@webskill/sdk 0.2.2 → 0.2.4

package/dist/{dist-D0saNPi_.js → dist-D7MsoMPx.js}

@@ -111,6 +111,18 @@ var MemoryFS = class {
 	async writeText(path, content) {
 		await this.writeBinary(path, new TextEncoder().encode(content));
 	}
+	async appendText(path, content) {
+		const key = this.#normalize(path);
+		const existing = this.#entries.get(key);
+		if (existing && existing.type !== "file") throw new WebSkillError("FS_PERMISSION_DENIED", `Cannot append to a directory: ${key}`);
+		const prior = existing ? new TextDecoder().decode(existing.content) : "";
+		this.#ensureParents(key);
+		this.#entries.set(key, {
+			type: "file",
+			content: new TextEncoder().encode(prior + content),
+			mtimeMs: Date.now()
+		});
+	}
 	async readBinary(path) {
 		return this.#getFile(this.#normalize(path)).content;
 	}
@@ -203,7 +215,9 @@ function normalizePath(path) {
 * 拒绝空串、`.`、`..`、含 `/` 或 `\`、含 `:`（Windows 盘符/ADS）。
 * 违规抛 FS_PATH_OUTSIDE_ROOT（kind 用于错误消息定位，如 "runId"）。
 */
+const CONTROL_CHARS_RE = /[\x00-\x1f\x7f]/;
 function assertSafePathSegment(segment, kind) {
+	if (CONTROL_CHARS_RE.test(segment)) throw new WebSkillError("FS_PATH_OUTSIDE_ROOT", `Invalid ${kind} (control characters including NUL are not allowed): ${JSON.stringify(segment)}`);
 	if (segment === "" || segment === "." || segment === ".." || segment.includes("/") || segment.includes("\\") || segment.includes(":")) throw new WebSkillError("FS_PATH_OUTSIDE_ROOT", `Invalid ${kind} (must be a single safe path segment): ${JSON.stringify(segment)}`);
 }
 /**
@@ -221,6 +235,7 @@ function resolveInsideRoot(root, relativePath) {
 	if (relativePath.trim() === "") fail("empty path");
 	if (relativePath.startsWith("/") || relativePath.startsWith("\\") || /^[a-zA-Z]:[\\/]/.test(relativePath)) fail("absolute paths not allowed");
 	const segments = relativePath.replace(/\\/g, "/").split("/");
+	if (CONTROL_CHARS_RE.test(relativePath)) fail("control characters including NUL are not allowed");
 	if (segments.some((s) => s === "..")) fail("`..` segments not allowed");
 	const clean = segments.filter((s) => s !== "" && s !== ".");
 	if (clean.length === 0) fail("path resolves to empty");
@@ -392,6 +407,7 @@ async function exportSkills(fs, input) {
 		for (const root of input.roots) {
 			const base = root.replace(/\/+$/, "");
 			const manifest = await input.manifestBuilder(base);
+			if (!isValidSkillName(manifest.name)) throw new WebSkillError("EXPORT_FAILED", `Skill "${manifest.name}" has an invalid name and cannot be exported to a skill pack`);
 			skills.push({
 				name: manifest.name,
 				digest: manifest.integrity.digest
@@ -427,7 +443,7 @@ function parseSkillPackManifest(text) {
 	for (const entry of record["skills"]) {
 		if (typeof entry !== "object" || entry === null) invalid("skill entry is not an object");
 		const { name, digest } = entry;
-		if (typeof name !== "string" || name === "") invalid("skill entry missing a valid \"name\"");
+		if (typeof name !== "string" || name === "" || !isValidSkillName(name)) invalid(`skill entry has an invalid name: ${JSON.stringify(name)}`);
 		if (typeof digest !== "string" || digest === "") invalid(`skill "${name}" missing a valid "digest"`);
 	}
 	return raw;
@@ -468,6 +484,14 @@ async function unzipWithLimits(data, limits) {
 	const unzip = new Unzip();
 	unzip.register(UnzipInflate);
 	unzip.onfile = (file) => {
+		if (file.name.startsWith("/") || file.name.startsWith("\\") || /^[a-zA-Z]:[\\/]/.test(file.name)) {
+			failure = new WebSkillError("INSTALL_FAILED", `Archive entry escapes the destination root: ${file.name}`);
+			return;
+		}
+		if (file.name.replace(/\\/g, "/").split("/").some((s) => s === "..") || /[\x00-\x1f\x7f]/.test(file.name)) {
+			failure = new WebSkillError("INSTALL_FAILED", `Archive entry escapes the destination root: ${file.name}`);
+			return;
+		}
 		if (file.name.endsWith("/")) {
 			entries.push([file.name, /* @__PURE__ */ new Uint8Array(0)]);
 			return;
@@ -579,7 +603,7 @@ var SkillDiscovery = class {
 		const candidates = [];
 		const knownSkillNames = /* @__PURE__ */ new Set();
 		const adjacency = /* @__PURE__ */ new Map();
-		for (const root of this.#roots) {
+		for (const [rootIndex, root] of this.#roots.entries()) {
 			if (!await this.#fs.exists(root)) {
 				issues.push({
 					code: "FS_NOT_FOUND",
@@ -604,6 +628,7 @@ var SkillDiscovery = class {
 				candidates.push({
 					dirName,
 					skillRoot,
+					rootIndex,
 					hasSkillMd,
 					metadata,
 					parseError,
@@ -616,6 +641,7 @@ var SkillDiscovery = class {
 				}
 			}));
 		}
+		candidates.sort((a, b) => a.rootIndex - b.rootIndex || a.dirName.localeCompare(b.dirName));
 		const cycles = checkDependencyCycles(adjacency);
 		const claimedNames = /* @__PURE__ */ new Set();
 		for (const candidate of candidates) {

