@webskill/sdk 0.2.3 → 0.2.4

package/dist/browser.d.ts

@@ -1,5 +1,5 @@
-import { C as FileStat, I as SkillInstallSource, K as VerifyResult, W as SkillsLockfile, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { N as NetworkPolicy, Q as ScriptExecutor, Z as ScriptExecutionContext, d as BridgeCapabilities, it as ToolResult, m as BridgeResponse, nt as ToolDefinition, p as BridgeRequest, pt as bridgeError, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, wt as parseBridgeRequest, y as ExternalToolSource } from "./index-gjFuBevI.js";
+import { C as FileStat, I as SkillInstallSource, K as VerifyResult, W as SkillsLockfile, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { Et as parseBridgeRequest, N as NetworkPolicy, Q as ScriptExecutor, Z as ScriptExecutionContext, d as BridgeCapabilities, it as ToolResult, m as BridgeResponse, nt as ToolDefinition, p as BridgeRequest, pt as bridgeError, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, y as ExternalToolSource } from "./index-DZShzhon.js";
 //#region ../browser/dist/index.d.ts
 //#region src/fs/featureDetection.d.ts
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -15,6 +15,7 @@ declare class OpfsProvider implements FileSystemProvider {
   });
   readText(p: string): Promise<string>;
   writeText(p: string, content: string): Promise<void>;
+  appendText(p: string, content: string): Promise<void>;
   readBinary(p: string): Promise<Uint8Array>;
   writeBinary(p: string, content: Uint8Array): Promise<void>;
   exists(p: string): Promise<boolean>;

package/dist/browser.js

@@ -1,6 +1,6 @@
-import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, T as readResponseWithLimit, b as isValidSkillName, c as SkillDiscovery, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D0saNPi_.js";
-import { A as isNetworkAllowed, C as bridgeError, E as createWebSkillApi, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, l as FsMemoryStore, m as OpenAiCompatibleClient, o as CapabilityApproval, u as FsRunSnapshotStore, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-NM4Mylx4.js";
-import { n as MockLlmClient } from "./testing-B4pq6JYa.js";
+import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, T as readResponseWithLimit, b as isValidSkillName, c as SkillDiscovery, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D7MsoMPx.js";
+import { A as isNetworkAllowed, C as bridgeError, E as createWebSkillApi, F as normalizeToolError, I as parseBridgeRequest, M as networkUrlHost, P as normalizeToolContent, c as FsArtifactStore, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, l as FsMemoryStore, m as OpenAiCompatibleClient, o as CapabilityApproval, u as FsRunSnapshotStore, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-CV64gN62.js";
+import { n as MockLlmClient } from "./testing-BN18eqbD.js";
 
 //#region ../browser/dist/index.js
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -57,6 +57,22 @@ var OpfsProvider = class {
 	async writeText(p, content) {
 		await this.writeBinary(p, new TextEncoder().encode(content));
 	}
+	async appendText(p, content) {
+		await this.#wrap(p, async () => {
+			const segments = this.#segments(p);
+			const name = segments.pop();
+			if (!name) throw new WebSkillError("FS_NOT_FOUND", `Invalid file path: ${p}`);
+			const handle = await (await this.#walkDir(`/${segments.join("/")}`, true)).getFileHandle(name, { create: true });
+			const size = (await handle.getFile()).size;
+			const writable = await handle.createWritable({ keepExistingData: true });
+			await writable.write({
+				type: "write",
+				position: size,
+				data: content
+			});
+			await writable.close();
+		});
+	}
 	async readBinary(p) {
 		return this.#wrap(p, async () => {
 			const handle = await this.#walkFile(p);
@@ -232,6 +248,16 @@ function loadModule(source) {
   return import(url);
 }
 
+function assertSerializable(value) {
+  try {
+    structuredClone(value);
+  } catch (e) {
+    var err = new Error('Script returned a non-serializable value: ' + String((e && e.message) || e));
+    err.code = 'TOOL_EXECUTION_FAILED';
+    throw err;
+  }
+}
+
 function postError(type, id, code, message, extra) {
   var msg = { type: type, id: id, ok: false, error: { code: code, message: message } };
   if (extra) Object.assign(msg, extra);
@@ -326,6 +352,7 @@ self.onmessage = async function (event) {
         throw new Error('Script does not export a run function');
       }
       var value = await mod2.run(msg.args, makeContext(msg));
+      assertSerializable(value);
       self.postMessage({
         type: 'execute-result', id: msg.id, ok: true,
         value: value === undefined ? null : value,
@@ -940,12 +967,13 @@ var BrowserWorkerScriptExecutor = class {
 			}, timeoutMs, (bridgeRequest) => this.#handleBridge(bridgeRequest, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!response.ok) {
 				const stderrSummary = response.stderr?.length ? ` | stderr: ${response.stderr.join(" | ").slice(0, 500)}` : "";
+				const normalized = normalizeToolError(response.error?.code, response.error?.message ?? "script execution failed");
 				return {
 					ok: false,
 					content: [],
 					error: {
-						code: response.error?.code ?? "TOOL_EXECUTION_FAILED",
-						message: `${response.error?.message ?? "script execution failed"}${stderrSummary}`
+						code: normalized.code,
+						message: `${normalized.message}${stderrSummary}`
 					}
 				};
 			}

package/dist/{dist-NM4Mylx4.js → dist-CV64gN62.js}

@@ -1,4 +1,4 @@
-import { C as parseSkillMarkdown, E as renderAvailableSkillsXml, c as SkillDiscovery, d as assertSafePathSegment, j as validateSkills, k as resolveInsideRoot, l as SkillReader, p as buildCatalog, u as WebSkillError } from "./dist-D0saNPi_.js";
+import { C as parseSkillMarkdown, E as renderAvailableSkillsXml, c as SkillDiscovery, d as assertSafePathSegment, j as validateSkills, k as resolveInsideRoot, l as SkillReader, p as buildCatalog, u as WebSkillError } from "./dist-D7MsoMPx.js";
 import { t as MemoryArtifactStore } from "./memoryArtifactStore-C9lFVqPF-yFz6yJj0.js";
 
