@webskill/sdk 0.2.3 → 0.2.5

package/dist/browser.d.ts

@@ -1,5 +1,5 @@
-import { C as FileStat, I as SkillInstallSource, K as VerifyResult, W as SkillsLockfile, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
-import { N as NetworkPolicy, Q as ScriptExecutor, Z as ScriptExecutionContext, d as BridgeCapabilities, it as ToolResult, m as BridgeResponse, nt as ToolDefinition, p as BridgeRequest, pt as bridgeError, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, wt as parseBridgeRequest, y as ExternalToolSource } from "./index-gjFuBevI.js";
+import { B as SkillManifest, C as FileStat, G as SkillsLockfile, L as SkillInstallSource, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, o as InteractionRequest, q as VerifyResult, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits } from "./types-CKm5G_eQ-krKWW8WV.js";
+import { Et as parseBridgeRequest, N as NetworkPolicy, Q as ScriptExecutor, Z as ScriptExecutionContext, d as BridgeCapabilities, it as ToolResult, m as BridgeResponse, nt as ToolDefinition, p as BridgeRequest, pt as bridgeError, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, y as ExternalToolSource } from "./index-DfINBEOy.js";
 //#region ../browser/dist/index.d.ts
 //#region src/fs/featureDetection.d.ts
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -15,6 +15,7 @@ declare class OpfsProvider implements FileSystemProvider {
   });
   readText(p: string): Promise<string>;
   writeText(p: string, content: string): Promise<void>;
+  appendText(p: string, content: string): Promise<void>;
   readBinary(p: string): Promise<Uint8Array>;
   writeBinary(p: string, content: Uint8Array): Promise<void>;
   exists(p: string): Promise<boolean>;

package/dist/browser.js

@@ -1,6 +1,6 @@
-import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, T as readResponseWithLimit, b as isValidSkillName, c as SkillDiscovery, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D0saNPi_.js";
-import { A as isNetworkAllowed, C as bridgeError, E as createWebSkillApi, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, l as FsMemoryStore, m as OpenAiCompatibleClient, o as CapabilityApproval, u as FsRunSnapshotStore, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-NM4Mylx4.js";
-import { n as MockLlmClient } from "./testing-B4pq6JYa.js";
+import { C as messageOf, D as readResponseWithLimit, E as parseSkillPackManifest, M as unzipWithLimits, N as validateSkills, P as verifyManifest, T as parseSkillMarkdown, b as exportSkills, c as SkillDiscovery, d as assertRemoteUrlAllowed, h as buildManifest, i as SKILL_MANIFEST_FILE, j as resolveInsideRoot, m as buildCatalog, p as atomicWriteText, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, x as isValidSkillName } from "./dist-BQzncxXg.js";
+import { A as isNetworkAllowed, C as bridgeError, E as createWebSkillApi, F as normalizeToolError, I as parseBridgeRequest, M as networkUrlHost, P as normalizeToolContent, c as FsArtifactStore, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, l as FsMemoryStore, m as OpenAiCompatibleClient, o as CapabilityApproval, u as FsRunSnapshotStore, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-B77plHjw.js";
+import { n as MockLlmClient } from "./testing-BUoXvm1u.js";
 
 //#region ../browser/dist/index.js
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -57,6 +57,22 @@ var OpfsProvider = class {
 	async writeText(p, content) {
 		await this.writeBinary(p, new TextEncoder().encode(content));
 	}
+	async appendText(p, content) {
+		await this.#wrap(p, async () => {
+			const segments = this.#segments(p);
+			const name = segments.pop();
+			if (!name) throw new WebSkillError("FS_NOT_FOUND", `Invalid file path: ${p}`);
+			const handle = await (await this.#walkDir(`/${segments.join("/")}`, true)).getFileHandle(name, { create: true });
+			const size = (await handle.getFile()).size;
+			const writable = await handle.createWritable({ keepExistingData: true });
+			await writable.write({
+				type: "write",
+				position: size,
+				data: content
+			});
+			await writable.close();
+		});
+	}
 	async readBinary(p) {
 		return this.#wrap(p, async () => {
 			const handle = await this.#walkFile(p);
@@ -232,6 +248,16 @@ function loadModule(source) {
   return import(url);
 }
 
