@webskill/sdk 0.2.0 → 0.2.1

package/README.md

@@ -15,12 +15,16 @@ governance.
   the LLM, guardrails, lifecycle events, memory, human interaction
   (missing-parameter forms, confirmations, authorization prompts), and
   resumable interrupted runs.
-- **Script sandbox** — `worker_threads` sandbox for Node, Web Worker sandbox for
-  the browser. Deny-by-default network policy, deny-by-default builtin-module
-  allowlist, per-capability forced approval, timeouts kill runaway scripts.
-  **Honest note:** these executors reduce the capability surface — they are NOT
-  a security boundary. Scripts share the host process/origin and bypasses
-  exist; never rely on them to isolate untrusted scripts.
+- **Script sandbox** — two tiers. Isolation-grade: Node `ProcessSandboxExecutor`
+  (`child_process.fork` + `--permission`, experimental; fs scoped to the skill
+  root, workers/child processes/addons denied by default — note the permission
+  model has NO network dimension, so `fetch`/`WebSocket` stay patch-enforced and
+  bare `node:net` imports remain a documented residual), and the browser opaque
+  origin sandbox (`sandbox="allow-scripts"` iframe hosting a classic Worker —
+  `type:"module"` workers cannot load in opaque origins, verified). Capability
+  tier (NOT a security boundary): `SandboxedScriptExecutor` /
+  `BrowserWorkerScriptExecutor` in blob-Worker mode, with deny-by-default
+  network policy, builtin-module allowlist, forced approval, timeouts.
 - **`navigator.webskill`** — a browser facade (`discover` / `read` / `validate` /
   `run` / `install` / `uninstall`) assembled explicitly in one call.
 - **MCP** — call page-provided tools and consume page-declared dynamic skills
@@ -102,7 +106,8 @@ const run = await api.run('Summarize the references of skill greeter.');
 
 ### `@webskill/sdk/node`
 
-Node host: `NodeFS`, script executors (in-process + `worker_threads` sandbox),
+Node host: `NodeFS`, script executors (in-process, `worker_threads` sandbox, and
+`ProcessSandboxExecutor` for real process isolation),
 file-backed stores, `SkillManager` (install/export incl. multi-skill packs),
 CLI UI bridge, schema inference.
 
@@ -117,9 +122,10 @@ console.log((await manager.verifyIntegrity('greeter')).ok);
 
 ### `@webskill/sdk/browser`
 
-Browser host: OPFS provider, Web Worker script sandbox (deny-by-default network
-policy), worker runtime host/client, `BrowserSkillManager`, and the
-`navigator.webskill` assembler. See
+Browser host: OPFS provider, opaque origin iframe script sandbox (default on
+the main thread; engines running inside a Worker automatically fall back to the
+blob Worker form — no iframe is available there, documented), worker runtime
+host/client, `BrowserSkillManager`, and the `navigator.webskill` assembler. See
 [`examples/quickstart-browser`](../examples/quickstart-browser).
 
 ```js

package/dist/browser.d.ts

@@ -1,5 +1,5 @@
 import { C as FileStat, I as SkillInstallSource, K as VerifyResult, W as SkillsLockfile, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { N as NetworkPolicy, Q as ScriptExecutor, Z as ScriptExecutionContext, d as BridgeCapabilities, it as ToolResult, m as BridgeResponse, nt as ToolDefinition, p as BridgeRequest, pt as bridgeError, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, wt as parseBridgeRequest, y as ExternalToolSource } from "./index-CySxIvRz.js";
+import { N as NetworkPolicy, Q as ScriptExecutor, Z as ScriptExecutionContext, d as BridgeCapabilities, it as ToolResult, m as BridgeResponse, nt as ToolDefinition, p as BridgeRequest, pt as bridgeError, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, wt as parseBridgeRequest, y as ExternalToolSource } from "./index-gjFuBevI.js";
 //#region ../browser/dist/index.d.ts
 //#region src/fs/featureDetection.d.ts
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -123,6 +123,8 @@ interface WorkerLike {
   terminate(): void;
 }
 type WorkerFactory = () => WorkerLike;
+/** 沙箱形态：opaque iframe（默认，主线程可用 document 时）/ blob Worker（Worker 内引擎回退） */
+type SandboxMode = 'iframe' | 'worker' | 'auto';
 /**
  * Web Worker 脚本沙箱执行器：loadDefinition 与 execute 都在 Worker 内完成，
  * 主线程从不 import 技能脚本；每次执行独立 Worker；超时 terminate 强杀。
@@ -133,6 +135,12 @@ declare class BrowserWorkerScriptExecutor implements ScriptExecutor {
   constructor(deps: {
     fs: FileSystemProvider;
     workerFactory?: WorkerFactory;
+    /**
+     * 沙箱形态：'auto'（默认）——主线程用 opaque origin iframe（sandbox=allow-scripts srcdoc，
+     * 真实隔离）；Worker 内引擎自动回退 blob Worker（无 iframe 可用，文档明示）。
+     * 显式 'worker' 强制 blob Worker（0.1.x 旧形态）。
+     */
+    sandbox?: SandboxMode;
     capabilities?: BridgeCapabilities;
     /** 网络策略：默认 'deny-all'（白名单见 runtime/sandbox/networkPolicy） */
     networkPolicy?: NetworkPolicy;
@@ -153,6 +161,31 @@ declare class BrowserWorkerScriptExecutor implements ScriptExecutor {
   }): Promise<ToolResult>;
 }
 //#endregion
+//#region src/executor/iframeSandbox.d.ts
+/**
+ * opaque origin 沙箱 iframe（sandbox="allow-scripts" srcdoc）：
+ * iframe 内建 module Worker（Blob URL），iframe window 作 postMessage 中继。
+ * opaque origin：沙箱内摸不到页面 DOM/localStorage/OPFS（独立 storage 分区）。
+ * 就绪握手：iframe 加载完成发 sandbox-ready 后才放行出站消息（防丢失）。
+ */
+declare class IframeWorkerLike implements WorkerLike {
+  #private;
+  constructor(iframe: HTMLIFrameElement);
+  get ready(): boolean;
+  markReady(): void;
+  postMessage(data: unknown): void;
+  addEventListener(_type: 'message', listener: (event: {
+    data: unknown;
+  }) => void): void;
+  emit(data: unknown): void;
+  terminate(): void;
+}
+/**
+ * 创建 opaque iframe 沙箱 Worker：sandbox="allow-scripts" srcdoc iframe 承载 module Worker。
+ * 返回 IframeWorkerLike（协议与 blob Worker 完全一致：load/execute/bridge/network-blocked）。
+ */
+declare function createIframeWorker(bootstrapSource: string, doc?: Document): IframeWorkerLike;
+//#endregion
 //#region src/navigator.d.ts
 declare global {
   /** 0.0.6：installWebSkillNavigator 显式装配后可用（不自动挂全局） */
@@ -343,4 +376,4 @@ declare class WorkerUiBridge implements UiBridge {
   onTextDelta(runId: string, delta: string): Promise<void>;
 }
 //#endregion
-export { type BridgeCapabilities, type BridgeRequest, type BridgeResponse, BrowserSkillManager, BrowserWorkerScriptExecutor, type LlmClientConfig, type MainToWorkerMessage, OpfsProvider, type SerializedError, TsTranspiler, type TypeScriptSupportOptions, WORKER_BOOTSTRAP_SOURCE, type WorkerEvent, type WorkerFactory, type WorkerLike, type WorkerRequest, WorkerRuntimeClient, type WorkerRuntimeClientDeps, type WorkerRuntimeHostOverrides, type WorkerScopeLike, WorkerUiBridge, bridgeError, extractZipWeb, installWebSkillNavigator, isOpfsAvailable, parseBridgeRequest, parseMainMessage, parseWorkerEvent, sha256HexWeb, startWorkerRuntimeHost };
+export { type BridgeCapabilities, type BridgeRequest, type BridgeResponse, BrowserSkillManager, BrowserWorkerScriptExecutor, IframeWorkerLike, type LlmClientConfig, type MainToWorkerMessage, OpfsProvider, type SandboxMode, type SerializedError, TsTranspiler, type TypeScriptSupportOptions, WORKER_BOOTSTRAP_SOURCE, type WorkerEvent, type WorkerFactory, type WorkerLike, type WorkerRequest, WorkerRuntimeClient, type WorkerRuntimeClientDeps, type WorkerRuntimeHostOverrides, type WorkerScopeLike, WorkerUiBridge, bridgeError, createIframeWorker, extractZipWeb, installWebSkillNavigator, isOpfsAvailable, parseBridgeRequest, parseMainMessage, parseWorkerEvent, sha256HexWeb, startWorkerRuntimeHost };

package/dist/browser.js

@@ -1,5 +1,5 @@
 import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, T as readResponseWithLimit, b as isValidSkillName, c as SkillDiscovery, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D0saNPi_.js";
-import { A as isNetworkAllowed, C as bridgeError, E as createWebSkillApi, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, l as FsMemoryStore, m as OpenAiCompatibleClient, o as CapabilityApproval, u as FsRunSnapshotStore, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-BS5OpedX.js";