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
-import { F as SkillDocument, N as SkillCatalogEntry, c as LlmClient, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { Q as ScriptExecutor, dt as WebSkillRuntime, ft as WebSkillRuntimeDeps, q as RuntimeRun, tt as SkillStateGuard } from "./index-gjFuBevI.js";
-import { d as SkillManager } from "./index-BmzysJX5.js";
+import { F as SkillDocument, N as SkillCatalogEntry, c as LlmClient, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { Q as ScriptExecutor, dt as WebSkillRuntime, ft as WebSkillRuntimeDeps, q as RuntimeRun, tt as SkillStateGuard } from "./index-DZShzhon.js";
+import { d as SkillManager } from "./index-DrHelz72.js";
 //#region ../governance/dist/index.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';
@@ -209,7 +209,12 @@ interface AuditChainVerification {
   brokenAt?: number;
   reason?: string;
 }
-/** JSONL 追加的审计日志：<managedRoot>/.webskill/audit.jsonl；跨实例可恢复查询；prevHash 链可校验完整性 */
+/**
+ * JSONL 追加式审计日志（<managedRoot>/.webskill/audit.jsonl）：
+ * 真追加（fs.appendText，不整读改写）+ lastHash 内存缓存（同实例不重读）。
+ * 语义：**tamper-evident, not tamper-proof**——verifyChain 能检出篡改/删除/换序，
+ * 但不阻止有写权限者直接改写文件；更强保证需要签名信任体系（未排期）。
+ */
 declare class FsAuditLog implements AuditLog {
   #private;
   constructor(deps: {
@@ -360,8 +365,10 @@ declare class EvaluationRunner {
 //#region src/evaluation/evaluationRuntime.d.ts
 /**
  * 治理评估专用 runtime 装配（不可信技能试用路径）：
- * 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离）；
- * 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态）。
+ * 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离；子进程
+ * env 默认清空防密钥泄露，需透传时经 ProcessSandboxOptions.envWhitelist 显式放行）。
+ * 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态，
+ * 非安全边界；envWhitelist 同样适用于该执行器）。
  */
 declare function createEvaluationRuntime(deps: WebSkillRuntimeDeps & {
   executor?: ScriptExecutor;

package/dist/governance.js

@@ -1,6 +1,6 @@
-import { A as unzipWithLimits, b as isValidSkillName, d as assertSafePathSegment, j as validateSkills, k as resolveInsideRoot, u as WebSkillError } from "./dist-D0saNPi_.js";
-import { S as WebSkillRuntime } from "./dist-DrySSQ5R.js";
-import { i as NodeFS, s as ProcessSandboxExecutor, u as exportArchive } from "./dist-Cn9GpW6Q.js";
+import { A as unzipWithLimits, b as isValidSkillName, d as assertSafePathSegment, j as validateSkills, k as resolveInsideRoot, u as WebSkillError } from "./dist-D7MsoMPx.js";
+import { S as WebSkillRuntime } from "./dist-CV64gN62.js";
+import { i as NodeFS, s as ProcessSandboxExecutor, u as exportArchive } from "./dist-Chgf2tcy.js";
 import path from "node:path";
 import { tmpdir } from "node:os";
 import { mkdtemp } from "node:fs/promises";
@@ -404,29 +404,42 @@ function canonical(event) {
 		prevHash: event.prevHash
 	});
 }
-/** JSONL 追加的审计日志：<managedRoot>/.webskill/audit.jsonl；跨实例可恢复查询；prevHash 链可校验完整性 */
+/**
+* JSONL 追加式审计日志（<managedRoot>/.webskill/audit.jsonl）：
+* 真追加（fs.appendText，不整读改写）+ lastHash 内存缓存（同实例不重读）。
+* 语义：**tamper-evident, not tamper-proof**——verifyChain 能检出篡改/删除/换序，
+* 但不阻止有写权限者直接改写文件；更强保证需要签名信任体系（未排期）。
+*/
 var FsAuditLog = class {
 	#root;
 	#fs;
 	#now;
 	#createId;
+	/** lastHash 内存缓存（同实例内追加不重读文件） */
+	#lastHash;
+	#lastHashSeeded = false;
 	constructor(deps) {
 		this.#root = deps.root.replace(/\/+$/, "");
 		this.#fs = deps.fs;
 		this.#now = deps.now;
 		this.#createId = deps.createId;
 	}
-	async append(event) {
+	/** 首追加时播种 lastHash（读一次尾部；尾行损坏 → 抛错，不静默重开链） */
+	async #seedLastHash() {
+		this.#lastHashSeeded = true;
 		const path = fileOf$1(this.#root);
-		const existing = await this.#fs.exists(path) ? await this.#fs.readText(path) : "";
-		const lines = existing.split("\n").filter((l) => l.trim() !== "");
-		let prevHash = "GENESIS";
-		if (lines.length > 0) try {
+		if (!await this.#fs.exists(path)) return "GENESIS";
+		const lines = (await this.#fs.readText(path)).split("\n").filter((l) => l.trim() !== "");
+		if (lines.length === 0) return "GENESIS";
+		try {
 			const last = JSON.parse(lines.at(-1));
-			prevHash = last.hash ?? sha256Hex(canonical(last));
-		} catch {
-			prevHash = "GENESIS";
+			return last.hash ?? sha256Hex(canonical(last));
+		} catch (e) {
+			throw new WebSkillError("GOVERNANCE_FAILED", `Audit log tail line at ${path} is corrupted; refusing to append (the chain must not silently restart)`, e);
 		}
+	}
+	async append(event) {
+		const prevHash = this.#lastHashSeeded ? this.#lastHash : await this.#seedLastHash();
 		const full = {
 			id: event.id ?? this.#createId?.() ?? `audit-${Math.random().toString(36).slice(2, 10)}`,
 			ts: event.ts ?? this.#now?.() ?? (/* @__PURE__ */ new Date()).toISOString(),
@@ -437,8 +450,8 @@ var FsAuditLog = class {
 			prevHash
 		};
 		full.hash = sha256Hex(canonical(full));
-		const prefix = existing === "" || existing.endsWith("\n") ? existing : `${existing}\n`;
-		await this.#fs.writeText(path, `${prefix}${JSON.stringify(full)}\n`);
+		await this.#fs.appendText(fileOf$1(this.#root), `${JSON.stringify(full)}\n`);
+		this.#lastHash = full.hash;
 		return full;
 	}
 	async query(filter) {
@@ -448,7 +461,12 @@ var FsAuditLog = class {
 		const events = [];
 		for (const line of raw.split("\n")) {
 			if (line.trim() === "") continue;
-			const event = JSON.parse(line);
+			let event;
+			try {
+				event = JSON.parse(line);
+			} catch {
+				continue;
+			}
 			if (filter.target !== void 0 && event.target !== filter.target) continue;
 			if (filter.type !== void 0 && event.type !== filter.type) continue;
 			if (filter.since !== void 0 && event.ts < filter.since) continue;
@@ -843,8 +861,10 @@ var EvaluationRunner = class {
 };
 /**
 * 治理评估专用 runtime 装配（不可信技能试用路径）：
-* 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离）；
-* 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态）。
+* 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离；子进程
+* env 默认清空防密钥泄露，需透传时经 ProcessSandboxOptions.envWhitelist 显式放行）。
+* 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态，
+* 非安全边界；envWhitelist 同样适用于该执行器）。
 */
 function createEvaluationRuntime(deps) {
 	return new WebSkillRuntime({