 //#region ../runtime/dist/index.js
@@ -272,7 +272,7 @@ var AnthropicClient = class {
 			"content-type": "application/json",
 			"x-api-key": this.#config.apiKey,
 			"anthropic-version": ANTHROPIC_VERSION,
-			"anthropic-dangerous-direct-browser-access": "true"
+			...this.#config.dangerouslyAllowDirectBrowserAccess ? { "anthropic-dangerous-direct-browser-access": "true" } : {}
 		};
 	}
 	async complete(input) {
@@ -571,7 +571,7 @@ var GoogleGenAiClient = class {
 	}
 	async #post(input, stream) {
 		const model = input.model ?? this.#config.model;
-		const action = stream ? `:streamGenerateContent?alt=sse&key=${encodeURIComponent(this.#config.apiKey)}` : `:generateContent?key=${encodeURIComponent(this.#config.apiKey)}`;
+		const action = stream ? ":streamGenerateContent?alt=sse" : ":generateContent";
 		const { systemInstruction, contents } = toGenAiContents(input.messages);
 		const body = { contents };
 		if (systemInstruction) body["systemInstruction"] = systemInstruction;
@@ -581,7 +581,10 @@ var GoogleGenAiClient = class {
 		try {
 			res = await this.#fetch(`${this.#baseUrl()}/v1beta/models/${encodeURIComponent(model)}${action}`, {
 				method: "POST",
-				headers: { "content-type": "application/json" },
+				headers: {
+					"content-type": "application/json",
+					"x-goog-api-key": this.#config.apiKey
+				},
 				body: JSON.stringify(body),
 				signal: input.signal ?? (this.#config.requestTimeoutMs ? AbortSignal.timeout(this.#config.requestTimeoutMs) : null)
 			});
@@ -597,7 +600,7 @@ var GoogleGenAiClient = class {
 	/** 轻量探测（GET /v1beta/models），集成测试据此决定 skip */
 	async checkAvailability() {
 		try {
-			return (await this.#fetch(`${this.#baseUrl()}/v1beta/models?key=${encodeURIComponent(this.#config.apiKey)}`)).ok;
+			return (await this.#fetch(`${this.#baseUrl()}/v1beta/models`, { headers: { "x-goog-api-key": this.#config.apiKey } })).ok;
 		} catch {
 			return false;
 		}
@@ -846,11 +849,12 @@ const ASK_USER_TOOL = {
 */
 function createScriptContext(deps) {
 	const { fs, artifactStore, skillName, skillRoot, runId, confirm, onWarning, onArtifactCreated } = deps;
+	const readFs = fs.withRoot?.(skillRoot) ?? fs;
 	return {
 		skillName,
 		runId,
 		async readReference(relativePath) {
-			return fs.readText(resolveInsideRoot(skillRoot, `references/${relativePath}`));
+			return readFs.readText(resolveInsideRoot(skillRoot, `references/${relativePath}`));
 		},
 		async writeArtifact(path, content, options) {
 			const artifact = typeof content === "string" ? await artifactStore.createTextArtifact({
@@ -1734,14 +1738,20 @@ var AgentLoop = class {
 		const text = JSON.stringify(result);
 		const max = this.#config.toolResultMaxBytes;
 		if (text.length <= max) return text;
-		const artifact = await this.#deps.artifactStore.createTextArtifact({
-			runId: state.runId,
-			path: `tool-results/${call.id}.json`,
-			content: text
-		});
+		let note;
+		try {
+			note = `full tool result saved as artifact "${(await this.#deps.artifactStore.createTextArtifact({
+				runId: state.runId,
+				path: `tool-results/${call.id}.json`,
+				content: text
+			})).id}"`;
+		} catch (e) {
+			state.trace.record("run.warning", { message: `Failed to persist oversized tool result artifact for "${call.name}": ${messageOf$1(e)}` });
+			note = "full result discarded (artifact store unavailable)";
+		}
 		const head = text.slice(0, Math.floor(max * .6));
 		const tail = text.slice(-Math.floor(max * .3));
-		return `${head}\n...[truncated ${text.length - head.length - tail.length} chars; full tool result saved as artifact "${artifact.id}"]...\n${tail}`;
+		return `${head}\n...[truncated ${text.length - head.length - tail.length} chars; ${note}]...\n${tail}`;
 	}
 	/** SkillStateGuard 判定（无注入默认全放行；仅显式 false 拦截） */
 	async #guardDenied(kind, skillName) {
@@ -2637,6 +2647,67 @@ function networkUrlHost(url) {
 		return "(unparseable-url)";
 	}
 }
+/** WebSkillErrorCode 全量白名单（错误码归一用；与 core errors.ts 保持同步） */
+const WHITELIST = /* @__PURE__ */ new Set([
+	"FS_NOT_FOUND",
+	"FS_PATH_OUTSIDE_ROOT",
+	"SKILL_NOT_FOUND",
+	"SKILL_INVALID_METADATA",
+	"SKILL_INVALID_NAME",
+	"SKILL_DUPLICATE_NAME",
+	"SKILL_UNSUPPORTED_SCRIPT",
+	"VALIDATION_FAILED",
+	"TOOL_NOT_FOUND",
+	"TOOL_EXECUTION_FAILED",
+	"NETWORK_BLOCKED",
+	"TOOL_UNSUPPORTED",
+	"TOOL_SCHEMA_UNAVAILABLE",
+	"RUN_TIMEOUT",
+	"RUN_MAX_TURNS_EXCEEDED",
+	"RUN_FAILED",
+	"RUN_CANCELLED",
+	"RUN_INTERACTION_TIMEOUT",
+	"UI_UNAVAILABLE",
+	"LLM_UNAVAILABLE",
+	"LLM_REQUEST_FAILED",
+	"INSTALL_FAILED",
+	"UNINSTALL_FAILED",
+	"EXPORT_FAILED",
+	"INTEGRITY_FAILED",
+	"FS_PERMISSION_DENIED",
+	"MCP_ENDPOINT_UNAVAILABLE",
+	"MCP_TOOL_NOT_FOUND",
+	"CANDIDATE_INVALID",
+	"APPROVAL_REQUIRED",
+	"SKILL_QUARANTINED",
+	"SKILL_DISABLED",
+	"SKILL_UNKNOWN_ALLOWED_TOOL",
+	"SKILL_UNKNOWN_DEPENDENCY",
+	"SKILL_CIRCULAR_DEPENDENCY",
+	"GOVERNANCE_FAILED",
+	"RUN_SNAPSHOT_NOT_FOUND",
+	"RUN_SNAPSHOT_EXPIRED",
+	"RUN_SNAPSHOT_INCOMPATIBLE"
+]);
+/**
+* 错误码白名单归一：沙箱/桥消息里出现的非白名单码（DOMException 数值码、
+* Node 任意 ERR_* 码等）一律归为 TOOL_EXECUTION_FAILED。
+*/
+function normalizeErrorCode(code) {
+	return typeof code === "string" && WHITELIST.has(code) ? code : "TOOL_EXECUTION_FAILED";
+}
+/** 归一化后的 (code, message)：非白名单码保留在 message 尾部（[original code: X]） */
+function normalizeToolError(code, message) {
+	const normalized = normalizeErrorCode(code);
+	if (typeof code === "string" && normalized === code) return {
+		code: normalized,
+		message
+	};
+	return {
+		code: normalized,
+		message: `${message} [original code: ${String(code)}]`
+	};
+}
 /**
 * Per-capability 强制授权判定（宿主侧，browser/node 执行器共用单一来源）。
 * 'require-approval' 模式下经注入的 UiBridge 发 authorize 交互；
@@ -2661,6 +2732,7 @@ var CapabilityApproval = class CapabilityApproval {
 	async authorize(input) {
 		const { runId, capability, mode } = input;
 		if (mode === false) return "disabled";
+		if (mode !== true && mode !== "require-approval") return "disabled";
 		if (mode !== "require-approval") return "allowed";
 		if (this.#scope === "once-per-run" && this.#approved.get(runId)?.has(capability)) return "allowed";
 		if (!this.#uiBridge) return "denied";
@@ -2688,4 +2760,4 @@ var CapabilityApproval = class CapabilityApproval {
 };
 
 //#endregion
-export { isNetworkAllowed as A, bridgeError as C, extractChartSpec as D, createWebSkillApi as E, resolveToolName as F, schemaToForm as I, toLlmToolSpec as L, networkUrlHost as M, normalizeToolContent as N, fromVercelResult as O, parseBridgeRequest as P, toVercelToolSpecs as R, WebSkillRuntime as S, createScriptContext as T, READ_SKILL_FILE_TOOL as _, AnthropicClient as a, SerializingMemoryStore as b, FsArtifactStore as c, FullDisclosureRouter as d, GoogleGenAiClient as f, READ_SKILL_FILE_INPUT_SCHEMA as g, ProgressiveRouter as h, AgentLoop as i, mergeCatalogEntries as j, fromVercelStreamPart as k, FsMemoryStore as l, OpenAiCompatibleClient as m, ASK_USER_TOOL as n, CapabilityApproval as o, HookRunner as p, ASK_USER_TOOL_NAME as r, EventBus as s, ASK_USER_INPUT_SCHEMA as t, FsRunSnapshotStore as u, READ_SKILL_FILE_TOOL_NAME as v, buildRenderResult as w, TraceRecorder as x, RUN_SNAPSHOT_SCHEMA_VERSION as y };
+export { isNetworkAllowed as A, toVercelToolSpecs as B, bridgeError as C, extractChartSpec as D, createWebSkillApi as E, normalizeToolError as F, parseBridgeRequest as I, resolveToolName as L, networkUrlHost as M, normalizeErrorCode as N, fromVercelResult as O, normalizeToolContent as P, schemaToForm as R, WebSkillRuntime as S, createScriptContext as T, READ_SKILL_FILE_TOOL as _, AnthropicClient as a, SerializingMemoryStore as b, FsArtifactStore as c, FullDisclosureRouter as d, GoogleGenAiClient as f, READ_SKILL_FILE_INPUT_SCHEMA as g, ProgressiveRouter as h, AgentLoop as i, mergeCatalogEntries as j, fromVercelStreamPart as k, FsMemoryStore as l, OpenAiCompatibleClient as m, ASK_USER_TOOL as n, CapabilityApproval as o, HookRunner as p, ASK_USER_TOOL_NAME as r, EventBus as s, ASK_USER_INPUT_SCHEMA as t, FsRunSnapshotStore as u, READ_SKILL_FILE_TOOL_NAME as v, buildRenderResult as w, TraceRecorder as x, RUN_SNAPSHOT_SCHEMA_VERSION as y, toLlmToolSpec as z };

package/dist/{dist-BJobG0i-.js → dist-CeNAzFYi.js}

@@ -1,4 +1,4 @@
-import { u as WebSkillError } from "./dist-D0saNPi_.js";
+import { u as WebSkillError } from "./dist-D7MsoMPx.js";
 