+import { A as isNetworkAllowed, C as bridgeError, E as createWebSkillApi, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, l as FsMemoryStore, m as OpenAiCompatibleClient, o as CapabilityApproval, u as FsRunSnapshotStore, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-DrySSQ5R.js";
 import { n as MockLlmClient } from "./testing-B4pq6JYa.js";
 
 //#region ../browser/dist/index.js
@@ -713,13 +713,106 @@ var BrowserSkillManager = class {
 		await atomicWriteText(this.#fs, lockfilePath(this.#managedRoot), JSON.stringify(lockfile, null, 2));
 	}
 };
-const defaultWorkerFactory = () => {
+const ENVELOPE = "__webskill_sandbox__";
+/**
+* opaque origin 沙箱 iframe（sandbox="allow-scripts" srcdoc）：
+* iframe 内建 module Worker（Blob URL），iframe window 作 postMessage 中继。
+* opaque origin：沙箱内摸不到页面 DOM/localStorage/OPFS（独立 storage 分区）。
+* 就绪握手：iframe 加载完成发 sandbox-ready 后才放行出站消息（防丢失）。
+*/
+var IframeWorkerLike = class {
+	#iframe;
+	#ready = false;
+	#queue = [];
+	constructor(iframe) {
+		this.#iframe = iframe;
+	}
+	get ready() {
+		return this.#ready;
+	}
+	markReady() {
+		this.#ready = true;
+		for (const payload of this.#queue) this.#post(payload);
+		this.#queue = [];
+	}
+	#post(payload) {
+		this.#iframe.contentWindow?.postMessage({
+			[ENVELOPE]: true,
+			payload
+		}, "*");
+	}
+	postMessage(data) {
+		if (this.#ready) this.#post(data);
+		else this.#queue.push(data);
+	}
+	addEventListener(_type, listener) {
+		this.#listeners.add(listener);
+	}
+	#listeners = /* @__PURE__ */ new Set();
+	emit(data) {
+		for (const listener of this.#listeners) listener({ data });
+	}
+	terminate() {
+		this.#iframe.remove();
+	}
+};
+/** srcdoc 文档：内嵌 Worker 引导源码 + 双向中继（BOOTSTRAP 经 JSON 字符串注入，防 <\/script> 截断） */
+function sandboxDocument(bootstrapSource) {
+	const bootstrapJson = JSON.stringify(bootstrapSource).replace(/<\//g, "<\\/");
+	return `<!doctype html>
+<html><head><meta charset="utf-8"></head><body><script>
+const ENVELOPE = ${JSON.stringify(ENVELOPE)};
+const blob = new Blob([${bootstrapJson}], { type: 'text/javascript' });
+const url = URL.createObjectURL(blob);
+// 注意：opaque origin 下 module Worker 无法加载（实证），classic Worker + data: URL 动态导入可用
+const worker = new Worker(url);
+URL.revokeObjectURL(url);
+window.addEventListener('message', (event) => {
+  const data = event.data;
+  if (data && data[ENVELOPE]) worker.postMessage(data.payload);
+});
+worker.addEventListener('message', (event) => {
+  parent.postMessage({ [ENVELOPE]: true, payload: event.data }, '*');
+});
+worker.addEventListener('error', (event) => {
+  parent.postMessage({ [ENVELOPE]: true, payload: { type: 'sandbox-worker-error', message: event.message } }, '*');
+});
+parent.postMessage({ [ENVELOPE]: true, payload: { type: 'sandbox-ready' } }, '*');
+<\/script></body></html>`;
+}
+/**
+* 创建 opaque iframe 沙箱 Worker：sandbox="allow-scripts" srcdoc iframe 承载 module Worker。
+* 返回 IframeWorkerLike（协议与 blob Worker 完全一致：load/execute/bridge/network-blocked）。
+*/
+function createIframeWorker(bootstrapSource, doc = document) {
+	const iframe = doc.createElement("iframe");
+	iframe.setAttribute("sandbox", "allow-scripts");
+	iframe.style.display = "none";
+	iframe.srcdoc = sandboxDocument(bootstrapSource);
+	const worker = new IframeWorkerLike(iframe);
+	(doc.defaultView ?? window).addEventListener("message", (event) => {
+		const data = event.data;
+		if (!data || data[ENVELOPE] !== true) return;
+		if (data.payload && data.payload.type === "sandbox-ready") {
+			worker.markReady();
+			return;
+		}
+		worker.emit(data.payload);
+	});
+	doc.body.appendChild(iframe);
+	return worker;
+}
+const blobWorkerFactory = () => {
 	const blob = new Blob([WORKER_BOOTSTRAP_SOURCE], { type: "text/javascript" });
 	const url = URL.createObjectURL(blob);
 	const worker = new Worker(url, { type: "module" });
 	URL.revokeObjectURL(url);
 	return worker;
 };
+const resolveWorkerFactory = (mode) => {
+	if (mode === "iframe" || mode === "auto" && typeof document !== "undefined") return () => createIframeWorker(WORKER_BOOTSTRAP_SOURCE);
+	return blobWorkerFactory;
+};
 const baseName = (p) => p.split("/").pop() ?? p;
 const messageOf = (e) => e instanceof Error ? e.message : String(e);
 /**
@@ -736,7 +829,7 @@ var BrowserWorkerScriptExecutor = class {
 	#transpiler;
 	constructor(deps) {
 		this.#fs = deps.fs;
-		this.#workerFactory = deps.workerFactory ?? defaultWorkerFactory;
+		this.#workerFactory = deps.workerFactory ?? resolveWorkerFactory(deps.sandbox ?? "auto");
 		this.#transpiler = deps.typescript ? new TsTranspiler({
 			fs: deps.fs,
 			options: deps.typescript
@@ -1483,4 +1576,4 @@ var WorkerRuntimeClient = class {
 };
 
 //#endregion
-export { BrowserSkillManager, BrowserWorkerScriptExecutor, OpfsProvider, TsTranspiler, WORKER_BOOTSTRAP_SOURCE, WorkerRuntimeClient, WorkerUiBridge, bridgeError, extractZipWeb, installWebSkillNavigator, isOpfsAvailable, parseBridgeRequest, parseMainMessage, parseWorkerEvent, sha256HexWeb, startWorkerRuntimeHost };
+export { BrowserSkillManager, BrowserWorkerScriptExecutor, IframeWorkerLike, OpfsProvider, TsTranspiler, WORKER_BOOTSTRAP_SOURCE, WorkerRuntimeClient, WorkerUiBridge, bridgeError, createIframeWorker, extractZipWeb, installWebSkillNavigator, isOpfsAvailable, parseBridgeRequest, parseMainMessage, parseWorkerEvent, sha256HexWeb, startWorkerRuntimeHost };

package/dist/{dist-Dj6QjHBn.js → dist-BRGQcLqR.js}

@@ -1,20 +1,20 @@
 import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, O as resolveArchiveLimits, T as readResponseWithLimit, b as isValidSkillName, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D0saNPi_.js";
-import { A as isNetworkAllowed, C as bridgeError, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, l as FsMemoryStore, o as CapabilityApproval } from "./dist-BS5OpedX.js";
+import { A as isNetworkAllowed, C as bridgeError, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, l as FsMemoryStore, o as CapabilityApproval } from "./dist-DrySSQ5R.js";
 import { createRequire } from "node:module";
 import { unzipSync, zipSync } from "fflate";
-import { existsSync, promises } from "node:fs";
+import { existsSync, promises, realpathSync } from "node:fs";
 import path from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { format, promisify } from "node:util";
 import { Worker } from "node:worker_threads";
+import { mkdtemp, rm } from "node:fs/promises";
+import { execFile, fork } from "node:child_process";
 import { createInterface } from "node:readline/promises";
-import { mkdtemp } from "node:fs/promises";
-import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 
 //#region ../node/dist/index.js
-const toPlatform$3 = (p) => p.split("/").join(path.sep);
+const toPlatform$4 = (p) => p.split("/").join(path.sep);
 const toPosix = (p) => p.split(path.sep).join("/");
 const isEnoent = (e) => typeof e === "object" && e !== null && e.code === "ENOENT";
 /** realpath 最近现存祖先并拼回剩余段（写入目标尚不存在时的等价判定） */
@@ -46,41 +46,41 @@ var NodeFS = class {
 	/** root 模式：目标 realpath 必须落在 root realpath 前缀内（符号链接逃逸防护） */
 	async #assertContained(p) {
 		if (!this.#root) return;
-		const rootReal = await promises.realpath(toPlatform$3(this.#root));
-		const targetReal = await realpathNearest(toPlatform$3(p));
+		const rootReal = await promises.realpath(toPlatform$4(this.#root));
+		const targetReal = await realpathNearest(toPlatform$4(p));
 		if (targetReal !== rootReal && !targetReal.startsWith(rootReal + path.sep)) throw new WebSkillError("FS_PATH_OUTSIDE_ROOT", `Path escapes root via symbolic link: ${p} (resolves outside ${this.#root})`);
 	}
 	async readText(p) {
 		await this.#assertContained(p);
 		try {
-			return await promises.readFile(toPlatform$3(p), "utf8");
+			return await promises.readFile(toPlatform$4(p), "utf8");
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 	}
 	async writeText(p, content) {
 		await this.#assertContained(p);
-		const target = toPlatform$3(p);
+		const target = toPlatform$4(p);
 		await promises.mkdir(path.dirname(target), { recursive: true });
 		await promises.writeFile(target, content, "utf8");
 	}
 	async readBinary(p) {
