@webskill/sdk 0.11.0 → 0.12.0

package/dist/{dist-B-cOu08W.js → dist-sdKFgERo.js}

@@ -210,16 +210,89 @@ function uniqueName(base, taken) {
 	while (taken.has(`${prefixed}_${index}`)) index += 1;
 	return `${prefixed}_${index}`;
 }
+function renameDefRefs(node, renames) {
+	if (Array.isArray(node)) return node.map((child) => renameDefRefs(child, renames));
+	if (!isRecord$7(node)) return node;
+	const out = {};
+	const prefix = `#/${DEFS_KEY}/`;
+	for (const [key, value] of Object.entries(node)) {
+		if (key === "$ref" && typeof value === "string" && value.startsWith(prefix)) {
+			const [head, ...tail] = value.slice(prefix.length).split("/");
+			const mapped = head === void 0 ? void 0 : renames.get(head);
+			out[key] = mapped === void 0 ? value : [`${prefix}${mapped}`, ...tail].join("/");
+			continue;
+		}
+		out[key] = renameDefRefs(value, renames);
+	}
+	return out;
+}
+/**
+* 把非根位置的 `$defs` 搬到根。zod 每次 `toJSONSchema()` 各自产出 `$defs.__schemaN`，
+* 嵌进大 schema 后其 `#/$defs/...` 从大根解析不到——提升即修复。重名时避让并改写引用。
+*/
+function hoistNestedDefs(schema) {
+	const rootDefs = isRecord$7(schema[DEFS_KEY]) ? { ...schema[DEFS_KEY] } : {};
+	const taken = new Set(Object.keys(rootDefs));
+	let hoisted = false;
+	function visit(node, isRoot) {
+		if (Array.isArray(node)) return node.map((child) => visit(child, false));
+		if (!isRecord$7(node)) return node;
+		const nested = !isRoot && isRecord$7(node[DEFS_KEY]) ? node[DEFS_KEY] : void 0;
+		const body = {};
+		for (const [key, value] of Object.entries(node)) {
+			if (key === DEFS_KEY && nested !== void 0) continue;
+			if (key === DEFS_KEY) {
+				body[key] = value;
+				continue;
+			}
+			if (SCHEMA_MAP_KEYS.has(key) && isRecord$7(value)) {
+				const mapped = {};
+				for (const [name, child] of Object.entries(value)) mapped[name] = visit(child, false);
+				body[key] = mapped;
+				continue;
+			}
+			if (SCHEMA_LIST_KEYS.has(key) && Array.isArray(value)) {
+				body[key] = value.map((child) => visit(child, false));
+				continue;
+			}
+			if (SCHEMA_KEYS.has(key)) {
+				body[key] = visit(value, false);
+				continue;
+			}
+			body[key] = value;
+		}
+		if (nested === void 0) return body;
+		hoisted = true;
+		const renames = /* @__PURE__ */ new Map();
+		for (const name of Object.keys(nested)) {
+			const target = uniqueName(name, taken);
+			taken.add(target);
+			if (target !== name) renames.set(name, target);
+		}
+		for (const [name, def] of Object.entries(nested)) {
+			const moved = visit(def, false);
+			rootDefs[renames.get(name) ?? name] = renames.size > 0 ? renameDefRefs(moved, renames) : moved;
+		}
+		return renames.size > 0 ? renameDefRefs(body, renames) : body;
+	}
+	const out = visit(schema, true);
+	return hoisted ? {
+		...out,
+		[DEFS_KEY]: rootDefs
+	} : schema;
+}
 /**
 * 把工具 inputSchema 重写为严格解析器可接受的 JSON Schema 2020-12 形态：
-* 自引用的 schema resource 提到根 `$defs`，所有 `$ref: '#'` 改写为 `$ref: '#/$defs/<Node>'`。
+* 非根 `$defs` 提到根，自引用的 schema resource 提到根 `$defs`，
+* 所有 `$ref: '#'` 改写为 `$ref: '#/$defs/<Node>'`。
 *
-* 幂等：不含自引用的 schema 原样返回。
+* 幂等：不含自引用也不含嵌套 `$defs` 的 schema 原样返回。
 *
 * 这是**传输层适配**，只应在出站请求体上调用；不要下沉到 AgentLoop，
 * 否则 trace / eventBus 观测到的 schema 会与技能作者写的不一致。
 */
-function toPortableToolSchema(schema) {
+function toPortableToolSchema(input) {
+	const schema = hoistNestedDefs(input);