 //#region ../ui/dist/index.js
 /** 提交值按请求类型归形（WebFormBridge 与框架组件库共享单一来源） */

package/dist/{dist-CvIMVwr3.js → dist-Chgf2tcy.js}

@@ -1,5 +1,5 @@
-import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, O as resolveArchiveLimits, T as readResponseWithLimit, b as isValidSkillName, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D0saNPi_.js";
-import { A as isNetworkAllowed, C as bridgeError, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, l as FsMemoryStore, o as CapabilityApproval } from "./dist-NM4Mylx4.js";
+import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, O as resolveArchiveLimits, T as readResponseWithLimit, b as isValidSkillName, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D7MsoMPx.js";
+import { A as isNetworkAllowed, C as bridgeError, F as normalizeToolError, I as parseBridgeRequest, M as networkUrlHost, P as normalizeToolContent, c as FsArtifactStore, l as FsMemoryStore, o as CapabilityApproval } from "./dist-CV64gN62.js";
 import { createRequire } from "node:module";
 import { unzipSync, zipSync } from "fflate";
 import { existsSync, promises, realpathSync } from "node:fs";
@@ -37,13 +37,16 @@ async function realpathNearest(platformPath) {
 * 可选 root 模式：构造传入 root 后，read/write 操作先做 realpath 包含校验
 * （root 与目标都 realpath 后前缀比对），经符号链接逃逸 root → FS_PATH_OUTSIDE_ROOT。
 */
-var NodeFS = class {
+var NodeFS = class NodeFS {
 	kind = "node";
 	#root;
 	constructor(deps = {}) {
 		this.#root = deps.root;
 	}
-	/** root 模式：目标 realpath 必须落在 root realpath 前缀内（符号链接逃逸防护） */
+	/** root 模式：全部方法（read/write/exists/stat/list/mkdir/remove/rename）目标 realpath 必须落在 root realpath 前缀内 */
+	withRoot(root) {
+		return new NodeFS({ root });
+	}
 	async #assertContained(p) {
 		if (!this.#root) return;
 		const rootReal = await promises.realpath(toPlatform$4(this.#root));
@@ -64,6 +67,12 @@ var NodeFS = class {
 		await promises.mkdir(path.dirname(target), { recursive: true });
 		await promises.writeFile(target, content, "utf8");
 	}
+	async appendText(p, content) {
+		await this.#assertContained(p);
+		const target = toPlatform$4(p);
+		await promises.mkdir(path.dirname(target), { recursive: true });
+		await promises.appendFile(target, content, "utf8");
+	}
 	async readBinary(p) {
 		await this.#assertContained(p);
 		try {
@@ -79,6 +88,7 @@ var NodeFS = class {
 		await promises.writeFile(target, content);
 	}
 	async exists(p) {
+		await this.#assertContained(p);
 		try {
 			await promises.access(toPlatform$4(p));
 			return true;
@@ -87,6 +97,7 @@ var NodeFS = class {
 		}
 	}
 	async stat(p) {
+		await this.#assertContained(p);
 		try {
 			const s = await promises.stat(toPlatform$4(p));
 			return {
@@ -100,6 +111,7 @@ var NodeFS = class {
 		}
 	}
 	async list(p) {
+		await this.#assertContained(p);
 		let dirents;
 		try {
 			dirents = await promises.readdir(toPlatform$4(p), { withFileTypes: true });
@@ -112,9 +124,11 @@ var NodeFS = class {
 		}));
 	}
 	async mkdir(p) {
+		await this.#assertContained(p);
 		await promises.mkdir(toPlatform$4(p), { recursive: true });
 	}
 	async remove(p, options) {
+		await this.#assertContained(p);
 		try {
 			await promises.rm(toPlatform$4(p), { recursive: options?.recursive ?? false });
 		} catch (e) {
@@ -122,6 +136,8 @@ var NodeFS = class {
 		}
 	}
 	async rename(from, to) {
+		await this.#assertContained(from);
+		await this.#assertContained(to);
 		await promises.mkdir(path.dirname(toPlatform$4(to)), { recursive: true });
 		try {
 			await promises.rename(toPlatform$4(from), toPlatform$4(to));
@@ -381,12 +397,13 @@ var SandboxedScriptExecutor = class {
 			}, timeoutMs, (request) => this.#handleBridge(request, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!result.ok) {
 				const stderrSummary = result.stderr?.length ? ` | stderr: ${result.stderr.join(" | ").slice(0, 500)}` : "";
+				const normalized = normalizeToolError(result.error?.code, result.error?.message ?? "script execution failed");
 				return {
 					ok: false,
 					content: [],
 					error: {
-						code: result.error?.code ?? "TOOL_EXECUTION_FAILED",
-						message: `${result.error?.message ?? "script execution failed"}${stderrSummary}`
+						code: normalized.code,
+						message: `${normalized.message}${stderrSummary}`
 					}
 				};
 			}
@@ -463,7 +480,7 @@ var SandboxedScriptExecutor = class {
 			});
 			worker.on("error", (e) => done(() => reject(e)));
 			worker.on("exit", (code) => {
-				if (code !== 0) done(() => reject(new WebSkillError("TOOL_EXECUTION_FAILED", `Sandbox worker exited with code ${code}`)));
+				if (!settled) done(() => reject(new WebSkillError("TOOL_EXECUTION_FAILED", `Sandbox worker exited ${code === null ? "by signal" : `with code ${code}`} without producing a result`)));
 			});
 		});
 	}
@@ -713,12 +730,13 @@ var ProcessSandboxExecutor = class {
 			}, timeoutMs, (request) => this.#handleBridge(request, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!result.ok) {
 				const stderrSummary = result.stderr?.length ? ` | stderr: ${result.stderr.join(" | ").slice(0, 500)}` : "";
+				const normalized = normalizeToolError(result.error?.code, result.error?.message ?? "script execution failed");
 				return {
 					ok: false,
 					content: [],
 					error: {
-						code: result.error?.code ?? "TOOL_EXECUTION_FAILED",
-						message: `${result.error?.message ?? "script execution failed"}${stderrSummary}`
+						code: normalized.code,
+						message: `${normalized.message}${stderrSummary}`
 					}
 				};
 			}

package/dist/{dist-D0saNPi_.js → dist-D7MsoMPx.js}

@@ -111,6 +111,18 @@ var MemoryFS = class {
 	async writeText(path, content) {
 		await this.writeBinary(path, new TextEncoder().encode(content));
 	}
+	async appendText(path, content) {
+		const key = this.#normalize(path);
+		const existing = this.#entries.get(key);
+		if (existing && existing.type !== "file") throw new WebSkillError("FS_PERMISSION_DENIED", `Cannot append to a directory: ${key}`);
+		const prior = existing ? new TextDecoder().decode(existing.content) : "";
+		this.#ensureParents(key);
+		this.#entries.set(key, {
+			type: "file",
+			content: new TextEncoder().encode(prior + content),
+			mtimeMs: Date.now()
+		});
+	}
 	async readBinary(path) {
 		return this.#getFile(this.#normalize(path)).content;
 	}
@@ -203,7 +215,9 @@ function normalizePath(path) {
 * 拒绝空串、`.`、`..`、含 `/` 或 `\`、含 `:`（Windows 盘符/ADS）。
 * 违规抛 FS_PATH_OUTSIDE_ROOT（kind 用于错误消息定位，如 "runId"）。
 */
+const CONTROL_CHARS_RE = /[\x00-\x1f\x7f]/;
 function assertSafePathSegment(segment, kind) {
+	if (CONTROL_CHARS_RE.test(segment)) throw new WebSkillError("FS_PATH_OUTSIDE_ROOT", `Invalid ${kind} (control characters including NUL are not allowed): ${JSON.stringify(segment)}`);
 	if (segment === "" || segment === "." || segment === ".." || segment.includes("/") || segment.includes("\\") || segment.includes(":")) throw new WebSkillError("FS_PATH_OUTSIDE_ROOT", `Invalid ${kind} (must be a single safe path segment): ${JSON.stringify(segment)}`);
 }
 /**
@@ -221,6 +235,7 @@ function resolveInsideRoot(root, relativePath) {
 	if (relativePath.trim() === "") fail("empty path");
 	if (relativePath.startsWith("/") || relativePath.startsWith("\\") || /^[a-zA-Z]:[\\/]/.test(relativePath)) fail("absolute paths not allowed");
 	const segments = relativePath.replace(/\\/g, "/").split("/");
+	if (CONTROL_CHARS_RE.test(relativePath)) fail("control characters including NUL are not allowed");
 	if (segments.some((s) => s === "..")) fail("`..` segments not allowed");
 	const clean = segments.filter((s) => s !== "" && s !== ".");
 	if (clean.length === 0) fail("path resolves to empty");
@@ -392,6 +407,7 @@ async function exportSkills(fs, input) {
 		for (const root of input.roots) {
 			const base = root.replace(/\/+$/, "");
 			const manifest = await input.manifestBuilder(base);
+			if (!isValidSkillName(manifest.name)) throw new WebSkillError("EXPORT_FAILED", `Skill "${manifest.name}" has an invalid name and cannot be exported to a skill pack`);
 			skills.push({
 				name: manifest.name,
 				digest: manifest.integrity.digest
@@ -427,7 +443,7 @@ function parseSkillPackManifest(text) {
 	for (const entry of record["skills"]) {
 		if (typeof entry !== "object" || entry === null) invalid("skill entry is not an object");
 		const { name, digest } = entry;
-		if (typeof name !== "string" || name === "") invalid("skill entry missing a valid \"name\"");
+		if (typeof name !== "string" || name === "" || !isValidSkillName(name)) invalid(`skill entry has an invalid name: ${JSON.stringify(name)}`);
 		if (typeof digest !== "string" || digest === "") invalid(`skill "${name}" missing a valid "digest"`);
 	}
 	return raw;
@@ -468,6 +484,14 @@ async function unzipWithLimits(data, limits) {
 	const unzip = new Unzip();
 	unzip.register(UnzipInflate);
 	unzip.onfile = (file) => {
+		if (file.name.startsWith("/") || file.name.startsWith("\\") || /^[a-zA-Z]:[\\/]/.test(file.name)) {
+			failure = new WebSkillError("INSTALL_FAILED", `Archive entry escapes the destination root: ${file.name}`);
+			return;
+		}
+		if (file.name.replace(/\\/g, "/").split("/").some((s) => s === "..") || /[\x00-\x1f\x7f]/.test(file.name)) {
+			failure = new WebSkillError("INSTALL_FAILED", `Archive entry escapes the destination root: ${file.name}`);
+			return;
+		}
 		if (file.name.endsWith("/")) {
 			entries.push([file.name, /* @__PURE__ */ new Uint8Array(0)]);
 			return;
@@ -579,7 +603,7 @@ var SkillDiscovery = class {
 		const candidates = [];
 		const knownSkillNames = /* @__PURE__ */ new Set();
 		const adjacency = /* @__PURE__ */ new Map();
-		for (const root of this.#roots) {
+		for (const [rootIndex, root] of this.#roots.entries()) {
 			if (!await this.#fs.exists(root)) {
 				issues.push({
 					code: "FS_NOT_FOUND",
@@ -604,6 +628,7 @@ var SkillDiscovery = class {
 				candidates.push({
 					dirName,
 					skillRoot,
+					rootIndex,
 					hasSkillMd,
 					metadata,
 					parseError,
@@ -616,6 +641,7 @@ var SkillDiscovery = class {
 				}
 			}));
 		}
+		candidates.sort((a, b) => a.rootIndex - b.rootIndex || a.dirName.localeCompare(b.dirName));
 		const cycles = checkDependencyCycles(adjacency);
 		const claimedNames = /* @__PURE__ */ new Set();
 		for (const candidate of candidates) {

