@webskill/sdk 0.1.5 → 0.2.1

package/dist/{dist-LIFS3ZjI.js → dist-BRGQcLqR.js}

@@ -1,21 +1,20 @@
-import { A as validateSkills, C as parseSkillPackManifest, D as resolveArchiveLimits, O as resolveInsideRoot, S as parseSkillMarkdown, i as SKILL_MANIFEST_FILE, j as verifyManifest, k as unzipWithLimits, p as buildManifest, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, v as exportSkills, w as readResponseWithLimit, y as isValidSkillName } from "./dist-fZFZaf43.js";
-import { M as normalizeToolContent, N as parseBridgeRequest, S as bridgeError, c as FsArtifactStore, j as networkUrlHost, k as isNetworkAllowed, l as FsMemoryStore, o as CapabilityApproval } from "./dist-DuGN5x0v.js";
+import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, O as resolveArchiveLimits, T as readResponseWithLimit, b as isValidSkillName, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D0saNPi_.js";
+import { A as isNetworkAllowed, C as bridgeError, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, l as FsMemoryStore, o as CapabilityApproval } from "./dist-DrySSQ5R.js";
+import { createRequire } from "node:module";
 import { unzipSync, zipSync } from "fflate";
-import { existsSync, promises, readFileSync } from "node:fs";
+import { existsSync, promises, realpathSync } from "node:fs";
 import path from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { format, promisify } from "node:util";
 import { Worker } from "node:worker_threads";
-import { parseSync } from "oxc-parser";
+import { mkdtemp, rm } from "node:fs/promises";
+import { execFile, fork } from "node:child_process";
 import { createInterface } from "node:readline/promises";
-import { mkdtemp } from "node:fs/promises";
-import * as tar from "tar";
-import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 
 //#region ../node/dist/index.js
-const toPlatform$3 = (p) => p.split("/").join(path.sep);
+const toPlatform$4 = (p) => p.split("/").join(path.sep);
 const toPosix = (p) => p.split(path.sep).join("/");
 const isEnoent = (e) => typeof e === "object" && e !== null && e.code === "ENOENT";
 /** realpath 最近现存祖先并拼回剩余段（写入目标尚不存在时的等价判定） */
@@ -47,41 +46,41 @@ var NodeFS = class {
 	/** root 模式：目标 realpath 必须落在 root realpath 前缀内（符号链接逃逸防护） */
 	async #assertContained(p) {
 		if (!this.#root) return;
-		const rootReal = await promises.realpath(toPlatform$3(this.#root));
-		const targetReal = await realpathNearest(toPlatform$3(p));
+		const rootReal = await promises.realpath(toPlatform$4(this.#root));
+		const targetReal = await realpathNearest(toPlatform$4(p));
 		if (targetReal !== rootReal && !targetReal.startsWith(rootReal + path.sep)) throw new WebSkillError("FS_PATH_OUTSIDE_ROOT", `Path escapes root via symbolic link: ${p} (resolves outside ${this.#root})`);
 	}
 	async readText(p) {
 		await this.#assertContained(p);
 		try {
-			return await promises.readFile(toPlatform$3(p), "utf8");
+			return await promises.readFile(toPlatform$4(p), "utf8");
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 	}
 	async writeText(p, content) {
 		await this.#assertContained(p);
-		const target = toPlatform$3(p);
+		const target = toPlatform$4(p);
 		await promises.mkdir(path.dirname(target), { recursive: true });
 		await promises.writeFile(target, content, "utf8");
 	}
 	async readBinary(p) {
 		await this.#assertContained(p);
 		try {
-			return await promises.readFile(toPlatform$3(p));
+			return await promises.readFile(toPlatform$4(p));
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 	}
 	async writeBinary(p, content) {
 		await this.#assertContained(p);
-		const target = toPlatform$3(p);
+		const target = toPlatform$4(p);
 		await promises.mkdir(path.dirname(target), { recursive: true });
 		await promises.writeFile(target, content);
 	}
 	async exists(p) {
 		try {
-			await promises.access(toPlatform$3(p));
+			await promises.access(toPlatform$4(p));
 			return true;
 		} catch {
