@webskill/sdk 0.2.2 → 0.2.3

package/README.md

@@ -16,6 +16,7 @@ governance.
   (missing-parameter forms, confirmations, authorization prompts), and
   resumable interrupted runs.
 - **Script sandbox** — two tiers. Isolation-grade: Node `ProcessSandboxExecutor`
+  (fork + `--permission`, real process isolation).
   (`child_process.fork` + `--permission`, experimental; fs scoped to the skill
   root, workers/child processes/addons denied by default — note the permission
   model has NO network dimension, so `fetch`/`WebSocket` stay patch-enforced and
@@ -25,6 +26,9 @@ governance.
   tier (NOT a security boundary): `SandboxedScriptExecutor` /
   `BrowserWorkerScriptExecutor` in blob-Worker mode, with deny-by-default
   network policy, builtin-module allowlist, forced approval, timeouts.
+  Known proactive escape hatches (`process.binding`, `dlopen`, `abort`, …) are
+  stripped in the worker entry (0.2.3); other host-shared surfaces are NOT
+  defended — use `ProcessSandboxExecutor` for untrusted skills.
 - **`navigator.webskill`** — a browser facade (`discover` / `read` / `validate` /
   `run` / `install` / `uninstall`) assembled explicitly in one call.
 - **MCP** — call page-provided tools and consume page-declared dynamic skills

package/dist/browser.d.ts

@@ -164,14 +164,16 @@ declare class BrowserWorkerScriptExecutor implements ScriptExecutor {
 //#region src/executor/iframeSandbox.d.ts
 /**
  * opaque origin 沙箱 iframe（sandbox="allow-scripts" srcdoc）：
- * iframe 内建 module Worker（Blob URL），iframe window 作 postMessage 中继。
- * opaque origin：沙箱内摸不到页面 DOM/localStorage/OPFS（独立 storage 分区）。
- * 就绪握手：iframe 加载完成发 sandbox-ready 后才放行出站消息（防丢失）。
+ * iframe 内建 classic Worker（Blob URL；module Worker 在 opaque origin 不可加载，实证），
+ * iframe window 作 postMessage 中继。opaque origin：沙箱内摸不到页面 DOM/localStorage/OPFS。
+ * 通道鉴别（P0-C）：每实例 channelId 随消息携带，宿主校验 event.source 与 channelId，
+ * 同页伪造消息一律丢弃；terminate 摘除监听器。
  */
 declare class IframeWorkerLike implements WorkerLike {
   #private;
-  constructor(iframe: HTMLIFrameElement);
+  constructor(iframe: HTMLIFrameElement, hostWindow: Window, channelId: string);
   get ready(): boolean;
+  get channelId(): string;
   markReady(): void;
   postMessage(data: unknown): void;
   addEventListener(_type: 'message', listener: (event: {
@@ -181,7 +183,7 @@ declare class IframeWorkerLike implements WorkerLike {
   terminate(): void;
 }
 /**
- * 创建 opaque iframe 沙箱 Worker：sandbox="allow-scripts" srcdoc iframe 承载 module Worker。
+ * 创建 opaque iframe 沙箱 Worker：sandbox="allow-scripts" srcdoc iframe 承载 classic Worker。
  * 返回 IframeWorkerLike（协议与 blob Worker 完全一致：load/execute/bridge/network-blocked）。
  */
 declare function createIframeWorker(bootstrapSource: string, doc?: Document): IframeWorkerLike;

package/dist/browser.js

@@ -1,5 +1,5 @@
 import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, T as readResponseWithLimit, b as isValidSkillName, c as SkillDiscovery, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D0saNPi_.js";
-import { A as isNetworkAllowed, C as bridgeError, E as createWebSkillApi, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, l as FsMemoryStore, m as OpenAiCompatibleClient, o as CapabilityApproval, u as FsRunSnapshotStore, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-DrySSQ5R.js";
+import { A as isNetworkAllowed, C as bridgeError, E as createWebSkillApi, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, l as FsMemoryStore, m as OpenAiCompatibleClient, o as CapabilityApproval, u as FsRunSnapshotStore, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-NM4Mylx4.js";
 import { n as MockLlmClient } from "./testing-B4pq6JYa.js";
 
