@webskill/sdk 0.1.5 → 0.2.1

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
-import { F as SkillDocument, N as SkillCatalogEntry, c as LlmClient, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CgNC-oQu-DEcIBJKG.js";
-import { $ as SkillStateGuard, lt as WebSkillRuntime, q as RuntimeRun } from "./index-COuOu6gw.js";
-import { f as SkillManager } from "./index-Bun1aEf4.js";
+import { F as SkillDocument, N as SkillCatalogEntry, c as LlmClient, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
+import { Q as ScriptExecutor, dt as WebSkillRuntime, ft as WebSkillRuntimeDeps, q as RuntimeRun, tt as SkillStateGuard } from "./index-gjFuBevI.js";
+import { d as SkillManager } from "./index-BmzysJX5.js";
 //#region ../governance/dist/index.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';
@@ -32,6 +32,10 @@ interface AuditEvent {
   actor?: string;
   ts: string;
   data?: Record<string, unknown>;
+  /** hash 链：上一条事件的 hash（首条为 GENESIS） */
+  prevHash?: string;
+  /** 本事件规范化载荷 + prevHash 的 sha256 */
+  hash?: string;
 }
 interface AuditLog {
   append(event: Omit<AuditEvent, 'id' | 'ts'> & {
@@ -51,6 +55,8 @@ interface SkillVersion {
   reason: string;
   manifest: SkillManifest;
   auditEventId?: string;
+  /** 发布时捕获的技能归档（zip 相对路径，applyRollback 恢复用；0.2.0 起记录） */
+  archivePath?: string;
 }
 type SkillState = 'active' | 'quarantined' | 'deprecated' | 'disabled';
 //#endregion
@@ -151,7 +157,10 @@ declare class SkillVersionStore {
     reason: string;
     manifest: SkillManifest;
     parentVersionId?: string;
+    archive?: Uint8Array;
   }): Promise<SkillVersion>;
+  /** 读取版本归档字节（applyRollback 用；未捕获归档的旧版本 → GOVERNANCE_FAILED） */
+  readArchive(skillName: string, versionId: string): Promise<Uint8Array>;
   list(skillName: string): Promise<SkillVersion[]>;
   get(skillName: string, versionId: string): Promise<SkillVersion>;
   /** 回滚：基于旧 manifest 追加新版本 + skill.rolled_back 审计 */
@@ -182,10 +191,25 @@ declare class ApprovalWorkflow {
   publish(candidateId: string, input: {
     actor: string;
   }): Promise<SkillManifest>;
+  /**
+   * 真实回滚（受审批保护：仅经显式 actor 调用并全程审计）：
+   * 版本归档解包 → staging 校验 → 原子安装（复用安装管线 swap）→ 追加新版本 + 审计。
+   * RepairPlanner 的 rollback 选项（targetVersionId）经本方法执行。
+   */
+  applyRollback(skillName: string, versionId: string, input: {
+    actor: string;
+    reason?: string;
+  }): Promise<SkillManifest>;
 }
 //#endregion
 //#region src/audit/fsAuditLog.d.ts
-/** JSONL 追加的审计日志：<managedRoot>/.webskill/audit.jsonl；跨实例可恢复查询 */
+interface AuditChainVerification {
+  ok: boolean;
+  /** 首个断链位置（行号，0 起；ok 时 undefined） */
+  brokenAt?: number;
+  reason?: string;
+}
+/** JSONL 追加的审计日志：<managedRoot>/.webskill/audit.jsonl；跨实例可恢复查询；prevHash 链可校验完整性 */
 declare class FsAuditLog implements AuditLog {
   #private;
   constructor(deps: {
@@ -194,7 +218,7 @@ declare class FsAuditLog implements AuditLog {
     now?: () => string;
     createId?: () => string;
   });
-  append(event: Omit<AuditEvent, 'id' | 'ts'> & {
+  append(event: Omit<AuditEvent, 'id' | 'ts' | 'prevHash' | 'hash'> & {
     id?: string;
     ts?: string;
   }): Promise<AuditEvent>;
@@ -203,6 +227,8 @@ declare class FsAuditLog implements AuditLog {
     type?: string;
     since?: string;
   }): Promise<AuditEvent[]>;
+  /** hash 链完整性校验：逐行重算 hash 并核对 prevHash 链接 */
+  verifyChain(): Promise<AuditChainVerification>;
 }
 //#endregion
 //#region src/repair/failureAnalyzer.d.ts
@@ -234,7 +260,7 @@ interface RepairOption {
 }
 /**
  * 修订选项规划：patch（按诊断给具体文件变更）/ rollback（有旧版本时）/ quarantine。
- * 注意：任何 option 的 apply 都必须经 ApprovalWorkflow 审批后执行。
+ * 注意：任何 option 的 apply 都必须经 ApprovalWorkflow 审批后执行；rollback 选项（targetVersionId）经 ApprovalWorkflow.applyRollback 真实恢复文件。
  */
 declare class RepairPlanner {
   plan(input: {
@@ -331,6 +357,16 @@ declare class EvaluationRunner {
   run(tasks: EvaluationTask[]): Promise<EvaluationReport>;
 }
 //#endregion
+//#region src/evaluation/evaluationRuntime.d.ts
+/**
+ * 治理评估专用 runtime 装配（不可信技能试用路径）：
+ * 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离）；