 	const roots = /* @__PURE__ */ new Map();
 	collectSelfRefRoots(schema, [], [], roots);
 	if (roots.size === 0) return schema;
@@ -382,6 +455,10 @@ const ANTHROPIC_SCHEMA_PROFILE = {
 /**
 * Google Gen AI 的 `FunctionDeclaration.parameters` 收到 `additionalProperties`
 * 直接回 400 `Unknown name "additionalProperties"`，且不解析 `$ref` / `$defs`。
+*
+* 本 profile 描述的是 **`parameters` 这一字段**的能力，不是 Google 的能力上限：
+* 完整 JSON Schema（含 `$ref` / `$defs`）走另一个字段 `parametersJsonSchema`。
+* 把 `supportsRefs: false` 读成「Google 不支持引用」是错的，分流见 `googleGenAiClient.toGenAiTools`。
 */
 const GOOGLE_SCHEMA_PROFILE = {
 	id: "google",
@@ -445,6 +522,46 @@ function sanitizeForVendor(schema, profile, toolName) {
 	if (!profile.supportsRefs && containsRef(schema)) throw new WebSkillError("TOOL_SCHEMA_UNAVAILABLE", `Tool "${toolName}" requires $ref support that provider "${profile.id}" does not accept`);
 	return sanitizeNode(schema, profile);
 }
+/**
+* schema 能否走 profile 描述的受限通道。与 `sanitizeForVendor` 同判据，但不抛错——
+* 调用方需要的是「选哪条通道」而不是「失败」。
+*/
+function isExpressibleForVendor(schema, profile) {
+	return profile.supportsRefs || !containsRef(schema);
+}
+/**
+* 放宽不可终止的递归环：Gemini 只接受「可选 / 可为 null / 可零长数组」的引用环。
+* 对 `items` 直接是 `$ref` 的数组节点删去 `minItems`。
+*
+* **只作用于出站副本**：catalog 本体的校验判据不变。
+*/
+function relaxRefLoops(schema) {
+	return relaxNode(schema);
+}
+function relaxNode(node) {
+	if (Array.isArray(node)) return node.map(relaxNode);
+	if (!isRecord$5(node)) return node;
+	const out = {};
+	for (const [key, value] of Object.entries(node)) {
+		if (key === "minItems" && isRecord$5(node["items"]) && typeof node["items"]["$ref"] === "string") continue;
+		if (SCHEMA_MAP_KEYS.has(key) && isRecord$5(value)) {
+			const mapped = {};
+			for (const [name, child] of Object.entries(value)) mapped[name] = relaxNode(child);
+			out[key] = mapped;
+			continue;
+		}
+		if (SCHEMA_LIST_KEYS.has(key) && Array.isArray(value)) {
+			out[key] = value.map(relaxNode);
+			continue;
+		}
+		if (SCHEMA_KEYS.has(key)) {
+			out[key] = relaxNode(value);
+			continue;
+		}
+		out[key] = value;
+	}
+	return out;
+}
 function createSseFrameReader() {
 	let buffer = "";
 	let data = [];
@@ -1151,11 +1268,14 @@ function toGenAiContents(messages) {
 		contents: out
 	};
 }
-const toGenAiTools = (tools) => [{ functionDeclarations: tools.map((tool) => ({
-	name: tool.name,
-	...tool.description ? { description: tool.description } : {},
-	parameters: sanitizeForVendor(toPortableToolSchema(stripModelUnfillableParams(tool.inputSchema)), GOOGLE_SCHEMA_PROFILE, tool.name)
-})) }];
+const toGenAiTools = (tools) => [{ functionDeclarations: tools.map((tool) => {
+	const portable = toPortableToolSchema(stripModelUnfillableParams(tool.inputSchema));
+	return {
+		name: tool.name,
+		...tool.description ? { description: tool.description } : {},
+		...isExpressibleForVendor(portable, GOOGLE_SCHEMA_PROFILE) ? { parameters: sanitizeForVendor(portable, GOOGLE_SCHEMA_PROFILE, tool.name) } : { parametersJsonSchema: relaxRefLoops(portable) }
+	};
+}) }];
 /** Google GenAI（generateContent / streamGenerateContent）客户端（零依赖 fetch） */
 var GoogleGenAiClient = class {
 	#config;
@@ -1682,6 +1802,7 @@ const ASK_USER_INPUT_SCHEMA = {
 						type: "string",
 						description: "Help text shown under the input."
