@webskill/sdk 0.2.4 → 0.2.6

package/dist/{dist-CeNAzFYi.js → dist-DNSG9FqC.js}

@@ -1,4 +1,4 @@
-import { u as WebSkillError } from "./dist-D7MsoMPx.js";
+import { u as WebSkillError } from "./dist-BQzncxXg.js";
 
 //#region ../ui/dist/index.js
 /** 提交值按请求类型归形（WebFormBridge 与框架组件库共享单一来源） */
@@ -78,8 +78,16 @@ function interactionToFormModel(request) {
 }
 const isEmpty = (v) => v === void 0 || v === "";
 /**
+* 控件名 → 属性选择器：优先 CSS.escape（标识符形式，免引号转义）；
+* 无 CSS.escape 的环境退化为引号包裹 + 转义反斜杠/双引号（防选择器注入崩溃）
+*/
+function controlSelector(name) {
+	if (typeof CSS !== "undefined" && typeof CSS.escape === "function") return `[data-webskill-control=${CSS.escape(name)}]`;
+	return `[data-webskill-control="${name.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"]`;
+}
+/**
 * 严格类型化控件值收集：
-* - number 空串 → undefined（非 0）
+* - number 空串 → undefined（非 0）；非数值输入（NaN）按缺失处理（required 时入 missingRequired）
 * - select 用 option 值本身经 JSON 编码比对命中（对象值可正确命中）
 * - required 空值列入 missingRequired（由调用方阻止提交并标记）
 */
@@ -87,13 +95,17 @@ function collectValues(controls, container) {
 	const values = {};
 	const missingRequired = [];
 	for (const control of controls) {
-		const el = container.querySelector(`[data-webskill-control="${control.name}"]`);
+		const el = container.querySelector(controlSelector(control.name));
 		let value;
 		if (el === null) value = void 0;
 		else if (control.control === "boolean") value = el.checked;
 		else if (control.control === "number") {
 			const raw = el.value.trim();
-			value = raw === "" ? void 0 : Number(raw);
+			if (raw === "") value = void 0;
+			else {
+				const n = Number(raw);
+				value = Number.isNaN(n) ? void 0 : n;
+			}
 		} else if (control.control === "select") {
 			const attr = el.value;
 			const hit = control.options?.find((o) => JSON.stringify(o.value) === attr);
@@ -736,12 +748,15 @@ var VercelUiBridge = class {
 * - 每行一条语句 `identifier = Expression`，`root = Component(...)` 为入口
 * - 组件调用参数为位置参数；字符串双引号反斜杠转义
 * - 组件词汇（与应用 Library 约定）：Form(title, children)、
+*   Text(content)（纯展示文本，authorize 的能力描述用）、
 *   TextField(name, label, required?, defaultValue?)、NumberField、BooleanField(name, label, default?)、
 *   SelectField(name, label, options)、SubmitButton(label, actionType, requestId)、
 *   CancelButton(label, actionType, requestId)
 */
 const OPENUI_SUBMIT_ACTION = "webskill:submit";
 const OPENUI_CANCEL_ACTION = "webskill:cancel";
+/** authorize 的 Allow 专用动作（提交即批准 → value:true；Deny 走 cancel → cancelled:true） */
+const OPENUI_AUTHORIZE_ACTION = "webskill:authorize";
 const str = (s) => JSON.stringify(s);
 const val = (v) => JSON.stringify(v ?? null);
 function fieldStatements(fields) {
@@ -808,18 +823,19 @@ function toOpenUiLang(request) {
 			break;
 		case "authorize":
 			title = "Authorization required";
-			fields = [{
-				name: "approved",
-				label: request.message,
-				control: "boolean",
-				defaultValue: false
-			}];
+			fields = [];
 			break;
 	}
 	lines.push(...fieldStatements(fields));
 	const children = fields.map((_, i) => `f${i}`);
-	lines.push(`submit = SubmitButton("Submit", ${str(OPENUI_SUBMIT_ACTION)}, ${str(request.id)})`);