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
-import { F as SkillDocument, N as SkillCatalogEntry, c as LlmClient, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { Q as ScriptExecutor, dt as WebSkillRuntime, ft as WebSkillRuntimeDeps, q as RuntimeRun, tt as SkillStateGuard } from "./index-gjFuBevI.js";
-import { d as SkillManager } from "./index-iqcz3_NS.js";
+import { F as SkillDocument, N as SkillCatalogEntry, c as LlmClient, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { Q as ScriptExecutor, dt as WebSkillRuntime, ft as WebSkillRuntimeDeps, q as RuntimeRun, tt as SkillStateGuard } from "./index-DZShzhon.js";
+import { d as SkillManager } from "./index-DrHelz72.js";
 //#region ../governance/dist/index.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';
@@ -209,7 +209,12 @@ interface AuditChainVerification {
   brokenAt?: number;
   reason?: string;
 }
-/** JSONL 追加的审计日志：<managedRoot>/.webskill/audit.jsonl；跨实例可恢复查询；prevHash 链可校验完整性 */
+/**
+ * JSONL 追加式审计日志（<managedRoot>/.webskill/audit.jsonl）：
+ * 真追加（fs.appendText，不整读改写）+ lastHash 内存缓存（同实例不重读）。
+ * 语义：**tamper-evident, not tamper-proof**——verifyChain 能检出篡改/删除/换序，
+ * 但不阻止有写权限者直接改写文件；更强保证需要签名信任体系（未排期）。
+ */
 declare class FsAuditLog implements AuditLog {
   #private;
   constructor(deps: {

package/dist/governance.js

@@ -1,6 +1,6 @@
-import { A as unzipWithLimits, b as isValidSkillName, d as assertSafePathSegment, j as validateSkills, k as resolveInsideRoot, u as WebSkillError } from "./dist-D0saNPi_.js";
-import { S as WebSkillRuntime } from "./dist-NM4Mylx4.js";
-import { i as NodeFS, s as ProcessSandboxExecutor, u as exportArchive } from "./dist-CvIMVwr3.js";
+import { A as unzipWithLimits, b as isValidSkillName, d as assertSafePathSegment, j as validateSkills, k as resolveInsideRoot, u as WebSkillError } from "./dist-D7MsoMPx.js";
+import { S as WebSkillRuntime } from "./dist-CV64gN62.js";
+import { i as NodeFS, s as ProcessSandboxExecutor, u as exportArchive } from "./dist-Chgf2tcy.js";
 import path from "node:path";
 import { tmpdir } from "node:os";
 import { mkdtemp } from "node:fs/promises";
@@ -404,29 +404,42 @@ function canonical(event) {
 		prevHash: event.prevHash
 	});
 }
-/** JSONL 追加的审计日志：<managedRoot>/.webskill/audit.jsonl；跨实例可恢复查询；prevHash 链可校验完整性 */
+/**
+* JSONL 追加式审计日志（<managedRoot>/.webskill/audit.jsonl）：
+* 真追加（fs.appendText，不整读改写）+ lastHash 内存缓存（同实例不重读）。
+* 语义：**tamper-evident, not tamper-proof**——verifyChain 能检出篡改/删除/换序，
+* 但不阻止有写权限者直接改写文件；更强保证需要签名信任体系（未排期）。
+*/
 var FsAuditLog = class {
 	#root;
 	#fs;
 	#now;
 	#createId;
+	/** lastHash 内存缓存（同实例内追加不重读文件） */
+	#lastHash;
+	#lastHashSeeded = false;
 	constructor(deps) {
 		this.#root = deps.root.replace(/\/+$/, "");
 		this.#fs = deps.fs;
 		this.#now = deps.now;
 		this.#createId = deps.createId;
 	}
-	async append(event) {
+	/** 首追加时播种 lastHash（读一次尾部；尾行损坏 → 抛错，不静默重开链） */
+	async #seedLastHash() {
+		this.#lastHashSeeded = true;
 		const path = fileOf$1(this.#root);
-		const existing = await this.#fs.exists(path) ? await this.#fs.readText(path) : "";
-		const lines = existing.split("\n").filter((l) => l.trim() !== "");
-		let prevHash = "GENESIS";
-		if (lines.length > 0) try {
+		if (!await this.#fs.exists(path)) return "GENESIS";
+		const lines = (await this.#fs.readText(path)).split("\n").filter((l) => l.trim() !== "");
+		if (lines.length === 0) return "GENESIS";
+		try {
 			const last = JSON.parse(lines.at(-1));
-			prevHash = last.hash ?? sha256Hex(canonical(last));
-		} catch {
-			prevHash = "GENESIS";
+			return last.hash ?? sha256Hex(canonical(last));
+		} catch (e) {
+			throw new WebSkillError("GOVERNANCE_FAILED", `Audit log tail line at ${path} is corrupted; refusing to append (the chain must not silently restart)`, e);
 		}
+	}
+	async append(event) {
+		const prevHash = this.#lastHashSeeded ? this.#lastHash : await this.#seedLastHash();
 		const full = {
 			id: event.id ?? this.#createId?.() ?? `audit-${Math.random().toString(36).slice(2, 10)}`,
 			ts: event.ts ?? this.#now?.() ?? (/* @__PURE__ */ new Date()).toISOString(),
@@ -437,8 +450,8 @@ var FsAuditLog = class {
 			prevHash
 		};
 		full.hash = sha256Hex(canonical(full));
-		const prefix = existing === "" || existing.endsWith("\n") ? existing : `${existing}\n`;
-		await this.#fs.writeText(path, `${prefix}${JSON.stringify(full)}\n`);
+		await this.#fs.appendText(fileOf$1(this.#root), `${JSON.stringify(full)}\n`);
+		this.#lastHash = full.hash;
 		return full;
 	}
 	async query(filter) {
@@ -448,7 +461,12 @@ var FsAuditLog = class {
 		const events = [];
 		for (const line of raw.split("\n")) {
 			if (line.trim() === "") continue;
-			const event = JSON.parse(line);
+			let event;
+			try {
+				event = JSON.parse(line);
+			} catch {
+				continue;
+			}
 			if (filter.target !== void 0 && event.target !== filter.target) continue;
 			if (filter.type !== void 0 && event.type !== filter.type) continue;
 			if (filter.since !== void 0 && event.ts < filter.since) continue;