 					},
+					defaultValue: { description: "A value the user already stated in this conversation; it is filled into the input for them. Only pass it when the user actually said it — do not guess." },
 					options: {
 						type: "array",
 						items: {
@@ -1725,6 +1846,78 @@ const ASK_USER_TOOL = {
 	source: "builtin"
 };
 /**
+* 产物 metadata 的准入与判读（分册 18）。
+*
+* metadata 是能力桥上第一个**开放结构**的入参，且来自沙箱内的技能脚本。
+* 校验落在 `createScriptContext.writeArtifact`——它是 in-process 与三个沙箱执行器
+* 唯一的汇聚点，在此抛错才能带上正确的桥请求 id 回给脚本（DV-10）。
+*/
+/** 序列化后的字节上限；`index.json` 是整覆盖原子写，无上限等于廉价的放大面 */
+const ARTIFACT_METADATA_MAX_BYTES = 4096;
+/** 原型污染键；JSON 解析产生的同名键是**自有键**，可被 getOwnPropertyNames 查出 */
+const FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isPlainObject$1(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+/** 函数声明而非箭头函数赋值：只有前者能让 TS 的控制流分析认到 never 终止 */
+function reject$1(message) {
+	throw new WebSkillError("VALIDATION_FAILED", message);
+}
+/**
+* 递归拒绝原型污染键与不可序列化值。
+* `JSON.stringify` 会**静默丢弃**函数与 symbol，而静默正是本需求明令禁止的形态，
+* 所以必须在序列化之前显式查一遍。
+*/
+function assertSerializableShape(value, path, seen) {
+	const kind = typeof value;
+	if (kind === "function" || kind === "symbol" || kind === "bigint") reject$1(`Artifact metadata value at "${path}" is not JSON-serializable (${kind})`);
+	if (kind !== "object" || value === null) return;
+	const container = value;
+	if (seen.has(container)) reject$1(`Artifact metadata contains a circular reference at "${path}"`);
+	seen.add(container);
+	if (Array.isArray(value)) value.forEach((item, index) => assertSerializableShape(item, `${path}[${index}]`, seen));
+	else {
+		if (!isPlainObject$1(value)) reject$1(`Artifact metadata value at "${path}" must be a plain object or array`);
+		for (const key of Object.getOwnPropertyNames(value)) {
+			if (FORBIDDEN_KEYS.has(key)) reject$1(`Artifact metadata must not contain the reserved key "${key}" (at "${path}")`);
+			assertSerializableShape(value[key], `${path}.${key}`, seen);
+		}
+	}
+	seen.delete(container);
+}
+/**
+* 准入校验。通过后返回 `JSON.parse(JSON.stringify(...))` 的副本：
+* in-process 路径由此获得与 JSON stdio 沙箱路径完全相同的语义，
+* 而不是依赖某条传输链路碰巧做了序列化。
+*/
+function admitArtifactMetadata(value) {
+	if (!isPlainObject$1(value)) reject$1("Artifact metadata must be a plain object");
+	assertSerializableShape(value, "metadata", /* @__PURE__ */ new Set());
+	let json;
+	try {
+		json = JSON.stringify(value);
+	} catch (error) {
+		reject$1(`Artifact metadata is not JSON-serializable: ${error.message}`);
+	}
+	const bytes = new TextEncoder().encode(json).length;
+	if (bytes > 4096) reject$1(`Artifact metadata is too large: ${bytes} bytes exceeds the ${ARTIFACT_METADATA_MAX_BYTES} byte limit`);
+	return JSON.parse(json);
+}
+/**
+* 「这份产物不出自动下载卡」的判读。**严格 `=== false`**：
+* 隐式真值转换会让写错的键值静默生效，而隐藏是不可见的失败。
+* `buildRenderResult` 与 agentLoop 的去重集合共用本函数，两处判据不得分叉。
+*/
+function isArtifactCardHidden(artifact) {
+	return artifact.metadata?.["resultCard"] === false;
+}
+/**
 * 越权 / 绝对路径 / 父级遍历的技能目录读取：策略拒绝（FS_PERMISSION_DENIED，
 * 计入 POLICY_DENIAL_CODES → 不计入隔离失败计数），
 * 与「目录内路径确实不存在 → FS_NOT_FOUND」区分（0.9.0 分册 14，UX-04）。
@@ -1762,16 +1955,19 @@ function createScriptContext(deps) {
 			return readFs.readBinary(resolveSkillDir(skillRoot, "assets", relativePath));
 		},
 		async writeArtifact(path, content, options) {
+			const metadata = options?.metadata === void 0 ? void 0 : admitArtifactMetadata(options.metadata);
 			const artifact = typeof content === "string" ? await artifactStore.createTextArtifact({
 				runId,
 				path,
 				content,
-				mimeType: options?.mimeType
+				mimeType: options?.mimeType,
+				...metadata === void 0 ? {} : { metadata }
 			}) : await artifactStore.createBinaryArtifact({
 				runId,
 				path,
 				content,
-				mimeType: options?.mimeType
+				mimeType: options?.mimeType,
+				...metadata === void 0 ? {} : { metadata }
 			});