 //#region ../browser/dist/index.js
@@ -714,22 +714,38 @@ var BrowserSkillManager = class {
 	}
 };
 const ENVELOPE = "__webskill_sandbox__";
+let channelSeq = 0;
+/** 每实例 channelId（防同页伪造消息注入；crypto.randomUUID 优先，无则随机回退） */
+function nextChannelId() {
+	return globalThis.crypto?.randomUUID?.() ?? `ch-${Date.now()}-${Math.random().toString(36).slice(2, 10)}-${++channelSeq}`;
+}
 /**
 * opaque origin 沙箱 iframe（sandbox="allow-scripts" srcdoc）：
-* iframe 内建 module Worker（Blob URL），iframe window 作 postMessage 中继。
-* opaque origin：沙箱内摸不到页面 DOM/localStorage/OPFS（独立 storage 分区）。
-* 就绪握手：iframe 加载完成发 sandbox-ready 后才放行出站消息（防丢失）。
+* iframe 内建 classic Worker（Blob URL；module Worker 在 opaque origin 不可加载，实证），
+* iframe window 作 postMessage 中继。opaque origin：沙箱内摸不到页面 DOM/localStorage/OPFS。
+* 通道鉴别（P0-C）：每实例 channelId 随消息携带，宿主校验 event.source 与 channelId，
+* 同页伪造消息一律丢弃；terminate 摘除监听器。
 */
 var IframeWorkerLike = class {
 	#iframe;
 	#ready = false;
 	#queue = [];
-	constructor(iframe) {
+	#channelId;
+	#hostWindow;
+	#hostListener;
+	constructor(iframe, hostWindow, channelId) {
 		this.#iframe = iframe;
+		this.#hostWindow = hostWindow;
+		this.#channelId = channelId;
+		this.#hostListener = (event) => this.#onMessage(event);
+		this.#hostWindow.addEventListener("message", this.#hostListener);
 	}
 	get ready() {
 		return this.#ready;
 	}
+	get channelId() {
+		return this.#channelId;
+	}
 	markReady() {
 		this.#ready = true;
 		for (const payload of this.#queue) this.#post(payload);
@@ -738,9 +754,21 @@ var IframeWorkerLike = class {
 	#post(payload) {
 		this.#iframe.contentWindow?.postMessage({
 			[ENVELOPE]: true,
+			channelId: this.#channelId,
 			payload
 		}, "*");
 	}
+	/** 通道鉴别：source 必须是本 iframe 的 contentWindow 且 channelId 匹配，否则丢弃 */
+	#onMessage(event) {
+		if (event.source !== this.#iframe.contentWindow) return;
+		const data = event.data;
+		if (!data || data[ENVELOPE] !== true || data.channelId !== this.#channelId) return;
+		if (data.payload && data.payload.type === "sandbox-ready") {
+			this.markReady();
+			return;
+		}
+		this.emit(data.payload);
+	}
 	postMessage(data) {
 		if (this.#ready) this.#post(data);
 		else this.#queue.push(data);
@@ -753,15 +781,17 @@ var IframeWorkerLike = class {
 		for (const listener of this.#listeners) listener({ data });
 	}
 	terminate() {
+		this.#hostWindow.removeEventListener("message", this.#hostListener);
 		this.#iframe.remove();
 	}
 };
 /** srcdoc 文档：内嵌 Worker 引导源码 + 双向中继（BOOTSTRAP 经 JSON 字符串注入，防 <\/script> 截断） */
-function sandboxDocument(bootstrapSource) {
+function sandboxDocument(bootstrapSource, channelId) {
 	const bootstrapJson = JSON.stringify(bootstrapSource).replace(/<\//g, "<\\/");
 	return `<!doctype html>
 <html><head><meta charset="utf-8"></head><body><script>
 const ENVELOPE = ${JSON.stringify(ENVELOPE)};
+const CHANNEL_ID = ${JSON.stringify(channelId)};
 const blob = new Blob([${bootstrapJson}], { type: 'text/javascript' });
 const url = URL.createObjectURL(blob);
 // 注意：opaque origin 下 module Worker 无法加载（实证），classic Worker + data: URL 动态导入可用