-	lines.push(`cancel = CancelButton("Cancel", ${str(OPENUI_CANCEL_ACTION)}, ${str(request.id)})`);
+	const isAuthorize = request.type === "authorize";
+	if (isAuthorize) {
+		lines.push(`message = Text(${str(request.message)})`);
+		children.push("message");
+	}
+	const submitAction = isAuthorize ? OPENUI_AUTHORIZE_ACTION : OPENUI_SUBMIT_ACTION;
+	lines.push(`submit = SubmitButton(${str(isAuthorize ? "Allow" : "Submit")}, ${str(submitAction)}, ${str(request.id)})`);
+	lines.push(`cancel = CancelButton(${str(isAuthorize ? "Deny" : "Cancel")}, ${str(OPENUI_CANCEL_ACTION)}, ${str(request.id)})`);
 	lines.push(`root = Form(${val(title)}, [${[
 		...children,
 		"submit",
@@ -838,6 +854,10 @@ function fromOpenUiAction(action) {
 		id,
 		cancelled: true
 	};
+	if (a.type === "webskill:authorize") return {
+		id,
+		value: true
+	};
 	if (a.type === "webskill:submit") {
 		const formState = a.formState;
 		if (formState) return {
@@ -1002,20 +1022,70 @@ function toA2uiMessages(request) {
 	return messages;
 }
 /**
-* A2UI client→server action 事件 → InteractionResponse
+* 按 InteractionRequest.type 解码提交值（绑定模型原样回传的是表单对象）：
+* confirm 仅 confirmed===true 批准；select 还原原始 option 值（非字符串值经 JSON 编码比对）；
+* form 的 number 字段转 number（NaN 保留原值）；ask 取 answer；authorize 提交即批准。
+* 纯转换器：任何直接使用 fromA2uiAction 的消费者都应经此拿到正确类型。
+* @experimental
+*/
+function decodeInteractionResponse(request, response) {
+	if (response.cancelled) return response;
+	const values = response.value;
+	switch (request.type) {
+		case "confirm": return {
+			...response,
+			value: values?.confirmed === true
+		};
+		case "ask": return {
+			...response,
+			value: values?.answer
+		};
+		case "select": {
+			const raw = values?.selected;
+			const option = request.options.find((o) => o.value === raw || JSON.stringify(o.value) === raw);
+			return {
+				...response,
+				value: option ? option.value : raw
+			};
+		}
+		case "form": {
+			if (typeof values !== "object" || values === null) return response;
+			const out = { ...values };
+			for (const field of request.fields) if (field.type === "number" && out[field.name] !== void 0) {
+				const n = Number(out[field.name]);
+				if (!Number.isNaN(n)) out[field.name] = n;
+			}
+			return {
+				...response,
+				value: out
+			};
+		}
+		case "authorize": return {
+			...response,
+			value: true
+		};
+		default: return response;
+	}
+}
+/**
+* A2UI client→server action 事件 → InteractionResponse。
+* 传入 request 时按类型解码提交值（见 decodeInteractionResponse）。
 * @experimental
 */
-function fromA2uiAction(event) {
+function fromA2uiAction(event, request) {
 	const e = event ?? {};
 	const id = String(e.context?.["requestId"] ?? "");
 	if (e.name === "webskill:cancel") return {
 		id,
 		cancelled: true
 	};
-	if (e.name === "webskill:submit") return {
-		id,
-		value: e.context?.["values"] ?? e.context?.["form"] ?? e.context
-	};
+	if (e.name === "webskill:submit") {
+		const response = {
+			id,
+			value: e.context?.["values"] ?? e.context?.["form"] ?? e.context
+		};
+		return request ? decodeInteractionResponse(request, response) : response;
+	}
 	return {
 		id,
 		value: e.context
@@ -1041,6 +1111,8 @@ function loadA2uiRuntime() {