package/dist/{index-gjFuBevI.d.ts → index-DZShzhon.d.ts}

@@ -1,4 +1,4 @@
-import { F as SkillDocument, G as ValidationReport, I as SkillInstallSource, M as SkillCatalog, N as SkillCatalogEntry, P as SkillDiscovery, S as DiscoveryResult, T as JsonSchema, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
+import { F as SkillDocument, G as ValidationReport, I as SkillInstallSource, J as WebSkillErrorCode, M as SkillCatalog, N as SkillCatalogEntry, P as SkillDiscovery, S as DiscoveryResult, T as JsonSchema, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
 //#region ../runtime/dist/index.d.ts
 //#region src/llm/openAiCompatibleClient.d.ts
 interface OpenAiCompatibleClientConfig {
@@ -33,6 +33,11 @@ interface AnthropicClientConfig {
   requestTimeoutMs?: number;
   /** max_tokens（Messages API 必填），默认 4096 */
   maxTokens?: number;
+  /**
+   * 浏览器直调 opt-in：true 时发送 anthropic-dangerous-direct-browser-access 头
+   * （默认 false 不发——仅在明确运行于浏览器且无服务端代理时开启）
+   */
+  dangerouslyAllowDirectBrowserAccess?: boolean;
 }
 /** Anthropic Messages API 客户端（零依赖 fetch；Node/浏览器通用） */
 declare class AnthropicClient implements LlmClient {
@@ -540,6 +545,18 @@ declare function isNetworkAllowed(policy: NetworkPolicy, url: string): boolean;
 /** 阻断 trace 用的脱敏 host（解析失败返回占位，不记录完整 URL） */
 declare function networkUrlHost(url: string): string;
 //#endregion
+//#region src/sandbox/errorCodes.d.ts
+/**
+ * 错误码白名单归一：沙箱/桥消息里出现的非白名单码（DOMException 数值码、
+ * Node 任意 ERR_* 码等）一律归为 TOOL_EXECUTION_FAILED。
+ */
+declare function normalizeErrorCode(code: unknown): WebSkillErrorCode;
+/** 归一化后的 (code, message)：非白名单码保留在 message 尾部（[original code: X]） */
+declare function normalizeToolError(code: unknown, message: string): {
+  code: WebSkillErrorCode;
+  message: string;
+};
+//#endregion
 //#region src/sandbox/approval.d.ts
 /** 桥消息对应的三类能力 */
 type BridgeCapability = 'readReference' | 'writeArtifact' | 'confirm';
@@ -810,4 +827,4 @@ declare class WebSkillRuntime {
   resumeRun(runId: string): Promise<RunResult>;
 }
 //#endregion
-export { SerializingMemoryStore as $, LifecycleHook as A, RUN_SNAPSHOT_SCHEMA_VERSION as B, FullDisclosureRouter as C, normalizeToolContent as Ct, HookRunnerOptions as D, toLlmToolSpec as Dt, HookRunner as E, schemaToForm as Et, OpenAiCompatibleClientConfig as F, RunTerminationReason as G, RunResult as H, ProgressiveRouter as I, RuntimeSession as J, RuntimePhase as K, READ_SKILL_FILE_INPUT_SCHEMA as L, LifecycleListener as M, NetworkPolicy as N, InstalledSkillManifest as O, toVercelToolSpecs as Ot, OpenAiCompatibleClient as P, ScriptExecutor as Q, READ_SKILL_FILE_TOOL as R, FsRunSnapshotStore as S, networkUrlHost as St, GoogleGenAiClientConfig as T, resolveToolName as Tt, RunSnapshot as U, RouteResult as V, RunSnapshotStore as W, SchemaInferer as X, RuntimeSessionHandle as Y, ScriptExecutionContext as Z, EventBus as _, extractChartSpec as _t, AgentLoopConfig as a, TraceClock as at, FsArtifactStore as b, isNetworkAllowed as bt, AnthropicClientConfig as c, TraceRecorder as ct, BridgeCapabilities as d, WebSkillRuntime as dt, SkillRouter as et, BridgeCapability as f, WebSkillRuntimeDeps as ft, CapabilityMode as g, createWebSkillApi as gt, CapabilityApproval as h, createScriptContext as ht, AgentLoop as i, ToolResult as it, LifecycleHookContext as j, LifecycleEvent as k, ApprovalDecision as l, VercelToolSpec as lt, BridgeResponse as m, buildRenderResult as mt, ASK_USER_TOOL as n, ToolDefinition as nt, AgentLoopDeps as o, TraceEvent as ot, BridgeRequest as p, bridgeError as pt, RuntimeRun as q, ASK_USER_TOOL_NAME as r, ToolResolution as rt, AnthropicClient as s, TraceEventType as st, ASK_USER_INPUT_SCHEMA as t, SkillStateGuard as tt, ApprovalScope as u, WebSkillApi as ut, ExternalSkillProvider as v, fromVercelResult as vt, GoogleGenAiClient as w, parseBridgeRequest as wt, FsMemoryStore as x, mergeCatalogEntries as xt, ExternalToolSource as y, fromVercelStreamPart as yt, READ_SKILL_FILE_TOOL_NAME as z };
+export { SerializingMemoryStore as $, LifecycleHook as A, toVercelToolSpecs as At, RUN_SNAPSHOT_SCHEMA_VERSION as B, FullDisclosureRouter as C, normalizeErrorCode as Ct, HookRunnerOptions as D, resolveToolName as Dt, HookRunner as E, parseBridgeRequest as Et, OpenAiCompatibleClientConfig as F, RunTerminationReason as G, RunResult as H, ProgressiveRouter as I, RuntimeSession as J, RuntimePhase as K, READ_SKILL_FILE_INPUT_SCHEMA as L, LifecycleListener as M, NetworkPolicy as N, InstalledSkillManifest as O, schemaToForm as Ot, OpenAiCompatibleClient as P, ScriptExecutor as Q, READ_SKILL_FILE_TOOL as R, FsRunSnapshotStore as S, networkUrlHost as St, GoogleGenAiClientConfig as T, normalizeToolError as Tt, RunSnapshot as U, RouteResult as V, RunSnapshotStore as W, SchemaInferer as X, RuntimeSessionHandle as Y, ScriptExecutionContext as Z, EventBus as _, extractChartSpec as _t, AgentLoopConfig as a, TraceClock as at, FsArtifactStore as b, isNetworkAllowed as bt, AnthropicClientConfig as c, TraceRecorder as ct, BridgeCapabilities as d, WebSkillRuntime as dt, SkillRouter as et, BridgeCapability as f, WebSkillRuntimeDeps as ft, CapabilityMode as g, createWebSkillApi as gt, CapabilityApproval as h, createScriptContext as ht, AgentLoop as i, ToolResult as it, LifecycleHookContext as j, LifecycleEvent as k, toLlmToolSpec as kt, ApprovalDecision as l, VercelToolSpec as lt, BridgeResponse as m, buildRenderResult as mt, ASK_USER_TOOL as n, ToolDefinition as nt, AgentLoopDeps as o, TraceEvent as ot, BridgeRequest as p, bridgeError as pt, RuntimeRun as q, ASK_USER_TOOL_NAME as r, ToolResolution as rt, AnthropicClient as s, TraceEventType as st, ASK_USER_INPUT_SCHEMA as t, SkillStateGuard as tt, ApprovalScope as u, WebSkillApi as ut, ExternalSkillProvider as v, fromVercelResult as vt, GoogleGenAiClient as w, normalizeToolContent as wt, FsMemoryStore as x, mergeCatalogEntries as xt, ExternalToolSource as y, fromVercelStreamPart as yt, READ_SKILL_FILE_TOOL_NAME as z };