 			onArtifactCreated?.(artifact);
 			return artifact;
@@ -1826,12 +2022,15 @@ function buildRenderResult(run, output, renderBlocks = []) {
 			text: output
 		});
 	}
-	for (const artifact of run.artifacts) blocks.push({
-		type: "file",
-		path: artifact.path,
-		...artifact.mimeType ? { mimeType: artifact.mimeType } : {},
-		size: artifact.size
-	});
+	for (const artifact of run.artifacts) {
+		if (isArtifactCardHidden(artifact)) continue;
+		blocks.push({
+			type: "file",
+			path: artifact.path,
+			...artifact.mimeType ? { mimeType: artifact.mimeType } : {},
+			size: artifact.size
+		});
+	}
 	return {
 		runId: run.id,
 		summary: run.terminationReason,
@@ -2391,10 +2590,18 @@ function extractSkillCandidate(data) {
 * @stable
 */
 const DEFAULT_LOOP_LIMITS = {
-	maxTurns: 10,
+	maxTurns: 1e3,
 	totalTimeoutMs: 36e5,
-	toolTimeoutMs: 6e5
+	toolTimeoutMs: 6e5,
+	maxHistoryMessages: 1e3
 };
+/**
+* 工具参数留存的单次体积上限（分册 30 / FR-30.2）。**全仓唯一来源**（S8）。
+*
+* 超限时不留半截参数，整条标记为 `truncated`。
+* @stable
+*/
+const MAX_TOOL_STEP_ARG_BYTES = 32768;
 const RUN_SNAPSHOT_SCHEMA_VERSION = 3;
 /** @experimental */
 function isUnsupportedRunSnapshot(entry) {
@@ -2537,6 +2744,69 @@ function evaluateToolAccess(state, llmToolName) {
 		reason: denialReason(state, canonical)
 	};
 }
+/**
+* 参数敏感标注关键字（分册 30 / FR-30.3）。
+*
+* 不用 `format: 'password'`：`format` 是 JSON Schema 的规范关键字，provider 侧
+* 可能据其做转换或校验，而且它只对 `type: 'string'` 有意义，对象型凭据标不了。
+* `x-` 前缀走 `JsonSchema` 的索引签名，不与任何规范语义抢占。
+*/
+const SENSITIVE_ANNOTATION = "x-webskill-sensitive";
+const isSensitive = (schema) => schema?.[SENSITIVE_ANNOTATION] === true;
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const join = (prefix, key) => prefix === "" ? key : `${prefix}.${key}`;
+/**
+* 按 schema 标注逐字段脱敏。
+*
+* 脱敏值取 `null` 而不是删键，也不是 `'***'`：删键会让生成器以为这个步骤
+* 本来就没有这个参数，从而写出漏参的技能；掩码则仍然泄露长度与存在性。
+*/
+function redactAnnotated(value, schema, path, redacted) {
+	if (isSensitive(schema)) {
+		redacted.push(path);
+		return null;
+	}
+	if (Array.isArray(value)) return value.map((item, i) => redactAnnotated(item, schema?.items, `${path}[${i}]`, redacted));
+	if (isPlainObject(value)) {
+		const out = {};
+		for (const [key, entry] of Object.entries(value)) out[key] = redactAnnotated(entry, schema?.properties?.[key], join(path, key), redacted);
+		return out;
+	}
+	return value;
+}
+/** 不可信来源：所有叶子脱敏，键与结构保留 */
+function redactAll(value, path, redacted) {
+	if (Array.isArray(value)) return value.map((item, i) => redactAll(item, `${path}[${i}]`, redacted));
+	if (isPlainObject(value)) {
+		const out = {};
+		for (const [key, entry] of Object.entries(value)) out[key] = redactAll(entry, join(path, key), redacted);
+		return out;
+	}
+	redacted.push(path);
+	return null;
+}
+/**
+* 分层脱敏（FR-30.3）——**全仓唯一实现**。
+*
+* 1. `untrusted` → 所有字段脱敏；
+* 2. `reviewed` / `host-trusted` → 逐字段走 schema，标注为敏感的脱敏。
+*
+* 标注为敏感的字段在**任何**层级都脱敏：信任声明说的是「未标注的可以留」，
+* 不是「标注了也能留」。
+*/
+function redactToolStepArgs(args, schema, trust) {
+	const redacted = [];
+	const redactedArgs = trust.tier === "untrusted" ? redactAll(args, "", redacted) : redactAnnotated(args, schema, "", redacted);
+	if (JSON.stringify(redactedArgs).length > 32768) return {
+		args: {},
+		redacted: [],
+		truncated: true
+	};
+	return {
+		args: redactedArgs,
+		redacted
+	};
+}
 const MAX_SURFACE_PATCHES_PER_SECOND = 240;
 /**
 * 一轮 LLM 调用可能抛出、且**值得原样上报**的结构化码。
@@ -2572,6 +2842,11 @@ const summarizeArgs = (args) => {
 	const json = JSON.stringify(args);
 	return json.length > 100 ? `${json.slice(0, 100)}…` : json;
 };
+/** 外部工具的 inputSchema 索引（分册 30）；run 开始与 resume 各重建一次 */
+function indexExternalToolSchemas(state, specs) {
+	state.externalToolSchemas.clear();
+	for (const spec of specs) state.externalToolSchemas.set(spec.name, spec.inputSchema);
+}
 /**
 * file-pick 的回填值带整个文件的 base64，落进 `paramHistory` 会把用户选的文件
 * 原样长期留在记忆里（体积与隐私都不可接受）。只留可辨识的描述，正文不留。