 var LitRendererBridge = class {
 	#mount;
 	#doc;
+	/** 进行中的交互：id → resolve 与 surface 元素（cancel 时清理并以 cancelled resolve） */
+	#pending = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.#mount = deps.mount;
 		this.#doc = deps.document ?? deps.mount.ownerDocument;
@@ -1050,75 +1122,42 @@ var LitRendererBridge = class {
 		const messages = toA2uiMessages(input);
 		const surfaceId = `webskill-${input.id}`;
 		return new Promise((resolve) => {
-			const cleanup = (el) => el?.remove();
-			let surfaceEl;
+			const entry = { resolve };
+			this.#pending.set(input.id, entry);
 			const processor = new MessageProcessor([basicCatalog], (action) => {
 				const surfaces = processor.getClientDataModel("v0.9.1")?.surfaces;
 				const formValues = typeof surfaces?.[surfaceId] === "object" && surfaces[surfaceId] !== null ? surfaces[surfaceId]["form"] ?? action.context : action.context;
-				cleanup(surfaceEl);
-				const response = fromA2uiAction({
+				this.#pending.delete(input.id);
+				entry.surfaceEl?.remove();
+				resolve(fromA2uiAction({
 					...action,
 					context: {
 						...action.context,
 						values: formValues
 					}
-				});
-				resolve(this.#decodeValue(input, response));
+				}, input));
 			}, { version: "v0.9.1" });
 			processor.onSurfaceCreated((surface) => {
 				const el = this.#doc.createElement("a2ui-surface");
 				el.surface = surface;
-				surfaceEl = el;
+				entry.surfaceEl = el;
 				this.#mount.appendChild(el);
 			});
 			processor.processMessages(messages);
 		});
 	}
-	/**
-	* 按 InteractionRequest.type 解码提交值（绑定模型原样回传的是表单对象）：
-	* confirm 仅 confirmed===true 批准；select 还原原始 option 值（非字符串值经 JSON 编码比对）；
-	* form 的 number 字段转 number；ask 取 answer；authorize 提交即批准。
-	*/
-	#decodeValue(input, response) {
-		if (response.cancelled) return response;
-		const values = response.value;
-		switch (input.type) {
-			case "confirm": return {
-				...response,
-				value: values?.confirmed === true
-			};
-			case "ask": return {
-				...response,
-				value: values?.answer
-			};
-			case "select": {
-				const raw = values?.selected;
-				const option = input.options.find((o) => o.value === raw || JSON.stringify(o.value) === raw);
-				return {
-					...response,
-					value: option ? option.value : raw
-				};
-			}
-			case "form": {
-				if (typeof values !== "object" || values === null) return response;
-				const out = { ...values };
-				for (const field of input.fields) if (field.type === "number" && out[field.name] !== void 0) {
-					const n = Number(out[field.name]);
-					if (!Number.isNaN(n)) out[field.name] = n;
-				}
-				return {
-					...response,
-					value: out
-				};
-			}
-			case "authorize": return {
-				...response,
-				value: true
-			};
-			default: return response;
-		}
+	/** runtime 交互超时/取消：移除 surface 并以 cancelled resolve pending Promise（防悬挂 + DOM 残留） */
+	cancel(id) {
+		const entry = this.#pending.get(id);
+		if (!entry) return;
+		this.#pending.delete(id);
+		entry.surfaceEl?.remove();
+		entry.resolve({
+			id,
+			cancelled: true
+		});
 	}
 };
 
 //#endregion