 		await this.#assertContained(p);
 		try {
-			return await promises.readFile(toPlatform$3(p));
+			return await promises.readFile(toPlatform$4(p));
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 	}
 	async writeBinary(p, content) {
 		await this.#assertContained(p);
-		const target = toPlatform$3(p);
+		const target = toPlatform$4(p);
 		await promises.mkdir(path.dirname(target), { recursive: true });
 		await promises.writeFile(target, content);
 	}
 	async exists(p) {
 		try {
-			await promises.access(toPlatform$3(p));
+			await promises.access(toPlatform$4(p));
 			return true;
 		} catch {
 			return false;
@@ -88,7 +88,7 @@ var NodeFS = class {
 	}
 	async stat(p) {
 		try {
-			const s = await promises.stat(toPlatform$3(p));
+			const s = await promises.stat(toPlatform$4(p));
 			return {
 				path: toPosix(p),
 				type: s.isDirectory() ? "directory" : "file",
@@ -102,29 +102,29 @@ var NodeFS = class {
 	async list(p) {
 		let dirents;
 		try {
-			dirents = await promises.readdir(toPlatform$3(p), { withFileTypes: true });
+			dirents = await promises.readdir(toPlatform$4(p), { withFileTypes: true });
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 		return dirents.map((d) => ({
-			path: toPosix(path.join(toPlatform$3(p), d.name)),
+			path: toPosix(path.join(toPlatform$4(p), d.name)),
 			type: d.isDirectory() ? "directory" : "file"
 		}));
 	}
 	async mkdir(p) {
-		await promises.mkdir(toPlatform$3(p), { recursive: true });
+		await promises.mkdir(toPlatform$4(p), { recursive: true });
 	}
 	async remove(p, options) {
 		try {
-			await promises.rm(toPlatform$3(p), { recursive: options?.recursive ?? false });
+			await promises.rm(toPlatform$4(p), { recursive: options?.recursive ?? false });
 		} catch (e) {
 			throw this.#mapError(e, p);
 		}
 	}
 	async rename(from, to) {
-		await promises.mkdir(path.dirname(toPlatform$3(to)), { recursive: true });
+		await promises.mkdir(path.dirname(toPlatform$4(to)), { recursive: true });
 		try {
-			await promises.rename(toPlatform$3(from), toPlatform$3(to));
+			await promises.rename(toPlatform$4(from), toPlatform$4(to));
 		} catch (e) {
 			throw this.#mapError(e, from);
 		}
@@ -134,7 +134,7 @@ var NodeFS = class {
 		return e;
 	}
 };
-const baseName$1 = (p) => p.split("/").pop() ?? p;
+const baseName$2 = (p) => p.split("/").pop() ?? p;
 /**
 * 进程内脚本执行器。接口按沙箱语义设计（context 无隐式宿主访问），
 * worker_threads 沙箱见 deferred-items D1。
@@ -173,7 +173,7 @@ var NodeScriptExecutor = class {
 	}
 	async loadDefinition(skillRoot, scriptName) {
 		const scriptPath = await this.#locateScript(skillRoot, scriptName);
-		const skillName = baseName$1(skillRoot);
+		const skillName = baseName$2(skillRoot);
 		let module;
 		try {
 			module = await this.#loadModule(scriptPath);
@@ -277,14 +277,14 @@ var NodeScriptExecutor = class {
 		};
 	}
 };
-const baseName = (p) => p.split("/").pop() ?? p;
-const toPlatform$2 = (p) => p.split("/").join(path.sep);
-const messageOf$5 = (e) => e instanceof Error ? e.message : String(e);
+const baseName$1 = (p) => p.split("/").pop() ?? p;
+const toPlatform$3 = (p) => p.split("/").join(path.sep);
+const messageOf$6 = (e) => e instanceof Error ? e.message : String(e);
 /**
 * 网络策略判定函数源码（注入 Worker；匹配逻辑单一来源在
 * runtime/sandbox/networkPolicy.ts，Worker 线程不走 vitest 别名故注入而非 import）
 */
-const NETWORK_POLICY_LIB = `${isNetworkAllowed.toString()}\n${networkUrlHost.toString()}`;
+const NETWORK_POLICY_LIB$1 = `${isNetworkAllowed.toString()}\n${networkUrlHost.toString()}`;
 /** Worker 入口文件：src 为同目录 .ts；node dist 为 dist/executor/；sdk dist 为平铺 dist/ */
 function workerEntryPath() {
 	const dir = path.dirname(fileURLToPath(import.meta.url));
@@ -336,10 +336,10 @@ var SandboxedScriptExecutor = class {
 	}
 	async loadDefinition(skillRoot, scriptName) {
 		const scriptPath = await this.#locateScript(skillRoot, scriptName);
-		const skillName = baseName(skillRoot);
+		const skillName = baseName$1(skillRoot);
 		const result = await this.#runWorker({
 			mode: "load",
-			scriptPath: toPlatform$2(scriptPath),
+			scriptPath: toPlatform$3(scriptPath),
 			scriptName,
 			scriptSource: await this.#fs.readText(scriptPath)
 		});
@@ -363,14 +363,14 @@ var SandboxedScriptExecutor = class {
 				content: [],
 				error: {
 					code: e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED",
-					message: messageOf$5(e)
+					message: messageOf$6(e)
 				}
 			};
 		}
 		try {
 			const result = await this.#runWorker({
 				mode: "execute",
-				scriptPath: toPlatform$2(scriptPath),
+				scriptPath: toPlatform$3(scriptPath),
 				scriptName,
 				skillName: context.skillName,
 				runId: context.runId,
@@ -403,7 +403,7 @@ var SandboxedScriptExecutor = class {
 				content: [],
 				error: {
 					code: e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED",
-					message: messageOf$5(e)
+					message: messageOf$6(e)
 				}
 			};
 		}
@@ -417,7 +417,7 @@ var SandboxedScriptExecutor = class {
 				workerData: {
 					...workerData,
 					networkPolicy: this.#networkPolicy,
-					networkPolicyLib: NETWORK_POLICY_LIB,
+					networkPolicyLib: NETWORK_POLICY_LIB$1,
 					allowedModules: this.#options.allowedModules ?? []
 				},
 				env,
@@ -454,7 +454,7 @@ var SandboxedScriptExecutor = class {
 						respond(bridgeError("unknown", "TOOL_EXECUTION_FAILED", "invalid bridge request"));
 						return;
 					}
-					onBridge(request).then(respond, (e) => respond(bridgeError(request.id, "TOOL_EXECUTION_FAILED", messageOf$5(e))));
+					onBridge(request).then(respond, (e) => respond(bridgeError(request.id, "TOOL_EXECUTION_FAILED", messageOf$6(e))));
 					return;
 				}
 				if (msg?.type === "load-result" || msg?.type === "execute-result") done(() => resolve(msg));
@@ -466,6 +466,328 @@ var SandboxedScriptExecutor = class {
 		});
 	}
 	/** 能力桥宿主侧处理：能力关闭/授权拒绝即 TOOL_UNSUPPORTED；判定逻辑共用 runtime/sandbox/approval */
+	async #handleBridge(request, context) {
+		const gate = async (capability, message, details) => {
+			const decision = await this.#approval.authorize({
+				runId: context.runId,
+				capability,
+				mode: this.#capabilities[capability],
+				message,
+				...details !== void 0 ? { details } : {}
+			});
+			if (decision === "allowed") return void 0;
+			return bridgeError(request.id, "TOOL_UNSUPPORTED", decision === "disabled" ? `Capability "${capability}" is disabled` : `Capability "${capability}" was denied by the user`);
+		};
+		try {
+			switch (request.kind) {
+				case "readReference": {
+					const denied = await gate("readReference", `Script "${context.skillName}" wants to read reference "${request.path}"`, { path: request.path });
+					if (denied) return denied;
+					return {
+						id: request.id,
+						ok: true,
+						value: await context.readReference(request.path)
+					};
+				}
+				case "writeArtifact": {
+					const denied = await gate("writeArtifact", `Script "${context.skillName}" wants to write artifact "${request.path}"`, {
+						path: request.path,
+						mimeType: request.mimeType
+					});
+					if (denied) return denied;
+					const content = typeof request.content === "string" ? request.content : new Uint8Array(request.content);
+					const artifact = await context.writeArtifact(request.path, content, { ...request.mimeType ? { mimeType: request.mimeType } : {} });
+					return {
+						id: request.id,
+						ok: true,
+						value: artifact
+					};
+				}
+				case "confirm": {
+					if (!context.confirm) return bridgeError(request.id, "TOOL_UNSUPPORTED", "Capability \"confirm\" is disabled");
+					const denied = await gate("confirm", `Script "${context.skillName}" asks for confirmation: ${request.message}`);
+					if (denied) return denied;
+					return {
+						id: request.id,
+						ok: true,
+						value: await context.confirm(request.message)
+					};
+				}
+			}
+		} catch (e) {
+			return bridgeError(request.id, e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED", messageOf$6(e));
+		}
+	}
+};
+const baseName = (p) => p.split("/").pop() ?? p;
+const toPlatform$2 = (p) => p.split("/").join(path.sep);