package/dist/{index-BmzysJX5.d.ts → index-DrHelz72.d.ts}

@@ -1,5 +1,5 @@
-import { C as FileStat, I as SkillInstallSource, K as VerifyResult, T as JsonSchema, W as SkillsLockfile, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { N as NetworkPolicy, Q as ScriptExecutor, X as SchemaInferer, Z as ScriptExecutionContext, b as FsArtifactStore, d as BridgeCapabilities, it as ToolResult, nt as ToolDefinition, u as ApprovalScope, x as FsMemoryStore } from "./index-gjFuBevI.js";
+import { C as FileStat, I as SkillInstallSource, K as VerifyResult, T as JsonSchema, W as SkillsLockfile, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { N as NetworkPolicy, Q as ScriptExecutor, X as SchemaInferer, Z as ScriptExecutionContext, b as FsArtifactStore, d as BridgeCapabilities, it as ToolResult, nt as ToolDefinition, u as ApprovalScope, x as FsMemoryStore } from "./index-DZShzhon.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts
 //#region src/fs/nodeFs.d.ts
@@ -14,8 +14,11 @@ declare class NodeFS implements FileSystemProvider {
   constructor(deps?: {
     root?: string;
   });
+  /** root 模式：全部方法（read/write/exists/stat/list/mkdir/remove/rename）目标 realpath 必须落在 root realpath 前缀内 */
+  withRoot(root: string): NodeFS;
   readText(p: string): Promise<string>;
   writeText(p: string, content: string): Promise<void>;
+  appendText(p: string, content: string): Promise<void>;
   readBinary(p: string): Promise<Uint8Array>;
   writeBinary(p: string, content: Uint8Array): Promise<void>;
   exists(p: string): Promise<boolean>;
@@ -72,8 +75,10 @@ interface SandboxOptions {
  * 能力桥协议与浏览器同一来源（runtime/sandbox/bridgeProtocol）。
  *
  * 诚实标注：本执行器做的是**能力面收敛**（网络策略、模块 allowlist、资源限额、
- * 超时强杀），**不是安全边界**——Worker 内脚本与宿主共享进程，仍有绕过手段；
- * 禁止假定其可隔离不可信脚本。
+ * 超时强杀），**不是安全边界**——Worker 内脚本与宿主共享进程；
+ * 已知主动逃逸面（process.binding/_linkedBinding/dlopen/openStdin/reallyExit/abort）
+ * 已在入口删除（0.2.3），常规 import 拦截之外不承诺防御其它宿主共享面；
+ * 禁止假定其可隔离不可信脚本（隔离级需求用 ProcessSandboxExecutor）。
  */
 declare class SandboxedScriptExecutor implements ScriptExecutor {
   #private;
@@ -92,6 +97,8 @@ declare class SandboxedScriptExecutor implements ScriptExecutor {
 interface ProcessSandboxOptions {
   /** 温池大小（并发上限；执行后 kill 并补位重生），默认 2 */
   poolSize?: number;
+  /** 透传给子进程的环境变量白名单（默认 []：子进程 env 为空，防密钥泄露） */
+  envWhitelist?: string[];
   capabilities?: BridgeCapabilities;
   /** 网络策略：默认 'deny-all'（权限模型无网络维度，补丁兜底；node:net 裸模块为已知残余面） */
   networkPolicy?: NetworkPolicy;