+ * 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态）。
+ */
+declare function createEvaluationRuntime(deps: WebSkillRuntimeDeps & {
+  executor?: ScriptExecutor;
+}): WebSkillRuntime;
+//#endregion
 //#region src/evaluation/testSuggestion.d.ts
 /** 失败 trace → 回归评估任务建议（prompt 复现 + expected 错误模式） */
 declare function suggestFromFailedRun(run: RuntimeRun): EvaluationTask;
@@ -448,4 +484,4 @@ declare function createMissHook(deps: {
  */
 declare function completeText(llm: LlmClient, messages: LlmMessage[]): Promise<string>;
 //#endregion
-export { AlwaysHumanApprovalPolicy, type ApprovalDecision, type ApprovalPolicy, ApprovalWorkflow, type AuditEvent, type AuditLog, type CandidateFile, type CandidateRisk, type CandidateSkill, type CandidateSource, type CandidateStatus, CandidateStore, CompositeApprovalPolicy, DependencyGraph, DocumentSkillExtractor, type EvaluationReport, type EvaluationResult, EvaluationRunner, type EvaluationTask, FailureAnalyzer, type FailureDiagnosis, FsAuditLog, LlmCandidateGenerator, type RepairOption, RepairPlanner, SCORING_WEIGHTS, type ScoreInput, SimilarityDetector, SkillScorer, type SkillState, SkillStatePolicy, type SkillVersion, SkillVersionStore, type SourceDocument, candidateToCatalogEntry, completeText, createMissHook, jaccardSimilarity, normalizeCandidate, normalizeCandidateFiles, normalizeRisk, parseJsonObject, readDocument, sanitizeCandidateName, suggestFromFailedRun, validateCandidate };
+export { AlwaysHumanApprovalPolicy, type ApprovalDecision, type ApprovalPolicy, ApprovalWorkflow, type AuditEvent, type AuditLog, type CandidateFile, type CandidateRisk, type CandidateSkill, type CandidateSource, type CandidateStatus, CandidateStore, CompositeApprovalPolicy, DependencyGraph, DocumentSkillExtractor, type EvaluationReport, type EvaluationResult, EvaluationRunner, type EvaluationTask, FailureAnalyzer, type FailureDiagnosis, FsAuditLog, LlmCandidateGenerator, type RepairOption, RepairPlanner, SCORING_WEIGHTS, type ScoreInput, SimilarityDetector, SkillScorer, type SkillState, SkillStatePolicy, type SkillVersion, SkillVersionStore, type SourceDocument, candidateToCatalogEntry, completeText, createEvaluationRuntime, createMissHook, jaccardSimilarity, normalizeCandidate, normalizeCandidateFiles, normalizeRisk, parseJsonObject, readDocument, sanitizeCandidateName, suggestFromFailedRun, validateCandidate };

package/dist/governance.js

@@ -1,5 +1,6 @@
-import { A as validateSkills, O as resolveInsideRoot, d as assertSafePathSegment, u as WebSkillError, y as isValidSkillName } from "./dist-fZFZaf43.js";
-import { i as NodeFS } from "./dist-LIFS3ZjI.js";
+import { A as unzipWithLimits, b as isValidSkillName, d as assertSafePathSegment, j as validateSkills, k as resolveInsideRoot, u as WebSkillError } from "./dist-D0saNPi_.js";
+import { S as WebSkillRuntime } from "./dist-DrySSQ5R.js";
+import { i as NodeFS, s as ProcessSandboxExecutor, u as exportArchive } from "./dist-BRGQcLqR.js";
 import path from "node:path";
 import { tmpdir } from "node:os";
 import { mkdtemp } from "node:fs/promises";
@@ -307,9 +308,15 @@ var ApprovalWorkflow = class {
 				type: "local",
 				path: skillDir
 			});
+			const archiveOut = `${stagingRoot}/version-archive.zip`;
+			await exportArchive(this.#fs, `${this.#skillManager.managedRoot}/${candidate.name}`, {
+				format: "zip",
+				outPath: archiveOut
+			});
 			await this.#versions.add(candidate.name, {
 				reason: `Publish candidate ${candidateId}`,
-				manifest
+				manifest,
+				archive: await this.#fs.readBinary(archiveOut)
 			});
 			await this.#store.updateStatus(candidateId, "published");
 			await this.#audit.append({
@@ -325,11 +332,79 @@ var ApprovalWorkflow = class {
 		} catch (e) {
 			if (e instanceof WebSkillError) throw e;
 			throw new WebSkillError("GOVERNANCE_FAILED", `Failed to publish candidate "${candidateId}": ${messageOf$1(e)}`, e);
+		} finally {
+			try {
+				await this.#fs.remove(stagingRoot, { recursive: true });
