@webskill/sdk 0.2.8 → 0.3.0

package/dist/node.d.ts

@@ -1,7 +1,296 @@
-import { K as SkillInstallSource, L as SKILLS_LOCKFILE, N as FileSystemProvider, R as SKILL_MANIFEST_FILE, Y as SkillManifest, et as SkillsLockfile, nt as VerifyResult, v as UiBridge } from "./types-AmKCKJn_-BogJPQHU.js";
-import { Q as ScriptExecutor, dt as WebSkillRuntime, ft as WebSkillRuntimeDeps, ht as createScriptContext } from "./index-QrHtAudz.js";
+import { $ as SkillInstallSource, H as SKILL_MANIFEST_FILE, I as JsonSchema, N as FileStat, O as ArchiveLimits, P as FileSystemProvider, V as SKILLS_LOCKFILE, _ as RenderResultRequest, dt as TrustedKeyStore, ft as UnsignedPolicy, lt as SkillsLockfile, mt as VerifyResult, nt as SkillManagerPort, o as InteractionRequest, q as SignatureAuditSink, rt as SkillManifest, s as InteractionResponse, v as UiBridge } from "./types-AmKCKJn_-VGabeXK4.js";
+import { F as NetworkPolicy, Ot as createScriptContext, Tt as WebSkillRuntimeDeps, _t as ToolResult, b as FsArtifactStore, ct as ScriptExecutor, d as BridgeCapabilities, ht as ToolDefinition, ot as SchemaInferer, st as ScriptExecutionContext, u as ApprovalScope, wt as WebSkillRuntime, x as FsMemoryStore } from "./index-8d-oEDww.js";
+import { a as AuditLog, c as CandidateSkill, d as CandidateStore, h as SkillVersionStore, r as ApprovalPolicy } from "./skillVersionStore-DOEI9ptb-BxbYL70B.js";
 import { n as LlmEnvConfig, s as probeLlmCapabilities, t as LlmCapabilities } from "./env-BPUBZCwJ-4jat_SVG.js";
-import { C as ProcessSandboxExecutor, D as SkillManager, E as SandboxedScriptExecutor, O as exportArchive, S as OxcSchemaInferer, T as SandboxOptions, _ as CliUiBridge, a as AuditLog, b as NodeFS, c as CandidateSkill, d as CandidateStore, h as SkillVersionStore, k as readArchiveManifest, r as ApprovalPolicy, v as FileArtifactStore, w as ProcessSandboxOptions, x as NodeScriptExecutor, y as FileMemoryStore } from "./skillVersionStore-B7rGjtMi-BgnQho9v.js";
+import { Readable, Writable } from "node:stream";
+//#region ../node/dist/index.d.ts
+//#region src/fs/nodeFs.d.ts
+/**
+ * 基于 node:fs/promises 的 FileSystemProvider；接受 `/` 风格路径，写入自动创建父目录。
+ * 可选 root 模式：构造传入 root 后，read/write 操作先做 realpath 包含校验
+ * （root 与目标都 realpath 后前缀比对），经符号链接逃逸 root → FS_PATH_OUTSIDE_ROOT。
+ */
+declare class NodeFS implements FileSystemProvider {
+  #private;
+  readonly kind = "node";
+  constructor(deps?: {
+    root?: string;
+  });
+  /** root 模式：全部方法（read/write/exists/stat/list/mkdir/remove/rename）目标 realpath 必须落在 root realpath 前缀内 */
+  withRoot(root: string): NodeFS;
+  readText(p: string): Promise<string>;
+  writeText(p: string, content: string): Promise<void>;
+  appendText(p: string, content: string): Promise<void>;
+  readBinary(p: string): Promise<Uint8Array>;
+  writeBinary(p: string, content: Uint8Array): Promise<void>;
+  exists(p: string): Promise<boolean>;
+  stat(p: string): Promise<FileStat>;
+  list(p: string): Promise<FileStat[]>;
+  mkdir(p: string): Promise<void>;
+  remove(p: string, options?: {
+    recursive?: boolean;
+  }): Promise<void>;
+  rename(from: string, to: string): Promise<void>;
+}
+//#endregion
+//#region src/executor/nodeScriptExecutor.d.ts
+/**
+ * 进程内脚本执行器。接口按沙箱语义设计（context 无隐式宿主访问），
+ * worker_threads 沙箱见 deferred-items D1。
+ */
+declare class NodeScriptExecutor implements ScriptExecutor {
+  #private;
+  constructor(fs: FileSystemProvider);
+  loadDefinition(skillRoot: string, scriptName: string): Promise<ToolDefinition>;
+  execute(input: {
+    skillRoot: string;
+    scriptName: string;
+    args: Record<string, unknown>;
+    context: Parameters<ScriptExecutor['execute']>[0]['context'];
+    timeoutMs: number;
+  }): Promise<ToolResult>;
+}
+//#endregion
+//#region src/executor/sandboxedScriptExecutor.d.ts
+interface SandboxOptions {