 			return false;
@@ -89,7 +88,7 @@ var NodeFS = class {
 	}
 	async stat(p) {
 		try {
-			const s = await promises.stat(toPlatform$3(p));
+			const s = await promises.stat(toPlatform$4(p));
 			return {
 				path: toPosix(p),
 				type: s.isDirectory() ? "directory" : "file",
@@ -103,31 +102,39 @@ var NodeFS = class {
 	async list(p) {
 		let dirents;
 		try {
-			dirents = await promises.readdir(toPlatform$3(p), { withFileTypes: true });
+			dirents = await promises.readdir(toPlatform$4(p), { withFileTypes: true });
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 		return dirents.map((d) => ({
-			path: toPosix(path.join(toPlatform$3(p), d.name)),
+			path: toPosix(path.join(toPlatform$4(p), d.name)),
 			type: d.isDirectory() ? "directory" : "file"
 		}));
 	}
 	async mkdir(p) {
-		await promises.mkdir(toPlatform$3(p), { recursive: true });
+		await promises.mkdir(toPlatform$4(p), { recursive: true });
 	}
 	async remove(p, options) {
 		try {
-			await promises.rm(toPlatform$3(p), { recursive: options?.recursive ?? false });
+			await promises.rm(toPlatform$4(p), { recursive: options?.recursive ?? false });
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 	}
+	async rename(from, to) {
+		await promises.mkdir(path.dirname(toPlatform$4(to)), { recursive: true });
+		try {
+			await promises.rename(toPlatform$4(from), toPlatform$4(to));
+		} catch (e) {
+			throw this.#mapError(e, from);
+		}
+	}
 	#mapError(e, p) {
 		if (isEnoent(e)) return new WebSkillError("FS_NOT_FOUND", `Path not found: ${p}`);
 		return e;
 	}
 };
-const baseName$1 = (p) => p.split("/").pop() ?? p;
+const baseName$2 = (p) => p.split("/").pop() ?? p;
 /**
 * 进程内脚本执行器。接口按沙箱语义设计（context 无隐式宿主访问），
 * worker_threads 沙箱见 deferred-items D1。
@@ -166,7 +173,7 @@ var NodeScriptExecutor = class {
 	}
 	async loadDefinition(skillRoot, scriptName) {
 		const scriptPath = await this.#locateScript(skillRoot, scriptName);
-		const skillName = baseName$1(skillRoot);
+		const skillName = baseName$2(skillRoot);
 		let module;
 		try {
 			module = await this.#loadModule(scriptPath);
@@ -270,14 +277,14 @@ var NodeScriptExecutor = class {
 		};
 	}
 };
-const baseName = (p) => p.split("/").pop() ?? p;
-const toPlatform$2 = (p) => p.split("/").join(path.sep);
-const messageOf$5 = (e) => e instanceof Error ? e.message : String(e);
+const baseName$1 = (p) => p.split("/").pop() ?? p;
+const toPlatform$3 = (p) => p.split("/").join(path.sep);
+const messageOf$6 = (e) => e instanceof Error ? e.message : String(e);
 /**
 * 网络策略判定函数源码（注入 Worker；匹配逻辑单一来源在
 * runtime/sandbox/networkPolicy.ts，Worker 线程不走 vitest 别名故注入而非 import）
 */
-const NETWORK_POLICY_LIB = `${isNetworkAllowed.toString()}\n${networkUrlHost.toString()}`;
+const NETWORK_POLICY_LIB$1 = `${isNetworkAllowed.toString()}\n${networkUrlHost.toString()}`;
 /** Worker 入口文件：src 为同目录 .ts；node dist 为 dist/executor/；sdk dist 为平铺 dist/ */
 function workerEntryPath() {
 	const dir = path.dirname(fileURLToPath(import.meta.url));
@@ -329,10 +336,10 @@ var SandboxedScriptExecutor = class {
 	}
 	async loadDefinition(skillRoot, scriptName) {
 		const scriptPath = await this.#locateScript(skillRoot, scriptName);
-		const skillName = baseName(skillRoot);
+		const skillName = baseName$1(skillRoot);
 		const result = await this.#runWorker({
 			mode: "load",
-			scriptPath: toPlatform$2(scriptPath),
+			scriptPath: toPlatform$3(scriptPath),
 			scriptName,
 			scriptSource: await this.#fs.readText(scriptPath)
 		});
@@ -356,14 +363,14 @@ var SandboxedScriptExecutor = class {
 				content: [],
 				error: {
 					code: e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED",
-					message: messageOf$5(e)
+					message: messageOf$6(e)
 				}
 			};
 		}
 		try {
 			const result = await this.#runWorker({
 				mode: "execute",
-				scriptPath: toPlatform$2(scriptPath),
+				scriptPath: toPlatform$3(scriptPath),
 				scriptName,