+const messageOf$5 = (e) => e instanceof Error ? e.message : String(e);
+const NETWORK_POLICY_LIB = `${isNetworkAllowed.toString()}\n${networkUrlHost.toString()}`;
+const readAllow = (p) => [`--allow-fs-read=${p}`, `--allow-fs-read=${realpathSync(p)}`];
+const writeAllow = (p) => [`--allow-fs-write=${p}`, `--allow-fs-write=${realpathSync(p)}`];
+/** 子进程入口文件：src 为同目录 .ts；node dist 为 dist/executor/；sdk dist 为平铺 dist/ */
+function processEntryPath() {
+	const dir = path.dirname(fileURLToPath(import.meta.url));
+	const candidates = [
+		path.join(dir, "processSandboxEntry.js"),
+		path.join(dir, "processSandboxEntry.ts"),
+		path.join(dir, "executor", "processSandboxEntry.js")
+	];
+	for (const candidate of candidates) if (existsSync(candidate)) return candidate;
+	throw new WebSkillError("TOOL_EXECUTION_FAILED", `Process sandbox entry not found (tried: ${candidates.join(", ")})`);
+}
+/**
+* child_process.fork + --permission 进程沙箱（真实进程隔离）。
+* 每个子进程以 `--permission --allow-fs-read=<入口目录> --allow-fs-read=<skillRoot>
+* --allow-fs-write=<artifactDir>` 启动：fs 维度由权限模型管控（experimental），
+* 子进程/Worker/addons 默认禁；网络无权限维度仍靠 fetch/WebSocket patch。
+* 能力桥协议与 worker_threads 沙箱同一形态（readReference/writeArtifact/confirm + 授权）。
+* 温池（默认 2）：同 skillRoot 复用子进程；执行后 kill 并补位重生；并发上限即池大小。
+* 超时 kill（同步死循环可杀）；非零退出码 → TOOL_EXECUTION_FAILED。
+*/
+var ProcessSandboxExecutor = class {
+	#fs;
+	#options;
+	#capabilities;
+	#networkPolicy;
+	#approval;
+	#slots = [];
+	#waiters = [];
+	constructor(fs, options = {}) {
+		this.#fs = fs;
+		this.#options = options;
+		this.#capabilities = {
+			readReference: options.capabilities?.readReference ?? true,
+			writeArtifact: options.capabilities?.writeArtifact ?? true,
+			confirm: options.capabilities?.confirm ?? true
+		};
+		this.#networkPolicy = options.networkPolicy ?? "deny-all";
+		this.#approval = new CapabilityApproval({
+			...options.uiBridge ? { uiBridge: options.uiBridge } : {},
+			...options.approvalScope ? { scope: options.approvalScope } : {}
+		});
+	}
+	get poolSize() {
+		return this.#options.poolSize ?? 2;
+	}
+	/** 池全部子进程销毁（测试收尾/进程退出前调用） */
+	async dispose() {
+		for (const slot of this.#slots) {
+			slot.child.kill();
+			await rm(slot.artifactDir, {
+				recursive: true,
+				force: true
+			}).catch(() => void 0);
+		}
+		this.#slots = [];
+		this.#waiters = [];
+	}
+	async #locateScript(skillRoot, scriptName) {
+		const tsPath = `${skillRoot}/scripts/${scriptName}.ts`;
+		const jsPath = `${skillRoot}/scripts/${scriptName}.js`;
+		const [hasTs, hasJs] = await Promise.all([this.#fs.exists(tsPath), this.#fs.exists(jsPath)]);
+		if (hasTs && hasJs) throw new WebSkillError("TOOL_EXECUTION_FAILED", `Script "${scriptName}" is ambiguous: both .ts and .js exist under ${skillRoot}/scripts`);
+		if (!hasTs && !hasJs) throw new WebSkillError("TOOL_NOT_FOUND", `Script "${scriptName}" not found under ${skillRoot}/scripts`);
+		return hasTs ? tsPath : jsPath;
+	}
+	/** 取一个可用子进程（同 key 复用 / 淘汰 idle 重生 / 扩容 / 排队） */
+	async #acquire(key) {
+		for (;;) {
+			const idle = this.#slots.filter((s) => !s.busy);
+			const match = idle.find((s) => s.key === key);
+			if (match) {
+				match.busy = true;
+				return match;
+			}
+			if (idle.length > 0) {
+				const victim = idle[0];
+				victim.child.kill();
+				await rm(victim.artifactDir, {
+					recursive: true,
+					force: true
+				}).catch(() => void 0);
+				this.#slots.splice(this.#slots.indexOf(victim), 1);
+			}
+			if (this.#slots.length < this.poolSize) {
+				const slot = await this.#spawnSlot(key);
+				slot.busy = true;
+				this.#slots.push(slot);
+				return slot;
+			}
+			await new Promise((resolve) => this.#waiters.push(resolve));
+		}
+	}
+	/** 执行后回收：kill 旧子进程，补位重生同 key 新子进程（温池保持），唤醒排队 */
+	#recycle(slot) {
+		slot.child.kill();
+		const index = this.#slots.indexOf(slot);
+		if (index >= 0) this.#slots.splice(index, 1);
+		rm(slot.artifactDir, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+		this.#spawnSlot(slot.key).then((fresh) => {
+			this.#slots.push(fresh);
+		}).catch(() => void 0).finally(() => {
+			const waiter = this.#waiters.shift();
+			if (waiter) waiter();
+		});
+	}
+	async #spawnSlot(key) {
+		const artifactDir = await mkdtemp(path.join(tmpdir(), "webskill-psbx-out-")).then((d) => d.split(path.sep).join("/"));
+		const entry = processEntryPath();
+		return {
+			key,
+			child: fork(entry, [], {
+				execArgv: [
+					"--permission",
+					...readAllow(path.dirname(entry)),
+					...readAllow(toPlatform$2(key)),
+					...readAllow(artifactDir),
+					...writeAllow(artifactDir)
+				],
+				silent: false
+			}),
+			busy: false,
+			artifactDir
+		};
+	}
+	async loadDefinition(skillRoot, scriptName) {
+		const scriptPath = await this.#locateScript(skillRoot, scriptName);
+		const skillName = baseName(skillRoot);
+		const slot = await this.#acquire(toPlatform$2(skillRoot));
+		try {
+			const response = await this.#runTask(slot, {
+				mode: "load",
+				scriptPath: toPlatform$2(scriptPath),
+				scriptName,
+				scriptSource: await this.#fs.readText(scriptPath),
+				scratchDir: slot.artifactDir
+			}, 3e4);
+			if (!response.ok) throw new WebSkillError("TOOL_EXECUTION_FAILED", `Failed to load script "${scriptName}": ${response.error?.message ?? "unknown error"}`);
+			return {
+				name: `${skillName}__${scriptName}`,
+				description: response.definition?.description,
+				inputSchema: response.definition?.inputSchema,
+				source: "script",
+				skillName
+			};
+		} finally {
+			this.#recycle(slot);
+		}
+	}
+	async execute(input) {
+		const { skillRoot, scriptName, args, context, timeoutMs } = input;
+		let scriptPath;
+		try {
+			scriptPath = await this.#locateScript(skillRoot, scriptName);
+		} catch (e) {
+			return {
+				ok: false,
+				content: [],
+				error: {
+					code: e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED",
+					message: messageOf$5(e)
+				}
+			};
+		}
+		const slot = await this.#acquire(toPlatform$2(skillRoot));
+		try {
+			const result = await this.#runTask(slot, {
+				mode: "execute",
+				scriptPath: toPlatform$2(scriptPath),
+				scriptName,
+				skillName: context.skillName,
+				runId: context.runId,
+				args,
+				scriptSource: await this.#fs.readText(scriptPath),
+				scratchDir: slot.artifactDir
+			}, timeoutMs, (request) => this.#handleBridge(request, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
+			if (!result.ok) {
+				const stderrSummary = result.stderr?.length ? ` | stderr: ${result.stderr.join(" | ").slice(0, 500)}` : "";
+				return {
+					ok: false,
+					content: [],
+					error: {
+						code: result.error?.code ?? "TOOL_EXECUTION_FAILED",
+						message: `${result.error?.message ?? "script execution failed"}${stderrSummary}`
+					}
+				};
+			}
+			const content = normalizeToolContent(result.value);
+			if (result.stdout?.length) content.push({
+				type: "text",
+				text: result.stdout.join("\n")
+			});
+			return {
+				ok: true,
+				content
+			};
+		} catch (e) {
+			return {
+				ok: false,
+				content: [],
+				error: {
+					code: e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED",
+					message: messageOf$5(e)
+				}
+			};
+		} finally {
+			this.#recycle(slot);
+		}
+	}
+	/** 在子进程上跑一个任务；超时 kill；非零退出码 → TOOL_EXECUTION_FAILED */
+	#runTask(slot, task, timeoutMs, onBridge, onNetworkBlocked) {
+		const { child } = slot;
+		return new Promise((resolve, reject) => {
+			let settled = false;
+			const timer = setTimeout(() => {
+				if (settled) return;
+				settled = true;
+				child.kill();
+				reject(new WebSkillError("RUN_TIMEOUT", `Process sandbox task timed out after ${timeoutMs}ms (child killed)`));
+			}, timeoutMs);
+			const done = (fn) => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(timer);
+				fn();
+			};
+			child.on("message", (msg) => {
+				if (msg?.type === "network-blocked") {
+					if (typeof msg.host === "string") onNetworkBlocked?.(msg.host);
+					return;
+				}
+				if (msg?.type === "bridge" && onBridge) {
+					const request = parseBridgeRequest(msg.request);
