@webskill/sdk 0.2.2 → 0.2.4

package/README.md

@@ -16,6 +16,7 @@ governance.
   (missing-parameter forms, confirmations, authorization prompts), and
   resumable interrupted runs.
 - **Script sandbox** — two tiers. Isolation-grade: Node `ProcessSandboxExecutor`
+  (fork + `--permission`, real process isolation).
   (`child_process.fork` + `--permission`, experimental; fs scoped to the skill
   root, workers/child processes/addons denied by default — note the permission
   model has NO network dimension, so `fetch`/`WebSocket` stay patch-enforced and
@@ -25,6 +26,9 @@ governance.
   tier (NOT a security boundary): `SandboxedScriptExecutor` /
   `BrowserWorkerScriptExecutor` in blob-Worker mode, with deny-by-default
   network policy, builtin-module allowlist, forced approval, timeouts.
+  Known proactive escape hatches (`process.binding`, `dlopen`, `abort`, …) are
+  stripped in the worker entry (0.2.3); other host-shared surfaces are NOT
+  defended — use `ProcessSandboxExecutor` for untrusted skills.
 - **`navigator.webskill`** — a browser facade (`discover` / `read` / `validate` /
   `run` / `install` / `uninstall`) assembled explicitly in one call.
 - **MCP** — call page-provided tools and consume page-declared dynamic skills

package/dist/browser.d.ts

@@ -1,5 +1,5 @@
-import { C as FileStat, I as SkillInstallSource, K as VerifyResult, W as SkillsLockfile, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { N as NetworkPolicy, Q as ScriptExecutor, Z as ScriptExecutionContext, d as BridgeCapabilities, it as ToolResult, m as BridgeResponse, nt as ToolDefinition, p as BridgeRequest, pt as bridgeError, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, wt as parseBridgeRequest, y as ExternalToolSource } from "./index-gjFuBevI.js";
+import { C as FileStat, I as SkillInstallSource, K as VerifyResult, W as SkillsLockfile, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { Et as parseBridgeRequest, N as NetworkPolicy, Q as ScriptExecutor, Z as ScriptExecutionContext, d as BridgeCapabilities, it as ToolResult, m as BridgeResponse, nt as ToolDefinition, p as BridgeRequest, pt as bridgeError, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, y as ExternalToolSource } from "./index-DZShzhon.js";
 //#region ../browser/dist/index.d.ts
 //#region src/fs/featureDetection.d.ts
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -15,6 +15,7 @@ declare class OpfsProvider implements FileSystemProvider {
   });
   readText(p: string): Promise<string>;
   writeText(p: string, content: string): Promise<void>;
+  appendText(p: string, content: string): Promise<void>;
   readBinary(p: string): Promise<Uint8Array>;
   writeBinary(p: string, content: Uint8Array): Promise<void>;
   exists(p: string): Promise<boolean>;
@@ -164,14 +165,16 @@ declare class BrowserWorkerScriptExecutor implements ScriptExecutor {
 //#region src/executor/iframeSandbox.d.ts
 /**
  * opaque origin 沙箱 iframe（sandbox="allow-scripts" srcdoc）：
- * iframe 内建 module Worker（Blob URL），iframe window 作 postMessage 中继。
- * opaque origin：沙箱内摸不到页面 DOM/localStorage/OPFS（独立 storage 分区）。
- * 就绪握手：iframe 加载完成发 sandbox-ready 后才放行出站消息（防丢失）。
+ * iframe 内建 classic Worker（Blob URL；module Worker 在 opaque origin 不可加载，实证），
+ * iframe window 作 postMessage 中继。opaque origin：沙箱内摸不到页面 DOM/localStorage/OPFS。
+ * 通道鉴别（P0-C）：每实例 channelId 随消息携带，宿主校验 event.source 与 channelId，
+ * 同页伪造消息一律丢弃；terminate 摘除监听器。
  */
 declare class IframeWorkerLike implements WorkerLike {
   #private;
-  constructor(iframe: HTMLIFrameElement);
+  constructor(iframe: HTMLIFrameElement, hostWindow: Window, channelId: string);
   get ready(): boolean;
+  get channelId(): string;
   markReady(): void;
   postMessage(data: unknown): void;
   addEventListener(_type: 'message', listener: (event: {
@@ -181,7 +184,7 @@ declare class IframeWorkerLike implements WorkerLike {
   terminate(): void;
 }
 /**
- * 创建 opaque iframe 沙箱 Worker：sandbox="allow-scripts" srcdoc iframe 承载 module Worker。
+ * 创建 opaque iframe 沙箱 Worker：sandbox="allow-scripts" srcdoc iframe 承载 classic Worker。
  * 返回 IframeWorkerLike（协议与 blob Worker 完全一致：load/execute/bridge/network-blocked）。
  */
 declare function createIframeWorker(bootstrapSource: string, doc?: Document): IframeWorkerLike;