+			} catch {}
+		}
+	}
+	/**
+	* 真实回滚（受审批保护：仅经显式 actor 调用并全程审计）：
+	* 版本归档解包 → staging 校验 → 原子安装（复用安装管线 swap）→ 追加新版本 + 审计。
+	* RepairPlanner 的 rollback 选项（targetVersionId）经本方法执行。
+	*/
+	async applyRollback(skillName, versionId, input) {
+		assertSafePathSegment(skillName, "skill name");
+		assertSafePathSegment(versionId, "version id");
+		const version = await this.#versions.get(skillName, versionId);
+		const archive = await this.#versions.readArchive(skillName, versionId);
+		const stagingRoot = (await mkdtemp(path.join(tmpdir(), "webskill-rollback-"))).split(path.sep).join("/");
+		try {
+			const skillDir = `${stagingRoot}/${skillName}`;
+			for (const [rel, content] of await unzipWithLimits(archive)) {
+				if (rel.endsWith("/")) continue;
+				await this.#fs.writeBinary(resolveInsideRoot(skillDir, rel), content);
+			}
+			const report = await validateSkills(this.#fs, [stagingRoot]);
+			if (!report.ok) {
+				const errors = report.issues.filter((i) => i.severity === "error");
+				throw new WebSkillError("GOVERNANCE_FAILED", `Rollback archive of "${skillName}" failed validation: ${errors.map((i) => i.message).join("; ")}`, errors);
+			}
+			const manifest = await this.#skillManager.install({
+				type: "local",
+				path: skillDir
+			});
+			if (manifest.integrity.digest !== version.manifest.integrity.digest) throw new WebSkillError("GOVERNANCE_FAILED", `Rollback of "${skillName}" to version "${versionId}" produced a digest mismatch: expected ${version.manifest.integrity.digest}, got ${manifest.integrity.digest}`);
+			await this.#versions.add(skillName, {
+				reason: input.reason ?? `Rollback to version ${versionId}`,
+				manifest,
+				archive
+			});
+			await this.#audit.append({
+				type: "skill.rolled_back",
+				target: skillName,
+				actor: input.actor,
+				data: {
+					targetVersionId: versionId,
+					reason: input.reason
+				}
+			});
+			return manifest;
+		} catch (e) {
+			if (e instanceof WebSkillError) throw e;
+			throw new WebSkillError("GOVERNANCE_FAILED", `Failed to roll back "${skillName}" to version "${versionId}": ${messageOf$1(e)}`, e);
+		} finally {
+			try {
+				await this.#fs.remove(stagingRoot, { recursive: true });
+			} catch {}
 		}
 	}
 };
 const fileOf$1 = (root) => `${root}/.webskill/audit.jsonl`;
-/** JSONL 追加的审计日志：<managedRoot>/.webskill/audit.jsonl；跨实例可恢复查询 */
+const sha256Hex = (text) => createHash("sha256").update(text, "utf8").digest("hex");
+/** 链字段之外的规范化事件载荷（hash 计算输入） */
+function canonical(event) {
+	return JSON.stringify({
+		id: event.id,
+		ts: event.ts,
+		type: event.type,
+		target: event.target,
+		actor: event.actor,
+		data: event.data,
+		prevHash: event.prevHash
+	});
+}
+/** JSONL 追加的审计日志：<managedRoot>/.webskill/audit.jsonl；跨实例可恢复查询；prevHash 链可校验完整性 */
 var FsAuditLog = class {
 	#root;
 	#fs;
@@ -342,16 +417,26 @@ var FsAuditLog = class {
 		this.#createId = deps.createId;
 	}
 	async append(event) {
+		const path = fileOf$1(this.#root);
+		const existing = await this.#fs.exists(path) ? await this.#fs.readText(path) : "";
+		const lines = existing.split("\n").filter((l) => l.trim() !== "");
+		let prevHash = "GENESIS";
+		if (lines.length > 0) try {
+			const last = JSON.parse(lines.at(-1));
+			prevHash = last.hash ?? sha256Hex(canonical(last));
+		} catch {
+			prevHash = "GENESIS";
+		}
 		const full = {
 			id: event.id ?? this.#createId?.() ?? `audit-${Math.random().toString(36).slice(2, 10)}`,
 			ts: event.ts ?? this.#now?.() ?? (/* @__PURE__ */ new Date()).toISOString(),
 			type: event.type,
 			target: event.target,
 			...event.actor !== void 0 ? { actor: event.actor } : {},
-			...event.data !== void 0 ? { data: event.data } : {}
+			...event.data !== void 0 ? { data: event.data } : {},
+			prevHash
 		};
-		const path = fileOf$1(this.#root);
-		const existing = await this.#fs.exists(path) ? await this.#fs.readText(path) : "";
+		full.hash = sha256Hex(canonical(full));
 		const prefix = existing === "" || existing.endsWith("\n") ? existing : `${existing}\n`;