+					const respond = (response) => child.send({
+						type: "bridge-response",
+						response
+					});
+					if (!request) {
+						respond(bridgeError("unknown", "TOOL_EXECUTION_FAILED", "invalid bridge request"));
+						return;
+					}
+					onBridge(request).then(respond, (e) => respond(bridgeError(request.id, "TOOL_EXECUTION_FAILED", messageOf$5(e))));
+					return;
+				}
+				if (msg?.type === "load-result" || msg?.type === "execute-result") done(() => resolve(msg));
+			});
+			child.on("error", (e) => done(() => reject(e)));
+			child.on("exit", (code) => {
+				if (!settled) done(() => reject(new WebSkillError("TOOL_EXECUTION_FAILED", `Sandbox child exited ${code === null ? "by signal" : `with code ${code}`} without producing a result`)));
+			});
+			child.send({
+				type: "task",
+				task: {
+					...task,
+					networkPolicy: this.#networkPolicy,
+					networkPolicyLib: NETWORK_POLICY_LIB
+				}
+			});
+		});
+	}
+	/** 能力桥宿主侧处理：与 worker_threads 沙箱同一判定（runtime/sandbox/approval 单一来源） */
 	async #handleBridge(request, context) {
 		const gate = async (capability, message, details) => {
 			const decision = await this.#approval.authorize({
@@ -1500,4 +1822,4 @@ var SkillManager = class {
 };
 
 //#endregion
-export { NodeScriptExecutor as a, SkillManager as c, NodeFS as i, exportArchive as l, FileArtifactStore as n, OxcSchemaInferer as o, FileMemoryStore as r, SandboxedScriptExecutor as s, CliUiBridge as t, readArchiveManifest as u };
+export { NodeScriptExecutor as a, SandboxedScriptExecutor as c, readArchiveManifest as d, NodeFS as i, SkillManager as l, FileArtifactStore as n, OxcSchemaInferer as o, FileMemoryStore as r, ProcessSandboxExecutor as s, CliUiBridge as t, exportArchive as u };

package/dist/{dist-BS5OpedX.js → dist-DrySSQ5R.js}

@@ -2090,6 +2090,10 @@ var WebSkillRuntime = class {
 	get session() {
 		return this.#session;
 	}
+	/** 当前装配的脚本执行器（治理默认执行器断言等只读场景） */
+	get executor() {
+		return this.#deps.executor;
+	}
 	/** 生命周期事件总线（只读观测） */
 	get events() {
 		return this.#events;

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
 import { F as SkillDocument, N as SkillCatalogEntry, c as LlmClient, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { dt as WebSkillRuntime, q as RuntimeRun, tt as SkillStateGuard } from "./index-CySxIvRz.js";
-import { l as SkillManager } from "./index-Vn63HJRO.js";
+import { Q as ScriptExecutor, dt as WebSkillRuntime, ft as WebSkillRuntimeDeps, q as RuntimeRun, tt as SkillStateGuard } from "./index-gjFuBevI.js";
+import { d as SkillManager } from "./index-BmzysJX5.js";
 //#region ../governance/dist/index.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';
@@ -357,6 +357,16 @@ declare class EvaluationRunner {
   run(tasks: EvaluationTask[]): Promise<EvaluationReport>;
 }
 //#endregion
+//#region src/evaluation/evaluationRuntime.d.ts
+/**
+ * 治理评估专用 runtime 装配（不可信技能试用路径）：
+ * 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离）；
+ * 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态）。
+ */
+declare function createEvaluationRuntime(deps: WebSkillRuntimeDeps & {
+  executor?: ScriptExecutor;
+}): WebSkillRuntime;
+//#endregion
 //#region src/evaluation/testSuggestion.d.ts
 /** 失败 trace → 回归评估任务建议（prompt 复现 + expected 错误模式） */
 declare function suggestFromFailedRun(run: RuntimeRun): EvaluationTask;
@@ -474,4 +484,4 @@ declare function createMissHook(deps: {
  */
 declare function completeText(llm: LlmClient, messages: LlmMessage[]): Promise<string>;
 //#endregion
-export { AlwaysHumanApprovalPolicy, type ApprovalDecision, type ApprovalPolicy, ApprovalWorkflow, type AuditEvent, type AuditLog, type CandidateFile, type CandidateRisk, type CandidateSkill, type CandidateSource, type CandidateStatus, CandidateStore, CompositeApprovalPolicy, DependencyGraph, DocumentSkillExtractor, type EvaluationReport, type EvaluationResult, EvaluationRunner, type EvaluationTask, FailureAnalyzer, type FailureDiagnosis, FsAuditLog, LlmCandidateGenerator, type RepairOption, RepairPlanner, SCORING_WEIGHTS, type ScoreInput, SimilarityDetector, SkillScorer, type SkillState, SkillStatePolicy, type SkillVersion, SkillVersionStore, type SourceDocument, candidateToCatalogEntry, completeText, createMissHook, jaccardSimilarity, normalizeCandidate, normalizeCandidateFiles, normalizeRisk, parseJsonObject, readDocument, sanitizeCandidateName, suggestFromFailedRun, validateCandidate };
+export { AlwaysHumanApprovalPolicy, type ApprovalDecision, type ApprovalPolicy, ApprovalWorkflow, type AuditEvent, type AuditLog, type CandidateFile, type CandidateRisk, type CandidateSkill, type CandidateSource, type CandidateStatus, CandidateStore, CompositeApprovalPolicy, DependencyGraph, DocumentSkillExtractor, type EvaluationReport, type EvaluationResult, EvaluationRunner, type EvaluationTask, FailureAnalyzer, type FailureDiagnosis, FsAuditLog, LlmCandidateGenerator, type RepairOption, RepairPlanner, SCORING_WEIGHTS, type ScoreInput, SimilarityDetector, SkillScorer, type SkillState, SkillStatePolicy, type SkillVersion, SkillVersionStore, type SourceDocument, candidateToCatalogEntry, completeText, createEvaluationRuntime, createMissHook, jaccardSimilarity, normalizeCandidate, normalizeCandidateFiles, normalizeRisk, parseJsonObject, readDocument, sanitizeCandidateName, suggestFromFailedRun, validateCandidate };

package/dist/governance.js

@@ -1,5 +1,6 @@
 import { A as unzipWithLimits, b as isValidSkillName, d as assertSafePathSegment, j as validateSkills, k as resolveInsideRoot, u as WebSkillError } from "./dist-D0saNPi_.js";
-import { i as NodeFS, l as exportArchive } from "./dist-Dj6QjHBn.js";
+import { S as WebSkillRuntime } from "./dist-DrySSQ5R.js";
+import { i as NodeFS, s as ProcessSandboxExecutor, u as exportArchive } from "./dist-BRGQcLqR.js";
 import path from "node:path";
 import { tmpdir } from "node:os";
 import { mkdtemp } from "node:fs/promises";
@@ -840,6 +841,17 @@ var EvaluationRunner = class {
 		};
 	}
 };
+/**
+* 治理评估专用 runtime 装配（不可信技能试用路径）：
+* 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离）；
+* 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态）。
+*/
+function createEvaluationRuntime(deps) {
+	return new WebSkillRuntime({
+		...deps,
+		executor: deps.executor ?? new ProcessSandboxExecutor(deps.fs)
+	});
+}
 /** 失败 trace → 回归评估任务建议（prompt 复现 + expected 错误模式） */
 function suggestFromFailedRun(run) {
 	const errorPatterns = run.trace.filter((e) => e.type === "tool.failed" || e.type === "run.failed").map((e) => String(e.data?.["code"] ?? e.message ?? "")).filter(Boolean);
@@ -1025,4 +1037,4 @@ function createMissHook(deps) {
 }
 
 //#endregion
-export { AlwaysHumanApprovalPolicy, ApprovalWorkflow, CandidateStore, CompositeApprovalPolicy, DependencyGraph, DocumentSkillExtractor, EvaluationRunner, FailureAnalyzer, FsAuditLog, LlmCandidateGenerator, RepairPlanner, SCORING_WEIGHTS, SimilarityDetector, SkillScorer, SkillStatePolicy, SkillVersionStore, candidateToCatalogEntry, completeText, createMissHook, jaccardSimilarity, normalizeCandidate, normalizeCandidateFiles, normalizeRisk, parseJsonObject, readDocument, sanitizeCandidateName, suggestFromFailedRun, validateCandidate };
+export { AlwaysHumanApprovalPolicy, ApprovalWorkflow, CandidateStore, CompositeApprovalPolicy, DependencyGraph, DocumentSkillExtractor, EvaluationRunner, FailureAnalyzer, FsAuditLog, LlmCandidateGenerator, RepairPlanner, SCORING_WEIGHTS, SimilarityDetector, SkillScorer, SkillStatePolicy, SkillVersionStore, candidateToCatalogEntry, completeText, createEvaluationRuntime, createMissHook, jaccardSimilarity, normalizeCandidate, normalizeCandidateFiles, normalizeRisk, parseJsonObject, readDocument, sanitizeCandidateName, suggestFromFailedRun, validateCandidate };

package/dist/{index-Vn63HJRO.d.ts → index-BmzysJX5.d.ts}

@@ -1,5 +1,5 @@
 import { C as FileStat, I as SkillInstallSource, K as VerifyResult, T as JsonSchema, W as SkillsLockfile, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { N as NetworkPolicy, Q as ScriptExecutor, X as SchemaInferer, Z as ScriptExecutionContext, b as FsArtifactStore, d as BridgeCapabilities, it as ToolResult, nt as ToolDefinition, u as ApprovalScope, x as FsMemoryStore } from "./index-CySxIvRz.js";