package/dist/browser.js

@@ -1,6 +1,6 @@
-import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, T as readResponseWithLimit, b as isValidSkillName, c as SkillDiscovery, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D0saNPi_.js";
-import { A as isNetworkAllowed, C as bridgeError, E as createWebSkillApi, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, l as FsMemoryStore, m as OpenAiCompatibleClient, o as CapabilityApproval, u as FsRunSnapshotStore, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-DrySSQ5R.js";
-import { n as MockLlmClient } from "./testing-B4pq6JYa.js";
+import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, T as readResponseWithLimit, b as isValidSkillName, c as SkillDiscovery, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D7MsoMPx.js";
+import { A as isNetworkAllowed, C as bridgeError, E as createWebSkillApi, F as normalizeToolError, I as parseBridgeRequest, M as networkUrlHost, P as normalizeToolContent, c as FsArtifactStore, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, l as FsMemoryStore, m as OpenAiCompatibleClient, o as CapabilityApproval, u as FsRunSnapshotStore, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-CV64gN62.js";
+import { n as MockLlmClient } from "./testing-BN18eqbD.js";
 
 //#region ../browser/dist/index.js
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -57,6 +57,22 @@ var OpfsProvider = class {
 	async writeText(p, content) {
 		await this.writeBinary(p, new TextEncoder().encode(content));
 	}
+	async appendText(p, content) {
+		await this.#wrap(p, async () => {
+			const segments = this.#segments(p);
+			const name = segments.pop();
+			if (!name) throw new WebSkillError("FS_NOT_FOUND", `Invalid file path: ${p}`);
+			const handle = await (await this.#walkDir(`/${segments.join("/")}`, true)).getFileHandle(name, { create: true });
+			const size = (await handle.getFile()).size;
+			const writable = await handle.createWritable({ keepExistingData: true });
+			await writable.write({
+				type: "write",
+				position: size,
+				data: content
+			});
+			await writable.close();
+		});
+	}
 	async readBinary(p) {
 		return this.#wrap(p, async () => {
 			const handle = await this.#walkFile(p);
@@ -232,6 +248,16 @@ function loadModule(source) {
   return import(url);
 }
 