+function assertSerializable(value) {
+  try {
+    structuredClone(value);
+  } catch (e) {
+    var err = new Error('Script returned a non-serializable value: ' + String((e && e.message) || e));
+    err.code = 'TOOL_EXECUTION_FAILED';
+    throw err;
+  }
+}
+
 function postError(type, id, code, message, extra) {
   var msg = { type: type, id: id, ok: false, error: { code: code, message: message } };
   if (extra) Object.assign(msg, extra);
@@ -326,6 +352,7 @@ self.onmessage = async function (event) {
         throw new Error('Script does not export a run function');
       }
       var value = await mod2.run(msg.args, makeContext(msg));
+      assertSerializable(value);
       self.postMessage({
         type: 'execute-result', id: msg.id, ok: true,
         value: value === undefined ? null : value,
@@ -435,8 +462,7 @@ async function extractZipWeb(fs, data, destRoot, limits) {
 		else await fs.writeBinary(target, content);
 	}
 }
-const messageOf$1 = (e) => e instanceof Error ? e.message : String(e);
-const asInstallFailed = (e) => e instanceof WebSkillError && (e.code === "INSTALL_FAILED" || e.code === "TOOL_UNSUPPORTED") ? e : new WebSkillError("INSTALL_FAILED", `Install failed: ${messageOf$1(e)}`, e);
+const asInstallFailed = (e) => e instanceof WebSkillError && (e.code === "INSTALL_FAILED" || e.code === "TOOL_UNSUPPORTED") ? e : new WebSkillError("INSTALL_FAILED", `Install failed: ${messageOf(e)}`, e);
 const lockfilePath = (root) => `${root}/${SKILLS_LOCKFILE}`;
 /**
 * D5：浏览器技能安装（http(s) zip / ArrayBuffer；tar/git/npm → TOOL_UNSUPPORTED）。
@@ -467,9 +493,15 @@ var BrowserSkillManager = class {
 			if (source.type === "http") {
 				let res;
 				try {
-					res = await (this.#fetchImpl ?? fetch)(source.url);
+					const absolute = new URL(source.url, typeof location !== "undefined" ? location.href : void 0).href;
+					const url = assertRemoteUrlAllowed(absolute, {
+						allowHttp: source.allowHttp ?? false,
+						allowPrivateHosts: source.allowPrivateHosts ?? false
+					});
+					res = await (this.#fetchImpl ?? fetch)(url.href);
 				} catch (e) {
-					throw new WebSkillError("INSTALL_FAILED", `Download failed: ${messageOf$1(e)}`, e);
+					if (e instanceof WebSkillError) throw e;
+					throw new WebSkillError("INSTALL_FAILED", `Download failed: ${messageOf(e)}`, e);
 				}
 				if (!res.ok) throw new WebSkillError("INSTALL_FAILED", `Download failed with HTTP ${res.status}`);
 				data = await readResponseWithLimit(res, this.#archiveLimits);
@@ -499,7 +531,7 @@ var BrowserSkillManager = class {
 				name = metadata.name;
 				version = typeof metadata["version"] === "string" ? metadata["version"] : void 0;
 			} catch (e) {
-				throw new WebSkillError("INSTALL_FAILED", `Failed to read skill name from SKILL.md: ${messageOf$1(e)}`, e);
+				throw new WebSkillError("INSTALL_FAILED", `Failed to read skill name from SKILL.md: ${messageOf(e)}`, e);
 			}
 			if (!isValidSkillName(name)) throw new WebSkillError("INSTALL_FAILED", `Invalid skill name in SKILL.md (path traversal rejected): ${JSON.stringify(name)}`);