package/dist/{index-gjFuBevI.d.ts → index-DZShzhon.d.ts}

@@ -1,4 +1,4 @@
-import { F as SkillDocument, G as ValidationReport, I as SkillInstallSource, M as SkillCatalog, N as SkillCatalogEntry, P as SkillDiscovery, S as DiscoveryResult, T as JsonSchema, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
+import { F as SkillDocument, G as ValidationReport, I as SkillInstallSource, J as WebSkillErrorCode, M as SkillCatalog, N as SkillCatalogEntry, P as SkillDiscovery, S as DiscoveryResult, T as JsonSchema, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
 //#region ../runtime/dist/index.d.ts
 //#region src/llm/openAiCompatibleClient.d.ts
 interface OpenAiCompatibleClientConfig {
@@ -33,6 +33,11 @@ interface AnthropicClientConfig {
   requestTimeoutMs?: number;
   /** max_tokens（Messages API 必填），默认 4096 */
   maxTokens?: number;
+  /**
+   * 浏览器直调 opt-in：true 时发送 anthropic-dangerous-direct-browser-access 头
+   * （默认 false 不发——仅在明确运行于浏览器且无服务端代理时开启）
+   */
+  dangerouslyAllowDirectBrowserAccess?: boolean;
 }
 /** Anthropic Messages API 客户端（零依赖 fetch；Node/浏览器通用） */
 declare class AnthropicClient implements LlmClient {
@@ -540,6 +545,18 @@ declare function isNetworkAllowed(policy: NetworkPolicy, url: string): boolean;
 /** 阻断 trace 用的脱敏 host（解析失败返回占位，不记录完整 URL） */
 declare function networkUrlHost(url: string): string;
 //#endregion
+//#region src/sandbox/errorCodes.d.ts
+/**
+ * 错误码白名单归一：沙箱/桥消息里出现的非白名单码（DOMException 数值码、
+ * Node 任意 ERR_* 码等）一律归为 TOOL_EXECUTION_FAILED。
+ */
+declare function normalizeErrorCode(code: unknown): WebSkillErrorCode;
+/** 归一化后的 (code, message)：非白名单码保留在 message 尾部（[original code: X]） */
+declare function normalizeToolError(code: unknown, message: string): {
+  code: WebSkillErrorCode;
+  message: string;
+};
+//#endregion
 //#region src/sandbox/approval.d.ts
 /** 桥消息对应的三类能力 */
 type BridgeCapability = 'readReference' | 'writeArtifact' | 'confirm';
@@ -810,4 +827,4 @@ declare class WebSkillRuntime {
   resumeRun(runId: string): Promise<RunResult>;
 }
 //#endregion
-export { SerializingMemoryStore as $, LifecycleHook as A, RUN_SNAPSHOT_SCHEMA_VERSION as B, FullDisclosureRouter as C, normalizeToolContent as Ct, HookRunnerOptions as D, toLlmToolSpec as Dt, HookRunner as E, schemaToForm as Et, OpenAiCompatibleClientConfig as F, RunTerminationReason as G, RunResult as H, ProgressiveRouter as I, RuntimeSession as J, RuntimePhase as K, READ_SKILL_FILE_INPUT_SCHEMA as L, LifecycleListener as M, NetworkPolicy as N, InstalledSkillManifest as O, toVercelToolSpecs as Ot, OpenAiCompatibleClient as P, ScriptExecutor as Q, READ_SKILL_FILE_TOOL as R, FsRunSnapshotStore as S, networkUrlHost as St, GoogleGenAiClientConfig as T, resolveToolName as Tt, RunSnapshot as U, RouteResult as V, RunSnapshotStore as W, SchemaInferer as X, RuntimeSessionHandle as Y, ScriptExecutionContext as Z, EventBus as _, extractChartSpec as _t, AgentLoopConfig as a, TraceClock as at, FsArtifactStore as b, isNetworkAllowed as bt, AnthropicClientConfig as c, TraceRecorder as ct, BridgeCapabilities as d, WebSkillRuntime as dt, SkillRouter as et, BridgeCapability as f, WebSkillRuntimeDeps as ft, CapabilityMode as g, createWebSkillApi as gt, CapabilityApproval as h, createScriptContext as ht, AgentLoop as i, ToolResult as it, LifecycleHookContext as j, LifecycleEvent as k, ApprovalDecision as l, VercelToolSpec as lt, BridgeResponse as m, buildRenderResult as mt, ASK_USER_TOOL as n, ToolDefinition as nt, AgentLoopDeps as o, TraceEvent as ot, BridgeRequest as p, bridgeError as pt, RuntimeRun as q, ASK_USER_TOOL_NAME as r, ToolResolution as rt, AnthropicClient as s, TraceEventType as st, ASK_USER_INPUT_SCHEMA as t, SkillStateGuard as tt, ApprovalScope as u, WebSkillApi as ut, ExternalSkillProvider as v, fromVercelResult as vt, GoogleGenAiClient as w, parseBridgeRequest as wt, FsMemoryStore as x, mergeCatalogEntries as xt, ExternalToolSource as y, fromVercelStreamPart as yt, READ_SKILL_FILE_TOOL_NAME as z };
+export { SerializingMemoryStore as $, LifecycleHook as A, toVercelToolSpecs as At, RUN_SNAPSHOT_SCHEMA_VERSION as B, FullDisclosureRouter as C, normalizeErrorCode as Ct, HookRunnerOptions as D, resolveToolName as Dt, HookRunner as E, parseBridgeRequest as Et, OpenAiCompatibleClientConfig as F, RunTerminationReason as G, RunResult as H, ProgressiveRouter as I, RuntimeSession as J, RuntimePhase as K, READ_SKILL_FILE_INPUT_SCHEMA as L, LifecycleListener as M, NetworkPolicy as N, InstalledSkillManifest as O, schemaToForm as Ot, OpenAiCompatibleClient as P, ScriptExecutor as Q, READ_SKILL_FILE_TOOL as R, FsRunSnapshotStore as S, networkUrlHost as St, GoogleGenAiClientConfig as T, normalizeToolError as Tt, RunSnapshot as U, RouteResult as V, RunSnapshotStore as W, SchemaInferer as X, RuntimeSessionHandle as Y, ScriptExecutionContext as Z, EventBus as _, extractChartSpec as _t, AgentLoopConfig as a, TraceClock as at, FsArtifactStore as b, isNetworkAllowed as bt, AnthropicClientConfig as c, TraceRecorder as ct, BridgeCapabilities as d, WebSkillRuntime as dt, SkillRouter as et, BridgeCapability as f, WebSkillRuntimeDeps as ft, CapabilityMode as g, createWebSkillApi as gt, CapabilityApproval as h, createScriptContext as ht, AgentLoop as i, ToolResult as it, LifecycleHookContext as j, LifecycleEvent as k, toLlmToolSpec as kt, ApprovalDecision as l, VercelToolSpec as lt, BridgeResponse as m, buildRenderResult as mt, ASK_USER_TOOL as n, ToolDefinition as nt, AgentLoopDeps as o, TraceEvent as ot, BridgeRequest as p, bridgeError as pt, RuntimeRun as q, ASK_USER_TOOL_NAME as r, ToolResolution as rt, AnthropicClient as s, TraceEventType as st, ASK_USER_INPUT_SCHEMA as t, SkillStateGuard as tt, ApprovalScope as u, WebSkillApi as ut, ExternalSkillProvider as v, fromVercelResult as vt, GoogleGenAiClient as w, normalizeToolContent as wt, FsMemoryStore as x, mergeCatalogEntries as xt, ExternalToolSource as y, fromVercelStreamPart as yt, READ_SKILL_FILE_TOOL_NAME as z };

package/dist/{index-iqcz3_NS.d.ts → index-DrHelz72.d.ts}

@@ -1,5 +1,5 @@
-import { C as FileStat, I as SkillInstallSource, K as VerifyResult, T as JsonSchema, W as SkillsLockfile, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { N as NetworkPolicy, Q as ScriptExecutor, X as SchemaInferer, Z as ScriptExecutionContext, b as FsArtifactStore, d as BridgeCapabilities, it as ToolResult, nt as ToolDefinition, u as ApprovalScope, x as FsMemoryStore } from "./index-gjFuBevI.js";
+import { C as FileStat, I as SkillInstallSource, K as VerifyResult, T as JsonSchema, W as SkillsLockfile, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { N as NetworkPolicy, Q as ScriptExecutor, X as SchemaInferer, Z as ScriptExecutionContext, b as FsArtifactStore, d as BridgeCapabilities, it as ToolResult, nt as ToolDefinition, u as ApprovalScope, x as FsMemoryStore } from "./index-DZShzhon.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts
 //#region src/fs/nodeFs.d.ts
@@ -14,8 +14,11 @@ declare class NodeFS implements FileSystemProvider {
   constructor(deps?: {
     root?: string;
   });
+  /** root 模式：全部方法（read/write/exists/stat/list/mkdir/remove/rename）目标 realpath 必须落在 root realpath 前缀内 */
+  withRoot(root: string): NodeFS;
   readText(p: string): Promise<string>;
   writeText(p: string, content: string): Promise<void>;
+  appendText(p: string, content: string): Promise<void>;
   readBinary(p: string): Promise<Uint8Array>;
   writeBinary(p: string, content: Uint8Array): Promise<void>;
   exists(p: string): Promise<boolean>;