+function assertSerializable(value) {
+  try {
+    structuredClone(value);
+  } catch (e) {
+    var err = new Error('Script returned a non-serializable value: ' + String((e && e.message) || e));
+    err.code = 'TOOL_EXECUTION_FAILED';
+    throw err;
+  }
+}
+
 function postError(type, id, code, message, extra) {
   var msg = { type: type, id: id, ok: false, error: { code: code, message: message } };
   if (extra) Object.assign(msg, extra);
@@ -326,6 +352,7 @@ self.onmessage = async function (event) {
         throw new Error('Script does not export a run function');
       }
       var value = await mod2.run(msg.args, makeContext(msg));
+      assertSerializable(value);
       self.postMessage({
         type: 'execute-result', id: msg.id, ok: true,
         value: value === undefined ? null : value,
@@ -714,22 +741,38 @@ var BrowserSkillManager = class {
 	}
 };
 const ENVELOPE = "__webskill_sandbox__";
+let channelSeq = 0;
+/** 每实例 channelId（防同页伪造消息注入；crypto.randomUUID 优先，无则随机回退） */
+function nextChannelId() {
+	return globalThis.crypto?.randomUUID?.() ?? `ch-${Date.now()}-${Math.random().toString(36).slice(2, 10)}-${++channelSeq}`;
+}
 /**
 * opaque origin 沙箱 iframe（sandbox="allow-scripts" srcdoc）：
-* iframe 内建 module Worker（Blob URL），iframe window 作 postMessage 中继。
-* opaque origin：沙箱内摸不到页面 DOM/localStorage/OPFS（独立 storage 分区）。
-* 就绪握手：iframe 加载完成发 sandbox-ready 后才放行出站消息（防丢失）。
+* iframe 内建 classic Worker（Blob URL；module Worker 在 opaque origin 不可加载，实证），
+* iframe window 作 postMessage 中继。opaque origin：沙箱内摸不到页面 DOM/localStorage/OPFS。
+* 通道鉴别（P0-C）：每实例 channelId 随消息携带，宿主校验 event.source 与 channelId，
+* 同页伪造消息一律丢弃；terminate 摘除监听器。
 */
 var IframeWorkerLike = class {
 	#iframe;
 	#ready = false;
 	#queue = [];
-	constructor(iframe) {
+	#channelId;
+	#hostWindow;
+	#hostListener;
+	constructor(iframe, hostWindow, channelId) {
 		this.#iframe = iframe;
+		this.#hostWindow = hostWindow;
+		this.#channelId = channelId;
+		this.#hostListener = (event) => this.#onMessage(event);
+		this.#hostWindow.addEventListener("message", this.#hostListener);
 	}
 	get ready() {
 		return this.#ready;
 	}
+	get channelId() {
+		return this.#channelId;
+	}
 	markReady() {
 		this.#ready = true;
 		for (const payload of this.#queue) this.#post(payload);
@@ -738,9 +781,21 @@ var IframeWorkerLike = class {
 	#post(payload) {
 		this.#iframe.contentWindow?.postMessage({
 			[ENVELOPE]: true,
+			channelId: this.#channelId,
 			payload
 		}, "*");
 	}
+	/** 通道鉴别：source 必须是本 iframe 的 contentWindow 且 channelId 匹配，否则丢弃 */
+	#onMessage(event) {
+		if (event.source !== this.#iframe.contentWindow) return;
+		const data = event.data;
+		if (!data || data[ENVELOPE] !== true || data.channelId !== this.#channelId) return;
+		if (data.payload && data.payload.type === "sandbox-ready") {
+			this.markReady();
+			return;
+		}
+		this.emit(data.payload);
+	}
 	postMessage(data) {
 		if (this.#ready) this.#post(data);
 		else this.#queue.push(data);
@@ -753,15 +808,17 @@ var IframeWorkerLike = class {
 		for (const listener of this.#listeners) listener({ data });
 	}
 	terminate() {
+		this.#hostWindow.removeEventListener("message", this.#hostListener);
 		this.#iframe.remove();
 	}
 };
 /** srcdoc 文档：内嵌 Worker 引导源码 + 双向中继（BOOTSTRAP 经 JSON 字符串注入，防 <\/script> 截断） */
-function sandboxDocument(bootstrapSource) {
+function sandboxDocument(bootstrapSource, channelId) {
 	const bootstrapJson = JSON.stringify(bootstrapSource).replace(/<\//g, "<\\/");
 	return `<!doctype html>
 <html><head><meta charset="utf-8"></head><body><script>
 const ENVELOPE = ${JSON.stringify(ENVELOPE)};
+const CHANNEL_ID = ${JSON.stringify(channelId)};
 const blob = new Blob([${bootstrapJson}], { type: 'text/javascript' });
 const url = URL.createObjectURL(blob);
 // 注意：opaque origin 下 module Worker 无法加载（实证），classic Worker + data: URL 动态导入可用