@@ -2717,6 +2992,7 @@ var AgentLoop = class {
 			pausedMs: 0,
 			maxTurns: this.#config.maxTurns,
 			totalTimeoutMs: this.#config.totalTimeoutMs,
+			externalToolSchemas: /* @__PURE__ */ new Map(),
 			controller: new AbortController()
 		};
 		this.#controllers.set(runId, state.controller);
@@ -2736,14 +3012,8 @@ var AgentLoop = class {
 				candidates: route.catalog.entries.map((e) => e.name)
 			}
 		}, state);
-		const externalSpecs = this.#config.toolCallingDisabled ? [] : (await Promise.all((this.#deps.externalTools ?? []).map(async (source) => {
-			try {
-				return await source.listToolSpecs();
-			} catch (e) {
-				trace.record("run.warning", { message: `External tool source "${source.kind}" failed to list specs: ${messageOf(e)}` });
-				return [];
-			}
-		}))).flat();
+		const externalSpecs = this.#config.toolCallingDisabled ? [] : await this.#collectExternalSpecs(state);
+		indexExternalToolSchemas(state, externalSpecs);
 		const externalSystemPrompts = [];
 		if (!this.#config.toolCallingDisabled) for (const source of this.#deps.externalTools ?? []) {
 			if (source.systemPrompt === void 0) continue;
@@ -3113,6 +3383,7 @@ var AgentLoop = class {
 			pausedMs: snapshot.pausedMs ?? 0,
 			maxTurns: snapshot.config.maxTurns,
 			totalTimeoutMs: snapshot.config.totalTimeoutMs,
+			externalToolSchemas: /* @__PURE__ */ new Map(),
 			controller: new AbortController()
 		};
 		this.#controllers.set(runId, state.controller);
@@ -3126,6 +3397,8 @@ var AgentLoop = class {
 		} });
 		const pending = pendingInteraction;
 		const pendingCall = this.#findPendingToolCall(state.messages);
+		const externalSpecs = await this.#collectExternalSpecs(state);
+		indexExternalToolSchemas(state, externalSpecs);
 		const carried = [];
 		try {
 			await this.#replaySurfaceEvents(state);
@@ -3183,14 +3456,6 @@ var AgentLoop = class {
 			if (e instanceof RunTerminated) return this.#finish(state, e.outcome.status, e.outcome.reason, e.outcome.message, e.outcome.code);
 			throw e;
 		}
-		const externalSpecs = (await Promise.all((this.#deps.externalTools ?? []).map(async (source) => {
-			try {
-				return await source.listToolSpecs();
-			} catch (e) {
-				trace.record("run.warning", { message: `External tool source "${source.kind}" failed to list specs: ${messageOf(e)}` });
-				return [];
-			}
-		}))).flat();
 		try {
 			return await this.#turnLoop(state, snapshot.turn + 1, externalSpecs);
 		} catch (e) {
@@ -3419,6 +3684,81 @@ var AgentLoop = class {
 			});
 		});
 	}
+	/** 外部工具 specs：单个来源失败跳过并记 warning（run 开始与 resume 共用） */
+	async #collectExternalSpecs(state) {
+		return (await Promise.all((this.#deps.externalTools ?? []).map(async (source) => {
+			try {
+				return await source.listToolSpecs();
+			} catch (e) {
+				state.trace.record("run.warning", { message: `External tool source "${source.kind}" failed to list specs: ${messageOf(e)}` });
+				return [];
+			}
+		}))).flat();
+	}
+	/**
+	* 一次工具调用的信任层级与 inputSchema（分册 30）。
+	*
+	* 技能脚本工具按 `untrusted`：它们的 schema 来自各技能的 frontmatter，
+	* 是第三方内容，不是本仓审查过的。
+	*/
+	#toolCaptureContext(call, state) {
+		if (call.name === "read_skill_file") return {
+			trust: { tier: "reviewed" },
+			schema: READ_SKILL_FILE_TOOL.inputSchema,
+			args: call.arguments
+		};
+		if (call.name === "ask_user") return {
+			trust: { tier: "reviewed" },
+			schema: ASK_USER_TOOL.inputSchema,
+			args: call.arguments
+		};
+		if (call.name === "read_linked_document") return {
+			trust: { tier: "reviewed" },
+			schema: READ_LINKED_DOCUMENT_TOOL.inputSchema,
+			args: call.arguments
+		};
+		const source = (this.#deps.externalTools ?? []).find((s) => s.canHandle(call.name));
+		if (source === void 0) return {
+			trust: { tier: "untrusted" },
+			args: call.arguments
+		};
+		const schema = state.externalToolSchemas.get(call.name);
+		const trust = source.argCaptureTrust?.(call.name, call.arguments) ?? { tier: "untrusted" };