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { $ as checkDependencyCycles, A as SKILL_NAME_PATTERN, B as SkillMetadata, C as FileStat, D as SKILLS_LOCKFILE, E as MemoryFS, F as SkillDocument, G as ValidationReport, H as SkillReader, I as SkillInstallSource, J as WebSkillErrorCode, K as VerifyResult, L as SkillIssue, M as SkillCatalog, N as SkillCatalogEntry, O as SKILL_MANIFEST_FILE, P as SkillDiscovery, Q as buildManifest, R as SkillLocation, S as DiscoveryResult, T as JsonSchema, U as SkillSource, V as SkillPackManifest, W as SkillsLockfile, X as atomicWriteText, Y as assertSafePathSegment, Z as buildCatalog, _ as RenderResultRequest, _t as xmlRenderer, a as InteractionPolicy, at as jsonRenderer, b as CatalogRenderer, c as LlmClient, ct as parseSkillPackManifest, d as LlmResponse, dt as renderCatalogJson, et as checkSkillRules, f as LlmStreamEvent, ft as resolveArchiveLimits, g as RenderBlock, gt as verifyManifest, h as MemoryStore, ht as validateSkills, i as FormField, it as isValidSkillName, j as SKILL_PACK_FILE, k as SKILL_NAME_MAX_LENGTH, l as LlmCompleteInput, lt as readResponseWithLimit, m as LlmToolSpec, mt as unzipWithLimits, n as ArtifactStore, nt as escapeXml, o as InteractionRequest, ot as normalizePath, p as LlmToolCall, pt as resolveInsideRoot, q as WebSkillError, r as ChartSpec, rt as exportSkills, s as InteractionResponse, st as parseSkillMarkdown, t as Artifact, tt as computeDigest, u as LlmMessage, ut as renderAvailableSkillsXml, v as UiBridge, w as FileSystemProvider, x as DEFAULT_ARCHIVE_LIMITS, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { $ as SerializingMemoryStore, A as LifecycleHook, B as RUN_SNAPSHOT_SCHEMA_VERSION, C as FullDisclosureRouter, Ct as normalizeToolContent, D as HookRunnerOptions, Dt as toLlmToolSpec, E as HookRunner, Et as schemaToForm, F as OpenAiCompatibleClientConfig, G as RunTerminationReason, H as RunResult, I as ProgressiveRouter, J as RuntimeSession, K as RuntimePhase, L as READ_SKILL_FILE_INPUT_SCHEMA, M as LifecycleListener, N as NetworkPolicy, O as InstalledSkillManifest, Ot as toVercelToolSpecs, P as OpenAiCompatibleClient, Q as ScriptExecutor, R as READ_SKILL_FILE_TOOL, S as FsRunSnapshotStore, St as networkUrlHost, T as GoogleGenAiClientConfig, Tt as resolveToolName, U as RunSnapshot, V as RouteResult, W as RunSnapshotStore, X as SchemaInferer, Y as RuntimeSessionHandle, Z as ScriptExecutionContext, _ as EventBus, _t as extractChartSpec, a as AgentLoopConfig, at as TraceClock, b as FsArtifactStore, bt as isNetworkAllowed, c as AnthropicClientConfig, ct as TraceRecorder, d as BridgeCapabilities, dt as WebSkillRuntime, et as SkillRouter, f as BridgeCapability, ft as WebSkillRuntimeDeps, g as CapabilityMode, gt as createWebSkillApi, h as CapabilityApproval, ht as createScriptContext, i as AgentLoop, it as ToolResult, j as LifecycleHookContext, k as LifecycleEvent, l as ApprovalDecision, lt as VercelToolSpec, m as BridgeResponse, mt as buildRenderResult, n as ASK_USER_TOOL, nt as ToolDefinition, o as AgentLoopDeps, ot as TraceEvent, p as BridgeRequest, pt as bridgeError, q as RuntimeRun, r as ASK_USER_TOOL_NAME, rt as ToolResolution, s as AnthropicClient, st as TraceEventType, t as ASK_USER_INPUT_SCHEMA, tt as SkillStateGuard, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, vt as fromVercelResult, w as GoogleGenAiClient, wt as parseBridgeRequest, x as FsMemoryStore, xt as mergeCatalogEntries, y as ExternalToolSource, yt as fromVercelStreamPart, z as READ_SKILL_FILE_TOOL_NAME } from "./index-gjFuBevI.js";
-export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type ArchiveLimits, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, DEFAULT_ARCHIVE_LIMITS, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, type RuntimeSessionHandle, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, SerializingMemoryStore, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, type SkillPackManifest, SkillReader, type SkillRouter, type SkillSource, type SkillStateGuard, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };
+import { $ as checkDependencyCycles, A as SKILL_NAME_PATTERN, B as SkillMetadata, C as FileStat, D as SKILLS_LOCKFILE, E as MemoryFS, F as SkillDocument, G as ValidationReport, H as SkillReader, I as SkillInstallSource, J as WebSkillErrorCode, K as VerifyResult, L as SkillIssue, M as SkillCatalog, N as SkillCatalogEntry, O as SKILL_MANIFEST_FILE, P as SkillDiscovery, Q as buildManifest, R as SkillLocation, S as DiscoveryResult, T as JsonSchema, U as SkillSource, V as SkillPackManifest, W as SkillsLockfile, X as atomicWriteText, Y as assertSafePathSegment, Z as buildCatalog, _ as RenderResultRequest, _t as xmlRenderer, a as InteractionPolicy, at as jsonRenderer, b as CatalogRenderer, c as LlmClient, ct as parseSkillPackManifest, d as LlmResponse, dt as renderCatalogJson, et as checkSkillRules, f as LlmStreamEvent, ft as resolveArchiveLimits, g as RenderBlock, gt as verifyManifest, h as MemoryStore, ht as validateSkills, i as FormField, it as isValidSkillName, j as SKILL_PACK_FILE, k as SKILL_NAME_MAX_LENGTH, l as LlmCompleteInput, lt as readResponseWithLimit, m as LlmToolSpec, mt as unzipWithLimits, n as ArtifactStore, nt as escapeXml, o as InteractionRequest, ot as normalizePath, p as LlmToolCall, pt as resolveInsideRoot, q as WebSkillError, r as ChartSpec, rt as exportSkills, s as InteractionResponse, st as parseSkillMarkdown, t as Artifact, tt as computeDigest, u as LlmMessage, ut as renderAvailableSkillsXml, v as UiBridge, w as FileSystemProvider, x as DEFAULT_ARCHIVE_LIMITS, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { $ as SerializingMemoryStore, A as LifecycleHook, At as toVercelToolSpecs, B as RUN_SNAPSHOT_SCHEMA_VERSION, C as FullDisclosureRouter, Ct as normalizeErrorCode, D as HookRunnerOptions, Dt as resolveToolName, E as HookRunner, Et as parseBridgeRequest, F as OpenAiCompatibleClientConfig, G as RunTerminationReason, H as RunResult, I as ProgressiveRouter, J as RuntimeSession, K as RuntimePhase, L as READ_SKILL_FILE_INPUT_SCHEMA, M as LifecycleListener, N as NetworkPolicy, O as InstalledSkillManifest, Ot as schemaToForm, P as OpenAiCompatibleClient, Q as ScriptExecutor, R as READ_SKILL_FILE_TOOL, S as FsRunSnapshotStore, St as networkUrlHost, T as GoogleGenAiClientConfig, Tt as normalizeToolError, U as RunSnapshot, V as RouteResult, W as RunSnapshotStore, X as SchemaInferer, Y as RuntimeSessionHandle, Z as ScriptExecutionContext, _ as EventBus, _t as extractChartSpec, a as AgentLoopConfig, at as TraceClock, b as FsArtifactStore, bt as isNetworkAllowed, c as AnthropicClientConfig, ct as TraceRecorder, d as BridgeCapabilities, dt as WebSkillRuntime, et as SkillRouter, f as BridgeCapability, ft as WebSkillRuntimeDeps, g as CapabilityMode, gt as createWebSkillApi, h as CapabilityApproval, ht as createScriptContext, i as AgentLoop, it as ToolResult, j as LifecycleHookContext, k as LifecycleEvent, kt as toLlmToolSpec, l as ApprovalDecision, lt as VercelToolSpec, m as BridgeResponse, mt as buildRenderResult, n as ASK_USER_TOOL, nt as ToolDefinition, o as AgentLoopDeps, ot as TraceEvent, p as BridgeRequest, pt as bridgeError, q as RuntimeRun, r as ASK_USER_TOOL_NAME, rt as ToolResolution, s as AnthropicClient, st as TraceEventType, t as ASK_USER_INPUT_SCHEMA, tt as SkillStateGuard, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, vt as fromVercelResult, w as GoogleGenAiClient, wt as normalizeToolContent, x as FsMemoryStore, xt as mergeCatalogEntries, y as ExternalToolSource, yt as fromVercelStreamPart, z as READ_SKILL_FILE_TOOL_NAME } from "./index-DZShzhon.js";
+export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type ArchiveLimits, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, DEFAULT_ARCHIVE_LIMITS, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, type RuntimeSessionHandle, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, SerializingMemoryStore, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, type SkillPackManifest, SkillReader, type SkillRouter, type SkillSource, type SkillStateGuard, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { A as unzipWithLimits, C as parseSkillMarkdown, D as renderCatalogJson, E as renderAvailableSkillsXml, M as verifyManifest, N as xmlRenderer, O as resolveArchiveLimits, S as normalizePath, T as readResponseWithLimit, _ as computeDigest, a as SKILL_NAME_MAX_LENGTH, b as isValidSkillName, c as SkillDiscovery, d as assertSafePathSegment, f as atomicWriteText, g as checkSkillRules, h as checkDependencyCycles, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, l as SkillReader, m as buildManifest, n as MemoryFS, o as SKILL_NAME_PATTERN, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, t as DEFAULT_ARCHIVE_LIMITS, u as WebSkillError, v as escapeXml, w as parseSkillPackManifest, x as jsonRenderer, y as exportSkills } from "./dist-D0saNPi_.js";
-import { A as isNetworkAllowed, C as bridgeError, D as extractChartSpec, E as createWebSkillApi, F as resolveToolName, I as schemaToForm, L as toLlmToolSpec, M as networkUrlHost, N as normalizeToolContent, O as fromVercelResult, P as parseBridgeRequest, R as toVercelToolSpecs, S as WebSkillRuntime, T as createScriptContext, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as SerializingMemoryStore, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, k as fromVercelStreamPart, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as buildRenderResult, x as TraceRecorder, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-NM4Mylx4.js";
+import { A as unzipWithLimits, C as parseSkillMarkdown, D as renderCatalogJson, E as renderAvailableSkillsXml, M as verifyManifest, N as xmlRenderer, O as resolveArchiveLimits, S as normalizePath, T as readResponseWithLimit, _ as computeDigest, a as SKILL_NAME_MAX_LENGTH, b as isValidSkillName, c as SkillDiscovery, d as assertSafePathSegment, f as atomicWriteText, g as checkSkillRules, h as checkDependencyCycles, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, l as SkillReader, m as buildManifest, n as MemoryFS, o as SKILL_NAME_PATTERN, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, t as DEFAULT_ARCHIVE_LIMITS, u as WebSkillError, v as escapeXml, w as parseSkillPackManifest, x as jsonRenderer, y as exportSkills } from "./dist-D7MsoMPx.js";
+import { A as isNetworkAllowed, B as toVercelToolSpecs, C as bridgeError, D as extractChartSpec, E as createWebSkillApi, F as normalizeToolError, I as parseBridgeRequest, L as resolveToolName, M as networkUrlHost, N as normalizeErrorCode, O as fromVercelResult, P as normalizeToolContent, R as schemaToForm, S as WebSkillRuntime, T as createScriptContext, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as SerializingMemoryStore, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, k as fromVercelStreamPart, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as buildRenderResult, x as TraceRecorder, y as RUN_SNAPSHOT_SCHEMA_VERSION, z as toLlmToolSpec } from "./dist-CV64gN62.js";
 
-export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, AnthropicClient, CapabilityApproval, DEFAULT_ARCHIVE_LIMITS, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SerializingMemoryStore, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };
+export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, AnthropicClient, CapabilityApproval, DEFAULT_ARCHIVE_LIMITS, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SerializingMemoryStore, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
-import { F as SkillDocument, N as SkillCatalogEntry, T as JsonSchema, m as LlmToolSpec } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { it as ToolResult, v as ExternalSkillProvider, xt as mergeCatalogEntries, y as ExternalToolSource } from "./index-gjFuBevI.js";
+import { F as SkillDocument, N as SkillCatalogEntry, T as JsonSchema, m as LlmToolSpec } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { it as ToolResult, v as ExternalSkillProvider, xt as mergeCatalogEntries, y as ExternalToolSource } from "./index-DZShzhon.js";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -63,7 +63,7 @@ declare class MessageChannelTransport implements Transport {
 /** endpoint 名 → client 注册表；单调版本号，事件驱动等待（禁止轮询） */
 declare class EndpointRegistry<TClient> {
   #private;
-  /** 注册新 endpoint；重名抛错 */
+  /** 注册新 endpoint；重名抛错；含 `__`（endpoint:tool 分隔符）或保留名 mcp 拒绝 */
   register(endpoint: string, client: TClient): void;
   /** 热替换 client，版本号 +1 */
   set(endpoint: string, client: TClient): void;

package/dist/mcp.js

@@ -1,5 +1,5 @@
-import { u as WebSkillError } from "./dist-D0saNPi_.js";
-import { N as normalizeToolContent, j as mergeCatalogEntries } from "./dist-NM4Mylx4.js";
+import { u as WebSkillError } from "./dist-D7MsoMPx.js";
+import { P as normalizeToolContent, j as mergeCatalogEntries } from "./dist-CV64gN62.js";
 