@@ -769,36 +826,29 @@ const worker = new Worker(url);
 URL.revokeObjectURL(url);
 window.addEventListener('message', (event) => {
   const data = event.data;
-  if (data && data[ENVELOPE]) worker.postMessage(data.payload);
+  // 中继同样校验 channelId（同页脚本无法伪造实例 id）
+  if (data && data[ENVELOPE] && data.channelId === CHANNEL_ID) worker.postMessage(data.payload);
 });
 worker.addEventListener('message', (event) => {
-  parent.postMessage({ [ENVELOPE]: true, payload: event.data }, '*');
+  parent.postMessage({ [ENVELOPE]: true, channelId: CHANNEL_ID, payload: event.data }, '*');
 });
 worker.addEventListener('error', (event) => {
-  parent.postMessage({ [ENVELOPE]: true, payload: { type: 'sandbox-worker-error', message: event.message } }, '*');
+  parent.postMessage({ [ENVELOPE]: true, channelId: CHANNEL_ID, payload: { type: 'sandbox-worker-error', message: event.message } }, '*');
 });
-parent.postMessage({ [ENVELOPE]: true, payload: { type: 'sandbox-ready' } }, '*');
+parent.postMessage({ [ENVELOPE]: true, channelId: CHANNEL_ID, payload: { type: 'sandbox-ready' } }, '*');
 <\/script></body></html>`;
 }
 /**
-* 创建 opaque iframe 沙箱 Worker：sandbox="allow-scripts" srcdoc iframe 承载 module Worker。
+* 创建 opaque iframe 沙箱 Worker：sandbox="allow-scripts" srcdoc iframe 承载 classic Worker。
 * 返回 IframeWorkerLike（协议与 blob Worker 完全一致：load/execute/bridge/network-blocked）。
 */
 function createIframeWorker(bootstrapSource, doc = document) {
+	const channelId = nextChannelId();
 	const iframe = doc.createElement("iframe");
 	iframe.setAttribute("sandbox", "allow-scripts");
 	iframe.style.display = "none";
-	iframe.srcdoc = sandboxDocument(bootstrapSource);
-	const worker = new IframeWorkerLike(iframe);
-	(doc.defaultView ?? window).addEventListener("message", (event) => {
-		const data = event.data;
-		if (!data || data[ENVELOPE] !== true) return;
-		if (data.payload && data.payload.type === "sandbox-ready") {
-			worker.markReady();
-			return;
-		}
-		worker.emit(data.payload);
-	});
+	iframe.srcdoc = sandboxDocument(bootstrapSource, channelId);
+	const worker = new IframeWorkerLike(iframe, doc.defaultView ?? window, channelId);
 	doc.body.appendChild(iframe);
 	return worker;
 }
@@ -827,6 +877,8 @@ var BrowserWorkerScriptExecutor = class {
 	#networkPolicy;
 	#approval;
 	#transpiler;
+	/** 消息 id 唯一递增（多实例/多执行不串） */
+	#messageSeq = 0;
 	constructor(deps) {
 		this.#fs = deps.fs;
 		this.#workerFactory = deps.workerFactory ?? resolveWorkerFactory(deps.sandbox ?? "auto");
@@ -871,7 +923,7 @@ var BrowserWorkerScriptExecutor = class {
 		try {
 			const data = await this.#request(worker, {
 				type: "load",
-				id: "load-1",
+				id: `load-${++this.#messageSeq}`,
 				source: script.source,
 				networkPolicy: this.#networkPolicy
 			});
@@ -906,7 +958,7 @@ var BrowserWorkerScriptExecutor = class {
 		try {
 			const response = await this.#request(worker, {
 				type: "execute",
-				id: "exec-1",
+				id: `exec-${++this.#messageSeq}`,
 				skillName: context.skillName,
 				runId: context.runId,
 				source: script.source,
@@ -915,12 +967,13 @@ var BrowserWorkerScriptExecutor = class {
 			}, timeoutMs, (bridgeRequest) => this.#handleBridge(bridgeRequest, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!response.ok) {
 				const stderrSummary = response.stderr?.length ? ` | stderr: ${response.stderr.join(" | ").slice(0, 500)}` : "";
+				const normalized = normalizeToolError(response.error?.code, response.error?.message ?? "script execution failed");
 				return {
 					ok: false,
 					content: [],
 					error: {
-						code: response.error?.code ?? "TOOL_EXECUTION_FAILED",
-						message: `${response.error?.message ?? "script execution failed"}${stderrSummary}`
+						code: normalized.code,
+						message: `${normalized.message}${stderrSummary}`
 					}
 				};
 			}