+import { N as NetworkPolicy, Q as ScriptExecutor, X as SchemaInferer, Z as ScriptExecutionContext, b as FsArtifactStore, d as BridgeCapabilities, it as ToolResult, nt as ToolDefinition, u as ApprovalScope, x as FsMemoryStore } from "./index-gjFuBevI.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts
 //#region src/fs/nodeFs.d.ts
@@ -88,6 +88,43 @@ declare class SandboxedScriptExecutor implements ScriptExecutor {
   }): Promise<ToolResult>;
 }
 //#endregion
+//#region src/executor/processSandboxExecutor.d.ts
+interface ProcessSandboxOptions {
+  /** 温池大小（并发上限；执行后 kill 并补位重生），默认 2 */
+  poolSize?: number;
+  capabilities?: BridgeCapabilities;
+  /** 网络策略：默认 'deny-all'（权限模型无网络维度，补丁兜底；node:net 裸模块为已知残余面） */
+  networkPolicy?: NetworkPolicy;
+  /** require-approval 模式的授权询问出口 */
+  uiBridge?: UiBridge;
+  /** 授权粒度：默认 'once-per-run' */
+  approvalScope?: ApprovalScope;
+}
+/**
+ * child_process.fork + --permission 进程沙箱（真实进程隔离）。
+ * 每个子进程以 `--permission --allow-fs-read=<入口目录> --allow-fs-read=<skillRoot>
+ * --allow-fs-write=<artifactDir>` 启动：fs 维度由权限模型管控（experimental），
+ * 子进程/Worker/addons 默认禁；网络无权限维度仍靠 fetch/WebSocket patch。
+ * 能力桥协议与 worker_threads 沙箱同一形态（readReference/writeArtifact/confirm + 授权）。
+ * 温池（默认 2）：同 skillRoot 复用子进程；执行后 kill 并补位重生；并发上限即池大小。
+ * 超时 kill（同步死循环可杀）；非零退出码 → TOOL_EXECUTION_FAILED。
+ */
+declare class ProcessSandboxExecutor implements ScriptExecutor {
+  #private;
+  constructor(fs: FileSystemProvider, options?: ProcessSandboxOptions);
+  get poolSize(): number;
+  /** 池全部子进程销毁（测试收尾/进程退出前调用） */
+  dispose(): Promise<void>;
+  loadDefinition(skillRoot: string, scriptName: string): Promise<ToolDefinition>;
+  execute(input: {
+    skillRoot: string;
+    scriptName: string;
+    args: Record<string, unknown>;
+    context: ScriptExecutionContext;
+    timeoutMs: number;
+  }): Promise<ToolResult>;
+}
+//#endregion
 //#region src/schema/oxcSchemaInferer.d.ts
 /**
  * D2 Schema 推导（OXC 静态文本分析，宿主侧执行，不进沙箱）。
@@ -191,4 +228,4 @@ declare function exportArchive(fs: FileSystemProvider, skillRoot: string, option
 /** 只解出归档中的 webskill.skill-manifest.json 条目（安装前预览） */
 declare function readArchiveManifest(fs: FileSystemProvider, archivePath: string): Promise<SkillManifest>;
 //#endregion
-export { NodeScriptExecutor as a, SandboxedScriptExecutor as c, readArchiveManifest as d, NodeFS as i, SkillManager as l, FileArtifactStore as n, OxcSchemaInferer as o, FileMemoryStore as r, SandboxOptions as s, CliUiBridge as t, exportArchive as u };
+export { NodeScriptExecutor as a, ProcessSandboxOptions as c, SkillManager as d, exportArchive as f, NodeFS as i, SandboxOptions as l, FileArtifactStore as n, OxcSchemaInferer as o, readArchiveManifest as p, FileMemoryStore as r, ProcessSandboxExecutor as s, CliUiBridge as t, SandboxedScriptExecutor as u };

package/dist/{index-CySxIvRz.d.ts → index-gjFuBevI.d.ts}

@@ -778,6 +778,8 @@ declare class WebSkillRuntime {
   #private;
   constructor(deps: WebSkillRuntimeDeps);
   get session(): RuntimeSession;
+  /** 当前装配的脚本执行器（治理默认执行器断言等只读场景） */
+  get executor(): ScriptExecutor | undefined;
   /** 生命周期事件总线（只读观测） */
   get events(): EventBus;
   /**

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 import { $ as checkDependencyCycles, A as SKILL_NAME_PATTERN, B as SkillMetadata, C as FileStat, D as SKILLS_LOCKFILE, E as MemoryFS, F as SkillDocument, G as ValidationReport, H as SkillReader, I as SkillInstallSource, J as WebSkillErrorCode, K as VerifyResult, L as SkillIssue, M as SkillCatalog, N as SkillCatalogEntry, O as SKILL_MANIFEST_FILE, P as SkillDiscovery, Q as buildManifest, R as SkillLocation, S as DiscoveryResult, T as JsonSchema, U as SkillSource, V as SkillPackManifest, W as SkillsLockfile, X as atomicWriteText, Y as assertSafePathSegment, Z as buildCatalog, _ as RenderResultRequest, _t as xmlRenderer, a as InteractionPolicy, at as jsonRenderer, b as CatalogRenderer, c as LlmClient, ct as parseSkillPackManifest, d as LlmResponse, dt as renderCatalogJson, et as checkSkillRules, f as LlmStreamEvent, ft as resolveArchiveLimits, g as RenderBlock, gt as verifyManifest, h as MemoryStore, ht as validateSkills, i as FormField, it as isValidSkillName, j as SKILL_PACK_FILE, k as SKILL_NAME_MAX_LENGTH, l as LlmCompleteInput, lt as readResponseWithLimit, m as LlmToolSpec, mt as unzipWithLimits, n as ArtifactStore, nt as escapeXml, o as InteractionRequest, ot as normalizePath, p as LlmToolCall, pt as resolveInsideRoot, q as WebSkillError, r as ChartSpec, rt as exportSkills, s as InteractionResponse, st as parseSkillMarkdown, t as Artifact, tt as computeDigest, u as LlmMessage, ut as renderAvailableSkillsXml, v as UiBridge, w as FileSystemProvider, x as DEFAULT_ARCHIVE_LIMITS, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { $ as SerializingMemoryStore, A as LifecycleHook, B as RUN_SNAPSHOT_SCHEMA_VERSION, C as FullDisclosureRouter, Ct as normalizeToolContent, D as HookRunnerOptions, Dt as toLlmToolSpec, E as HookRunner, Et as schemaToForm, F as OpenAiCompatibleClientConfig, G as RunTerminationReason, H as RunResult, I as ProgressiveRouter, J as RuntimeSession, K as RuntimePhase, L as READ_SKILL_FILE_INPUT_SCHEMA, M as LifecycleListener, N as NetworkPolicy, O as InstalledSkillManifest, Ot as toVercelToolSpecs, P as OpenAiCompatibleClient, Q as ScriptExecutor, R as READ_SKILL_FILE_TOOL, S as FsRunSnapshotStore, St as networkUrlHost, T as GoogleGenAiClientConfig, Tt as resolveToolName, U as RunSnapshot, V as RouteResult, W as RunSnapshotStore, X as SchemaInferer, Y as RuntimeSessionHandle, Z as ScriptExecutionContext, _ as EventBus, _t as extractChartSpec, a as AgentLoopConfig, at as TraceClock, b as FsArtifactStore, bt as isNetworkAllowed, c as AnthropicClientConfig, ct as TraceRecorder, d as BridgeCapabilities, dt as WebSkillRuntime, et as SkillRouter, f as BridgeCapability, ft as WebSkillRuntimeDeps, g as CapabilityMode, gt as createWebSkillApi, h as CapabilityApproval, ht as createScriptContext, i as AgentLoop, it as ToolResult, j as LifecycleHookContext, k as LifecycleEvent, l as ApprovalDecision, lt as VercelToolSpec, m as BridgeResponse, mt as buildRenderResult, n as ASK_USER_TOOL, nt as ToolDefinition, o as AgentLoopDeps, ot as TraceEvent, p as BridgeRequest, pt as bridgeError, q as RuntimeRun, r as ASK_USER_TOOL_NAME, rt as ToolResolution, s as AnthropicClient, st as TraceEventType, t as ASK_USER_INPUT_SCHEMA, tt as SkillStateGuard, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, vt as fromVercelResult, w as GoogleGenAiClient, wt as parseBridgeRequest, x as FsMemoryStore, xt as mergeCatalogEntries, y as ExternalToolSource, yt as fromVercelStreamPart, z as READ_SKILL_FILE_TOOL_NAME } from "./index-CySxIvRz.js";
+import { $ as SerializingMemoryStore, A as LifecycleHook, B as RUN_SNAPSHOT_SCHEMA_VERSION, C as FullDisclosureRouter, Ct as normalizeToolContent, D as HookRunnerOptions, Dt as toLlmToolSpec, E as HookRunner, Et as schemaToForm, F as OpenAiCompatibleClientConfig, G as RunTerminationReason, H as RunResult, I as ProgressiveRouter, J as RuntimeSession, K as RuntimePhase, L as READ_SKILL_FILE_INPUT_SCHEMA, M as LifecycleListener, N as NetworkPolicy, O as InstalledSkillManifest, Ot as toVercelToolSpecs, P as OpenAiCompatibleClient, Q as ScriptExecutor, R as READ_SKILL_FILE_TOOL, S as FsRunSnapshotStore, St as networkUrlHost, T as GoogleGenAiClientConfig, Tt as resolveToolName, U as RunSnapshot, V as RouteResult, W as RunSnapshotStore, X as SchemaInferer, Y as RuntimeSessionHandle, Z as ScriptExecutionContext, _ as EventBus, _t as extractChartSpec, a as AgentLoopConfig, at as TraceClock, b as FsArtifactStore, bt as isNetworkAllowed, c as AnthropicClientConfig, ct as TraceRecorder, d as BridgeCapabilities, dt as WebSkillRuntime, et as SkillRouter, f as BridgeCapability, ft as WebSkillRuntimeDeps, g as CapabilityMode, gt as createWebSkillApi, h as CapabilityApproval, ht as createScriptContext, i as AgentLoop, it as ToolResult, j as LifecycleHookContext, k as LifecycleEvent, l as ApprovalDecision, lt as VercelToolSpec, m as BridgeResponse, mt as buildRenderResult, n as ASK_USER_TOOL, nt as ToolDefinition, o as AgentLoopDeps, ot as TraceEvent, p as BridgeRequest, pt as bridgeError, q as RuntimeRun, r as ASK_USER_TOOL_NAME, rt as ToolResolution, s as AnthropicClient, st as TraceEventType, t as ASK_USER_INPUT_SCHEMA, tt as SkillStateGuard, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, vt as fromVercelResult, w as GoogleGenAiClient, wt as parseBridgeRequest, x as FsMemoryStore, xt as mergeCatalogEntries, y as ExternalToolSource, yt as fromVercelStreamPart, z as READ_SKILL_FILE_TOOL_NAME } from "./index-gjFuBevI.js";