-export { renderRenderResult as C, toVercelToolInvocation as D, toOpenUiLang as E, renderMiniMarkdown as S, toA2uiMessages as T, fromOpenUiAction as _, CHART_PALETTE as a, renderBlocks as b, OPENUI_SUBMIT_ACTION as c, WEBSKILL_STYLES_CSS as d, WebFormBridge as f, fromA2uiAction as g, ensureStyles as h, A2UI_VERSION as i, VERCEL_INTERACTION_TOOL_NAME as l, collectValues as m, A2UI_CANCEL_ACTION as n, LitRendererBridge as o, chartToTable as p, A2UI_SUBMIT_ACTION as r, OPENUI_CANCEL_ACTION as s, A2UI_BASIC_CATALOG_ID as t, VercelUiBridge as u, fromVercelToolResult as v, shapeInteractionValue as w, renderMiniChart as x, interactionToFormModel as y };
+export { renderMiniChart as C, toA2uiMessages as D, shapeInteractionValue as E, toOpenUiLang as O, renderBlocks as S, renderRenderResult as T, ensureStyles as _, CHART_PALETTE as a, fromVercelToolResult as b, OPENUI_CANCEL_ACTION as c, VercelUiBridge as d, WEBSKILL_STYLES_CSS as f, decodeInteractionResponse as g, collectValues as h, A2UI_VERSION as i, toVercelToolInvocation as k, OPENUI_SUBMIT_ACTION as l, chartToTable as m, A2UI_CANCEL_ACTION as n, LitRendererBridge as o, WebFormBridge as p, A2UI_SUBMIT_ACTION as r, OPENUI_AUTHORIZE_ACTION as s, A2UI_BASIC_CATALOG_ID as t, VERCEL_INTERACTION_TOOL_NAME as u, fromA2uiAction as v, renderMiniMarkdown as w, interactionToFormModel as x, fromOpenUiAction as y };

package/dist/{dist-Chgf2tcy.js → dist-DWFDb1Ww.js}

@@ -1,5 +1,5 @@
-import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, O as resolveArchiveLimits, T as readResponseWithLimit, b as isValidSkillName, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D7MsoMPx.js";
-import { A as isNetworkAllowed, C as bridgeError, F as normalizeToolError, I as parseBridgeRequest, M as networkUrlHost, P as normalizeToolContent, c as FsArtifactStore, l as FsMemoryStore, o as CapabilityApproval } from "./dist-CV64gN62.js";
+import { A as resolveArchiveLimits, C as messageOf, D as readResponseWithLimit, E as parseSkillPackManifest, M as unzipWithLimits, N as validateSkills, P as verifyManifest, T as parseSkillMarkdown, b as exportSkills, d as assertRemoteUrlAllowed, h as buildManifest, i as SKILL_MANIFEST_FILE, j as resolveInsideRoot, p as atomicWriteText, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, x as isValidSkillName } from "./dist-BQzncxXg.js";
+import { A as isNetworkAllowed, C as bridgeError, F as normalizeToolError, I as parseBridgeRequest, M as networkUrlHost, P as normalizeToolContent, c as FsArtifactStore, l as FsMemoryStore, o as CapabilityApproval } from "./dist-BXpDDZpR.js";
 import { createRequire } from "node:module";
 import { unzipSync, zipSync } from "fflate";
 import { existsSync, promises, realpathSync } from "node:fs";
@@ -295,7 +295,6 @@ var NodeScriptExecutor = class {
 };
 const baseName$1 = (p) => p.split("/").pop() ?? p;
 const toPlatform$3 = (p) => p.split("/").join(path.sep);
-const messageOf$6 = (e) => e instanceof Error ? e.message : String(e);
 /**
 * 网络策略判定函数源码（注入 Worker；匹配逻辑单一来源在
 * runtime/sandbox/networkPolicy.ts，Worker 线程不走 vitest 别名故注入而非 import）
@@ -381,7 +380,7 @@ var SandboxedScriptExecutor = class {
 				content: [],
 				error: {
 					code: e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED",