@@ -769,36 +799,29 @@ const worker = new Worker(url);
 URL.revokeObjectURL(url);
 window.addEventListener('message', (event) => {
   const data = event.data;
-  if (data && data[ENVELOPE]) worker.postMessage(data.payload);
+  // 中继同样校验 channelId（同页脚本无法伪造实例 id）
+  if (data && data[ENVELOPE] && data.channelId === CHANNEL_ID) worker.postMessage(data.payload);
 });
 worker.addEventListener('message', (event) => {
-  parent.postMessage({ [ENVELOPE]: true, payload: event.data }, '*');
+  parent.postMessage({ [ENVELOPE]: true, channelId: CHANNEL_ID, payload: event.data }, '*');
 });
 worker.addEventListener('error', (event) => {
-  parent.postMessage({ [ENVELOPE]: true, payload: { type: 'sandbox-worker-error', message: event.message } }, '*');
+  parent.postMessage({ [ENVELOPE]: true, channelId: CHANNEL_ID, payload: { type: 'sandbox-worker-error', message: event.message } }, '*');
 });
-parent.postMessage({ [ENVELOPE]: true, payload: { type: 'sandbox-ready' } }, '*');
+parent.postMessage({ [ENVELOPE]: true, channelId: CHANNEL_ID, payload: { type: 'sandbox-ready' } }, '*');
 <\/script></body></html>`;
 }
 /**
-* 创建 opaque iframe 沙箱 Worker：sandbox="allow-scripts" srcdoc iframe 承载 module Worker。
+* 创建 opaque iframe 沙箱 Worker：sandbox="allow-scripts" srcdoc iframe 承载 classic Worker。
 * 返回 IframeWorkerLike（协议与 blob Worker 完全一致：load/execute/bridge/network-blocked）。
 */
 function createIframeWorker(bootstrapSource, doc = document) {
+	const channelId = nextChannelId();
 	const iframe = doc.createElement("iframe");
 	iframe.setAttribute("sandbox", "allow-scripts");
 	iframe.style.display = "none";
-	iframe.srcdoc = sandboxDocument(bootstrapSource);
-	const worker = new IframeWorkerLike(iframe);
-	(doc.defaultView ?? window).addEventListener("message", (event) => {
-		const data = event.data;
-		if (!data || data[ENVELOPE] !== true) return;
-		if (data.payload && data.payload.type === "sandbox-ready") {
-			worker.markReady();
-			return;
-		}
-		worker.emit(data.payload);
-	});
+	iframe.srcdoc = sandboxDocument(bootstrapSource, channelId);
+	const worker = new IframeWorkerLike(iframe, doc.defaultView ?? window, channelId);
 	doc.body.appendChild(iframe);
 	return worker;
 }
@@ -827,6 +850,8 @@ var BrowserWorkerScriptExecutor = class {
 	#networkPolicy;
 	#approval;
 	#transpiler;
+	/** 消息 id 唯一递增（多实例/多执行不串） */
+	#messageSeq = 0;
 	constructor(deps) {
 		this.#fs = deps.fs;
 		this.#workerFactory = deps.workerFactory ?? resolveWorkerFactory(deps.sandbox ?? "auto");
@@ -871,7 +896,7 @@ var BrowserWorkerScriptExecutor = class {
 		try {
 			const data = await this.#request(worker, {
 				type: "load",
-				id: "load-1",
+				id: `load-${++this.#messageSeq}`,
 				source: script.source,
 				networkPolicy: this.#networkPolicy
 			});
@@ -906,7 +931,7 @@ var BrowserWorkerScriptExecutor = class {
 		try {
 			const response = await this.#request(worker, {
 				type: "execute",
-				id: "exec-1",
+				id: `exec-${++this.#messageSeq}`,
 				skillName: context.skillName,
 				runId: context.runId,
 				source: script.source,