 export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type ArchiveLimits, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, DEFAULT_ARCHIVE_LIMITS, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, type RuntimeSessionHandle, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, SerializingMemoryStore, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, type SkillPackManifest, SkillReader, type SkillRouter, type SkillSource, type SkillStateGuard, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };

package/dist/index.js

@@ -1,4 +1,4 @@
 import { A as unzipWithLimits, C as parseSkillMarkdown, D as renderCatalogJson, E as renderAvailableSkillsXml, M as verifyManifest, N as xmlRenderer, O as resolveArchiveLimits, S as normalizePath, T as readResponseWithLimit, _ as computeDigest, a as SKILL_NAME_MAX_LENGTH, b as isValidSkillName, c as SkillDiscovery, d as assertSafePathSegment, f as atomicWriteText, g as checkSkillRules, h as checkDependencyCycles, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, l as SkillReader, m as buildManifest, n as MemoryFS, o as SKILL_NAME_PATTERN, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, t as DEFAULT_ARCHIVE_LIMITS, u as WebSkillError, v as escapeXml, w as parseSkillPackManifest, x as jsonRenderer, y as exportSkills } from "./dist-D0saNPi_.js";
-import { A as isNetworkAllowed, C as bridgeError, D as extractChartSpec, E as createWebSkillApi, F as resolveToolName, I as schemaToForm, L as toLlmToolSpec, M as networkUrlHost, N as normalizeToolContent, O as fromVercelResult, P as parseBridgeRequest, R as toVercelToolSpecs, S as WebSkillRuntime, T as createScriptContext, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as SerializingMemoryStore, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, k as fromVercelStreamPart, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as buildRenderResult, x as TraceRecorder, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-BS5OpedX.js";
+import { A as isNetworkAllowed, C as bridgeError, D as extractChartSpec, E as createWebSkillApi, F as resolveToolName, I as schemaToForm, L as toLlmToolSpec, M as networkUrlHost, N as normalizeToolContent, O as fromVercelResult, P as parseBridgeRequest, R as toVercelToolSpecs, S as WebSkillRuntime, T as createScriptContext, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as SerializingMemoryStore, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, k as fromVercelStreamPart, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as buildRenderResult, x as TraceRecorder, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-DrySSQ5R.js";
 
 export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, AnthropicClient, CapabilityApproval, DEFAULT_ARCHIVE_LIMITS, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SerializingMemoryStore, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
 import { F as SkillDocument, N as SkillCatalogEntry, T as JsonSchema, m as LlmToolSpec } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { it as ToolResult, v as ExternalSkillProvider, xt as mergeCatalogEntries, y as ExternalToolSource } from "./index-CySxIvRz.js";
+import { it as ToolResult, v as ExternalSkillProvider, xt as mergeCatalogEntries, y as ExternalToolSource } from "./index-gjFuBevI.js";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/dist/mcp.js

@@ -1,5 +1,5 @@
 import { u as WebSkillError } from "./dist-D0saNPi_.js";
-import { N as normalizeToolContent, j as mergeCatalogEntries } from "./dist-BS5OpedX.js";
+import { N as normalizeToolContent, j as mergeCatalogEntries } from "./dist-DrySSQ5R.js";
 
 //#region ../mcp/dist/index.js
 /**

package/dist/node.d.ts

@@ -1,5 +1,5 @@
 import { D as SKILLS_LOCKFILE, I as SkillInstallSource, K as VerifyResult, O as SKILL_MANIFEST_FILE, W as SkillsLockfile, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { ht as createScriptContext } from "./index-CySxIvRz.js";
+import { ht as createScriptContext } from "./index-gjFuBevI.js";
 import { n as LlmEnvConfig, s as probeLlmCapabilities, t as LlmCapabilities } from "./env-BPUBZCwJ-4jat_SVG.js";
-import { a as NodeScriptExecutor, c as SandboxedScriptExecutor, d as readArchiveManifest, i as NodeFS, l as SkillManager, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as SandboxOptions, t as CliUiBridge, u as exportArchive } from "./index-Vn63HJRO.js";
-export { CliUiBridge, FileArtifactStore, FileMemoryStore, type LlmCapabilities, type LlmEnvConfig, NodeFS, NodeScriptExecutor, OxcSchemaInferer, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, type SandboxOptions, SandboxedScriptExecutor, type SkillInstallSource, SkillManager, type SkillManifest, type SkillsLockfile, type VerifyResult, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };
+import { a as NodeScriptExecutor, c as ProcessSandboxOptions, d as SkillManager, f as exportArchive, i as NodeFS, l as SandboxOptions, n as FileArtifactStore, o as OxcSchemaInferer, p as readArchiveManifest, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as SandboxedScriptExecutor } from "./index-BmzysJX5.js";
+export { CliUiBridge, FileArtifactStore, FileMemoryStore, type LlmCapabilities, type LlmEnvConfig, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, type ProcessSandboxOptions, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, type SandboxOptions, SandboxedScriptExecutor, type SkillInstallSource, SkillManager, type SkillManifest, type SkillsLockfile, type VerifyResult, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };

package/dist/node.js

@@ -1,6 +1,6 @@
 import { i as SKILL_MANIFEST_FILE, r as SKILLS_LOCKFILE } from "./dist-D0saNPi_.js";
-import { T as createScriptContext } from "./dist-BS5OpedX.js";
+import { T as createScriptContext } from "./dist-DrySSQ5R.js";
 import { i as probeLlmCapabilities } from "./env--jJB-TSX-04klhTYi.js";
-import { a as NodeScriptExecutor, c as SkillManager, i as NodeFS, l as exportArchive, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as SandboxedScriptExecutor, t as CliUiBridge, u as readArchiveManifest } from "./dist-Dj6QjHBn.js";
+import { a as NodeScriptExecutor, c as SandboxedScriptExecutor, d as readArchiveManifest, i as NodeFS, l as SkillManager, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as exportArchive } from "./dist-BRGQcLqR.js";
 
-export { CliUiBridge, FileArtifactStore, FileMemoryStore, NodeFS, NodeScriptExecutor, OxcSchemaInferer, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SandboxedScriptExecutor, SkillManager, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };
+export { CliUiBridge, FileArtifactStore, FileMemoryStore, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SandboxedScriptExecutor, SkillManager, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };

package/dist/processSandboxEntry.d.ts

@@ -0,0 +1 @@
+export {}

package/dist/processSandboxEntry.js

@@ -0,0 +1,202 @@
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { pathToFileURL } from "node:url";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+
+//#region ../node/dist/executor/processSandboxEntry.js
+/**
+* ProcessSandbox 子进程入口（child_process.fork + --permission）。
+* 与 worker_threads 入口同构：任务经 workerData 等价的 argv[2] JSON 传入（fork 无 workerData，
+* 经环境变量 PROCESS_SANDBOX_TASK 传 JSON）；能力桥 RPC 经 process IPC。