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { $ as checkDependencyCycles, A as SKILL_NAME_PATTERN, B as SkillMetadata, C as FileStat, D as SKILLS_LOCKFILE, E as MemoryFS, F as SkillDocument, G as ValidationReport, H as SkillReader, I as SkillInstallSource, J as WebSkillErrorCode, K as VerifyResult, L as SkillIssue, M as SkillCatalog, N as SkillCatalogEntry, O as SKILL_MANIFEST_FILE, P as SkillDiscovery, Q as buildManifest, R as SkillLocation, S as DiscoveryResult, T as JsonSchema, U as SkillSource, V as SkillPackManifest, W as SkillsLockfile, X as atomicWriteText, Y as assertSafePathSegment, Z as buildCatalog, _ as RenderResultRequest, _t as xmlRenderer, a as InteractionPolicy, at as jsonRenderer, b as CatalogRenderer, c as LlmClient, ct as parseSkillPackManifest, d as LlmResponse, dt as renderCatalogJson, et as checkSkillRules, f as LlmStreamEvent, ft as resolveArchiveLimits, g as RenderBlock, gt as verifyManifest, h as MemoryStore, ht as validateSkills, i as FormField, it as isValidSkillName, j as SKILL_PACK_FILE, k as SKILL_NAME_MAX_LENGTH, l as LlmCompleteInput, lt as readResponseWithLimit, m as LlmToolSpec, mt as unzipWithLimits, n as ArtifactStore, nt as escapeXml, o as InteractionRequest, ot as normalizePath, p as LlmToolCall, pt as resolveInsideRoot, q as WebSkillError, r as ChartSpec, rt as exportSkills, s as InteractionResponse, st as parseSkillMarkdown, t as Artifact, tt as computeDigest, u as LlmMessage, ut as renderAvailableSkillsXml, v as UiBridge, w as FileSystemProvider, x as DEFAULT_ARCHIVE_LIMITS, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { $ as SerializingMemoryStore, A as LifecycleHook, B as RUN_SNAPSHOT_SCHEMA_VERSION, C as FullDisclosureRouter, Ct as normalizeToolContent, D as HookRunnerOptions, Dt as toLlmToolSpec, E as HookRunner, Et as schemaToForm, F as OpenAiCompatibleClientConfig, G as RunTerminationReason, H as RunResult, I as ProgressiveRouter, J as RuntimeSession, K as RuntimePhase, L as READ_SKILL_FILE_INPUT_SCHEMA, M as LifecycleListener, N as NetworkPolicy, O as InstalledSkillManifest, Ot as toVercelToolSpecs, P as OpenAiCompatibleClient, Q as ScriptExecutor, R as READ_SKILL_FILE_TOOL, S as FsRunSnapshotStore, St as networkUrlHost, T as GoogleGenAiClientConfig, Tt as resolveToolName, U as RunSnapshot, V as RouteResult, W as RunSnapshotStore, X as SchemaInferer, Y as RuntimeSessionHandle, Z as ScriptExecutionContext, _ as EventBus, _t as extractChartSpec, a as AgentLoopConfig, at as TraceClock, b as FsArtifactStore, bt as isNetworkAllowed, c as AnthropicClientConfig, ct as TraceRecorder, d as BridgeCapabilities, dt as WebSkillRuntime, et as SkillRouter, f as BridgeCapability, ft as WebSkillRuntimeDeps, g as CapabilityMode, gt as createWebSkillApi, h as CapabilityApproval, ht as createScriptContext, i as AgentLoop, it as ToolResult, j as LifecycleHookContext, k as LifecycleEvent, l as ApprovalDecision, lt as VercelToolSpec, m as BridgeResponse, mt as buildRenderResult, n as ASK_USER_TOOL, nt as ToolDefinition, o as AgentLoopDeps, ot as TraceEvent, p as BridgeRequest, pt as bridgeError, q as RuntimeRun, r as ASK_USER_TOOL_NAME, rt as ToolResolution, s as AnthropicClient, st as TraceEventType, t as ASK_USER_INPUT_SCHEMA, tt as SkillStateGuard, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, vt as fromVercelResult, w as GoogleGenAiClient, wt as parseBridgeRequest, x as FsMemoryStore, xt as mergeCatalogEntries, y as ExternalToolSource, yt as fromVercelStreamPart, z as READ_SKILL_FILE_TOOL_NAME } from "./index-gjFuBevI.js";
-export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type ArchiveLimits, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, DEFAULT_ARCHIVE_LIMITS, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, type RuntimeSessionHandle, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, SerializingMemoryStore, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, type SkillPackManifest, SkillReader, type SkillRouter, type SkillSource, type SkillStateGuard, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };
+import { $ as checkDependencyCycles, A as SKILL_NAME_PATTERN, B as SkillMetadata, C as FileStat, D as SKILLS_LOCKFILE, E as MemoryFS, F as SkillDocument, G as ValidationReport, H as SkillReader, I as SkillInstallSource, J as WebSkillErrorCode, K as VerifyResult, L as SkillIssue, M as SkillCatalog, N as SkillCatalogEntry, O as SKILL_MANIFEST_FILE, P as SkillDiscovery, Q as buildManifest, R as SkillLocation, S as DiscoveryResult, T as JsonSchema, U as SkillSource, V as SkillPackManifest, W as SkillsLockfile, X as atomicWriteText, Y as assertSafePathSegment, Z as buildCatalog, _ as RenderResultRequest, _t as xmlRenderer, a as InteractionPolicy, at as jsonRenderer, b as CatalogRenderer, c as LlmClient, ct as parseSkillPackManifest, d as LlmResponse, dt as renderCatalogJson, et as checkSkillRules, f as LlmStreamEvent, ft as resolveArchiveLimits, g as RenderBlock, gt as verifyManifest, h as MemoryStore, ht as validateSkills, i as FormField, it as isValidSkillName, j as SKILL_PACK_FILE, k as SKILL_NAME_MAX_LENGTH, l as LlmCompleteInput, lt as readResponseWithLimit, m as LlmToolSpec, mt as unzipWithLimits, n as ArtifactStore, nt as escapeXml, o as InteractionRequest, ot as normalizePath, p as LlmToolCall, pt as resolveInsideRoot, q as WebSkillError, r as ChartSpec, rt as exportSkills, s as InteractionResponse, st as parseSkillMarkdown, t as Artifact, tt as computeDigest, u as LlmMessage, ut as renderAvailableSkillsXml, v as UiBridge, w as FileSystemProvider, x as DEFAULT_ARCHIVE_LIMITS, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { $ as SerializingMemoryStore, A as LifecycleHook, At as toVercelToolSpecs, B as RUN_SNAPSHOT_SCHEMA_VERSION, C as FullDisclosureRouter, Ct as normalizeErrorCode, D as HookRunnerOptions, Dt as resolveToolName, E as HookRunner, Et as parseBridgeRequest, F as OpenAiCompatibleClientConfig, G as RunTerminationReason, H as RunResult, I as ProgressiveRouter, J as RuntimeSession, K as RuntimePhase, L as READ_SKILL_FILE_INPUT_SCHEMA, M as LifecycleListener, N as NetworkPolicy, O as InstalledSkillManifest, Ot as schemaToForm, P as OpenAiCompatibleClient, Q as ScriptExecutor, R as READ_SKILL_FILE_TOOL, S as FsRunSnapshotStore, St as networkUrlHost, T as GoogleGenAiClientConfig, Tt as normalizeToolError, U as RunSnapshot, V as RouteResult, W as RunSnapshotStore, X as SchemaInferer, Y as RuntimeSessionHandle, Z as ScriptExecutionContext, _ as EventBus, _t as extractChartSpec, a as AgentLoopConfig, at as TraceClock, b as FsArtifactStore, bt as isNetworkAllowed, c as AnthropicClientConfig, ct as TraceRecorder, d as BridgeCapabilities, dt as WebSkillRuntime, et as SkillRouter, f as BridgeCapability, ft as WebSkillRuntimeDeps, g as CapabilityMode, gt as createWebSkillApi, h as CapabilityApproval, ht as createScriptContext, i as AgentLoop, it as ToolResult, j as LifecycleHookContext, k as LifecycleEvent, kt as toLlmToolSpec, l as ApprovalDecision, lt as VercelToolSpec, m as BridgeResponse, mt as buildRenderResult, n as ASK_USER_TOOL, nt as ToolDefinition, o as AgentLoopDeps, ot as TraceEvent, p as BridgeRequest, pt as bridgeError, q as RuntimeRun, r as ASK_USER_TOOL_NAME, rt as ToolResolution, s as AnthropicClient, st as TraceEventType, t as ASK_USER_INPUT_SCHEMA, tt as SkillStateGuard, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, vt as fromVercelResult, w as GoogleGenAiClient, wt as normalizeToolContent, x as FsMemoryStore, xt as mergeCatalogEntries, y as ExternalToolSource, yt as fromVercelStreamPart, z as READ_SKILL_FILE_TOOL_NAME } from "./index-DZShzhon.js";
+export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type ArchiveLimits, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, DEFAULT_ARCHIVE_LIMITS, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, type RuntimeSessionHandle, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, SerializingMemoryStore, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, type SkillPackManifest, SkillReader, type SkillRouter, type SkillSource, type SkillStateGuard, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { A as unzipWithLimits, C as parseSkillMarkdown, D as renderCatalogJson, E as renderAvailableSkillsXml, M as verifyManifest, N as xmlRenderer, O as resolveArchiveLimits, S as normalizePath, T as readResponseWithLimit, _ as computeDigest, a as SKILL_NAME_MAX_LENGTH, b as isValidSkillName, c as SkillDiscovery, d as assertSafePathSegment, f as atomicWriteText, g as checkSkillRules, h as checkDependencyCycles, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, l as SkillReader, m as buildManifest, n as MemoryFS, o as SKILL_NAME_PATTERN, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, t as DEFAULT_ARCHIVE_LIMITS, u as WebSkillError, v as escapeXml, w as parseSkillPackManifest, x as jsonRenderer, y as exportSkills } from "./dist-D0saNPi_.js";
-import { A as isNetworkAllowed, C as bridgeError, D as extractChartSpec, E as createWebSkillApi, F as resolveToolName, I as schemaToForm, L as toLlmToolSpec, M as networkUrlHost, N as normalizeToolContent, O as fromVercelResult, P as parseBridgeRequest, R as toVercelToolSpecs, S as WebSkillRuntime, T as createScriptContext, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as SerializingMemoryStore, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, k as fromVercelStreamPart, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as buildRenderResult, x as TraceRecorder, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-DrySSQ5R.js";
+import { A as unzipWithLimits, C as parseSkillMarkdown, D as renderCatalogJson, E as renderAvailableSkillsXml, M as verifyManifest, N as xmlRenderer, O as resolveArchiveLimits, S as normalizePath, T as readResponseWithLimit, _ as computeDigest, a as SKILL_NAME_MAX_LENGTH, b as isValidSkillName, c as SkillDiscovery, d as assertSafePathSegment, f as atomicWriteText, g as checkSkillRules, h as checkDependencyCycles, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, l as SkillReader, m as buildManifest, n as MemoryFS, o as SKILL_NAME_PATTERN, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, t as DEFAULT_ARCHIVE_LIMITS, u as WebSkillError, v as escapeXml, w as parseSkillPackManifest, x as jsonRenderer, y as exportSkills } from "./dist-D7MsoMPx.js";
+import { A as isNetworkAllowed, B as toVercelToolSpecs, C as bridgeError, D as extractChartSpec, E as createWebSkillApi, F as normalizeToolError, I as parseBridgeRequest, L as resolveToolName, M as networkUrlHost, N as normalizeErrorCode, O as fromVercelResult, P as normalizeToolContent, R as schemaToForm, S as WebSkillRuntime, T as createScriptContext, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as SerializingMemoryStore, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, k as fromVercelStreamPart, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as buildRenderResult, x as TraceRecorder, y as RUN_SNAPSHOT_SCHEMA_VERSION, z as toLlmToolSpec } from "./dist-CV64gN62.js";
 
