilitiesCache;
-}
-async function doProbeLlmCapabilities(config) {
-	const baseUrl = config.baseUrl.replace(/\/+$/, "");
-	const headers = { authorization: `Bearer ${config.apiKey}` };
-	let available = false;
-	try {
-		available = (await fetch(`${baseUrl}/models`, {
-			headers,
-			signal: AbortSignal.timeout(1e4)
-		})).ok;
-	} catch {
-		available = false;
-	}
-	if (!available) return {
-		available: false,
-		nonStreaming: false,
-		reason: "endpoint unreachable or unauthorized"
-	};
-	if (process.env["VITE_LLM_NON_STREAMING"] === "0") return {
-		available: true,
-		nonStreaming: false,
-		reason: "non-streaming disabled via VITE_LLM_NON_STREAMING=0 (simulated)"
-	};
-	try {
-		const res = await fetch(`${baseUrl}/chat/completions`, {
-			method: "POST",
-			headers: {
-				...headers,
-				"content-type": "application/json"
-			},
-			body: JSON.stringify({
-				model: config.model,
-				messages: [{
-					role: "user",
-					content: "OK"
-				}],
-				max_tokens: 1
-			}),
-			signal: AbortSignal.timeout(15e3)
-		});
-		const contentType = res.headers.get("content-type") ?? "";
-		if (res.ok && !contentType.includes("text/event-stream")) return {
-			available: true,
-			nonStreaming: true
-		};
-		const detail = (await res.text().catch(() => "")).slice(0, 200);
-		return {
-			available: true,
-			nonStreaming: false,
-			reason: `endpoint rejects non-streaming chat completions (HTTP ${res.status})${detail ? `: ${detail}` : ""}`
-		};
-	} catch (e) {
-		return {
-			available: true,
-			nonStreaming: false,
-			reason: `non-streaming probe failed: ${e instanceof Error ? e.message : String(e)}`
-		};
-	}
-}
 
 //#endregion
-export { NodeScriptExecutor as a, SkillManager as c, loadLlmConfigFromEnv as d, probeLlmCapabilities as f, NodeFS as i, loadAnthropicConfigFromEnv as l, FileArtifactStore as n, OxcSchemaInferer as o, readArchiveManifest as p, FileMemoryStore as r, SandboxedScriptExecutor as s, CliUiBridge as t, loadGoogleConfigFromEnv as u };
+export { NodeScriptExecutor as a, SkillManager as c, NodeFS as i, exportArchive as l, FileArtifactStore as n, OxcSchemaInferer as o, FileMemoryStore as r, SandboxedScriptExecutor as s, CliUiBridge as t, readArchiveManifest as u };