+		const args = source.captureArgs?.(call.name, call.arguments) ?? call.arguments;
+		return schema === void 0 ? {
+			trust,
+			args
+		} : {
+			trust,
+			schema,
+			args
+		};
+	}
+	/**
+	* 成功调用的完整参数留存（FR-30.2）。失败的调用不留存：它什么也没做成，
+	* 让模型引用它只会生成一个跑不通的步骤。
+	*/
+	async #captureToolStep(call, state) {
+		const store = this.#deps.toolSteps;
+		if (store === void 0) return;
+		const { trust, schema, args: captured } = this.#toolCaptureContext(call, state);
+		const { args, redacted, truncated } = redactToolStepArgs(captured, schema, trust);
+		try {
+			await store.append({
+				runId: state.runId,
+				sessionId: state.run.sessionId,
+				callId: call.id,
+				tool: call.name,
+				at: state.now(),
+				args,
+				redacted,
+				...truncated !== void 0 ? { truncated } : {},
+				trust
+			});
+		} catch (e) {
+			state.trace.record("run.warning", { message: `Failed to capture tool step arguments: ${messageOf(e)}` });
+		}
+	}
 	async #executeCall(call, state) {
 		const argsSummary = summarizeArgs(call.arguments);
 		const owner = this.#skillOf(call, state);
@@ -3458,6 +3798,7 @@ var AgentLoop = class {
 				durationMs,
 				...attribution
 			} });
+			await this.#captureToolStep(call, state);
 			this.#emitTool(state, "completed", call);
 			for (const item of result.content) {
 				if (item.type !== "json") continue;
@@ -3497,7 +3838,7 @@ var AgentLoop = class {
 			this.#emitTool(state, "failed", call, result.error?.code);
 		}
 		for (const artifact of result.artifacts ?? []) {
-			state.artifactPaths.add(artifact.path);
+			if (!isArtifactCardHidden(artifact)) state.artifactPaths.add(artifact.path);
 			state.trace.record("artifact.created", { data: {
 				artifactId: artifact.id,
 				path: artifact.path
@@ -3575,7 +3916,7 @@ var AgentLoop = class {
 	async #stripDuplicateFileLinks(state, event) {
 		if (state.artifactPaths.size === 0) {
 			const listed = await this.#deps.artifactStore.listArtifacts(state.runId).catch(() => []);
-			for (const artifact of listed) state.artifactPaths.add(artifact.path);
+			for (const artifact of listed) if (!isArtifactCardHidden(artifact)) state.artifactPaths.add(artifact.path);
 		}
 		if (state.artifactPaths.size === 0) return event;
 		const paths = state.artifactPaths;
@@ -3956,6 +4297,7 @@ var AgentLoop = class {
 				type,
 				...field["required"] === true ? { required: true } : {},
 				...typeof field["description"] === "string" ? { description: field["description"] } : {},
+				...field["defaultValue"] !== void 0 ? { defaultValue: field["defaultValue"] } : {},
 				...Array.isArray(options) ? { options: options.filter((o) => typeof o === "object" && o !== null).map((o) => ({
 					label: String(o["label"] ?? o["value"]),
 					value: o["value"]
@@ -4719,12 +5061,12 @@ var WebSkillRuntime = class {
 	* 多会话：session 对象的 run(prompt) 跨 run 延续消息历史（同一 session 对话上下文连续）。
 	* 既有 runtime.run(prompt) 保持无状态单次语义不变。
 	* 同 handle 并发 run 经 per-handle 队列串行化（防历史 last-writer-wins 丢轮次）；
-	* maxHistoryMessages（默认 100）超出时滚动裁剪中段（保留首尾；边界对齐 tool 契约）。
+	* maxHistoryMessages（默认取 `DEFAULT_LOOP_LIMITS`）超出时滚动裁剪中段（保留首尾；边界对齐 tool 契约）。
 	*/
 	createSession(options = {}) {
 		const sessionId = options.sessionId ?? `session-${Math.random().toString(36).slice(2, 10)}`;
 		const createdAt = (/* @__PURE__ */ new Date()).toISOString();
-		const maxHistory = options.maxHistoryMessages ?? 100;
+		const maxHistory = options.maxHistoryMessages ?? DEFAULT_LOOP_LIMITS.maxHistoryMessages;
 		let history = [];
 		let queue = Promise.resolve();
 		return {
@@ -4791,6 +5133,7 @@ var WebSkillRuntime = class {
 			skillProviders: this.#deps.skillProviders,
 			catalogFilter: this.#deps.catalogFilter,
 			snapshotStore: this.#deps.snapshotStore,
+			toolSteps: this.#deps.toolSteps,
 			skillStateGuard: this.#deps.skillStateGuard,
 			skillIntegrityGuard: this.#deps.skillIntegrityGuard,