 				skillName: context.skillName,
 				runId: context.runId,
@@ -396,7 +403,7 @@ var SandboxedScriptExecutor = class {
 				content: [],
 				error: {
 					code: e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED",
-					message: messageOf$5(e)
+					message: messageOf$6(e)
 				}
 			};
 		}
@@ -410,7 +417,7 @@ var SandboxedScriptExecutor = class {
 				workerData: {
 					...workerData,
 					networkPolicy: this.#networkPolicy,
-					networkPolicyLib: NETWORK_POLICY_LIB,
+					networkPolicyLib: NETWORK_POLICY_LIB$1,
 					allowedModules: this.#options.allowedModules ?? []
 				},
 				env,
@@ -447,7 +454,7 @@ var SandboxedScriptExecutor = class {
 						respond(bridgeError("unknown", "TOOL_EXECUTION_FAILED", "invalid bridge request"));
 						return;
 					}
-					onBridge(request).then(respond, (e) => respond(bridgeError(request.id, "TOOL_EXECUTION_FAILED", messageOf$5(e))));
+					onBridge(request).then(respond, (e) => respond(bridgeError(request.id, "TOOL_EXECUTION_FAILED", messageOf$6(e))));
 					return;
 				}
 				if (msg?.type === "load-result" || msg?.type === "execute-result") done(() => resolve(msg));
@@ -459,6 +466,328 @@ var SandboxedScriptExecutor = class {
 		});
 	}
 	/** 能力桥宿主侧处理：能力关闭/授权拒绝即 TOOL_UNSUPPORTED；判定逻辑共用 runtime/sandbox/approval */
+	async #handleBridge(request, context) {
+		const gate = async (capability, message, details) => {
+			const decision = await this.#approval.authorize({
+				runId: context.runId,
+				capability,
+				mode: this.#capabilities[capability],
+				message,
+				...details !== void 0 ? { details } : {}
+			});
+			if (decision === "allowed") return void 0;
+			return bridgeError(request.id, "TOOL_UNSUPPORTED", decision === "disabled" ? `Capability "${capability}" is disabled` : `Capability "${capability}" was denied by the user`);
+		};
+		try {
+			switch (request.kind) {
+				case "readReference": {
+					const denied = await gate("readReference", `Script "${context.skillName}" wants to read reference "${request.path}"`, { path: request.path });
+					if (denied) return denied;
+					return {
+						id: request.id,
+						ok: true,
+						value: await context.readReference(request.path)
+					};
+				}
+				case "writeArtifact": {
+					const denied = await gate("writeArtifact", `Script "${context.skillName}" wants to write artifact "${request.path}"`, {
+						path: request.path,
+						mimeType: request.mimeType
+					});
+					if (denied) return denied;
+					const content = typeof request.content === "string" ? request.content : new Uint8Array(request.content);
+					const artifact = await context.writeArtifact(request.path, content, { ...request.mimeType ? { mimeType: request.mimeType } : {} });
+					return {
+						id: request.id,
+						ok: true,
+						value: artifact
+					};
+				}
+				case "confirm": {
+					if (!context.confirm) return bridgeError(request.id, "TOOL_UNSUPPORTED", "Capability \"confirm\" is disabled");
+					const denied = await gate("confirm", `Script "${context.skillName}" asks for confirmation: ${request.message}`);
+					if (denied) return denied;
+					return {
+						id: request.id,
+						ok: true,
+						value: await context.confirm(request.message)
+					};
+				}
+			}
+		} catch (e) {
+			return bridgeError(request.id, e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED", messageOf$6(e));
+		}
+	}
+};
+const baseName = (p) => p.split("/").pop() ?? p;
+const toPlatform$2 = (p) => p.split("/").join(path.sep);
+const messageOf$5 = (e) => e instanceof Error ? e.message : String(e);
+const NETWORK_POLICY_LIB = `${isNetworkAllowed.toString()}\n${networkUrlHost.toString()}`;
+const readAllow = (p) => [`--allow-fs-read=${p}`, `--allow-fs-read=${realpathSync(p)}`];
+const writeAllow = (p) => [`--allow-fs-write=${p}`, `--allow-fs-write=${realpathSync(p)}`];
+/** 子进程入口文件：src 为同目录 .ts；node dist 为 dist/executor/；sdk dist 为平铺 dist/ */