-					message: messageOf$6(e)
+					message: messageOf(e)
 				}
 			};
 		}
@@ -422,7 +421,7 @@ var SandboxedScriptExecutor = class {
 				content: [],
 				error: {
 					code: e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED",
-					message: messageOf$6(e)
+					message: messageOf(e)
 				}
 			};
 		}
@@ -473,7 +472,7 @@ var SandboxedScriptExecutor = class {
 						respond(bridgeError("unknown", "TOOL_EXECUTION_FAILED", "invalid bridge request"));
 						return;
 					}
-					onBridge(request).then(respond, (e) => respond(bridgeError(request.id, "TOOL_EXECUTION_FAILED", messageOf$6(e))));
+					onBridge(request).then(respond, (e) => respond(bridgeError(request.id, "TOOL_EXECUTION_FAILED", messageOf(e))));
 					return;
 				}
 				if (msg?.type === "load-result" || msg?.type === "execute-result") done(() => resolve(msg));
@@ -534,13 +533,12 @@ var SandboxedScriptExecutor = class {
 				}
 			}
 		} catch (e) {
-			return bridgeError(request.id, e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED", messageOf$6(e));
+			return bridgeError(request.id, e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED", messageOf(e));
 		}
 	}
 };
 const baseName = (p) => p.split("/").pop() ?? p;
 const toPlatform$2 = (p) => p.split("/").join(path.sep);
-const messageOf$5 = (e) => e instanceof Error ? e.message : String(e);
 const NETWORK_POLICY_LIB = `${isNetworkAllowed.toString()}\n${networkUrlHost.toString()}`;
 const readAllow = (p) => [`--allow-fs-read=${p}`, `--allow-fs-read=${realpathSync(p)}`];
 const writeAllow = (p) => [`--allow-fs-write=${p}`, `--allow-fs-write=${realpathSync(p)}`];
@@ -572,6 +570,7 @@ var ProcessSandboxExecutor = class {
 	#approval;
 	#slots = [];
 	#waiters = [];
+	#disposed = false;
 	constructor(fs, options = {}) {
 		this.#fs = fs;
 		this.#options = options;
@@ -589,8 +588,9 @@ var ProcessSandboxExecutor = class {
 	get poolSize() {
 		return this.#options.poolSize ?? 2;
 	}
-	/** 池全部子进程销毁（测试收尾/进程退出前调用） */
+	/** 池全部子进程销毁（测试收尾/进程退出前调用）；排队中的 acquire 一律 reject（不悬挂） */
 	async dispose() {
+		this.#disposed = true;
 		for (const slot of this.#slots) {
 			slot.child.kill();
 			await rm(slot.artifactDir, {
@@ -599,7 +599,8 @@ var ProcessSandboxExecutor = class {
 			}).catch(() => void 0);
 		}
 		this.#slots = [];
-		this.#waiters = [];
+		const waiters = this.#waiters.splice(0);
+		for (const waiter of waiters) waiter.reject(new WebSkillError("TOOL_EXECUTION_FAILED", "Process sandbox executor disposed while a caller was waiting for a pool slot"));
 	}
 	async #locateScript(skillRoot, scriptName) {
 		const tsPath = `${skillRoot}/scripts/${scriptName}.ts`;
@@ -612,6 +613,7 @@ var ProcessSandboxExecutor = class {
 	/** 取一个可用子进程（同 key 复用 / 淘汰 idle 重生 / 扩容 / 排队） */
 	async #acquire(key) {
 		for (;;) {
+			if (this.#disposed) throw new WebSkillError("TOOL_EXECUTION_FAILED", "Process sandbox executor is disposed");
 			const idle = this.#slots.filter((s) => !s.busy);
 			const match = idle.find((s) => s.key === key);
 			if (match) {
@@ -633,7 +635,10 @@ var ProcessSandboxExecutor = class {
 				this.#slots.push(slot);
 				return slot;
 			}