 		await this.#fs.writeText(path, `${prefix}${JSON.stringify(full)}\n`);
 		return full;
@@ -371,6 +456,38 @@ var FsAuditLog = class {
 		}
 		return events;
 	}
+	/** hash 链完整性校验：逐行重算 hash 并核对 prevHash 链接 */
+	async verifyChain() {
+		const path = fileOf$1(this.#root);
+		if (!await this.#fs.exists(path)) return { ok: true };
+		const lines = (await this.#fs.readText(path)).split("\n").filter((l) => l.trim() !== "");
+		let expectedPrev = "GENESIS";
+		for (let i = 0; i < lines.length; i++) {
+			let event;
+			try {
+				event = JSON.parse(lines[i]);
+			} catch {
+				return {
+					ok: false,
+					brokenAt: i,
+					reason: "line is not valid JSON"
+				};
+			}
+			if (event.prevHash !== expectedPrev) return {
+				ok: false,
+				brokenAt: i,
+				reason: "prevHash link mismatch (events may have been removed or reordered)"
+			};
+			const expectedHash = sha256Hex(canonical(event));
+			if (event.hash !== expectedHash) return {
+				ok: false,
+				brokenAt: i,
+				reason: "event hash mismatch (event content was tampered)"
+			};
+			expectedPrev = event.hash;
+		}
+		return { ok: true };
+	}
 };
 const dirOf = (root, skillName) => {
 	assertSafePathSegment(skillName, "skill name");
@@ -400,9 +517,20 @@ var SkillVersionStore = class {
 			manifest: input.manifest
 		};
 		assertSafePathSegment(version.versionId, "version id");
+		if (input.archive) {
+			const archivePath = `${dirOf(this.#root, skillName)}/${version.versionId}.zip`;
+			await this.#fs.writeBinary(archivePath, input.archive);
+			version.archivePath = archivePath;
+		}
 		await this.#fs.writeText(`${dirOf(this.#root, skillName)}/${version.versionId}.json`, JSON.stringify(version, null, 2));
 		return version;
 	}
+	/** 读取版本归档字节（applyRollback 用；未捕获归档的旧版本 → GOVERNANCE_FAILED） */
+	async readArchive(skillName, versionId) {
+		const version = await this.get(skillName, versionId);
+		if (!version.archivePath || !await this.#fs.exists(version.archivePath)) throw new WebSkillError("GOVERNANCE_FAILED", `Version "${versionId}" of skill "${skillName}" has no captured archive (recorded before archive capture existed)`);
+		return this.#fs.readBinary(version.archivePath);
+	}
 	async list(skillName) {
 		const dir = dirOf(this.#root, skillName);
 		if (!await this.#fs.exists(dir)) return [];
@@ -484,7 +612,7 @@ var FailureAnalyzer = class {
 };
 /**
 * 修订选项规划：patch（按诊断给具体文件变更）/ rollback（有旧版本时）/ quarantine。
-* 注意：任何 option 的 apply 都必须经 ApprovalWorkflow 审批后执行。
+* 注意：任何 option 的 apply 都必须经 ApprovalWorkflow 审批后执行；rollback 选项（targetVersionId）经 ApprovalWorkflow.applyRollback 真实恢复文件。
 */
 var RepairPlanner = class {
 	plan(input) {
@@ -522,6 +650,8 @@ var SkillStatePolicy = class {
 	#audit;
 	#failureThreshold;
 	#loaded;
+	/** 缓存文件 mtime（states.json 外部变更时按 mtime 重载） */
+	#loadedMtimeMs;
 	constructor(deps) {
 		this.#root = deps.root.replace(/\/+$/, "");
 		this.#fs = deps.fs;
@@ -529,17 +659,33 @@ var SkillStatePolicy = class {
 		this.#failureThreshold = deps.failureThreshold ?? 3;
 	}
 	async #load() {
-		if (this.#loaded) return this.#loaded;
 		const path = fileOf(this.#root);
+		if (this.#loaded) try {
+			const stat = await this.#fs.stat(path);
+			if (stat.mtimeMs !== void 0 && stat.mtimeMs === this.#loadedMtimeMs) return this.#loaded;
+		} catch {
+			return this.#loaded;
+		}
 		this.#loaded = await this.#fs.exists(path) ? JSON.parse(await this.#fs.readText(path)) : {
 			states: {},
 			failures: {}
 		};
+		try {
+			this.#loadedMtimeMs = (await this.#fs.stat(path)).mtimeMs;
+		} catch {
+			this.#loadedMtimeMs = void 0;
+		}
 		return this.#loaded;
 	}
 	async #persist() {
 		const data = await this.#load();
-		await this.#fs.writeText(fileOf(this.#root), JSON.stringify(data, null, 2));
+		const path = fileOf(this.#root);
+		await this.#fs.writeText(path, JSON.stringify(data, null, 2));
+		try {
+			this.#loadedMtimeMs = (await this.#fs.stat(path)).mtimeMs;
+		} catch {
+			this.#loadedMtimeMs = void 0;
+		}
 	}
 	async getState(skillName) {