-export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, AnthropicClient, CapabilityApproval, DEFAULT_ARCHIVE_LIMITS, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SerializingMemoryStore, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };
+export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, AnthropicClient, CapabilityApproval, DEFAULT_ARCHIVE_LIMITS, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SerializingMemoryStore, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
-import { F as SkillDocument, N as SkillCatalogEntry, T as JsonSchema, m as LlmToolSpec } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { it as ToolResult, v as ExternalSkillProvider, xt as mergeCatalogEntries, y as ExternalToolSource } from "./index-gjFuBevI.js";
+import { F as SkillDocument, N as SkillCatalogEntry, T as JsonSchema, m as LlmToolSpec } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { it as ToolResult, v as ExternalSkillProvider, xt as mergeCatalogEntries, y as ExternalToolSource } from "./index-DZShzhon.js";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -63,7 +63,7 @@ declare class MessageChannelTransport implements Transport {
 /** endpoint 名 → client 注册表；单调版本号，事件驱动等待（禁止轮询） */
 declare class EndpointRegistry<TClient> {
   #private;
-  /** 注册新 endpoint；重名抛错 */
+  /** 注册新 endpoint；重名抛错；含 `__`（endpoint:tool 分隔符）或保留名 mcp 拒绝 */
   register(endpoint: string, client: TClient): void;
   /** 热替换 client，版本号 +1 */
   set(endpoint: string, client: TClient): void;

package/dist/mcp.js

@@ -1,5 +1,5 @@
-import { u as WebSkillError } from "./dist-D0saNPi_.js";
-import { N as normalizeToolContent, j as mergeCatalogEntries } from "./dist-DrySSQ5R.js";
+import { u as WebSkillError } from "./dist-D7MsoMPx.js";
+import { P as normalizeToolContent, j as mergeCatalogEntries } from "./dist-CV64gN62.js";
 