+function processEntryPath() {
+	const dir = path.dirname(fileURLToPath(import.meta.url));
+	const candidates = [
+		path.join(dir, "processSandboxEntry.js"),
+		path.join(dir, "processSandboxEntry.ts"),
+		path.join(dir, "executor", "processSandboxEntry.js")
+	];
+	for (const candidate of candidates) if (existsSync(candidate)) return candidate;
+	throw new WebSkillError("TOOL_EXECUTION_FAILED", `Process sandbox entry not found (tried: ${candidates.join(", ")})`);
+}
+/**
+* child_process.fork + --permission 进程沙箱（真实进程隔离）。
+* 每个子进程以 `--permission --allow-fs-read=<入口目录> --allow-fs-read=<skillRoot>
+* --allow-fs-write=<artifactDir>` 启动：fs 维度由权限模型管控（experimental），
+* 子进程/Worker/addons 默认禁；网络无权限维度仍靠 fetch/WebSocket patch。
+* 能力桥协议与 worker_threads 沙箱同一形态（readReference/writeArtifact/confirm + 授权）。
+* 温池（默认 2）：同 skillRoot 复用子进程；执行后 kill 并补位重生；并发上限即池大小。
+* 超时 kill（同步死循环可杀）；非零退出码 → TOOL_EXECUTION_FAILED。
+*/
+var ProcessSandboxExecutor = class {
+	#fs;
+	#options;
+	#capabilities;
+	#networkPolicy;
+	#approval;
+	#slots = [];
+	#waiters = [];
+	constructor(fs, options = {}) {
+		this.#fs = fs;
+		this.#options = options;
+		this.#capabilities = {
+			readReference: options.capabilities?.readReference ?? true,
+			writeArtifact: options.capabilities?.writeArtifact ?? true,
+			confirm: options.capabilities?.confirm ?? true
+		};
+		this.#networkPolicy = options.networkPolicy ?? "deny-all";
+		this.#approval = new CapabilityApproval({
+			...options.uiBridge ? { uiBridge: options.uiBridge } : {},
+			...options.approvalScope ? { scope: options.approvalScope } : {}
+		});
+	}
+	get poolSize() {
+		return this.#options.poolSize ?? 2;
+	}
+	/** 池全部子进程销毁（测试收尾/进程退出前调用） */
+	async dispose() {
+		for (const slot of this.#slots) {
+			slot.child.kill();
+			await rm(slot.artifactDir, {
+				recursive: true,
+				force: true
+			}).catch(() => void 0);
+		}
+		this.#slots = [];
+		this.#waiters = [];
+	}
+	async #locateScript(skillRoot, scriptName) {
+		const tsPath = `${skillRoot}/scripts/${scriptName}.ts`;
+		const jsPath = `${skillRoot}/scripts/${scriptName}.js`;
+		const [hasTs, hasJs] = await Promise.all([this.#fs.exists(tsPath), this.#fs.exists(jsPath)]);
+		if (hasTs && hasJs) throw new WebSkillError("TOOL_EXECUTION_FAILED", `Script "${scriptName}" is ambiguous: both .ts and .js exist under ${skillRoot}/scripts`);
+		if (!hasTs && !hasJs) throw new WebSkillError("TOOL_NOT_FOUND", `Script "${scriptName}" not found under ${skillRoot}/scripts`);
+		return hasTs ? tsPath : jsPath;
+	}
+	/** 取一个可用子进程（同 key 复用 / 淘汰 idle 重生 / 扩容 / 排队） */
+	async #acquire(key) {
+		for (;;) {
+			const idle = this.#slots.filter((s) => !s.busy);
+			const match = idle.find((s) => s.key === key);
+			if (match) {
+				match.busy = true;
+				return match;
+			}
+			if (idle.length > 0) {
+				const victim = idle[0];
+				victim.child.kill();
+				await rm(victim.artifactDir, {
+					recursive: true,
+					force: true
+				}).catch(() => void 0);
+				this.#slots.splice(this.#slots.indexOf(victim), 1);
+			}
+			if (this.#slots.length < this.poolSize) {
+				const slot = await this.#spawnSlot(key);
+				slot.busy = true;
+				this.#slots.push(slot);
+				return slot;
+			}
+			await new Promise((resolve) => this.#waiters.push(resolve));
+		}
+	}
+	/** 执行后回收：kill 旧子进程，补位重生同 key 新子进程（温池保持），唤醒排队 */
+	#recycle(slot) {
+		slot.child.kill();
+		const index = this.#slots.indexOf(slot);
+		if (index >= 0) this.#slots.splice(index, 1);
+		rm(slot.artifactDir, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+		this.#spawnSlot(slot.key).then((fresh) => {
+			this.#slots.push(fresh);
+		}).catch(() => void 0).finally(() => {
+			const waiter = this.#waiters.shift();
+			if (waiter) waiter();
+		});
+	}
+	async #spawnSlot(key) {
+		const artifactDir = await mkdtemp(path.join(tmpdir(), "webskill-psbx-out-")).then((d) => d.split(path.sep).join("/"));
+		const entry = processEntryPath();