 		assertSafePathSegment(skillName, "skill name");
@@ -695,6 +841,17 @@ var EvaluationRunner = class {
 		};
 	}
 };
+/**
+* 治理评估专用 runtime 装配（不可信技能试用路径）：
+* 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离）；
+* 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态）。
+*/
+function createEvaluationRuntime(deps) {
+	return new WebSkillRuntime({
+		...deps,
+		executor: deps.executor ?? new ProcessSandboxExecutor(deps.fs)
+	});
+}
 /** 失败 trace → 回归评估任务建议（prompt 复现 + expected 错误模式） */
 function suggestFromFailedRun(run) {
 	const errorPatterns = run.trace.filter((e) => e.type === "tool.failed" || e.type === "run.failed").map((e) => String(e.data?.["code"] ?? e.message ?? "")).filter(Boolean);
@@ -880,4 +1037,4 @@ function createMissHook(deps) {
 }
 
 //#endregion
-export { AlwaysHumanApprovalPolicy, ApprovalWorkflow, CandidateStore, CompositeApprovalPolicy, DependencyGraph, DocumentSkillExtractor, EvaluationRunner, FailureAnalyzer, FsAuditLog, LlmCandidateGenerator, RepairPlanner, SCORING_WEIGHTS, SimilarityDetector, SkillScorer, SkillStatePolicy, SkillVersionStore, candidateToCatalogEntry, completeText, createMissHook, jaccardSimilarity, normalizeCandidate, normalizeCandidateFiles, normalizeRisk, parseJsonObject, readDocument, sanitizeCandidateName, suggestFromFailedRun, validateCandidate };
+export { AlwaysHumanApprovalPolicy, ApprovalWorkflow, CandidateStore, CompositeApprovalPolicy, DependencyGraph, DocumentSkillExtractor, EvaluationRunner, FailureAnalyzer, FsAuditLog, LlmCandidateGenerator, RepairPlanner, SCORING_WEIGHTS, SimilarityDetector, SkillScorer, SkillStatePolicy, SkillVersionStore, candidateToCatalogEntry, completeText, createEvaluationRuntime, createMissHook, jaccardSimilarity, normalizeCandidate, normalizeCandidateFiles, normalizeRisk, parseJsonObject, readDocument, sanitizeCandidateName, suggestFromFailedRun, validateCandidate };

package/dist/{index-Bun1aEf4.d.ts → index-BmzysJX5.d.ts}

@@ -1,5 +1,5 @@
-import { C as FileStat, I as SkillInstallSource, K as VerifyResult, T as JsonSchema, W as SkillsLockfile, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CgNC-oQu-DEcIBJKG.js";
-import { N as NetworkPolicy, X as ScriptExecutionContext, Y as SchemaInferer, Z as ScriptExecutor, b as FsArtifactStore, d as BridgeCapabilities, et as ToolDefinition, nt as ToolResult, u as ApprovalScope, x as FsMemoryStore } from "./index-COuOu6gw.js";
+import { C as FileStat, I as SkillInstallSource, K as VerifyResult, T as JsonSchema, W as SkillsLockfile, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
+import { N as NetworkPolicy, Q as ScriptExecutor, X as SchemaInferer, Z as ScriptExecutionContext, b as FsArtifactStore, d as BridgeCapabilities, it as ToolResult, nt as ToolDefinition, u as ApprovalScope, x as FsMemoryStore } from "./index-gjFuBevI.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts
 //#region src/fs/nodeFs.d.ts
@@ -25,6 +25,7 @@ declare class NodeFS implements FileSystemProvider {
   remove(p: string, options?: {
     recursive?: boolean;
   }): Promise<void>;
+  rename(from: string, to: string): Promise<void>;
 }
 //#endregion
 //#region src/executor/nodeScriptExecutor.d.ts
@@ -87,6 +88,43 @@ declare class SandboxedScriptExecutor implements ScriptExecutor {
   }): Promise<ToolResult>;
 }
 //#endregion
+//#region src/executor/processSandboxExecutor.d.ts
+interface ProcessSandboxOptions {
+  /** 温池大小（并发上限；执行后 kill 并补位重生），默认 2 */
+  poolSize?: number;
+  capabilities?: BridgeCapabilities;
+  /** 网络策略：默认 'deny-all'（权限模型无网络维度，补丁兜底；node:net 裸模块为已知残余面） */
+  networkPolicy?: NetworkPolicy;
+  /** require-approval 模式的授权询问出口 */
+  uiBridge?: UiBridge;
+  /** 授权粒度：默认 'once-per-run' */
+  approvalScope?: ApprovalScope;
+}
+/**
+ * child_process.fork + --permission 进程沙箱（真实进程隔离）。
+ * 每个子进程以 `--permission --allow-fs-read=<入口目录> --allow-fs-read=<skillRoot>
+ * --allow-fs-write=<artifactDir>` 启动：fs 维度由权限模型管控（experimental），
+ * 子进程/Worker/addons 默认禁；网络无权限维度仍靠 fetch/WebSocket patch。
+ * 能力桥协议与 worker_threads 沙箱同一形态（readReference/writeArtifact/confirm + 授权）。