package/dist/{dist-Cn9GpW6Q.js → dist-CvIMVwr3.js}

@@ -1,5 +1,5 @@
 import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, O as resolveArchiveLimits, T as readResponseWithLimit, b as isValidSkillName, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D0saNPi_.js";
-import { A as isNetworkAllowed, C as bridgeError, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, l as FsMemoryStore, o as CapabilityApproval } from "./dist-DrySSQ5R.js";
+import { A as isNetworkAllowed, C as bridgeError, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, l as FsMemoryStore, o as CapabilityApproval } from "./dist-NM4Mylx4.js";
 import { createRequire } from "node:module";
 import { unzipSync, zipSync } from "fflate";
 import { existsSync, promises, realpathSync } from "node:fs";
@@ -303,8 +303,10 @@ function workerEntryPath() {
 * 能力桥协议与浏览器同一来源（runtime/sandbox/bridgeProtocol）。
 *
 * 诚实标注：本执行器做的是**能力面收敛**（网络策略、模块 allowlist、资源限额、
-* 超时强杀），**不是安全边界**——Worker 内脚本与宿主共享进程，仍有绕过手段；
-* 禁止假定其可隔离不可信脚本。
+* 超时强杀），**不是安全边界**——Worker 内脚本与宿主共享进程；
+* 已知主动逃逸面（process.binding/_linkedBinding/dlopen/openStdin/reallyExit/abort）
+* 已在入口删除（0.2.3），常规 import 拦截之外不承诺防御其它宿主共享面；
+* 禁止假定其可隔离不可信脚本（隔离级需求用 ProcessSandboxExecutor）。
 */
 var SandboxedScriptExecutor = class {
 	#fs;
@@ -644,8 +646,11 @@ var ProcessSandboxExecutor = class {
 				...readAllow(artifactDir),
 				...writeAllow(artifactDir)
 			],
-			silent: false
+			env: Object.fromEntries((this.#options.envWhitelist ?? []).filter((key) => process.env[key] !== void 0).map((key) => [key, process.env[key]])),
+			silent: true
 		});
+		child.stdout?.resume();
+		child.stderr?.resume();
 		child.unref();
 		child.channel?.unref();
 		return {

package/dist/{dist-DrySSQ5R.js → dist-NM4Mylx4.js}

@@ -1402,7 +1402,7 @@ var AgentLoop = class {
 				state.messages.push({
 					role: "tool",
 					toolCallId: pendingCall.id,
-					content: JSON.stringify(result)
+					content: await this.#serializeToolResult(pendingCall, result, state)
 				});
 			} else if (pending.type === "ask" && pendingCall) {
 				const value = await this.#interact(state, pending, {
@@ -1423,14 +1423,24 @@ var AgentLoop = class {
 				state.messages.push({
 					role: "tool",
 					toolCallId: pendingCall.id,
-					content: JSON.stringify(result)
+					content: await this.#serializeToolResult(pendingCall, result, state)
 				});
 			} else if (pendingCall) {
 				const result = await this.#executeCall(pendingCall, state);
 				state.messages.push({
 					role: "tool",
 					toolCallId: pendingCall.id,
-					content: JSON.stringify(result)
+					content: await this.#serializeToolResult(pendingCall, result, state)
+				});
+			}
+			for (;;) {
+				const next = this.#findPendingToolCall(state.messages);
+				if (!next) break;
+				const result = await this.#executeCall(next, state);
+				state.messages.push({
+					role: "tool",
+					toolCallId: next.id,
+					content: await this.#serializeToolResult(next, result, state)
 				});
 			}
 		} catch (e) {