+		return {
+			key,
+			child: fork(entry, [], {
+				execArgv: [
+					"--permission",
+					...readAllow(path.dirname(entry)),
+					...readAllow(toPlatform$2(key)),
+					...readAllow(artifactDir),
+					...writeAllow(artifactDir)
+				],
+				silent: false
+			}),
+			busy: false,
+			artifactDir
+		};
+	}
+	async loadDefinition(skillRoot, scriptName) {
+		const scriptPath = await this.#locateScript(skillRoot, scriptName);
+		const skillName = baseName(skillRoot);
+		const slot = await this.#acquire(toPlatform$2(skillRoot));
+		try {
+			const response = await this.#runTask(slot, {
+				mode: "load",
+				scriptPath: toPlatform$2(scriptPath),
+				scriptName,
+				scriptSource: await this.#fs.readText(scriptPath),
+				scratchDir: slot.artifactDir
+			}, 3e4);
+			if (!response.ok) throw new WebSkillError("TOOL_EXECUTION_FAILED", `Failed to load script "${scriptName}": ${response.error?.message ?? "unknown error"}`);
+			return {
+				name: `${skillName}__${scriptName}`,
+				description: response.definition?.description,
+				inputSchema: response.definition?.inputSchema,
+				source: "script",
+				skillName
+			};
+		} finally {
+			this.#recycle(slot);
+		}
+	}
+	async execute(input) {
+		const { skillRoot, scriptName, args, context, timeoutMs } = input;
+		let scriptPath;
+		try {
+			scriptPath = await this.#locateScript(skillRoot, scriptName);
+		} catch (e) {
+			return {
+				ok: false,
+				content: [],
+				error: {
+					code: e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED",
+					message: messageOf$5(e)
+				}
+			};
+		}
+		const slot = await this.#acquire(toPlatform$2(skillRoot));
+		try {
+			const result = await this.#runTask(slot, {
+				mode: "execute",
+				scriptPath: toPlatform$2(scriptPath),
+				scriptName,
+				skillName: context.skillName,
+				runId: context.runId,
+				args,
+				scriptSource: await this.#fs.readText(scriptPath),
+				scratchDir: slot.artifactDir
+			}, timeoutMs, (request) => this.#handleBridge(request, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
+			if (!result.ok) {
+				const stderrSummary = result.stderr?.length ? ` | stderr: ${result.stderr.join(" | ").slice(0, 500)}` : "";
+				return {
+					ok: false,
+					content: [],
+					error: {
+						code: result.error?.code ?? "TOOL_EXECUTION_FAILED",
+						message: `${result.error?.message ?? "script execution failed"}${stderrSummary}`
+					}
+				};
+			}
+			const content = normalizeToolContent(result.value);
+			if (result.stdout?.length) content.push({
+				type: "text",
+				text: result.stdout.join("\n")
+			});
+			return {
+				ok: true,
+				content
+			};
+		} catch (e) {
+			return {
+				ok: false,
+				content: [],
+				error: {
+					code: e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED",
+					message: messageOf$5(e)
+				}
+			};
+		} finally {
+			this.#recycle(slot);
+		}
+	}
+	/** 在子进程上跑一个任务；超时 kill；非零退出码 → TOOL_EXECUTION_FAILED */
+	#runTask(slot, task, timeoutMs, onBridge, onNetworkBlocked) {
+		const { child } = slot;
+		return new Promise((resolve, reject) => {
+			let settled = false;
+			const timer = setTimeout(() => {
+				if (settled) return;
+				settled = true;
+				child.kill();
+				reject(new WebSkillError("RUN_TIMEOUT", `Process sandbox task timed out after ${timeoutMs}ms (child killed)`));
+			}, timeoutMs);
+			const done = (fn) => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(timer);
+				fn();
+			};
+			child.on("message", (msg) => {
+				if (msg?.type === "network-blocked") {
+					if (typeof msg.host === "string") onNetworkBlocked?.(msg.host);
+					return;
+				}
+				if (msg?.type === "bridge" && onBridge) {
+					const request = parseBridgeRequest(msg.request);
+					const respond = (response) => child.send({
+						type: "bridge-response",
+						response
+					});
+					if (!request) {
+						respond(bridgeError("unknown", "TOOL_EXECUTION_FAILED", "invalid bridge request"));