-			await new Promise((resolve) => this.#waiters.push(resolve));
+			await new Promise((resolve, reject) => this.#waiters.push({
+				resolve,
+				reject
+			}));
 		}
 	}
 	/** 执行后回收：kill 旧子进程，补位重生同 key 新子进程（温池保持），唤醒排队 */
@@ -645,13 +650,27 @@ var ProcessSandboxExecutor = class {
 			recursive: true,
 			force: true
 		}).catch(() => void 0);
-		this.#spawnSlot(slot.key).then((fresh) => {
+		this.#spawnSlot(slot.key).then(async (fresh) => {
+			if (this.#disposed) {
+				fresh.child.kill();
+				await rm(fresh.artifactDir, {
+					recursive: true,
+					force: true
+				}).catch(() => void 0);
+				return;
+			}
 			this.#slots.push(fresh);
-		}).catch(() => void 0).finally(() => {
+		}).catch((e) => {
+			this.#warn(`Failed to respawn sandbox child for pool maintenance: ${messageOf(e)}`);
+		}).finally(() => {
 			const waiter = this.#waiters.shift();
-			if (waiter) waiter();
+			if (waiter) waiter.resolve();
 		});
 	}
+	#warn(message) {
+		if (this.#options.onWarning) this.#options.onWarning(message);
+		else console.warn(message);
+	}
 	async #spawnSlot(key) {
 		const artifactDir = await mkdtemp(path.join(tmpdir(), "webskill-psbx-out-")).then((d) => d.split(path.sep).join("/"));
 		const entry = processEntryPath();
@@ -712,7 +731,7 @@ var ProcessSandboxExecutor = class {
 				content: [],
 				error: {
 					code: e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED",
-					message: messageOf$5(e)
+					message: messageOf(e)
 				}
 			};
 		}
@@ -755,7 +774,7 @@ var ProcessSandboxExecutor = class {
 				content: [],
 				error: {
 					code: e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED",
-					message: messageOf$5(e)
+					message: messageOf(e)
 				}
 			};
 		} finally {
@@ -794,7 +813,7 @@ var ProcessSandboxExecutor = class {
 						respond(bridgeError("unknown", "TOOL_EXECUTION_FAILED", "invalid bridge request"));
 						return;
 					}
-					onBridge(request).then(respond, (e) => respond(bridgeError(request.id, "TOOL_EXECUTION_FAILED", messageOf$5(e))));
+					onBridge(request).then(respond, (e) => respond(bridgeError(request.id, "TOOL_EXECUTION_FAILED", messageOf(e))));
 					return;
 				}
 				if (msg?.type === "load-result" || msg?.type === "execute-result") done(() => resolve(msg));
@@ -863,7 +882,7 @@ var ProcessSandboxExecutor = class {
 				}
 			}
 		} catch (e) {
-			return bridgeError(request.id, e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED", messageOf$5(e));
+			return bridgeError(request.id, e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED", messageOf(e));
 		}
 	}
 };
@@ -1195,7 +1214,6 @@ var CliUiBridge = class {
 		return new Promise((resolve) => this.#waiters.push(resolve));
 	}
 };
-const messageOf$4 = (e) => e instanceof Error ? e.message : String(e);
 const toPlatform$1 = (p) => p.split("/").join(path.sep);
 const isZipArchive = (data) => data.length > 1 && data[0] === 80 && data[1] === 75;
 let tarModule$1;
@@ -1244,7 +1262,7 @@ async function extractTarFile(archivePath, destRoot, limits) {
 		});
 	} catch (e) {
 		if (e instanceof WebSkillError) throw e;
-		throw new WebSkillError("INSTALL_FAILED", `Failed to extract tar archive: ${messageOf$4(e)}`, e);