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
 import { F as SkillDocument, N as SkillCatalogEntry, c as LlmClient, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
 import { Q as ScriptExecutor, dt as WebSkillRuntime, ft as WebSkillRuntimeDeps, q as RuntimeRun, tt as SkillStateGuard } from "./index-gjFuBevI.js";
-import { d as SkillManager } from "./index-BmzysJX5.js";
+import { d as SkillManager } from "./index-iqcz3_NS.js";
 //#region ../governance/dist/index.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';
@@ -360,8 +360,10 @@ declare class EvaluationRunner {
 //#region src/evaluation/evaluationRuntime.d.ts
 /**
  * 治理评估专用 runtime 装配（不可信技能试用路径）：
- * 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离）；
- * 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态）。
+ * 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离；子进程
+ * env 默认清空防密钥泄露，需透传时经 ProcessSandboxOptions.envWhitelist 显式放行）。
+ * 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态，
+ * 非安全边界；envWhitelist 同样适用于该执行器）。
  */
 declare function createEvaluationRuntime(deps: WebSkillRuntimeDeps & {
   executor?: ScriptExecutor;

package/dist/governance.js

@@ -1,6 +1,6 @@
 import { A as unzipWithLimits, b as isValidSkillName, d as assertSafePathSegment, j as validateSkills, k as resolveInsideRoot, u as WebSkillError } from "./dist-D0saNPi_.js";
-import { S as WebSkillRuntime } from "./dist-DrySSQ5R.js";
-import { i as NodeFS, s as ProcessSandboxExecutor, u as exportArchive } from "./dist-Cn9GpW6Q.js";
+import { S as WebSkillRuntime } from "./dist-NM4Mylx4.js";
+import { i as NodeFS, s as ProcessSandboxExecutor, u as exportArchive } from "./dist-CvIMVwr3.js";
 import path from "node:path";
 import { tmpdir } from "node:os";
 import { mkdtemp } from "node:fs/promises";
@@ -843,8 +843,10 @@ var EvaluationRunner = class {
 };
 /**
 * 治理评估专用 runtime 装配（不可信技能试用路径）：
-* 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离）；
-* 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态）。
+* 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离；子进程
+* env 默认清空防密钥泄露，需透传时经 ProcessSandboxOptions.envWhitelist 显式放行）。
+* 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态，
+* 非安全边界；envWhitelist 同样适用于该执行器）。
 */
 function createEvaluationRuntime(deps) {
 	return new WebSkillRuntime({

package/dist/{index-BmzysJX5.d.ts → index-iqcz3_NS.d.ts}

@@ -72,8 +72,10 @@ interface SandboxOptions {
  * 能力桥协议与浏览器同一来源（runtime/sandbox/bridgeProtocol）。
  *
  * 诚实标注：本执行器做的是**能力面收敛**（网络策略、模块 allowlist、资源限额、
- * 超时强杀），**不是安全边界**——Worker 内脚本与宿主共享进程，仍有绕过手段；
- * 禁止假定其可隔离不可信脚本。
+ * 超时强杀），**不是安全边界**——Worker 内脚本与宿主共享进程；
+ * 已知主动逃逸面（process.binding/_linkedBinding/dlopen/openStdin/reallyExit/abort）
+ * 已在入口删除（0.2.3），常规 import 拦截之外不承诺防御其它宿主共享面；
+ * 禁止假定其可隔离不可信脚本（隔离级需求用 ProcessSandboxExecutor）。
  */
 declare class SandboxedScriptExecutor implements ScriptExecutor {
   #private;
@@ -92,6 +94,8 @@ declare class SandboxedScriptExecutor implements ScriptExecutor {
 interface ProcessSandboxOptions {
   /** 温池大小（并发上限；执行后 kill 并补位重生），默认 2 */
   poolSize?: number;
+  /** 透传给子进程的环境变量白名单（默认 []：子进程 env 为空，防密钥泄露） */
+  envWhitelist?: string[];
   capabilities?: BridgeCapabilities;
   /** 网络策略：默认 'deny-all'（权限模型无网络维度，补丁兜底；node:net 裸模块为已知残余面） */
   networkPolicy?: NetworkPolicy;