package/dist/{dist-DrySSQ5R.js → dist-CV64gN62.js}

@@ -1,4 +1,4 @@
-import { C as parseSkillMarkdown, E as renderAvailableSkillsXml, c as SkillDiscovery, d as assertSafePathSegment, j as validateSkills, k as resolveInsideRoot, l as SkillReader, p as buildCatalog, u as WebSkillError } from "./dist-D0saNPi_.js";
+import { C as parseSkillMarkdown, E as renderAvailableSkillsXml, c as SkillDiscovery, d as assertSafePathSegment, j as validateSkills, k as resolveInsideRoot, l as SkillReader, p as buildCatalog, u as WebSkillError } from "./dist-D7MsoMPx.js";
 import { t as MemoryArtifactStore } from "./memoryArtifactStore-C9lFVqPF-yFz6yJj0.js";
 
 //#region ../runtime/dist/index.js
@@ -272,7 +272,7 @@ var AnthropicClient = class {
 			"content-type": "application/json",
 			"x-api-key": this.#config.apiKey,
 			"anthropic-version": ANTHROPIC_VERSION,
-			"anthropic-dangerous-direct-browser-access": "true"
+			...this.#config.dangerouslyAllowDirectBrowserAccess ? { "anthropic-dangerous-direct-browser-access": "true" } : {}
 		};
 	}
 	async complete(input) {
@@ -571,7 +571,7 @@ var GoogleGenAiClient = class {
 	}
 	async #post(input, stream) {
 		const model = input.model ?? this.#config.model;
-		const action = stream ? `:streamGenerateContent?alt=sse&key=${encodeURIComponent(this.#config.apiKey)}` : `:generateContent?key=${encodeURIComponent(this.#config.apiKey)}`;
+		const action = stream ? ":streamGenerateContent?alt=sse" : ":generateContent";
 		const { systemInstruction, contents } = toGenAiContents(input.messages);
 		const body = { contents };
 		if (systemInstruction) body["systemInstruction"] = systemInstruction;
@@ -581,7 +581,10 @@ var GoogleGenAiClient = class {
 		try {
 			res = await this.#fetch(`${this.#baseUrl()}/v1beta/models/${encodeURIComponent(model)}${action}`, {
 				method: "POST",
-				headers: { "content-type": "application/json" },
+				headers: {
+					"content-type": "application/json",
+					"x-goog-api-key": this.#config.apiKey
+				},
 				body: JSON.stringify(body),
 				signal: input.signal ?? (this.#config.requestTimeoutMs ? AbortSignal.timeout(this.#config.requestTimeoutMs) : null)
 			});
@@ -597,7 +600,7 @@ var GoogleGenAiClient = class {
 	/** 轻量探测（GET /v1beta/models），集成测试据此决定 skip */
 	async checkAvailability() {
 		try {
-			return (await this.#fetch(`${this.#baseUrl()}/v1beta/models?key=${encodeURIComponent(this.#config.apiKey)}`)).ok;
+			return (await this.#fetch(`${this.#baseUrl()}/v1beta/models`, { headers: { "x-goog-api-key": this.#config.apiKey } })).ok;
 		} catch {
 			return false;
 		}
@@ -846,11 +849,12 @@ const ASK_USER_TOOL = {
 */
 function createScriptContext(deps) {
 	const { fs, artifactStore, skillName, skillRoot, runId, confirm, onWarning, onArtifactCreated } = deps;
+	const readFs = fs.withRoot?.(skillRoot) ?? fs;
 	return {
 		skillName,
 		runId,
 		async readReference(relativePath) {
-			return fs.readText(resolveInsideRoot(skillRoot, `references/${relativePath}`));
+			return readFs.readText(resolveInsideRoot(skillRoot, `references/${relativePath}`));
 		},
 		async writeArtifact(path, content, options) {
 			const artifact = typeof content === "string" ? await artifactStore.createTextArtifact({
@@ -1402,7 +1406,7 @@ var AgentLoop = class {
 				state.messages.push({
 					role: "tool",
 					toolCallId: pendingCall.id,
-					content: JSON.stringify(result)
+					content: await this.#serializeToolResult(pendingCall, result, state)
 				});
 			} else if (pending.type === "ask" && pendingCall) {
 				const value = await this.#interact(state, pending, {
@@ -1423,14 +1427,24 @@ var AgentLoop = class {
 				state.messages.push({
 					role: "tool",
 					toolCallId: pendingCall.id,
-					content: JSON.stringify(result)
+					content: await this.#serializeToolResult(pendingCall, result, state)
 				});
 			} else if (pendingCall) {
 				const result = await this.#executeCall(pendingCall, state);
 				state.messages.push({
 					role: "tool",
 					toolCallId: pendingCall.id,
-					content: JSON.stringify(result)