+ * 温池（默认 2）：同 skillRoot 复用子进程；执行后 kill 并补位重生；并发上限即池大小。
+ * 超时 kill（同步死循环可杀）；非零退出码 → TOOL_EXECUTION_FAILED。
+ */
+declare class ProcessSandboxExecutor implements ScriptExecutor {
+  #private;
+  constructor(fs: FileSystemProvider, options?: ProcessSandboxOptions);
+  get poolSize(): number;
+  /** 池全部子进程销毁（测试收尾/进程退出前调用） */
+  dispose(): Promise<void>;
+  loadDefinition(skillRoot: string, scriptName: string): Promise<ToolDefinition>;
+  execute(input: {
+    skillRoot: string;
+    scriptName: string;
+    args: Record<string, unknown>;
+    context: ScriptExecutionContext;
+    timeoutMs: number;
+  }): Promise<ToolResult>;
+}
+//#endregion
 //#region src/schema/oxcSchemaInferer.d.ts
 /**
  * D2 Schema 推导（OXC 静态文本分析，宿主侧执行，不进沙箱）。
@@ -163,6 +201,8 @@ declare class SkillManager {
     /** install/uninstall 成功后的变更回调（宿主接线缓存失效，如 WebSkillRuntime.invalidate） */
     onChanged?: () => void;
   });
+  /** 托管根目录（治理发布归档捕获等只读场景） */
+  get managedRoot(): string;
   install(source: SkillInstallSource, options?: {
     expectedSha256?: string;
   }): Promise<SkillManifest>;
@@ -180,42 +220,12 @@ declare class SkillManager {
 }
 //#endregion
 //#region src/skillManagement/export/archiveExporter.d.ts
+/** 导出技能目录全部文件（含 manifest）为 zip/tar 归档，返回 outPath */
+declare function exportArchive(fs: FileSystemProvider, skillRoot: string, options: {
+  format: 'zip' | 'tar';
+  outPath: string;
+}): Promise<string>;
 /** 只解出归档中的 webskill.skill-manifest.json 条目（安装前预览） */
 declare function readArchiveManifest(fs: FileSystemProvider, archivePath: string): Promise<SkillManifest>;
 //#endregion
-//#region src/env.d.ts
-interface LlmEnvConfig {
-  baseUrl: string;
-  apiKey: string;
-  model: string;
-}
-/** per-provider env 配置（baseUrl 可选，客户端自带默认） */
-interface ProviderEnvConfig {
-  apiKey: string;
-  model: string;
-  baseUrl?: string;
-}
-/**
- * 读取 VITE_BASE_URL / VITE_API_KEY / VITE_MODEL_NAME；缺项返回 undefined 供测试 skip 判断。
- */
-declare function loadLlmConfigFromEnv(dotenvPath?: string): LlmEnvConfig | undefined;
-/** ANTHROPIC_API_KEY / ANTHROPIC_MODEL（可选 ANTHROPIC_BASE_URL）；缺项返回 undefined */
-declare function loadAnthropicConfigFromEnv(dotenvPath?: string): ProviderEnvConfig | undefined;
-/** GOOGLE_API_KEY / GOOGLE_MODEL（可选 GOOGLE_BASE_URL）；缺项返回 undefined */
-declare function loadGoogleConfigFromEnv(dotenvPath?: string): ProviderEnvConfig | undefined;
-interface LlmCapabilities {
-  available: boolean;
-  nonStreaming: boolean;
-  reason?: string;
-}
-/**
- * 探测 LLM 能力（结果模块级缓存）：
- * - available：GET /models 可达（与 checkAvailability 同语义）
- * - nonStreaming：最小非流式 chat completion（max_tokens=1，短超时）；
- *   HTTP 400/404 或明确不支持非流式的错误 → false
- * - streaming 能力由 available 推断（SSE 解析在 SDK 侧实现）
- * 环境变量 VITE_LLM_NON_STREAMING=0 可显式强制 nonStreaming=false（模拟流式-only 回归）。
- */
-declare function probeLlmCapabilities(config: LlmEnvConfig): Promise<LlmCapabilities>;
-//#endregion
-export { readArchiveManifest as _, LlmEnvConfig as a, OxcSchemaInferer as c, SandboxedScriptExecutor as d, SkillManager as f, probeLlmCapabilities as g, loadLlmConfigFromEnv as h, LlmCapabilities as i, ProviderEnvConfig as l, loadGoogleConfigFromEnv as m, FileArtifactStore as n, NodeFS as o, loadAnthropicConfigFromEnv as p, FileMemoryStore as r, NodeScriptExecutor as s, CliUiBridge as t, SandboxOptions as u };
+export { NodeScriptExecutor as a, ProcessSandboxOptions as c, SkillManager as d, exportArchive as f, NodeFS as i, SandboxOptions as l, FileArtifactStore as n, OxcSchemaInferer as o, readArchiveManifest as p, FileMemoryStore as r, ProcessSandboxExecutor as s, CliUiBridge as t, SandboxedScriptExecutor as u };

package/dist/{index-COuOu6gw.d.ts → index-gjFuBevI.d.ts}

@@ -1,4 +1,4 @@
-import { F as SkillDocument, G as ValidationReport, I as SkillInstallSource, M as SkillCatalog, N as SkillCatalogEntry, P as SkillDiscovery, S as DiscoveryResult, T as JsonSchema, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CgNC-oQu-DEcIBJKG.js";