 //#region ../mcp/dist/index.js
 /**
@@ -117,8 +117,9 @@ var EndpointRegistry = class {
 	#clients = /* @__PURE__ */ new Map();
 	#versions = /* @__PURE__ */ new Map();
 	#waiters = /* @__PURE__ */ new Map();
-	/** 注册新 endpoint；重名抛错 */
+	/** 注册新 endpoint；重名抛错；含 `__`（endpoint:tool 分隔符）或保留名 mcp 拒绝 */
 	register(endpoint, client) {
+		if (endpoint.includes("__") || endpoint === "mcp") throw new Error(`Endpoint name ${JSON.stringify(endpoint)} is not allowed (no "__" segments, "mcp" is reserved)`);
 		if (this.#clients.has(endpoint)) throw new Error(`Endpoint "${endpoint}" is already registered`);
 		this.#clients.set(endpoint, client);
 		this.#versions.set(endpoint, (this.#versions.get(endpoint) ?? 0) + 1);
@@ -172,6 +173,8 @@ var EndpointRegistry = class {
 	}
 };
 const messageOf$3 = (e) => e instanceof Error ? e.message : String(e);
+/** MCP 结果单项 text 上限（64KB） */
+const MAX_MCP_RESULT_TEXT_BYTES = 64 * 1024;
 const failure$1 = (code, message) => ({
 	ok: false,
 	content: [],
@@ -235,14 +238,16 @@ var McpToolResolver = class {
 		});
 		return names;
 	}
-	/** CallToolResult → ToolResult；isError 转失败；content 经共享归一 */
+	/** CallToolResult → ToolResult；isError 转失败；形状消毒（无 content 且无 isError 不当作 ok）+ 大小上限 */
 	#normalizeCallResult(raw) {
 		const result = raw;
+		if (result?.isError !== true && result?.content === void 0) return failure$1("MCP_ENDPOINT_UNAVAILABLE", `MCP tool returned a malformed result (no "content" and no "isError"): ${messageOf$3(raw).slice(0, 200)}`);
 		const content = normalizeToolContent(result?.content ?? raw);
 		if (result?.isError === true) {
 			const text = content.map((c) => c.text ?? "").filter(Boolean).join("\n");
 			return failure$1("TOOL_EXECUTION_FAILED", text || "MCP tool returned an error");
 		}
+		for (const item of content) if (item.text !== void 0 && item.text.length > MAX_MCP_RESULT_TEXT_BYTES) item.text = `${item.text.slice(0, MAX_MCP_RESULT_TEXT_BYTES)}…[truncated ${item.text.length - MAX_MCP_RESULT_TEXT_BYTES} chars]`;
 		return {
 			ok: true,
 			content
@@ -414,7 +419,7 @@ var ExperimentalWebMcpAdapter = class {
 		this.#enabled = options?.enabled ?? false;
 	}
 	isAvailable() {
-		return typeof this.#resolveApi()?.executeTool === "function";
+		return this.#enabled && typeof this.#resolveApi()?.executeTool === "function";
 	}
 	/** 工具清单（listTools 缺失/失败时返回 undefined）；描述含 inputSchema 时透传 */
 	async listTools() {
@@ -549,7 +554,12 @@ const messageOf = (e) => e instanceof Error ? e.message : String(e);
 */
 async function connectRemoteEndpoint(registry, config) {
 	const { Client, SSEClientTransport, StreamableHTTPClientTransport } = await loadMcpSdk();
-	const url = new URL(config.url);
+	let url;
+	try {
+		url = new URL(config.url);
+	} catch (e) {
+		throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", `Invalid remote MCP endpoint URL for "${config.endpoint}": ${JSON.stringify(config.url)}`, e);
+	}
 	const requestInit = config.headers ? { headers: config.headers } : void 0;
 	const transport = config.transport === "sse" ? new SSEClientTransport(url, { ...requestInit ? { requestInit } : {} }) : new StreamableHTTPClientTransport(url, { ...requestInit ? { requestInit } : {} });
 	const client = new Client({
@@ -570,7 +580,14 @@ async function connectRemoteEndpoint(registry, config) {
 		} catch {}
 		throw unavailable(e);
 	}
-	registry.register(config.endpoint, client);
+	try {
+		registry.register(config.endpoint, client);
+	} catch (e) {
+		try {
+			await client.close();
+		} catch {}
+		throw unavailable(e);
+	}
 	let closed = false;
 	return { close: async () => {
 		if (closed) return;

package/dist/node.d.ts

@@ -1,5 +1,5 @@
-import { D as SKILLS_LOCKFILE, I as SkillInstallSource, K as VerifyResult, O as SKILL_MANIFEST_FILE, W as SkillsLockfile, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { ht as createScriptContext } from "./index-gjFuBevI.js";
+import { D as SKILLS_LOCKFILE, I as SkillInstallSource, K as VerifyResult, O as SKILL_MANIFEST_FILE, W as SkillsLockfile, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { ht as createScriptContext } from "./index-DZShzhon.js";
 import { n as LlmEnvConfig, s as probeLlmCapabilities, t as LlmCapabilities } from "./env-BPUBZCwJ-4jat_SVG.js";
-import { a as NodeScriptExecutor, c as ProcessSandboxOptions, d as SkillManager, f as exportArchive, i as NodeFS, l as SandboxOptions, n as FileArtifactStore, o as OxcSchemaInferer, p as readArchiveManifest, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as SandboxedScriptExecutor } from "./index-BmzysJX5.js";
+import { a as NodeScriptExecutor, c as ProcessSandboxOptions, d as SkillManager, f as exportArchive, i as NodeFS, l as SandboxOptions, n as FileArtifactStore, o as OxcSchemaInferer, p as readArchiveManifest, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as SandboxedScriptExecutor } from "./index-DrHelz72.js";
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, type LlmCapabilities, type LlmEnvConfig, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, type ProcessSandboxOptions, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, type SandboxOptions, SandboxedScriptExecutor, type SkillInstallSource, SkillManager, type SkillManifest, type SkillsLockfile, type VerifyResult, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };

package/dist/node.js

@@ -1,6 +1,6 @@
-import { i as SKILL_MANIFEST_FILE, r as SKILLS_LOCKFILE } from "./dist-D0saNPi_.js";
-import { T as createScriptContext } from "./dist-DrySSQ5R.js";
+import { i as SKILL_MANIFEST_FILE, r as SKILLS_LOCKFILE } from "./dist-D7MsoMPx.js";
+import { T as createScriptContext } from "./dist-CV64gN62.js";
 import { i as probeLlmCapabilities } from "./env--jJB-TSX-04klhTYi.js";
-import { a as NodeScriptExecutor, c as SandboxedScriptExecutor, d as readArchiveManifest, i as NodeFS, l as SkillManager, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as exportArchive } from "./dist-Cn9GpW6Q.js";
+import { a as NodeScriptExecutor, c as SandboxedScriptExecutor, d as readArchiveManifest, i as NodeFS, l as SkillManager, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as exportArchive } from "./dist-Chgf2tcy.js";
 