 //#region ../mcp/dist/index.js
 /**
@@ -117,8 +117,9 @@ var EndpointRegistry = class {
 	#clients = /* @__PURE__ */ new Map();
 	#versions = /* @__PURE__ */ new Map();
 	#waiters = /* @__PURE__ */ new Map();
-	/** 注册新 endpoint；重名抛错 */
+	/** 注册新 endpoint；重名抛错；含 `__`（endpoint:tool 分隔符）或保留名 mcp 拒绝 */
 	register(endpoint, client) {
+		if (endpoint.includes("__") || endpoint === "mcp") throw new Error(`Endpoint name ${JSON.stringify(endpoint)} is not allowed (no "__" segments, "mcp" is reserved)`);
 		if (this.#clients.has(endpoint)) throw new Error(`Endpoint "${endpoint}" is already registered`);
 		this.#clients.set(endpoint, client);
 		this.#versions.set(endpoint, (this.#versions.get(endpoint) ?? 0) + 1);
@@ -172,6 +173,8 @@ var EndpointRegistry = class {
 	}
 };
 const messageOf$3 = (e) => e instanceof Error ? e.message : String(e);
+/** MCP 结果单项 text 上限（64KB） */
+const MAX_MCP_RESULT_TEXT_BYTES = 64 * 1024;
 const failure$1 = (code, message) => ({
 	ok: false,
 	content: [],
@@ -235,14 +238,16 @@ var McpToolResolver = class {
 		});
 		return names;
 	}
-	/** CallToolResult → ToolResult；isError 转失败；content 经共享归一 */
+	/** CallToolResult → ToolResult；isError 转失败；形状消毒（无 content 且无 isError 不当作 ok）+ 大小上限 */
 	#normalizeCallResult(raw) {
 		const result = raw;
+		if (result?.isError !== true && result?.content === void 0) return failure$1("MCP_ENDPOINT_UNAVAILABLE", `MCP tool returned a malformed result (no "content" and no "isError"): ${messageOf$3(raw).slice(0, 200)}`);
 		const content = normalizeToolContent(result?.content ?? raw);
 		if (result?.isError === true) {
 			const text = content.map((c) => c.text ?? "").filter(Boolean).join("\n");
 			return failure$1("TOOL_EXECUTION_FAILED", text || "MCP tool returned an error");
 		}
+		for (const item of content) if (item.text !== void 0 && item.text.length > MAX_MCP_RESULT_TEXT_BYTES) item.text = `${item.text.slice(0, MAX_MCP_RESULT_TEXT_BYTES)}…[truncated ${item.text.length - MAX_MCP_RESULT_TEXT_BYTES} chars]`;
 		return {
 			ok: true,
 			content
@@ -414,7 +419,7 @@ var ExperimentalWebMcpAdapter = class {
 		this.#enabled = options?.enabled ?? false;
 	}
 	isAvailable() {
-		return typeof this.#resolveApi()?.executeTool === "function";
+		return this.#enabled && typeof this.#resolveApi()?.executeTool === "function";
 	}
 	/** 工具清单（listTools 缺失/失败时返回 undefined）；描述含 inputSchema 时透传 */
 	async listTools() {
@@ -549,7 +554,12 @@ const messageOf = (e) => e instanceof Error ? e.message : String(e);
 */
 async function connectRemoteEndpoint(registry, config) {
 	const { Client, SSEClientTransport, StreamableHTTPClientTransport } = await loadMcpSdk();
-	const url = new URL(config.url);
+	let url;
+	try {
+		url = new URL(config.url);
+	} catch (e) {
+		throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", `Invalid remote MCP endpoint URL for "${config.endpoint}": ${JSON.stringify(config.url)}`, e);
+	}
 	const requestInit = config.headers ? { headers: config.headers } : void 0;
 	const transport = config.transport === "sse" ? new SSEClientTransport(url, { ...requestInit ? { requestInit } : {} }) : new StreamableHTTPClientTransport(url, { ...requestInit ? { requestInit } : {} });
 	const client = new Client({
@@ -570,7 +580,14 @@ async function connectRemoteEndpoint(registry, config) {
 		} catch {}
 		throw unavailable(e);
 	}
-	registry.register(config.endpoint, client);
+	try {
+		registry.register(config.endpoint, client);
+	} catch (e) {
+		try {
+			await client.close();
+		} catch {}
+		throw unavailable(e);
+	}
 	let closed = false;
 	return { close: async () => {
 		if (closed) return;

package/dist/node.d.ts

@@ -1,5 +1,5 @@
-import { D as SKILLS_LOCKFILE, I as SkillInstallSource, K as VerifyResult, O as SKILL_MANIFEST_FILE, W as SkillsLockfile, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { ht as createScriptContext } from "./index-gjFuBevI.js";
+import { D as SKILLS_LOCKFILE, I as SkillInstallSource, K as VerifyResult, O as SKILL_MANIFEST_FILE, W as SkillsLockfile, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { ht as createScriptContext } from "./index-DZShzhon.js";
 import { n as LlmEnvConfig, s as probeLlmCapabilities, t as LlmCapabilities } from "./env-BPUBZCwJ-4jat_SVG.js";
-import { a as NodeScriptExecutor, c as ProcessSandboxOptions, d as SkillManager, f as exportArchive, i as NodeFS, l as SandboxOptions, n as FileArtifactStore, o as OxcSchemaInferer, p as readArchiveManifest, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as SandboxedScriptExecutor } from "./index-iqcz3_NS.js";
+import { a as NodeScriptExecutor, c as ProcessSandboxOptions, d as SkillManager, f as exportArchive, i as NodeFS, l as SandboxOptions, n as FileArtifactStore, o as OxcSchemaInferer, p as readArchiveManifest, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as SandboxedScriptExecutor } from "./index-DrHelz72.js";
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, type LlmCapabilities, type LlmEnvConfig, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, type ProcessSandboxOptions, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, type SandboxOptions, SandboxedScriptExecutor, type SkillInstallSource, SkillManager, type SkillManifest, type SkillsLockfile, type VerifyResult, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };

package/dist/node.js

@@ -1,6 +1,6 @@
-import { i as SKILL_MANIFEST_FILE, r as SKILLS_LOCKFILE } from "./dist-D0saNPi_.js";
-import { T as createScriptContext } from "./dist-NM4Mylx4.js";
+import { i as SKILL_MANIFEST_FILE, r as SKILLS_LOCKFILE } from "./dist-D7MsoMPx.js";
+import { T as createScriptContext } from "./dist-CV64gN62.js";
 import { i as probeLlmCapabilities } from "./env--jJB-TSX-04klhTYi.js";
-import { a as NodeScriptExecutor, c as SandboxedScriptExecutor, d as readArchiveManifest, i as NodeFS, l as SkillManager, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as exportArchive } from "./dist-CvIMVwr3.js";
+import { a as NodeScriptExecutor, c as SandboxedScriptExecutor, d as readArchiveManifest, i as NodeFS, l as SkillManager, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as exportArchive } from "./dist-Chgf2tcy.js";
 
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SandboxedScriptExecutor, SkillManager, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };

package/dist/processSandboxEntry.js

@@ -16,6 +16,16 @@ import { mkdtemp, rm, writeFile } from "node:fs/promises";
 * runtime/sandbox/networkPolicy.ts）；node:net 裸模块为已知残余面（文档明示）。
 * .js 走 data: URL 导入（permission 下实证可用）；.ts 走中性临时目录 file URL。
 */
+/** 不可序列化返回值统一报错（不静默丢数据；0.2.4 跨执行器语义统一） */
+function assertSerializable(value) {
+	try {
+		structuredClone(value);
+	} catch (e) {
+		const err = /* @__PURE__ */ new Error(`Script returned a non-serializable value: ${e instanceof Error ? e.message : String(e)}`);
+		err.code = "TOOL_EXECUTION_FAILED";
+		throw err;
+	}
+}
 const send = (message) => {
 	process.send?.(message);
 };
@@ -164,6 +174,7 @@ async function main(task) {
 		};
 		const runFn = mod["run"];
 		const value = await runFn(task.args ?? {}, context);
+		assertSerializable(value);
 		send({
 			type: "execute-result",
 			ok: true,

package/dist/sandboxWorkerEntry.js

@@ -67,6 +67,16 @@ async function loadModule(scriptPath, scriptSource) {
 	}
 	return await import(`${pathToFileURL(scriptPath).href}?t=${Date.now()}`);
 }
+/** 不可序列化返回值统一报错（不静默丢数据；0.2.4 跨执行器语义统一） */
+function assertSerializable(value) {
+	try {
+		structuredClone(value);
+	} catch (e) {
+		const err = /* @__PURE__ */ new Error(`Script returned a non-serializable value: ${e instanceof Error ? e.message : String(e)}`);
+		err.code = "TOOL_EXECUTION_FAILED";
+		throw err;
+	}
+}
 function post(message) {
 	port.postMessage(message);
 }
@@ -216,6 +226,7 @@ async function main() {
 		};
 		const runFn = mod["run"];
 		const value = await runFn(task.args ?? {}, context);
+		assertSerializable(value);
 		post({
 			type: "execute-result",
 			ok: true,

package/dist/{testing-B4pq6JYa.js → testing-BN18eqbD.js}

@@ -1,4 +1,4 @@
-import { u as WebSkillError } from "./dist-D0saNPi_.js";
+import { u as WebSkillError } from "./dist-D7MsoMPx.js";
 