 			skillOutcomeReporter: this.#deps.skillOutcomeReporter,
@@ -4916,6 +5259,7 @@ var WebSkillRuntime = class {
 			skillProviders: this.#deps.skillProviders,
 			catalogFilter: this.#deps.catalogFilter,
 			snapshotStore: store,
+			toolSteps: this.#deps.toolSteps,
 			skillStateGuard: this.#deps.skillStateGuard,
 			skillIntegrityGuard: this.#deps.skillIntegrityGuard,
 			skillOutcomeReporter: this.#deps.skillOutcomeReporter,
@@ -5449,7 +5793,8 @@ function parseBridgeRequest(data) {
 				id,
 				path,
 				content,
-				...isNonEmptyString(mimeType) ? { mimeType } : {}
+				...isNonEmptyString(mimeType) ? { mimeType } : {},
+				..."metadata" in data ? { metadata: data["metadata"] } : {}
 			};
 		}
 		case "confirm": return isNonEmptyString(data["message"]) ? {
@@ -5892,6 +6237,7 @@ function sortByStartedAtDesc(summaries) {
 function applyFilter(summaries, filter) {
 	let runs = summaries;
 	if (filter.status !== void 0 && filter.status !== "") runs = runs.filter((r) => r.status === filter.status);
+	if (filter.sessionId !== void 0 && filter.sessionId !== "") runs = runs.filter((r) => r.sessionId === filter.sessionId);
 	const q = filter.search?.trim().toLowerCase();
 	if (q !== void 0 && q !== "") runs = runs.filter((r) => r.runId.toLowerCase().includes(q) || r.activeSkills.some((s) => s.toLowerCase().includes(q)));
 	return runs;
@@ -6151,6 +6497,51 @@ var FsSessionStore = class {
 		});
 	}
 };
+/**
+* 按会话分文件的 append-only JSONL 留存。
+*
+* 分文件维度取会话而非 run：读取侧唯一的查询就是「这个会话的全部步骤」，
+* 按 run 分会让一次生成要开 N 个文件。
+*/
+var FsToolStepStore = class {
+	#root;
+	#fs;
+	#onError;
+	constructor(deps) {
+		this.#root = deps.root.replace(/\/+$/, "");
+		this.#fs = deps.fs;
+		this.#onError = deps.onError ?? ((error, record) => {
+			console.warn(`Failed to persist tool step for call "${record.callId}": ${messageOf(error)}`);
+		});
+	}
+	#path(sessionId) {
+		assertSafePathSegment(sessionId, "session id");
+		return resolveInsideRoot(this.#root, `${sessionId}.jsonl`);
+	}
+	async append(record) {
+		const path = this.#path(record.sessionId);
+		try {
+			await this.#fs.appendText(path, `${JSON.stringify(record)}\n`);
+		} catch (e) {
+			this.#onError(e, record);
+		}
+	}
+	async listBySession(sessionId) {
+		const path = this.#path(sessionId);
+		if (!await this.#fs.exists(path)) return [];
+		const raw = await this.#fs.readText(path);
+		const records = [];
+		for (const line of raw.split("\n")) {
+			if (line.trim() === "") continue;
+			try {
+				records.push(JSON.parse(line));
+			} catch {
+				continue;
+			}
+		}
+		return records;
+	}
+};
 
 //#endregion
-export { createWebSkillApi as $, READ_LINKED_DOCUMENT_TOOL_NAME as A, schemaSourceLabel as At, TraceRecorder as B, validateUiSpecNode as Bt, FsSessionStore as C, readBehaviorRecords as Ct, OpenAiCompatibleClient as D, renderUserProfileContext as Dt, HookRunner as E, refineUserProfile as Et, RUN_TRACE_SCHEMA_VERSION as F, summarizeToolCalls as Ft, USER_PROFILE_PROMPT_HEADER as G, USER_PROFILE_EXPORT_VERSION as H, SESSION_SCHEMA_VERSION as I, toLlmToolSpec as It, appendBehaviorRecords as J, USER_PROFILE_REFINE_PROMPT as K, SUPPORTED_DOCUMENT_MIME as L, toRecordDigests as Lt, READ_SKILL_FILE_TOOL as M, scriptToolName as Mt, READ_SKILL_FILE_TOOL_NAME as N, sealToolCallPairs as Nt, ProgressiveRouter as O, resolveToolName as Ot, RUN_SNAPSHOT_SCHEMA_VERSION as P, summarizeRunUsage as Pt, createScriptContext as Q, SerializingMemoryStore as R, toVercelToolSpecs as Rt, FsRunTraceStore as S, parseUserProfileExport as St, GoogleGenAiClient as T, readUserProfile as Tt, USER_PROFILE_KEY as U, UNSUPPORTED_DOCUMENT_MESSAGE as V, USER_PROFILE_NO_INVENTION_RULE as W, bridgeError as X, applyUserProfileImport as Y, buildRenderResult as Z, EventBus as _, networkUrlHost as _t, ASK_USER_TOOL as a, extractUiSpecEvents as at, FsMemoryStore as b, normalizeToolError as bt, AnthropicClient as c, fromVercelResult