+					content: await this.#serializeToolResult(pendingCall, result, state)
+				});
+			}
+			for (;;) {
+				const next = this.#findPendingToolCall(state.messages);
+				if (!next) break;
+				const result = await this.#executeCall(next, state);
+				state.messages.push({
+					role: "tool",
+					toolCallId: next.id,
+					content: await this.#serializeToolResult(next, result, state)
 				});
 			}
 		} catch (e) {
@@ -1724,14 +1738,20 @@ var AgentLoop = class {
 		const text = JSON.stringify(result);
 		const max = this.#config.toolResultMaxBytes;
 		if (text.length <= max) return text;
-		const artifact = await this.#deps.artifactStore.createTextArtifact({
-			runId: state.runId,
-			path: `tool-results/${call.id}.json`,
-			content: text
-		});
+		let note;
+		try {
+			note = `full tool result saved as artifact "${(await this.#deps.artifactStore.createTextArtifact({
+				runId: state.runId,
+				path: `tool-results/${call.id}.json`,
+				content: text
+			})).id}"`;
+		} catch (e) {
+			state.trace.record("run.warning", { message: `Failed to persist oversized tool result artifact for "${call.name}": ${messageOf$1(e)}` });
+			note = "full result discarded (artifact store unavailable)";
+		}
 		const head = text.slice(0, Math.floor(max * .6));
 		const tail = text.slice(-Math.floor(max * .3));
-		return `${head}\n...[truncated ${text.length - head.length - tail.length} chars; full tool result saved as artifact "${artifact.id}"]...\n${tail}`;
+		return `${head}\n...[truncated ${text.length - head.length - tail.length} chars; ${note}]...\n${tail}`;
 	}
 	/** SkillStateGuard 判定（无注入默认全放行；仅显式 false 拦截） */
 	async #guardDenied(kind, skillName) {
@@ -2627,6 +2647,67 @@ function networkUrlHost(url) {
 		return "(unparseable-url)";
 	}
 }
+/** WebSkillErrorCode 全量白名单（错误码归一用；与 core errors.ts 保持同步） */
+const WHITELIST = /* @__PURE__ */ new Set([
+	"FS_NOT_FOUND",
+	"FS_PATH_OUTSIDE_ROOT",
+	"SKILL_NOT_FOUND",
+	"SKILL_INVALID_METADATA",
+	"SKILL_INVALID_NAME",
+	"SKILL_DUPLICATE_NAME",
+	"SKILL_UNSUPPORTED_SCRIPT",
+	"VALIDATION_FAILED",
+	"TOOL_NOT_FOUND",
+	"TOOL_EXECUTION_FAILED",
+	"NETWORK_BLOCKED",
+	"TOOL_UNSUPPORTED",
+	"TOOL_SCHEMA_UNAVAILABLE",
+	"RUN_TIMEOUT",
+	"RUN_MAX_TURNS_EXCEEDED",
+	"RUN_FAILED",
+	"RUN_CANCELLED",
+	"RUN_INTERACTION_TIMEOUT",
+	"UI_UNAVAILABLE",
+	"LLM_UNAVAILABLE",
+	"LLM_REQUEST_FAILED",
+	"INSTALL_FAILED",
+	"UNINSTALL_FAILED",
+	"EXPORT_FAILED",
+	"INTEGRITY_FAILED",
+	"FS_PERMISSION_DENIED",
+	"MCP_ENDPOINT_UNAVAILABLE",
+	"MCP_TOOL_NOT_FOUND",
+	"CANDIDATE_INVALID",
+	"APPROVAL_REQUIRED",
+	"SKILL_QUARANTINED",
+	"SKILL_DISABLED",
+	"SKILL_UNKNOWN_ALLOWED_TOOL",
+	"SKILL_UNKNOWN_DEPENDENCY",
+	"SKILL_CIRCULAR_DEPENDENCY",
+	"GOVERNANCE_FAILED",
+	"RUN_SNAPSHOT_NOT_FOUND",
+	"RUN_SNAPSHOT_EXPIRED",
+	"RUN_SNAPSHOT_INCOMPATIBLE"
+]);
+/**
+* 错误码白名单归一：沙箱/桥消息里出现的非白名单码（DOMException 数值码、
+* Node 任意 ERR_* 码等）一律归为 TOOL_EXECUTION_FAILED。
+*/
+function normalizeErrorCode(code) {
+	return typeof code === "string" && WHITELIST.has(code) ? code : "TOOL_EXECUTION_FAILED";
+}
+/** 归一化后的 (code, message)：非白名单码保留在 message 尾部（[original code: X]） */
+function normalizeToolError(code, message) {
+	const normalized = normalizeErrorCode(code);
+	if (typeof code === "string" && normalized === code) return {
+		code: normalized,
+		message
+	};
+	return {
+		code: normalized,
+		message: `${message} [original code: ${String(code)}]`
+	};
+}
 /**
 * Per-capability 强制授权判定（宿主侧，browser/node 执行器共用单一来源）。
 * 'require-approval' 模式下经注入的 UiBridge 发 authorize 交互；
@@ -2651,6 +2732,7 @@ var CapabilityApproval = class CapabilityApproval {
 	async authorize(input) {
 		const { runId, capability, mode } = input;
 		if (mode === false) return "disabled";
+		if (mode !== true && mode !== "require-approval") return "disabled";
 		if (mode !== "require-approval") return "allowed";
 		if (this.#scope === "once-per-run" && this.#approved.get(runId)?.has(capability)) return "allowed";
 		if (!this.#uiBridge) return "denied";
@@ -2678,4 +2760,4 @@ var CapabilityApproval = class CapabilityApproval {
 };
 