+		throw new WebSkillError("INSTALL_FAILED", `Failed to extract tar archive: ${messageOf(e)}`, e);
 	}
 }
 /** 递归列出目录内全部文件（相对路径，posix 分隔，不含目录条目） */
@@ -1288,7 +1306,6 @@ async function removeDirQuiet(fs, dir) {
 		if (await fs.exists(dir)) await fs.remove(dir, { recursive: true });
 	} catch {}
 }
-const messageOf$3 = (e) => e instanceof Error ? e.message : String(e);
 let tarModule;
 async function loadTar() {
 	tarModule ??= await import("tar").catch((e) => {
@@ -1310,7 +1327,7 @@ async function exportArchive(fs, skillRoot, options) {
 		return options.outPath;
 	} catch (e) {
 		if (e instanceof WebSkillError) throw e;
-		throw new WebSkillError("EXPORT_FAILED", `Failed to export ${options.format} archive: ${messageOf$3(e)}`, e);
+		throw new WebSkillError("EXPORT_FAILED", `Failed to export ${options.format} archive: ${messageOf(e)}`, e);
 	}
 }
 /** 只解出归档中的 webskill.skill-manifest.json 条目（安装前预览） */
@@ -1338,13 +1355,12 @@ async function readArchiveManifest(fs, archivePath) {
 			}
 		});
 	} catch (e) {
-		throw new WebSkillError("EXPORT_FAILED", `Failed to read tar archive: ${messageOf$3(e)}`, e);
+		throw new WebSkillError("EXPORT_FAILED", `Failed to read tar archive: ${messageOf(e)}`, e);
 	}
 	if (manifestText === void 0) throw notFound();
 	return JSON.parse(manifestText);
 }
 const _execFileP = promisify(execFile);
-const messageOf$2 = (e) => e instanceof Error ? e.message : String(e);
 /**
 * 跨平台执行命令：Windows 下对 npm 等 cmd 包装的命令通过 cmd.exe 代理执行，
 * git 等原生 exe 不受影响。默认 120s 超时（防挂死安装管线）。
@@ -1360,7 +1376,7 @@ async function execFileP(command, args, options = {}) {
 }
 /** 命令缺失/失败 → INSTALL_FAILED 结构化诊断 */
 function commandFailed(command, e) {
-	return new WebSkillError("INSTALL_FAILED", `Failed to run ${command}: ${e?.code === "ENOENT" ? `command "${command}" not found on this system` : messageOf$2(e)}`, e);
+	return new WebSkillError("INSTALL_FAILED", `Failed to run ${command}: ${e?.code === "ENOENT" ? `command "${command}" not found on this system` : messageOf(e)}`, e);
 }
 /** git url 协议白名单：https:// 与 git@ SCP 形式；无 scheme 的本地路径放行（dev 工作流）；
 * 其余显式协议（ext::/file:// 等）一律拒绝 */
@@ -1409,15 +1425,38 @@ async function stageGit(source, ctx) {
 function sha256Hex(data) {
 	return createHash("sha256").update(data).digest("hex");
 }
-const messageOf$1 = (e) => e instanceof Error ? e.message : String(e);
-/** http 源：下载归档（Content-Length + 流式累计上限；可选 expectedSha256 校验包体）→ 解包 → 定位技能根/包集 */
+/** 重定向跳数上限（SSRF 防护：逐跳重新校验目标 URL） */
+const MAX_REDIRECT_HOPS = 3;
+/**
+* 带 SSRF 防护的下载：手动跟随重定向（默认 ≤3 跳），初始 URL 与每一跳目标
+* 都过 assertRemoteUrlAllowed（https 默认；私有/环回/链路本地默认拒绝）。
+*/
+async function fetchWithSsrfGuard(source, fetchImpl) {
+	const policy = {
+		allowHttp: source.allowHttp ?? false,
+		allowPrivateHosts: source.allowPrivateHosts ?? false
+	};
+	let url = assertRemoteUrlAllowed(source.url, policy);
+	for (let hop = 0;; hop++) {
+		const res = await fetchImpl(url.href, { redirect: "manual" });
+		const location = res.headers.get("location");
+		if (res.status >= 300 && res.status < 400 && location) {
+			if (hop >= MAX_REDIRECT_HOPS) throw new WebSkillError("INSTALL_FAILED", `Download exceeded the redirect limit of ${MAX_REDIRECT_HOPS} hops`);