as ct, DEFAULT_LOOP_LIMITS as d, isNetworkAllowed as dt, diffUserProfile as et, DEFAULT_MAX_DATA_SOURCE_BYTES as f, isUnsupportedRunSnapshot as ft, EMPTY_USER_PROFILE as g, networkPolicyLibSource as gt, DEFAULT_USER_PROFILE_LIMITS as h, mergeProfileEntries as ht, ASK_USER_MAX_FIELDS as i, extractTodoTraceEvents as it, READ_SKILL_FILE_INPUT_SCHEMA as j, schemaToForm as jt, READ_LINKED_DOCUMENT_TOOL as k, sampleBehaviorRecords as kt, BEHAVIOR_RECORDS_KEY as l, fromVercelStreamPart as lt, DEFAULT_MAX_DOCUMENT_TEXT_BYTES as m, mergeCatalogEntries as mt, ASK_USER_FIELD_TYPES as n, extractChartSpec as nt, ASK_USER_TOOL_NAME as o, findUnpairedToolCalls as ot, DEFAULT_MAX_DOCUMENT_BYTES as p, listSkillScripts as pt, WebSkillRuntime as q, ASK_USER_INPUT_SCHEMA as r, extractSkillCandidate as rt, AgentLoop as s, formatSkillScriptManifest as st, ALLOWED_TOOLS_EXCLUSION_REASON as t, exportUserProfile as tt, CapabilityApproval as u, interruptedToolResult as ut, FS_SESSION_PAGE_SIZE as v, normalizeErrorCode as vt, FullDisclosureRouter as w, readProfileEntries as wt, FsRunSnapshotStore as x, parseBridgeRequest as xt, FsArtifactStore as y, normalizeToolContent as yt, TEXT_BUDGETED_CONTENT_TYPES as z, validateUiSpecEvent as zt };
+export { bridgeError as $, ProgressiveRouter as A, refineUserProfile as At, SUPPORTED_DOCUMENT_MIME as B, toLlmToolSpec as Bt, FsSessionStore as C, normalizeToolError as Ct, HookRunner as D, readProfileEntries as Dt, GoogleGenAiClient as E, readBehaviorRecords as Et, READ_SKILL_FILE_TOOL_NAME as F, schemaToForm as Ft, USER_PROFILE_EXPORT_VERSION as G, TEXT_BUDGETED_CONTENT_TYPES as H, toVercelToolSpecs as Ht, RUN_SNAPSHOT_SCHEMA_VERSION as I, scriptToolName as It, USER_PROFILE_PROMPT_HEADER as J, USER_PROFILE_KEY as K, RUN_TRACE_SCHEMA_VERSION as L, sealToolCallPairs as Lt, READ_LINKED_DOCUMENT_TOOL_NAME as M, resolveToolName as Mt, READ_SKILL_FILE_INPUT_SCHEMA as N, sampleBehaviorRecords as Nt, MAX_TOOL_STEP_ARG_BYTES as O, readUserProfile as Ot, READ_SKILL_FILE_TOOL as P, schemaSourceLabel as Pt, applyUserProfileImport as Q, SENSITIVE_ANNOTATION as R, summarizeRunUsage as Rt, FsRunTraceStore as S, normalizeToolContent as St, FullDisclosureRouter as T, parseUserProfileExport as Tt, TraceRecorder as U, validateUiSpecEvent as Ut, SerializingMemoryStore as V, toRecordDigests as Vt, UNSUPPORTED_DOCUMENT_MESSAGE as W, validateUiSpecNode as Wt, WebSkillRuntime as X, USER_PROFILE_REFINE_PROMPT as Y, appendBehaviorRecords as Z, EventBus as _, mergeCatalogEntries as _t, ASK_USER_TOOL as a, extractChartSpec as at, FsMemoryStore as b, networkUrlHost as bt, AnthropicClient as c, extractUiSpecEvents as ct, DEFAULT_LOOP_LIMITS as d, fromVercelResult as dt, buildRenderResult as et, DEFAULT_MAX_DATA_SOURCE_BYTES as f, fromVercelStreamPart as ft, EMPTY_USER_PROFILE as g, listSkillScripts as gt, DEFAULT_USER_PROFILE_LIMITS as h, isUnsupportedRunSnapshot as ht, ASK_USER_MAX_FIELDS as i, exportUserProfile as it, READ_LINKED_DOCUMENT_TOOL as j, renderUserProfileContext as jt, OpenAiCompatibleClient as k, redactToolStepArgs as kt, BEHAVIOR_RECORDS_KEY as l, findUnpairedToolCalls as lt, DEFAULT_MAX_DOCUMENT_TEXT_BYTES as m, isNetworkAllowed as mt, ASK_USER_FIELD_TYPES as n, createWebSkillApi as nt, ASK_USER_TOOL_NAME as o, extractSkillCandidate as ot, DEFAULT_MAX_DOCUMENT_BYTES as p, interruptedToolResult as pt, USER_PROFILE_NO_INVENTION_RULE as q, ASK_USER_INPUT_SCHEMA as r, diffUserProfile as rt, AgentLoop as s, extractTodoTraceEvents as st, ALLOWED_TOOLS_EXCLUSION_REASON as t, createScriptContext as tt, CapabilityApproval as u, formatSkillScriptManifest as ut, FS_SESSION_PAGE_SIZE as v, mergeProfileEntries as vt, FsToolStepStore as w, parseBridgeRequest as wt, FsRunSnapshotStore as x, normalizeErrorCode as xt, FsArtifactStore as y, networkPolicyLibSource as yt, SESSION_SCHEMA_VERSION as z, summarizeToolCalls as zt };