+						return;
+					}
+					onBridge(request).then(respond, (e) => respond(bridgeError(request.id, "TOOL_EXECUTION_FAILED", messageOf$5(e))));
+					return;
+				}
+				if (msg?.type === "load-result" || msg?.type === "execute-result") done(() => resolve(msg));
+			});
+			child.on("error", (e) => done(() => reject(e)));
+			child.on("exit", (code) => {
+				if (!settled) done(() => reject(new WebSkillError("TOOL_EXECUTION_FAILED", `Sandbox child exited ${code === null ? "by signal" : `with code ${code}`} without producing a result`)));
+			});
+			child.send({
+				type: "task",
+				task: {
+					...task,
+					networkPolicy: this.#networkPolicy,
+					networkPolicyLib: NETWORK_POLICY_LIB
+				}
+			});
+		});
+	}
+	/** 能力桥宿主侧处理：与 worker_threads 沙箱同一判定（runtime/sandbox/approval 单一来源） */
 	async #handleBridge(request, context) {
 		const gate = async (capability, message, details) => {
 			const decision = await this.#approval.authorize({
@@ -512,6 +841,16 @@ var SandboxedScriptExecutor = class {
 		}
 	}
 };
+const require_ = createRequire(import.meta.url);
+let parseSyncCache;
+function loadParseSync() {
+	if (!parseSyncCache) try {
+		parseSyncCache = require_("oxc-parser").parseSync;
+	} catch (e) {
+		throw new WebSkillError("TOOL_UNSUPPORTED", "The \"oxc-parser\" package is required for schema inference; install it first (npm i oxc-parser)", e);
+	}
+	return parseSyncCache;
+}
 const PLACEHOLDER_PREFIX = "Inferred placeholder (unsupported type: ";
 const placeholder = (text) => ({
 	type: "string",
@@ -561,7 +900,7 @@ var TypeMapper = class {
 		};
 		return placeholder(this.#text(t));
 	}
-	#union(t, seen) {
+	#union(t, _seen) {
 		const values = [];
 		for (const member of t.types ?? []) {
 			const value = member.literal?.value ?? member.value;
@@ -661,7 +1000,7 @@ var OxcSchemaInferer = class {
 		let program;
 		let comments;
 		try {
-			const result = parseSync(options?.fileName ?? "script.ts", source);
+			const result = loadParseSync()(options?.fileName ?? "script.ts", source);
 			if (result.errors?.length > 0) return void 0;
 			program = result.program;
 			comments = result.comments ?? [];
@@ -677,7 +1016,7 @@ var OxcSchemaInferer = class {
 		const jsdoc = comments.filter((c) => c.type === "Block" && typeof c.value === "string" && c.value.includes("@param") && typeof c.end === "number" && c.end <= runStart).sort((a, b) => b.end - a.end)[0];
 		if (!jsdoc) return void 0;
 		const reparse = (typeText) => {
-			const r = parseSync("__t.ts", `type __T = ${typeText};`);
+			const r = loadParseSync()("__t.ts", `type __T = ${typeText};`);
 			if (r.errors?.length > 0) return void 0;
 			return r.program.body.find((n) => n.type === "TSTypeAliasDeclaration")?.typeAnnotation;
 		};
@@ -833,6 +1172,13 @@ var CliUiBridge = class {
 const messageOf$4 = (e) => e instanceof Error ? e.message : String(e);
 const toPlatform$1 = (p) => p.split("/").join(path.sep);
 const isZipArchive = (data) => data.length > 1 && data[0] === 80 && data[1] === 75;
+let tarModule$1;
+async function loadTar$1() {
+	tarModule$1 ??= await import("tar").catch((e) => {
+		throw new WebSkillError("TOOL_UNSUPPORTED", "The \"tar\" package is required for tar/tar.gz archives; install it first (npm i tar)", e);
+	});
+	return tarModule$1;
+}
 /**
 * zip 解包（fflate 流式，单条目/总解压体积上限）。每个条目路径过 resolveInsideRoot：
 * 拒绝 `..` 段、绝对路径、反斜杠穿越（zip-slip 防护）。
@@ -853,7 +1199,8 @@ async function extractTarFile(archivePath, destRoot, limits) {
 	try {
 		const entryPaths = [];
 		let total = 0;
-		await tar.t({
+		const tarMod = await loadTar$1();
+		await tarMod.t({
 			file: toPlatform$1(archivePath),
 			onentry: (entry) => {
 				entryPaths.push(entry.path);
@@ -864,7 +1211,7 @@ async function extractTarFile(archivePath, destRoot, limits) {
 			}
 		});
 		for (const p of entryPaths) if (!p.replace(/\\/g, "/").split("/").every((s) => s === "" || s === ".")) resolveInsideRoot(destRoot, p);