package/dist/index.js

@@ -1,4 +1,4 @@
 import { A as unzipWithLimits, C as parseSkillMarkdown, D as renderCatalogJson, E as renderAvailableSkillsXml, M as verifyManifest, N as xmlRenderer, O as resolveArchiveLimits, S as normalizePath, T as readResponseWithLimit, _ as computeDigest, a as SKILL_NAME_MAX_LENGTH, b as isValidSkillName, c as SkillDiscovery, d as assertSafePathSegment, f as atomicWriteText, g as checkSkillRules, h as checkDependencyCycles, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, l as SkillReader, m as buildManifest, n as MemoryFS, o as SKILL_NAME_PATTERN, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, t as DEFAULT_ARCHIVE_LIMITS, u as WebSkillError, v as escapeXml, w as parseSkillPackManifest, x as jsonRenderer, y as exportSkills } from "./dist-D0saNPi_.js";
-import { A as isNetworkAllowed, C as bridgeError, D as extractChartSpec, E as createWebSkillApi, F as resolveToolName, I as schemaToForm, L as toLlmToolSpec, M as networkUrlHost, N as normalizeToolContent, O as fromVercelResult, P as parseBridgeRequest, R as toVercelToolSpecs, S as WebSkillRuntime, T as createScriptContext, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as SerializingMemoryStore, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, k as fromVercelStreamPart, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as buildRenderResult, x as TraceRecorder, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-DrySSQ5R.js";
+import { A as isNetworkAllowed, C as bridgeError, D as extractChartSpec, E as createWebSkillApi, F as resolveToolName, I as schemaToForm, L as toLlmToolSpec, M as networkUrlHost, N as normalizeToolContent, O as fromVercelResult, P as parseBridgeRequest, R as toVercelToolSpecs, S as WebSkillRuntime, T as createScriptContext, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as SerializingMemoryStore, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, k as fromVercelStreamPart, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as buildRenderResult, x as TraceRecorder, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-NM4Mylx4.js";
 
 export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, AnthropicClient, CapabilityApproval, DEFAULT_ARCHIVE_LIMITS, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SerializingMemoryStore, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };

package/dist/mcp.js

@@ -1,5 +1,5 @@
 import { u as WebSkillError } from "./dist-D0saNPi_.js";
-import { N as normalizeToolContent, j as mergeCatalogEntries } from "./dist-DrySSQ5R.js";
+import { N as normalizeToolContent, j as mergeCatalogEntries } from "./dist-NM4Mylx4.js";
 
 //#region ../mcp/dist/index.js
 /**

package/dist/node.d.ts

@@ -1,5 +1,5 @@
 import { D as SKILLS_LOCKFILE, I as SkillInstallSource, K as VerifyResult, O as SKILL_MANIFEST_FILE, W as SkillsLockfile, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
 import { ht as createScriptContext } from "./index-gjFuBevI.js";
 import { n as LlmEnvConfig, s as probeLlmCapabilities, t as LlmCapabilities } from "./env-BPUBZCwJ-4jat_SVG.js";
-import { a as NodeScriptExecutor, c as ProcessSandboxOptions, d as SkillManager, f as exportArchive, i as NodeFS, l as SandboxOptions, n as FileArtifactStore, o as OxcSchemaInferer, p as readArchiveManifest, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as SandboxedScriptExecutor } from "./index-BmzysJX5.js";
+import { a as NodeScriptExecutor, c as ProcessSandboxOptions, d as SkillManager, f as exportArchive, i as NodeFS, l as SandboxOptions, n as FileArtifactStore, o as OxcSchemaInferer, p as readArchiveManifest, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as SandboxedScriptExecutor } from "./index-iqcz3_NS.js";
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, type LlmCapabilities, type LlmEnvConfig, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, type ProcessSandboxOptions, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, type SandboxOptions, SandboxedScriptExecutor, type SkillInstallSource, SkillManager, type SkillManifest, type SkillsLockfile, type VerifyResult, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };

package/dist/node.js

@@ -1,6 +1,6 @@
 import { i as SKILL_MANIFEST_FILE, r as SKILLS_LOCKFILE } from "./dist-D0saNPi_.js";
-import { T as createScriptContext } from "./dist-DrySSQ5R.js";
+import { T as createScriptContext } from "./dist-NM4Mylx4.js";
 import { i as probeLlmCapabilities } from "./env--jJB-TSX-04klhTYi.js";
-import { a as NodeScriptExecutor, c as SandboxedScriptExecutor, d as readArchiveManifest, i as NodeFS, l as SkillManager, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as exportArchive } from "./dist-Cn9GpW6Q.js";
+import { a as NodeScriptExecutor, c as SandboxedScriptExecutor, d as readArchiveManifest, i as NodeFS, l as SkillManager, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as exportArchive } from "./dist-CvIMVwr3.js";
 