 			const finalRoot = `${stagingRoot}/final`;
@@ -565,7 +597,7 @@ var BrowserSkillManager = class {
 					name = metadata.name;
 					versions.set(name, typeof metadata["version"] === "string" ? metadata["version"] : void 0);
 				} catch (e) {
-					throw new WebSkillError("INSTALL_FAILED", `Failed to read skill name from SKILL.md of pack entry "${entry.name}": ${messageOf$1(e)}`, e);
+					throw new WebSkillError("INSTALL_FAILED", `Failed to read skill name from SKILL.md of pack entry "${entry.name}": ${messageOf(e)}`, e);
 				}
 				if (name !== entry.name) throw new WebSkillError("INSTALL_FAILED", `Skill pack entry "${entry.name}" does not match the SKILL.md name "${name}"`);
 				await copyDir(fs, skillDir, `${finalRoot}/${name}`);
@@ -647,7 +679,7 @@ var BrowserSkillManager = class {
 			await this.#removeLockEntry(name);
 			this.#onChanged?.();
 		} catch (e) {
-			throw new WebSkillError("UNINSTALL_FAILED", `Failed to uninstall "${name}": ${messageOf$1(e)}`, e);
+			throw new WebSkillError("UNINSTALL_FAILED", `Failed to uninstall "${name}": ${messageOf(e)}`, e);
 		}
 	}
 	async verifyIntegrity(name) {
@@ -667,7 +699,7 @@ var BrowserSkillManager = class {
 		try {
 			return JSON.parse(await this.#fs.readText(path));
 		} catch (e) {
-			throw new WebSkillError("INTEGRITY_FAILED", `Skills lockfile at ${path} is corrupted: ${messageOf$1(e)}`, e);
+			throw new WebSkillError("INTEGRITY_FAILED", `Skills lockfile at ${path} is corrupted: ${messageOf(e)}`, e);
 		}
 	}
 	async #createManifest(skillRoot, input) {
@@ -699,7 +731,7 @@ var BrowserSkillManager = class {
 		try {
 			return JSON.parse(await this.#fs.readText(path));
 		} catch (e) {
-			throw new WebSkillError("INTEGRITY_FAILED", `Skill manifest at ${path} is corrupted: ${messageOf$1(e)}`, e);
+			throw new WebSkillError("INTEGRITY_FAILED", `Skill manifest at ${path} is corrupted: ${messageOf(e)}`, e);
 		}
 	}
 	async #upsertLockEntry(name, entry) {
@@ -837,7 +869,6 @@ const resolveWorkerFactory = (mode) => {
 	return blobWorkerFactory;
 };
 const baseName = (p) => p.split("/").pop() ?? p;
-const messageOf = (e) => e instanceof Error ? e.message : String(e);
 /**
 * Web Worker 脚本沙箱执行器：loadDefinition 与 execute 都在 Worker 内完成，
 * 主线程从不 import 技能脚本；每次执行独立 Worker；超时 terminate 强杀。
@@ -940,12 +971,13 @@ var BrowserWorkerScriptExecutor = class {
 			}, timeoutMs, (bridgeRequest) => this.#handleBridge(bridgeRequest, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!response.ok) {
 				const stderrSummary = response.stderr?.length ? ` | stderr: ${response.stderr.join(" | ").slice(0, 500)}` : "";
+				const normalized = normalizeToolError(response.error?.code, response.error?.message ?? "script execution failed");
 				return {
 					ok: false,
 					content: [],
 					error: {
-						code: response.error?.code ?? "TOOL_EXECUTION_FAILED",
-						message: `${response.error?.message ?? "script execution failed"}${stderrSummary}`
+						code: normalized.code,
+						message: `${normalized.message}${stderrSummary}`
 					}
 				};
 			}