-		await tar.x({
+		await tarMod.x({
 			file: toPlatform$1(archivePath),
 			cwd: toPlatform$1(destRoot),
 			filter: (_p, entry) => !("type" in entry) || entry.type !== "SymbolicLink" && entry.type !== "Link"
@@ -916,6 +1263,13 @@ async function removeDirQuiet(fs, dir) {
 	} catch {}
 }
 const messageOf$3 = (e) => e instanceof Error ? e.message : String(e);
+let tarModule;
+async function loadTar() {
+	tarModule ??= await import("tar").catch((e) => {
+		throw new WebSkillError("TOOL_UNSUPPORTED", "The \"tar\" package is required for tar/tar.gz archives; install it first (npm i tar)", e);
+	});
+	return tarModule;
+}
 /** 导出技能目录全部文件（含 manifest）为 zip/tar 归档，返回 outPath */
 async function exportArchive(fs, skillRoot, options) {
 	try {
@@ -923,7 +1277,7 @@ async function exportArchive(fs, skillRoot, options) {
 			const files = {};
 			for (const rel of await listFiles(fs, skillRoot)) files[rel] = await fs.readBinary(`${skillRoot}/${rel}`);
 			await fs.writeBinary(options.outPath, zipSync(files, { level: 6 }));
-		} else await tar.c({
+		} else await (await loadTar()).c({
 			file: toPlatform$1(options.outPath),
 			cwd: toPlatform$1(skillRoot)
 		}, ["."]);
@@ -945,7 +1299,7 @@ async function readArchiveManifest(fs, archivePath) {
 	}
 	let manifestText;
 	try {
-		await tar.t({
+		await (await loadTar()).t({
 			file: toPlatform$1(archivePath),
 			onentry: (entry) => {
 				if (entry.path === "webskill.skill-manifest.json" || entry.path.endsWith(`/${"webskill.skill-manifest.json"}`)) {
@@ -1151,15 +1505,19 @@ async function readLockfile(fs, managedRoot) {
 async function upsertLockEntry(fs, managedRoot, name, entry) {
 	const lockfile = await readLockfile(fs, managedRoot);
 	lockfile.skills[name] = entry;
-	await fs.writeText(`${managedRoot}/${SKILLS_LOCKFILE}`, JSON.stringify(lockfile, null, 2));
+	await writeLockfileAtomic(fs, managedRoot, lockfile);
 	return lockfile;
 }
 async function removeLockEntry(fs, managedRoot, name) {
 	const lockfile = await readLockfile(fs, managedRoot);
 	delete lockfile.skills[name];
-	await fs.writeText(`${managedRoot}/${SKILLS_LOCKFILE}`, JSON.stringify(lockfile, null, 2));
+	await writeLockfileAtomic(fs, managedRoot, lockfile);
 	return lockfile;
 }
+/** 原子写：先写临时文件再 rename（进程崩溃不留下半写 lockfile） */
+async function writeLockfileAtomic(fs, managedRoot, lockfile) {
+	await atomicWriteText(fs, `${managedRoot}/${SKILLS_LOCKFILE}`, JSON.stringify(lockfile, null, 2));
+}
 const EXCLUDED_FILES = /* @__PURE__ */ new Set([SKILL_MANIFEST_FILE, SKILLS_LOCKFILE]);
 /** 递归收集技能目录内的文件（相对路径，posix 分隔） */
 async function walkFiles(fs, root, prefix = "") {
@@ -1235,6 +1593,10 @@ var SkillManager = class {
 		this.#archiveLimits = deps.archiveLimits;
 		this.#onChanged = deps.onChanged;
 	}
+	/** 托管根目录（治理发布归档捕获等只读场景） */
+	get managedRoot() {
+		return this.#managedRoot;
+	}
 	async install(source, options) {
 		const fs = this.#fs;
 		const stagingRoot = (await mkdtemp(path.join(tmpdir(), "webskill-install-"))).split(path.sep).join("/");
@@ -1458,142 +1820,6 @@ var SkillManager = class {
 		return options.outPath;
 	}
 };
-/** 解析 .env（简单 KEY=VALUE 行解析，不引依赖）；文件缺失返回 undefined */
-function readEnvVars(dotenvPath) {
-	let raw;
-	try {
-		raw = readFileSync(dotenvPath, "utf8");
-	} catch {
-		return;
-	}
-	const vars = /* @__PURE__ */ new Map();
-	for (const line of raw.split(/\r?\n/)) {
-		const trimmed = line.trim();
-		if (trimmed === "" || trimmed.startsWith("#")) continue;
-		const eq = trimmed.indexOf("=");
-		if (eq <= 0) continue;
-		const key = trimmed.slice(0, eq).trim();
-		let value = trimmed.slice(eq + 1).trim();
-		if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
-		vars.set(key, value);
-	}
-	return vars;
-}
-/**
-* 读取 VITE_BASE_URL / VITE_API_KEY / VITE_MODEL_NAME；缺项返回 undefined 供测试 skip 判断。
-*/
-function loadLlmConfigFromEnv(dotenvPath = ".env") {