 //#endregion
-export { isNetworkAllowed as A, bridgeError as C, extractChartSpec as D, createWebSkillApi as E, resolveToolName as F, schemaToForm as I, toLlmToolSpec as L, networkUrlHost as M, normalizeToolContent as N, fromVercelResult as O, parseBridgeRequest as P, toVercelToolSpecs as R, WebSkillRuntime as S, createScriptContext as T, READ_SKILL_FILE_TOOL as _, AnthropicClient as a, SerializingMemoryStore as b, FsArtifactStore as c, FullDisclosureRouter as d, GoogleGenAiClient as f, READ_SKILL_FILE_INPUT_SCHEMA as g, ProgressiveRouter as h, AgentLoop as i, mergeCatalogEntries as j, fromVercelStreamPart as k, FsMemoryStore as l, OpenAiCompatibleClient as m, ASK_USER_TOOL as n, CapabilityApproval as o, HookRunner as p, ASK_USER_TOOL_NAME as r, EventBus as s, ASK_USER_INPUT_SCHEMA as t, FsRunSnapshotStore as u, READ_SKILL_FILE_TOOL_NAME as v, buildRenderResult as w, TraceRecorder as x, RUN_SNAPSHOT_SCHEMA_VERSION as y };
+export { isNetworkAllowed as A, toVercelToolSpecs as B, bridgeError as C, extractChartSpec as D, createWebSkillApi as E, normalizeToolError as F, parseBridgeRequest as I, resolveToolName as L, networkUrlHost as M, normalizeErrorCode as N, fromVercelResult as O, normalizeToolContent as P, schemaToForm as R, WebSkillRuntime as S, createScriptContext as T, READ_SKILL_FILE_TOOL as _, AnthropicClient as a, SerializingMemoryStore as b, FsArtifactStore as c, FullDisclosureRouter as d, GoogleGenAiClient as f, READ_SKILL_FILE_INPUT_SCHEMA as g, ProgressiveRouter as h, AgentLoop as i, mergeCatalogEntries as j, fromVercelStreamPart as k, FsMemoryStore as l, OpenAiCompatibleClient as m, ASK_USER_TOOL as n, CapabilityApproval as o, HookRunner as p, ASK_USER_TOOL_NAME as r, EventBus as s, ASK_USER_INPUT_SCHEMA as t, FsRunSnapshotStore as u, READ_SKILL_FILE_TOOL_NAME as v, buildRenderResult as w, TraceRecorder as x, RUN_SNAPSHOT_SCHEMA_VERSION as y, toLlmToolSpec as z };