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SandboxedScriptExecutor, SkillManager, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };

package/dist/processSandboxEntry.js

@@ -16,6 +16,16 @@ import { mkdtemp, rm, writeFile } from "node:fs/promises";
 * runtime/sandbox/networkPolicy.ts）；node:net 裸模块为已知残余面（文档明示）。
 * .js 走 data: URL 导入（permission 下实证可用）；.ts 走中性临时目录 file URL。
 */
+/** 不可序列化返回值统一报错（不静默丢数据；0.2.4 跨执行器语义统一） */
+function assertSerializable(value) {
+	try {
+		structuredClone(value);
+	} catch (e) {
+		const err = /* @__PURE__ */ new Error(`Script returned a non-serializable value: ${e instanceof Error ? e.message : String(e)}`);
+		err.code = "TOOL_EXECUTION_FAILED";
+		throw err;
+	}
+}
 const send = (message) => {
 	process.send?.(message);
 };
@@ -164,6 +174,7 @@ async function main(task) {
 		};
 		const runFn = mod["run"];
 		const value = await runFn(task.args ?? {}, context);
+		assertSerializable(value);
 		send({
 			type: "execute-result",
 			ok: true,

package/dist/sandboxWorkerEntry.js

@@ -67,6 +67,16 @@ async function loadModule(scriptPath, scriptSource) {
 	}
 	return await import(`${pathToFileURL(scriptPath).href}?t=${Date.now()}`);
 }
+/** 不可序列化返回值统一报错（不静默丢数据；0.2.4 跨执行器语义统一） */
+function assertSerializable(value) {
+	try {
+		structuredClone(value);
+	} catch (e) {
+		const err = /* @__PURE__ */ new Error(`Script returned a non-serializable value: ${e instanceof Error ? e.message : String(e)}`);
+		err.code = "TOOL_EXECUTION_FAILED";
+		throw err;
+	}
+}
 function post(message) {
 	port.postMessage(message);
 }
@@ -132,8 +142,29 @@ function setupNetworkGuards(task) {
 	};
 	register(`data:text/javascript,${encodeURIComponent(MODULE_HOOK_SOURCE.replace("%ALLOWED_MODULES%", JSON.stringify(task.allowedModules ?? [])))}`);
 }
+/**
+* 加载用户代码前删除 native 逃逸面（P0-A）：binding/_linkedBinding/dlopen/
+* openStdin/reallyExit/abort——这些直达宿主进程 internals，防御面与
+* 能力收敛语义一致（常规 import 拦截之外的主动逃逸项由此封闭）。
+* 注意：process.exit() 内部依赖 reallyExit（per_thread.js），故删前捕获引用，
+* 关闭路径直接调用 internalExit（不经 process.exit）。
+*/
+const internalExit = process.reallyExit.bind(process);
+function stripProcessEscapeHatches() {
+	for (const key of [
+		"binding",
+		"_linkedBinding",
+		"dlopen",
+		"openStdin",
+		"reallyExit",
+		"abort"
+	]) try {
+		Reflect.deleteProperty(process, key);
+	} catch {}
+}
 async function main() {
 	const task = workerData;
+	stripProcessEscapeHatches();
 	setupNetworkGuards(task);
 	port.on("message", (msg) => {
 		if (msg?.type === "bridge-response" && msg.response?.id) {
@@ -195,6 +226,7 @@ async function main() {
 		};
 		const runFn = mod["run"];
 		const value = await runFn(task.args ?? {}, context);
+		assertSerializable(value);
 		post({
 			type: "execute-result",
 			ok: true,
@@ -222,9 +254,9 @@ async function main() {
 		console.error = originals.error;
 	}
 }
-main().then(() => process.exit(0), (e) => {
+main().then(() => internalExit(0), (e) => {
 	console.error(e);
-	process.exit(1);
+	internalExit(1);
 });
 
 //#endregion

package/dist/{testing-B4pq6JYa.js → testing-BN18eqbD.js}

@@ -1,4 +1,4 @@
-import { u as WebSkillError } from "./dist-D0saNPi_.js";
+import { u as WebSkillError } from "./dist-D7MsoMPx.js";
 
 //#region ../runtime/dist/testing.js
 /**

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { c as LlmClient, d as LlmResponse, f as LlmStreamEvent, h as MemoryStore, l as LlmCompleteInput, n as ArtifactStore, o as InteractionRequest, s as InteractionResponse, t as Artifact, v as UiBridge } from "./types-CKm5G_eQ-8W8FnP4u.js";
+import { c as LlmClient, d as LlmResponse, f as LlmStreamEvent, h as MemoryStore, l as LlmCompleteInput, n as ArtifactStore, o as InteractionRequest, s as InteractionResponse, t as Artifact, v as UiBridge } from "./types-CKm5G_eQ-BqyXnvoR.js";
 import { a as loadGoogleConfigFromEnv, i as loadAnthropicConfigFromEnv, n as LlmEnvConfig, o as loadLlmConfigFromEnv, r as ProviderEnvConfig } from "./env-BPUBZCwJ-4jat_SVG.js";
 //#region ../runtime/dist/testing.d.ts
 //#region src/llm/mockLlmClient.d.ts

package/dist/testing.js

@@ -1,5 +1,5 @@
 import { t as MemoryArtifactStore } from "./memoryArtifactStore-C9lFVqPF-yFz6yJj0.js";
 import { n as loadGoogleConfigFromEnv, r as loadLlmConfigFromEnv, t as loadAnthropicConfigFromEnv } from "./env--jJB-TSX-04klhTYi.js";
-import { n as MockLlmClient, r as MockUiBridge, t as InMemoryStore } from "./testing-B4pq6JYa.js";
+import { n as MockLlmClient, r as MockUiBridge, t as InMemoryStore } from "./testing-BN18eqbD.js";
 
 export { InMemoryStore, MemoryArtifactStore, MockLlmClient, MockUiBridge, loadAnthropicConfigFromEnv, loadGoogleConfigFromEnv, loadLlmConfigFromEnv };