+*
+* 权限模型（--permission，experimental）负责 fs 维度：读仅限 skillRoot（+入口目录），
+* 写仅限 artifactDir；子进程/Worker/addons 默认禁（module.register 在其下不可用——
+* 内部钩子线程同属 WorkerThreads，实证后已移除裸模块钩子）。网络无权限维度：
+* 仍靠 globalThis.fetch/WebSocket patch（函数源码经任务 JSON 注入，单一来源在
+* runtime/sandbox/networkPolicy.ts）；node:net 裸模块为已知残余面（文档明示）。
+* .js 走 data: URL 导入（permission 下实证可用）；.ts 走中性临时目录 file URL。
+*/
+const send = (message) => {
+	process.send?.(message);
+};
+const pending = /* @__PURE__ */ new Map();
+let bridgeSeq = 0;
+function callCapability(kind, payload) {
+	const request = {
+		kind,
+		id: `br-${++bridgeSeq}`,
+		...payload
+	};
+	return new Promise((resolve, reject) => {
+		pending.set(request.id, {
+			resolve,
+			reject
+		});
+		send({
+			type: "bridge",
+			request
+		});
+	}).then((response) => {
+		const r = response;
+		if (!r.ok) {
+			const err = new Error(r.error?.message ?? "capability call failed");
+			err.code = r.error?.code ?? "TOOL_EXECUTION_FAILED";
+			throw err;
+		}
+		return r.value;
+	});
+}
+function blockedError(host) {
+	const err = /* @__PURE__ */ new Error(`Network request blocked by sandbox network policy: ${host}`);
+	err.code = "NETWORK_BLOCKED";
+	return err;
+}
+function setupNetworkGuards(task) {
+	const policy = task.networkPolicy ?? "deny-all";
+	if (!task.networkPolicyLib) return;
+	const { isNetworkAllowed, networkUrlHost } = new Function(`${task.networkPolicyLib}\nreturn { isNetworkAllowed: isNetworkAllowed, networkUrlHost: networkUrlHost };`)();
+	const gate = (rawUrl) => {
+		const url = String(rawUrl);
+		if (isNetworkAllowed(policy, url)) return null;
+		const host = networkUrlHost(url);
+		send({
+			type: "network-blocked",
+			host
+		});
+		return blockedError(host);
+	};
+	const originalFetch = globalThis["fetch"];
+	if (typeof originalFetch === "function") globalThis["fetch"] = (input, init) => {
+		const raw = typeof input === "string" ? input : input instanceof URL ? input.href : input?.url ?? String(input);
+		const blocked = gate(raw);
+		if (blocked) return Promise.reject(blocked);
+		return originalFetch(input, init);
+	};
+	const OriginalWebSocket = globalThis["WebSocket"];
+	if (typeof OriginalWebSocket === "function") globalThis["WebSocket"] = class extends OriginalWebSocket {
+		constructor(url, protocols) {
+			const blocked = gate(String(url));
+			if (blocked) throw blocked;
+			super(url, protocols);
+		}
+	};
+}
+let task_scratchDir;
+async function loadModule(scriptPath, scriptSource) {
+	if (scriptPath.endsWith(".js") && scriptSource !== void 0) return await import(`data:text/javascript;charset=utf-8,${encodeURIComponent(`${scriptSource}\n//# ${Date.now()}`)}`);
+	if (scriptPath.endsWith(".ts") && scriptSource !== void 0) {
+		const base = task_scratchDir ?? await mkdtemp(path.join(tmpdir(), "webskill-psbx-ts-"));
+		const dir = await mkdtemp(path.join(base, "ts-"));
+		try {
+			const file = path.join(dir, "script.ts");
+			await writeFile(file, scriptSource);
+			return await import(`${pathToFileURL(file).href}?t=${Date.now()}`);
+		} finally {
+			await rm(dir, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	return await import(`${pathToFileURL(scriptPath).href}?t=${Date.now()}`);
+}
+async function main(task) {
+	task_scratchDir = task.scratchDir;
+	setupNetworkGuards(task);
+	process.on("message", (msg) => {
+		if (msg?.type === "bridge-response" && msg.response?.id) {
+			const entry = pending.get(msg.response.id);
+			if (entry) {
+				pending.delete(msg.response.id);
+				entry.resolve(msg.response);
+			}
+		}
+	});
+	if (task.mode === "load") {
+		try {
+			const mod = await loadModule(task.scriptPath, task.scriptSource);
+			send({
+				type: "load-result",
+				ok: true,
+				definition: {
+					description: typeof mod["description"] === "string" ? mod["description"] : void 0,
+					inputSchema: mod["inputSchema"] !== void 0 ? mod["inputSchema"] : void 0,
+					hasRun: typeof mod["run"] === "function"
+				}
+			});
+		} catch (e) {
+			const err = e;
+			send({
+				type: "load-result",
+				ok: false,
+				error: {
+					code: err?.code ?? "TOOL_EXECUTION_FAILED",
+					message: String(err?.message ?? e)
+				}
+			});
+		}
+		return;
+	}
+	const stdout = [];
+	const stderr = [];
+	const originals = {
+		log: console.log,
+		info: console.info,
+		debug: console.debug,
+		warn: console.warn,
+		error: console.error
+	};
+	console.log = console.info = console.debug = (...args) => stdout.push(args.map(String).join(" "));
+	console.warn = console.error = (...args) => stderr.push(args.map(String).join(" "));
+	try {
+		const mod = await loadModule(task.scriptPath, task.scriptSource);
+		if (typeof mod["run"] !== "function") throw new Error("Script does not export a run function");
+		const context = {
+			skillName: task.skillName ?? "",
+			runId: task.runId ?? "",
+			readReference: (path) => callCapability("readReference", { path }),
+			writeArtifact: (path, content, options) => callCapability("writeArtifact", {
+				path,
+				content: typeof content === "string" ? content : Array.from(content ?? []),
+				mimeType: options?.mimeType
+			}),
+			confirm: (message) => callCapability("confirm", { message })
+		};
+		const runFn = mod["run"];
+		const value = await runFn(task.args ?? {}, context);
+		send({
+			type: "execute-result",
+			ok: true,
+			value: value === void 0 ? null : value,
+			stdout,
+			stderr
+		});
+	} catch (e) {
+		const err = e;
+		send({
+			type: "execute-result",
+			ok: false,
+			error: {
+				code: err?.code ?? "TOOL_EXECUTION_FAILED",
+				message: String(err?.message ?? e)
+			},
+			stdout,
+			stderr
+		});
+	} finally {
+		console.log = originals.log;
+		console.info = originals.info;
+		console.debug = originals.debug;
+		console.warn = originals.warn;
+		console.error = originals.error;
+	}
+}
+process.on("message", (msg) => {
+	if (msg?.type === "task" && msg.task) main(msg.task).then(() => process.exit(0), (e) => {
+		console.error(e);
+		process.exit(1);
+	});
+});
+
+//#endregion
+export {  };

package/dist/ui.d.ts

@@ -1,5 +1,5 @@
 import { _ as RenderResultRequest, g as RenderBlock, o as InteractionRequest, r as ChartSpec, s as InteractionResponse, v as UiBridge } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { mt as buildRenderResult } from "./index-CySxIvRz.js";
+import { mt as buildRenderResult } from "./index-gjFuBevI.js";
 //#region ../ui/dist/index.d.ts
 //#region src/model/formModel.d.ts
 interface FormModel {

package/dist/ui.js

@@ -1,4 +1,4 @@
-import { w as buildRenderResult } from "./dist-BS5OpedX.js";
+import { w as buildRenderResult } from "./dist-DrySSQ5R.js";
 import { C as renderRenderResult, D as toVercelToolInvocation, E as toOpenUiLang, S as renderMiniMarkdown, T as toA2uiMessages, _ as fromOpenUiAction, a as CHART_PALETTE, b as renderBlocks, c as OPENUI_SUBMIT_ACTION, d as WEBSKILL_STYLES_CSS, f as WebFormBridge, g as fromA2uiAction, h as ensureStyles, i as A2UI_VERSION, l as VERCEL_INTERACTION_TOOL_NAME, m as collectValues, n as A2UI_CANCEL_ACTION, o as LitRendererBridge, p as chartToTable, r as A2UI_SUBMIT_ACTION, s as OPENUI_CANCEL_ACTION, t as A2UI_BASIC_CATALOG_ID, u as VercelUiBridge, v as fromVercelToolResult, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-BJobG0i-.js";
 
 export { A2UI_BASIC_CATALOG_ID, A2UI_CANCEL_ACTION, A2UI_SUBMIT_ACTION, A2UI_VERSION, CHART_PALETTE, LitRendererBridge, OPENUI_CANCEL_ACTION, OPENUI_SUBMIT_ACTION, VERCEL_INTERACTION_TOOL_NAME, VercelUiBridge, WEBSKILL_STYLES_CSS, WebFormBridge, buildRenderResult, chartToTable, collectValues, ensureStyles, fromA2uiAction, fromOpenUiAction, fromVercelToolResult, interactionToFormModel, renderBlocks, renderMiniChart, renderMiniMarkdown, renderRenderResult, shapeInteractionValue, toA2uiMessages, toOpenUiLang, toVercelToolInvocation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webskill/sdk",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "WebSkill \u2014 browser/Node agent skill runtime (skills, tools, MCP, governance, UI)",
   "license": "MIT",
   "type": "module",