+import { F as SkillDocument, G as ValidationReport, I as SkillInstallSource, M as SkillCatalog, N as SkillCatalogEntry, P as SkillDiscovery, S as DiscoveryResult, T as JsonSchema, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
 //#region ../runtime/dist/index.d.ts
 //#region src/llm/openAiCompatibleClient.d.ts
 interface OpenAiCompatibleClientConfig {
@@ -295,6 +295,12 @@ interface RuntimeRun {
 interface RunResult {
   output: string;
   run: RuntimeRun;
+  /** 最终消息历史（多会话延续用；含 system/user/assistant/tool） */
+  messages: LlmMessage[];
+}
+/** createSession 返回的会话句柄：跨 run 延续消息历史 */
+interface RuntimeSessionHandle extends RuntimeSession {
+  run(prompt: string): Promise<RunResult>;
 }
 //#endregion
 //#region src/interaction/renderResult.d.ts
@@ -417,6 +423,26 @@ declare class FsMemoryStore implements MemoryStore {
   clear(scope?: string): Promise<void>;
 }
 //#endregion
+//#region src/memory/serializingMemoryStore.d.ts
+/**
+ * per-scope 串行化 MemoryStore 装饰器：同一 scope 的 get/set/delete/list
+ * 按 promise 链串行（并发 run 的 read-modify-write 不丢计数）。
+ */
+declare class SerializingMemoryStore implements MemoryStore {
+  #private;
+  constructor(inner: MemoryStore);
+  get(scope: string, key: string): Promise<unknown>;
+  set(scope: string, key: string, value: unknown): Promise<void>;
+  delete(scope: string, key: string): Promise<void>;
+  list(scope: string): Promise<Array<{
+    key: string;
+    value: unknown;
+  }>>;
+  clear(scope?: string): Promise<void>;
+  /** scope 级原子段：read-modify-write 全段在 promise 链内串行执行（fn 收到底层 store） */
+  transaction<T>(scope: string, fn: (inner: MemoryStore) => Promise<T>): Promise<T>;
+}
+//#endregion
 //#region src/artifacts/fsArtifactStore.d.ts
 /**
  * 基于 FileSystemProvider 的 ArtifactStore：产物落盘 <root>/<runId>/<path>，
@@ -531,6 +557,8 @@ declare class CapabilityApproval {
     uiBridge?: UiBridge;
     scope?: ApprovalScope;
   });
+  /** run 终态清理授权记录（宿主在 run 结束后调用；同时有 LRU 上限兜底） */
+  clearRun(runId: string): void;
   authorize(input: {
     runId: string;
     capability: BridgeCapability;
@@ -600,6 +628,10 @@ interface RunSnapshot {
   activatedTools: ToolDefinition[];
   /** 等待中的交互（恢复时重新发起，表单重新渲染） */
   pendingInteraction: InteractionRequest;
+  /** $chart 等内容收集的渲染块（0.2.0 起跨 resume 保留；旧快照缺省视为空） */
+  renderBlocks?: RenderBlock[];
+  /** 交互 id 序号（resume 后续算，避免 id 冲突；旧快照缺省从 0 起） */
+  interactionSeq?: number;
   /** 进入 interrupted 时计算的过期时间 */
   interactionExpiresAt: string;
   config: {
@@ -620,6 +652,10 @@ interface RunSnapshotStore {
 /**
  * FileSystemProvider 后端的快照存储：<root>/<runId>.snapshot.json。
  * 坏 JSON → RUN_SNAPSHOT_INCOMPATIBLE 并自动清理坏文件；runId 过路径安全校验。
+ * save/list 时顺带清理已过 interactionExpiresAt 的过期快照。
+ *
+ * 数据敏感性说明：快照含完整对话历史（用户输入、工具结果、可能的凭据片段），
+ * 以明文 JSON 落盘于宿主提供的 fs；宿主应将其视为会话数据同等保护。
  * @experimental
  */
 declare class FsRunSnapshotStore implements RunSnapshotStore {
@@ -683,6 +719,8 @@ declare class AgentLoop {
     userPrompt: string;
     route: RouteResult;
     runId?: string;
+    /** 多会话历史延续：插入 system 与本轮 user 之间（不含 system 消息） */
+    history?: LlmMessage[];
   }): Promise<RunResult>;
   /**
    * D3 恢复：以快照重建 LoopState，重新发起等待中的交互（表单重新渲染），
@@ -740,6 +778,8 @@ declare class WebSkillRuntime {
   #private;
   constructor(deps: WebSkillRuntimeDeps);
   get session(): RuntimeSession;
+  /** 当前装配的脚本执行器（治理默认执行器断言等只读场景） */
+  get executor(): ScriptExecutor | undefined;
   /** 生命周期事件总线（只读观测） */
   get events(): EventBus;
   /**
@@ -747,8 +787,18 @@ declare class WebSkillRuntime {
    * 与 SkillManager onChanged 接线：`new SkillManager({ ..., onChanged: () => runtime.invalidate() })`。
    */
   invalidate(): void;
+  /**
+   * 多会话：session 对象的 run(prompt) 跨 run 延续消息历史（同一 session 对话上下文连续）。
+   * 既有 runtime.run(prompt) 保持无状态单次语义不变。
+   */
+  createSession(options?: {
+    sessionId?: string;
+  }): RuntimeSessionHandle;
   discover(): Promise<DiscoveryResult>;
-  run(userPrompt: string): Promise<RunResult>;
+  run(userPrompt: string, options?: {
+    sessionId?: string;
+    history?: LlmMessage[];
+  }): Promise<RunResult>;