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SandboxedScriptExecutor, SkillManager, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };

package/dist/sandboxWorkerEntry.js

@@ -132,8 +132,29 @@ function setupNetworkGuards(task) {
 	};
 	register(`data:text/javascript,${encodeURIComponent(MODULE_HOOK_SOURCE.replace("%ALLOWED_MODULES%", JSON.stringify(task.allowedModules ?? [])))}`);
 }
+/**
+* 加载用户代码前删除 native 逃逸面（P0-A）：binding/_linkedBinding/dlopen/
+* openStdin/reallyExit/abort——这些直达宿主进程 internals，防御面与
+* 能力收敛语义一致（常规 import 拦截之外的主动逃逸项由此封闭）。
+* 注意：process.exit() 内部依赖 reallyExit（per_thread.js），故删前捕获引用，
+* 关闭路径直接调用 internalExit（不经 process.exit）。
+*/
+const internalExit = process.reallyExit.bind(process);
+function stripProcessEscapeHatches() {
+	for (const key of [
+		"binding",
+		"_linkedBinding",
+		"dlopen",
+		"openStdin",
+		"reallyExit",
+		"abort"
+	]) try {
+		Reflect.deleteProperty(process, key);
+	} catch {}
+}
 async function main() {
 	const task = workerData;
+	stripProcessEscapeHatches();
 	setupNetworkGuards(task);
 	port.on("message", (msg) => {
 		if (msg?.type === "bridge-response" && msg.response?.id) {
@@ -222,9 +243,9 @@ async function main() {
 		console.error = originals.error;
 	}
 }
-main().then(() => process.exit(0), (e) => {
+main().then(() => internalExit(0), (e) => {
 	console.error(e);
-	process.exit(1);
+	internalExit(1);
 });
 
 //#endregion

package/dist/ui.js

@@ -1,4 +1,4 @@
-import { w as buildRenderResult } from "./dist-DrySSQ5R.js";
+import { w as buildRenderResult } from "./dist-NM4Mylx4.js";
 import { C as renderRenderResult, D as toVercelToolInvocation, E as toOpenUiLang, S as renderMiniMarkdown, T as toA2uiMessages, _ as fromOpenUiAction, a as CHART_PALETTE, b as renderBlocks, c as OPENUI_SUBMIT_ACTION, d as WEBSKILL_STYLES_CSS, f as WebFormBridge, g as fromA2uiAction, h as ensureStyles, i as A2UI_VERSION, l as VERCEL_INTERACTION_TOOL_NAME, m as collectValues, n as A2UI_CANCEL_ACTION, o as LitRendererBridge, p as chartToTable, r as A2UI_SUBMIT_ACTION, s as OPENUI_CANCEL_ACTION, t as A2UI_BASIC_CATALOG_ID, u as VercelUiBridge, v as fromVercelToolResult, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-BJobG0i-.js";
 
 export { A2UI_BASIC_CATALOG_ID, A2UI_CANCEL_ACTION, A2UI_SUBMIT_ACTION, A2UI_VERSION, CHART_PALETTE, LitRendererBridge, OPENUI_CANCEL_ACTION, OPENUI_SUBMIT_ACTION, VERCEL_INTERACTION_TOOL_NAME, VercelUiBridge, WEBSKILL_STYLES_CSS, WebFormBridge, buildRenderResult, chartToTable, collectValues, ensureStyles, fromA2uiAction, fromOpenUiAction, fromVercelToolResult, interactionToFormModel, renderBlocks, renderMiniChart, renderMiniMarkdown, renderRenderResult, shapeInteractionValue, toA2uiMessages, toOpenUiLang, toVercelToolInvocation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webskill/sdk",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "WebSkill \u2014 browser/Node agent skill runtime (skills, tools, MCP, governance, UI)",
   "license": "MIT",
   "type": "module",