+			url = assertRemoteUrlAllowed(new URL(location, url).href, policy);
+			continue;
+		}
+		return res;
+	}
+}
+/** http 源：下载归档（SSRF 防护 + Content-Length/流式上限；可选 expectedSha256 校验包体）→ 解包 → 定位技能根/包集 */
 async function stageHttp(source, ctx, expectedSha256) {
 	const fetchImpl = ctx.fetchImpl ?? fetch;
 	let res;
 	try {
-		res = await fetchImpl(source.url);
+		res = await fetchWithSsrfGuard(source, fetchImpl);
 	} catch (e) {
-		throw new WebSkillError("INSTALL_FAILED", `Download failed: ${messageOf$1(e)}`, e);
+		if (e instanceof WebSkillError) throw e;
+		throw new WebSkillError("INSTALL_FAILED", `Download failed: ${messageOf(e)}`, e);
 	}
 	if (!res.ok) throw new WebSkillError("INSTALL_FAILED", `Download failed with HTTP ${res.status}`);
 	const data = await readResponseWithLimit(res, ctx.archiveLimits);
@@ -1466,13 +1505,19 @@ async function stageLocal(source, ctx) {
 /** npm 包名（@scope/name 或 name，小写字母数字 . _ - /）与版本（semver 或 dist-tag）正则 */
 const PACKAGE_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
 const VERSION_RE = /^[a-z0-9._~^>=<x*+-]+$/i;
+/**
+* 本地路径字符白名单（Windows 下 npm 经 cmd /c 代理二次解析，
+* `& | < > ^ " ' % ! ;` 与空格一律拒绝；允许 Windows 盘符 `C:\` 与正/反斜杠）
+*/
+const LOCAL_PATH_RE = /^[A-Za-z0-9._~+@/\\:-]+$/;
 function assertNpmSpecSafe(source) {
 	const name = source.packageName;
 	const isLocalPath = name.startsWith("/") || name.startsWith("./") || name.startsWith("../");
 	if (name.startsWith("--") || !PACKAGE_NAME_RE.test(name) && !isLocalPath) throw new WebSkillError("INSTALL_FAILED", `Invalid npm package name: ${JSON.stringify(name)}`);
+	if (isLocalPath && !LOCAL_PATH_RE.test(name)) throw new WebSkillError("INSTALL_FAILED", `Local npm path contains characters outside the safe whitelist: ${JSON.stringify(name)}`);
 	if (source.version !== void 0 && (!VERSION_RE.test(source.version) || source.version.startsWith("--"))) throw new WebSkillError("INSTALL_FAILED", `Invalid npm package version: ${JSON.stringify(source.version)}`);
 }
-/** npm 源：npm pack → 解 tar.gz；技能根取包的 skill/ 子目录（存在时）否则包根；spec 前插 `--` 防选项注入 */
+/** npm 源：npm pack --ignore-scripts → 解 tar.gz；技能根取包的 skill/ 子目录（存在时）否则包根；spec 前插 `--` 防选项注入 */
 async function stageNpm(source, ctx) {
 	assertNpmSpecSafe(source);
 	const spec = source.version ? `${source.packageName}@${source.version}` : source.packageName;
@@ -1480,6 +1525,7 @@ async function stageNpm(source, ctx) {
 	try {
 		({stdout} = await execFileP("npm", [
 			"pack",
+			"--ignore-scripts",
 			"--pack-destination",
 			ctx.stagingRoot,
 			"--",
@@ -1596,7 +1642,6 @@ async function verifyIntegrity(fs, skillRoot) {
 	for (const rel of actualFiles) actualHashes.set(rel, sha256Hex(await fs.readBinary(`${skillRoot}/${rel}`)));
 	return verifyManifest(manifest, actualHashes, actualFiles);
 }
-const messageOf = (e) => e instanceof Error ? e.message : String(e);
 const asInstallFailed = (e) => e instanceof WebSkillError && e.code === "INSTALL_FAILED" ? e : new WebSkillError("INSTALL_FAILED", `Install failed: ${messageOf(e)}`, e);
 /**
 * 技能管理门面：统一安装管线（staging → 解析 name → 校验 → 拷贝 → manifest → lockfile），