   /** D3：列出可恢复的 interrupted run（供 UI 展示"未完成任务"） */
   listInterruptedRuns(): Promise<RunSnapshot[]>;
   /**
@@ -760,4 +810,4 @@ declare class WebSkillRuntime {
   resumeRun(runId: string): Promise<RunResult>;
 }
 //#endregion
-export { SkillStateGuard as $, LifecycleHook as A, RUN_SNAPSHOT_SCHEMA_VERSION as B, FullDisclosureRouter as C, resolveToolName as Ct, HookRunnerOptions as D, HookRunner as E, toVercelToolSpecs as Et, OpenAiCompatibleClientConfig as F, RunTerminationReason as G, RunResult as H, ProgressiveRouter as I, RuntimeSession as J, RuntimePhase as K, READ_SKILL_FILE_INPUT_SCHEMA as L, LifecycleListener as M, NetworkPolicy as N, InstalledSkillManifest as O, OpenAiCompatibleClient as P, SkillRouter as Q, READ_SKILL_FILE_TOOL as R, FsRunSnapshotStore as S, parseBridgeRequest as St, GoogleGenAiClientConfig as T, toLlmToolSpec as Tt, RunSnapshot as U, RouteResult as V, RunSnapshotStore as W, ScriptExecutionContext as X, SchemaInferer as Y, ScriptExecutor as Z, EventBus as _, fromVercelStreamPart as _t, AgentLoopConfig as a, TraceEventType as at, FsArtifactStore as b, networkUrlHost as bt, AnthropicClientConfig as c, WebSkillApi as ct, BridgeCapabilities as d, bridgeError as dt, ToolDefinition as et, BridgeCapability as f, buildRenderResult as ft, CapabilityMode as g, fromVercelResult as gt, CapabilityApproval as h, extractChartSpec as ht, AgentLoop as i, TraceEvent as it, LifecycleHookContext as j, LifecycleEvent as k, ApprovalDecision as l, WebSkillRuntime as lt, BridgeResponse as m, createWebSkillApi as mt, ASK_USER_TOOL as n, ToolResult as nt, AgentLoopDeps as o, TraceRecorder as ot, BridgeRequest as p, createScriptContext as pt, RuntimeRun as q, ASK_USER_TOOL_NAME as r, TraceClock as rt, AnthropicClient as s, VercelToolSpec as st, ASK_USER_INPUT_SCHEMA as t, ToolResolution as tt, ApprovalScope as u, WebSkillRuntimeDeps as ut, ExternalSkillProvider as v, isNetworkAllowed as vt, GoogleGenAiClient as w, schemaToForm as wt, FsMemoryStore as x, normalizeToolContent as xt, ExternalToolSource as y, mergeCatalogEntries as yt, READ_SKILL_FILE_TOOL_NAME as z };
+export { SerializingMemoryStore as $, LifecycleHook as A, RUN_SNAPSHOT_SCHEMA_VERSION as B, FullDisclosureRouter as C, normalizeToolContent as Ct, HookRunnerOptions as D, toLlmToolSpec as Dt, HookRunner as E, schemaToForm as Et, OpenAiCompatibleClientConfig as F, RunTerminationReason as G, RunResult as H, ProgressiveRouter as I, RuntimeSession as J, RuntimePhase as K, READ_SKILL_FILE_INPUT_SCHEMA as L, LifecycleListener as M, NetworkPolicy as N, InstalledSkillManifest as O, toVercelToolSpecs as Ot, OpenAiCompatibleClient as P, ScriptExecutor as Q, READ_SKILL_FILE_TOOL as R, FsRunSnapshotStore as S, networkUrlHost as St, GoogleGenAiClientConfig as T, resolveToolName as Tt, RunSnapshot as U, RouteResult as V, RunSnapshotStore as W, SchemaInferer as X, RuntimeSessionHandle as Y, ScriptExecutionContext as Z, EventBus as _, extractChartSpec as _t, AgentLoopConfig as a, TraceClock as at, FsArtifactStore as b, isNetworkAllowed as bt, AnthropicClientConfig as c, TraceRecorder as ct, BridgeCapabilities as d, WebSkillRuntime as dt, SkillRouter as et, BridgeCapability as f, WebSkillRuntimeDeps as ft, CapabilityMode as g, createWebSkillApi as gt, CapabilityApproval as h, createScriptContext as ht, AgentLoop as i, ToolResult as it, LifecycleHookContext as j, LifecycleEvent as k, ApprovalDecision as l, VercelToolSpec as lt, BridgeResponse as m, buildRenderResult as mt, ASK_USER_TOOL as n, ToolDefinition as nt, AgentLoopDeps as o, TraceEvent as ot, BridgeRequest as p, bridgeError as pt, RuntimeRun as q, ASK_USER_TOOL_NAME as r, ToolResolution as rt, AnthropicClient as s, TraceEventType as st, ASK_USER_INPUT_SCHEMA as t, SkillStateGuard as tt, ApprovalScope as u, WebSkillApi as ut, ExternalSkillProvider as v, fromVercelResult as vt, GoogleGenAiClient as w, parseBridgeRequest as wt, FsMemoryStore as x, mergeCatalogEntries as xt, ExternalToolSource as y, fromVercelStreamPart as yt, READ_SKILL_FILE_TOOL_NAME as z };