 //#region ../runtime/dist/testing.js
 /**

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { c as LlmClient, d as LlmResponse, f as LlmStreamEvent, h as MemoryStore, l as LlmCompleteInput, n as ArtifactStore, o as InteractionRequest, s as InteractionResponse, t as Artifact, v as UiBridge } from "./types-CKm5G_eQ-8W8FnP4u.js";
+import { c as LlmClient, d as LlmResponse, f as LlmStreamEvent, h as MemoryStore, l as LlmCompleteInput, n as ArtifactStore, o as InteractionRequest, s as InteractionResponse, t as Artifact, v as UiBridge } from "./types-CKm5G_eQ-BqyXnvoR.js";
 import { a as loadGoogleConfigFromEnv, i as loadAnthropicConfigFromEnv, n as LlmEnvConfig, o as loadLlmConfigFromEnv, r as ProviderEnvConfig } from "./env-BPUBZCwJ-4jat_SVG.js";
 //#region ../runtime/dist/testing.d.ts
 //#region src/llm/mockLlmClient.d.ts

package/dist/testing.js

@@ -1,5 +1,5 @@
 import { t as MemoryArtifactStore } from "./memoryArtifactStore-C9lFVqPF-yFz6yJj0.js";
 import { n as loadGoogleConfigFromEnv, r as loadLlmConfigFromEnv, t as loadAnthropicConfigFromEnv } from "./env--jJB-TSX-04klhTYi.js";
-import { n as MockLlmClient, r as MockUiBridge, t as InMemoryStore } from "./testing-B4pq6JYa.js";
+import { n as MockLlmClient, r as MockUiBridge, t as InMemoryStore } from "./testing-BN18eqbD.js";
 
 export { InMemoryStore, MemoryArtifactStore, MockLlmClient, MockUiBridge, loadAnthropicConfigFromEnv, loadGoogleConfigFromEnv, loadLlmConfigFromEnv };

package/dist/{types-CKm5G_eQ-8W8FnP4u.d.ts → types-CKm5G_eQ-BqyXnvoR.d.ts}

@@ -118,6 +118,8 @@ interface FileSystemProvider {
   readonly kind: string;
   readText(path: string): Promise<string>;
   writeText(path: string, content: string): Promise<void>;
+  /** 真追加（审计日志等 append-only 账本；不整读改写） */
+  appendText(path: string, content: string): Promise<void>;
   readBinary(path: string): Promise<Uint8Array>;
   writeBinary(path: string, content: Uint8Array): Promise<void>;
   exists(path: string): Promise<boolean>;
@@ -129,6 +131,11 @@ interface FileSystemProvider {
   }): Promise<void>;
   /** 原子重命名（lockfile 等先写临时文件再 rename 的场景；实现侧无原生 rename 时 copy+remove 兜底） */
   rename(from: string, to: string): Promise<void>;
+  /**
+   * 可选：返回 root 限定视图（realpath 包含校验全方法生效）。
+   * 实现：NodeFS 支持；缺省（无此方法）时调用方按词法校验降级。
+   */
+  withRoot?(root: string): FileSystemProvider;
 }
 //#endregion
 //#region src/fs/memoryFs.d.ts
@@ -139,6 +146,7 @@ declare class MemoryFS implements FileSystemProvider {
   constructor();
   readText(path: string): Promise<string>;
   writeText(path: string, content: string): Promise<void>;
+  appendText(path: string, content: string): Promise<void>;
   readBinary(path: string): Promise<Uint8Array>;
   writeBinary(path: string, content: Uint8Array): Promise<void>;
   exists(path: string): Promise<boolean>;
@@ -158,11 +166,6 @@ declare function atomicWriteText(fs: FileSystemProvider, path: string, content:
 //#region src/fs/pathSecurity.d.ts
 /** 统一分隔符为 `/`，去除 `.` 段与重复分隔符（不解析 `..`） */
 declare function normalizePath(path: string): string;
-/**
- * 外部标识（runId、candidateId、skillName、versionId 等）作为单一路径段使用前的统一校验：
- * 拒绝空串、`.`、`..`、含 `/` 或 `\`、含 `:`（Windows 盘符/ADS）。
- * 违规抛 FS_PATH_OUTSIDE_ROOT（kind 用于错误消息定位，如 "runId"）。
- */
 declare function assertSafePathSegment(segment: string, kind: string): void;
 /**
  * 将相对路径安全地解析到 root 之内。

package/dist/ui-react.d.ts

@@ -1,4 +1,4 @@
-import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CKm5G_eQ-8W8FnP4u.js";
+import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CKm5G_eQ-BqyXnvoR.js";
 //#region ../ui-react/dist/index.d.ts
 //#region src/bridgeState.d.ts
 /**

package/dist/ui-react.js

@@ -1,4 +1,4 @@
-import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-BJobG0i-.js";
+import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-CeNAzFYi.js";
 import { useLayoutEffect, useRef, useState, useSyncExternalStore } from "react";
 import { jsx, jsxs } from "react/jsx-runtime";
 

package/dist/ui-vue.d.ts

@@ -1,4 +1,4 @@
-import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CKm5G_eQ-8W8FnP4u.js";
+import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CKm5G_eQ-BqyXnvoR.js";
 import { PropType } from "vue";
 //#region ../ui-vue/dist/index.d.ts
 //#region src/bridgeState.d.ts

package/dist/ui-vue.js

@@ -1,4 +1,4 @@
-import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-BJobG0i-.js";
+import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-CeNAzFYi.js";
 import { defineComponent, h, reactive, ref } from "vue";
 
 //#region ../ui-vue/dist/index.js

package/dist/ui.d.ts

@@ -1,5 +1,5 @@
-import { _ as RenderResultRequest, g as RenderBlock, o as InteractionRequest, r as ChartSpec, s as InteractionResponse, v as UiBridge } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { mt as buildRenderResult } from "./index-gjFuBevI.js";
+import { _ as RenderResultRequest, g as RenderBlock, o as InteractionRequest, r as ChartSpec, s as InteractionResponse, v as UiBridge } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { mt as buildRenderResult } from "./index-DZShzhon.js";
 //#region ../ui/dist/index.d.ts
 //#region src/model/formModel.d.ts
 interface FormModel {

package/dist/ui.js

@@ -1,4 +1,4 @@
-import { w as buildRenderResult } from "./dist-NM4Mylx4.js";
-import { C as renderRenderResult, D as toVercelToolInvocation, E as toOpenUiLang, S as renderMiniMarkdown, T as toA2uiMessages, _ as fromOpenUiAction, a as CHART_PALETTE, b as renderBlocks, c as OPENUI_SUBMIT_ACTION, d as WEBSKILL_STYLES_CSS, f as WebFormBridge, g as fromA2uiAction, h as ensureStyles, i as A2UI_VERSION, l as VERCEL_INTERACTION_TOOL_NAME, m as collectValues, n as A2UI_CANCEL_ACTION, o as LitRendererBridge, p as chartToTable, r as A2UI_SUBMIT_ACTION, s as OPENUI_CANCEL_ACTION, t as A2UI_BASIC_CATALOG_ID, u as VercelUiBridge, v as fromVercelToolResult, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-BJobG0i-.js";
+import { w as buildRenderResult } from "./dist-CV64gN62.js";
+import { C as renderRenderResult, D as toVercelToolInvocation, E as toOpenUiLang, S as renderMiniMarkdown, T as toA2uiMessages, _ as fromOpenUiAction, a as CHART_PALETTE, b as renderBlocks, c as OPENUI_SUBMIT_ACTION, d as WEBSKILL_STYLES_CSS, f as WebFormBridge, g as fromA2uiAction, h as ensureStyles, i as A2UI_VERSION, l as VERCEL_INTERACTION_TOOL_NAME, m as collectValues, n as A2UI_CANCEL_ACTION, o as LitRendererBridge, p as chartToTable, r as A2UI_SUBMIT_ACTION, s as OPENUI_CANCEL_ACTION, t as A2UI_BASIC_CATALOG_ID, u as VercelUiBridge, v as fromVercelToolResult, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-CeNAzFYi.js";
 
 export { A2UI_BASIC_CATALOG_ID, A2UI_CANCEL_ACTION, A2UI_SUBMIT_ACTION, A2UI_VERSION, CHART_PALETTE, LitRendererBridge, OPENUI_CANCEL_ACTION, OPENUI_SUBMIT_ACTION, VERCEL_INTERACTION_TOOL_NAME, VercelUiBridge, WEBSKILL_STYLES_CSS, WebFormBridge, buildRenderResult, chartToTable, collectValues, ensureStyles, fromA2uiAction, fromOpenUiAction, fromVercelToolResult, interactionToFormModel, renderBlocks, renderMiniChart, renderMiniMarkdown, renderRenderResult, shapeInteractionValue, toA2uiMessages, toOpenUiLang, toVercelToolInvocation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webskill/sdk",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "WebSkill \u2014 browser/Node agent skill runtime (skills, tools, MCP, governance, UI)",
   "license": "MIT",
   "type": "module",