-	const vars = readEnvVars(dotenvPath);
-	if (!vars) return void 0;
-	const baseUrl = vars.get("VITE_BASE_URL");
-	const apiKey = vars.get("VITE_API_KEY");
-	const model = vars.get("VITE_MODEL_NAME");
-	if (!baseUrl || !apiKey || !model) return void 0;
-	return {
-		baseUrl,
-		apiKey,
-		model
-	};
-}
-/** ANTHROPIC_API_KEY / ANTHROPIC_MODEL（可选 ANTHROPIC_BASE_URL）；缺项返回 undefined */
-function loadAnthropicConfigFromEnv(dotenvPath = ".env") {
-	const vars = readEnvVars(dotenvPath);
-	if (!vars) return void 0;
-	const apiKey = vars.get("ANTHROPIC_API_KEY");
-	const model = vars.get("ANTHROPIC_MODEL");
-	if (!apiKey || !model) return void 0;
-	const baseUrl = vars.get("ANTHROPIC_BASE_URL");
-	return {
-		apiKey,
-		model,
-		...baseUrl ? { baseUrl } : {}
-	};
-}
-/** GOOGLE_API_KEY / GOOGLE_MODEL（可选 GOOGLE_BASE_URL）；缺项返回 undefined */
-function loadGoogleConfigFromEnv(dotenvPath = ".env") {
-	const vars = readEnvVars(dotenvPath);
-	if (!vars) return void 0;
-	const apiKey = vars.get("GOOGLE_API_KEY");
-	const model = vars.get("GOOGLE_MODEL");
-	if (!apiKey || !model) return void 0;
-	const baseUrl = vars.get("GOOGLE_BASE_URL");
-	return {
-		apiKey,
-		model,
-		...baseUrl ? { baseUrl } : {}
-	};
-}
-let capabilitiesCache;
-/**
-* 探测 LLM 能力（结果模块级缓存）：
-* - available：GET /models 可达（与 checkAvailability 同语义）
-* - nonStreaming：最小非流式 chat completion（max_tokens=1，短超时）；
-*   HTTP 400/404 或明确不支持非流式的错误 → false
-* - streaming 能力由 available 推断（SSE 解析在 SDK 侧实现）
-* 环境变量 VITE_LLM_NON_STREAMING=0 可显式强制 nonStreaming=false（模拟流式-only 回归）。
-*/
-function probeLlmCapabilities(config) {
-	capabilitiesCache ??= doProbeLlmCapabilities(config);
-	return capabilitiesCache;
-}
-async function doProbeLlmCapabilities(config) {
-	const baseUrl = config.baseUrl.replace(/\/+$/, "");
-	const headers = { authorization: `Bearer ${config.apiKey}` };
-	let available = false;
-	try {
-		available = (await fetch(`${baseUrl}/models`, {
-			headers,
-			signal: AbortSignal.timeout(1e4)
-		})).ok;
-	} catch {
-		available = false;
-	}
-	if (!available) return {
-		available: false,
-		nonStreaming: false,
-		reason: "endpoint unreachable or unauthorized"
-	};
-	if (process.env["VITE_LLM_NON_STREAMING"] === "0") return {
-		available: true,
-		nonStreaming: false,
-		reason: "non-streaming disabled via VITE_LLM_NON_STREAMING=0 (simulated)"
-	};
-	try {
-		const res = await fetch(`${baseUrl}/chat/completions`, {
-			method: "POST",
-			headers: {
-				...headers,
-				"content-type": "application/json"
-			},
-			body: JSON.stringify({
-				model: config.model,
-				messages: [{
-					role: "user",
-					content: "OK"
-				}],
-				max_tokens: 1
-			}),
-			signal: AbortSignal.timeout(15e3)
-		});
-		const contentType = res.headers.get("content-type") ?? "";
-		if (res.ok && !contentType.includes("text/event-stream")) return {
-			available: true,
-			nonStreaming: true
-		};
-		const detail = (await res.text().catch(() => "")).slice(0, 200);
-		return {
-			available: true,
-			nonStreaming: false,
-			reason: `endpoint rejects non-streaming chat completions (HTTP ${res.status})${detail ? `: ${detail}` : ""}`
-		};
-	} catch (e) {
-		return {
-			available: true,
-			nonStreaming: false,
-			reason: `non-streaming probe failed: ${e instanceof Error ? e.message : String(e)}`
-		};
-	}
-}
 
 //#endregion
-export { NodeScriptExecutor as a, SkillManager as c, loadLlmConfigFromEnv as d, probeLlmCapabilities as f, NodeFS as i, loadAnthropicConfigFromEnv as l, FileArtifactStore as n, OxcSchemaInferer as o, readArchiveManifest as p, FileMemoryStore as r, SandboxedScriptExecutor as s, CliUiBridge as t, loadGoogleConfigFromEnv as u };
+export { NodeScriptExecutor as a, SandboxedScriptExecutor as c, readArchiveManifest as d, NodeFS as i, SkillManager as l, FileArtifactStore as n, OxcSchemaInferer as o, FileMemoryStore as r, ProcessSandboxExecutor as s, CliUiBridge as t, exportArchive as u };