package/dist/{dist-BJobG0i-.js → dist-CeNAzFYi.js}

@@ -1,4 +1,4 @@
-import { u as WebSkillError } from "./dist-D0saNPi_.js";
+import { u as WebSkillError } from "./dist-D7MsoMPx.js";
 
 //#region ../ui/dist/index.js
 /** 提交值按请求类型归形（WebFormBridge 与框架组件库共享单一来源） */

package/dist/{dist-Cn9GpW6Q.js → dist-Chgf2tcy.js}

@@ -1,5 +1,5 @@
-import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, O as resolveArchiveLimits, T as readResponseWithLimit, b as isValidSkillName, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D0saNPi_.js";
-import { A as isNetworkAllowed, C as bridgeError, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, l as FsMemoryStore, o as CapabilityApproval } from "./dist-DrySSQ5R.js";
+import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, O as resolveArchiveLimits, T as readResponseWithLimit, b as isValidSkillName, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D7MsoMPx.js";
+import { A as isNetworkAllowed, C as bridgeError, F as normalizeToolError, I as parseBridgeRequest, M as networkUrlHost, P as normalizeToolContent, c as FsArtifactStore, l as FsMemoryStore, o as CapabilityApproval } from "./dist-CV64gN62.js";
 import { createRequire } from "node:module";
 import { unzipSync, zipSync } from "fflate";
 import { existsSync, promises, realpathSync } from "node:fs";
@@ -37,13 +37,16 @@ async function realpathNearest(platformPath) {
 * 可选 root 模式：构造传入 root 后，read/write 操作先做 realpath 包含校验
 * （root 与目标都 realpath 后前缀比对），经符号链接逃逸 root → FS_PATH_OUTSIDE_ROOT。
 */
-var NodeFS = class {
+var NodeFS = class NodeFS {
 	kind = "node";
 	#root;
 	constructor(deps = {}) {
 		this.#root = deps.root;
 	}
-	/** root 模式：目标 realpath 必须落在 root realpath 前缀内（符号链接逃逸防护） */
+	/** root 模式：全部方法（read/write/exists/stat/list/mkdir/remove/rename）目标 realpath 必须落在 root realpath 前缀内 */
+	withRoot(root) {
+		return new NodeFS({ root });
+	}
 	async #assertContained(p) {
 		if (!this.#root) return;
 		const rootReal = await promises.realpath(toPlatform$4(this.#root));
@@ -64,6 +67,12 @@ var NodeFS = class {
 		await promises.mkdir(path.dirname(target), { recursive: true });
 		await promises.writeFile(target, content, "utf8");
 	}
+	async appendText(p, content) {
+		await this.#assertContained(p);
+		const target = toPlatform$4(p);
+		await promises.mkdir(path.dirname(target), { recursive: true });
+		await promises.appendFile(target, content, "utf8");
+	}
 	async readBinary(p) {
 		await this.#assertContained(p);
 		try {
@@ -79,6 +88,7 @@ var NodeFS = class {
 		await promises.writeFile(target, content);
 	}
 	async exists(p) {
+		await this.#assertContained(p);
 		try {
 			await promises.access(toPlatform$4(p));
 			return true;
@@ -87,6 +97,7 @@ var NodeFS = class {
 		}
 	}
 	async stat(p) {
+		await this.#assertContained(p);
 		try {
 			const s = await promises.stat(toPlatform$4(p));
 			return {
@@ -100,6 +111,7 @@ var NodeFS = class {
 		}
 	}
 	async list(p) {
+		await this.#assertContained(p);
 		let dirents;
 		try {
 			dirents = await promises.readdir(toPlatform$4(p), { withFileTypes: true });
@@ -112,9 +124,11 @@ var NodeFS = class {
 		}));
 	}
 	async mkdir(p) {
+		await this.#assertContained(p);
 		await promises.mkdir(toPlatform$4(p), { recursive: true });
 	}
 	async remove(p, options) {
+		await this.#assertContained(p);
 		try {
 			await promises.rm(toPlatform$4(p), { recursive: options?.recursive ?? false });
 		} catch (e) {
@@ -122,6 +136,8 @@ var NodeFS = class {
 		}
 	}
 	async rename(from, to) {
+		await this.#assertContained(from);
+		await this.#assertContained(to);
 		await promises.mkdir(path.dirname(toPlatform$4(to)), { recursive: true });
 		try {
 			await promises.rename(toPlatform$4(from), toPlatform$4(to));
@@ -303,8 +319,10 @@ function workerEntryPath() {
 * 能力桥协议与浏览器同一来源（runtime/sandbox/bridgeProtocol）。
 *
 * 诚实标注：本执行器做的是**能力面收敛**（网络策略、模块 allowlist、资源限额、
-* 超时强杀），**不是安全边界**——Worker 内脚本与宿主共享进程，仍有绕过手段；
-* 禁止假定其可隔离不可信脚本。
+* 超时强杀），**不是安全边界**——Worker 内脚本与宿主共享进程；
+* 已知主动逃逸面（process.binding/_linkedBinding/dlopen/openStdin/reallyExit/abort）
+* 已在入口删除（0.2.3），常规 import 拦截之外不承诺防御其它宿主共享面；
+* 禁止假定其可隔离不可信脚本（隔离级需求用 ProcessSandboxExecutor）。
 */
 var SandboxedScriptExecutor = class {
 	#fs;
@@ -379,12 +397,13 @@ var SandboxedScriptExecutor = class {
 			}, timeoutMs, (request) => this.#handleBridge(request, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!result.ok) {
 				const stderrSummary = result.stderr?.length ? ` | stderr: ${result.stderr.join(" | ").slice(0, 500)}` : "";
+				const normalized = normalizeToolError(result.error?.code, result.error?.message ?? "script execution failed");
 				return {
 					ok: false,
 					content: [],
 					error: {
-						code: result.error?.code ?? "TOOL_EXECUTION_FAILED",
-						message: `${result.error?.message ?? "script execution failed"}${stderrSummary}`
+						code: normalized.code,
+						message: `${normalized.message}${stderrSummary}`
 					}
 				};
 			}
@@ -461,7 +480,7 @@ var SandboxedScriptExecutor = class {
 			});
 			worker.on("error", (e) => done(() => reject(e)));
 			worker.on("exit", (code) => {
-				if (code !== 0) done(() => reject(new WebSkillError("TOOL_EXECUTION_FAILED", `Sandbox worker exited with code ${code}`)));
+				if (!settled) done(() => reject(new WebSkillError("TOOL_EXECUTION_FAILED", `Sandbox worker exited ${code === null ? "by signal" : `with code ${code}`} without producing a result`)));
 			});
 		});
 	}
@@ -644,8 +663,11 @@ var ProcessSandboxExecutor = class {
 				...readAllow(artifactDir),
 				...writeAllow(artifactDir)
 			],
-			silent: false
+			env: Object.fromEntries((this.#options.envWhitelist ?? []).filter((key) => process.env[key] !== void 0).map((key) => [key, process.env[key]])),
+			silent: true
 		});
+		child.stdout?.resume();
+		child.stderr?.resume();
 		child.unref();
 		child.channel?.unref();
 		return {
@@ -708,12 +730,13 @@ var ProcessSandboxExecutor = class {
 			}, timeoutMs, (request) => this.#handleBridge(request, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!result.ok) {
 				const stderrSummary = result.stderr?.length ? ` | stderr: ${result.stderr.join(" | ").slice(0, 500)}` : "";
+				const normalized = normalizeToolError(result.error?.code, result.error?.message ?? "script execution failed");
 				return {
 					ok: false,
 					content: [],
 					error: {
-						code: result.error?.code ?? "TOOL_EXECUTION_FAILED",
-						message: `${result.error?.message ?? "script execution failed"}${stderrSummary}`
+						code: normalized.code,
+						message: `${normalized.message}${stderrSummary}`
 					}
 				};
 			}