+  /** 默认 { maxOldGenerationSizeMb: 64, maxYoungGenerationSizeMb: 16 } */
+  resourceLimits?: {
+    maxOldGenerationSizeMb?: number;
+    maxYoungGenerationSizeMb?: number;
+  };
+  /** env 白名单（仅这些变量传入 Worker；默认空） */
+  envWhitelist?: string[];
+  capabilities?: BridgeCapabilities;
+  /** 网络策略：默认 'deny-all'（白名单见 runtime/sandbox/networkPolicy） */
+  networkPolicy?: NetworkPolicy;
+  /** 裸模块 allowlist（默认 []：一切 node: 内置模块全禁；按需放行如 ['node:path']） */
+  allowedModules?: string[];
+  /** require-approval 模式的授权询问出口（缺失时 require-approval 一律拒绝） */
+  uiBridge?: UiBridge;
+  /** 授权粒度：默认 'once-per-run' */
+  approvalScope?: ApprovalScope;
+}
+/**
+ * D1：worker_threads 沙箱脚本执行器。
+ * 每次执行独立 Worker（resourceLimits + env 白名单），loadDefinition 同样在
+ * Worker 内完成（禁止主进程 import 不可信脚本）；超时 terminate（可杀同步死循环）。
+ * 能力桥协议与浏览器同一来源（runtime/sandbox/bridgeProtocol）。
+ *
+ * 诚实标注：本执行器做的是**能力面收敛**（网络策略、模块 allowlist、资源限额、
+ * 超时强杀），**不是安全边界**——Worker 内脚本与宿主共享进程；
+ * 已知主动逃逸面（process.binding/_linkedBinding/dlopen/openStdin/reallyExit/abort）
+ * 已在入口删除（0.2.3），常规 import 拦截之外不承诺防御其它宿主共享面；
+ * 禁止假定其可隔离不可信脚本（隔离级需求用 ProcessSandboxExecutor）。
+ */
+declare class SandboxedScriptExecutor implements ScriptExecutor {
+  #private;
+  constructor(fs: FileSystemProvider, options?: SandboxOptions);
+  loadDefinition(skillRoot: string, scriptName: string): Promise<ToolDefinition>;
+  execute(input: {
+    skillRoot: string;
+    scriptName: string;
+    args: Record<string, unknown>;
+    context: ScriptExecutionContext;
+    timeoutMs: number;
+  }): Promise<ToolResult>;
+}
+//#endregion
+//#region src/executor/processSandboxExecutor.d.ts
+interface ProcessSandboxOptions {
+  /** 温池大小（并发上限；执行后 kill 并补位重生），默认 2 */
+  poolSize?: number;
+  /** 透传给子进程的环境变量白名单（默认 []：子进程 env 为空，防密钥泄露） */
+  envWhitelist?: string[];
+  capabilities?: BridgeCapabilities;
+  /** 网络策略：默认 'deny-all'（权限模型无网络维度，补丁兜底；node:net 裸模块为已知残余面） */
+  networkPolicy?: NetworkPolicy;
+  /** require-approval 模式的授权询问出口 */
+  uiBridge?: UiBridge;
+  /** 授权粒度：默认 'once-per-run' */
+  approvalScope?: ApprovalScope;
+  /** 池维护告警出口（recycle 重生失败等；默认 console.warn） */
+  onWarning?: (message: string) => void;
+}
+/**
+ * child_process.fork + --permission 进程沙箱（真实进程隔离）。
+ * 每个子进程以 `--permission --allow-fs-read=<入口目录> --allow-fs-read=<skillRoot>
+ * --allow-fs-write=<artifactDir>` 启动：fs 维度由权限模型管控（experimental），
+ * 子进程/Worker/addons 默认禁；网络无权限维度仍靠 fetch/WebSocket patch。
+ * 能力桥协议与 worker_threads 沙箱同一形态（readReference/writeArtifact/confirm + 授权）。
+ * 温池（默认 2）：同 skillRoot 复用子进程；执行后 kill 并补位重生；并发上限即池大小。
+ * 超时 kill（同步死循环可杀）；非零退出码 → TOOL_EXECUTION_FAILED。
+ */
+declare class ProcessSandboxExecutor implements ScriptExecutor {
+  #private;
+  constructor(fs: FileSystemProvider, options?: ProcessSandboxOptions);
+  get poolSize(): number;
+  /** 池全部子进程销毁（测试收尾/进程退出前调用）；排队中的 acquire 一律 reject（不悬挂） */
+  dispose(): Promise<void>;
+  loadDefinition(skillRoot: string, scriptName: string): Promise<ToolDefinition>;
+  execute(input: {
+    skillRoot: string;
+    scriptName: string;
+    args: Record<string, unknown>;
+    context: ScriptExecutionContext;
+    timeoutMs: number;
+  }): Promise<ToolResult>;
+}
+//#endregion
+//#region src/schema/oxcSchemaInferer.d.ts
+/**
+ * D2 Schema 推导（OXC 静态文本分析，宿主侧执行，不进沙箱）。
+ * TS 类型标注为主路径，JSDoc @param 为辅路径；不支持类型降级 string 并标 'x-inferred'。
+ */
+declare class OxcSchemaInferer implements SchemaInferer {
+  inferSchemaFromSource(source: string, options?: {
+    fileName?: string;
+  }): JsonSchema | undefined;
+}
+//#endregion
+//#region src/artifacts/fileArtifactStore.d.ts
+/**
+ * FileArtifactStore：兼容别名，语义同阶段 2-4。
+ * 实现已上移到 runtime 的 FsArtifactStore；node 侧保留 NodeFS 默认值。
+ */
+declare class FileArtifactStore extends FsArtifactStore {
+  constructor(deps: {
+    root: string;
+    fs?: FileSystemProvider;
+  });
+}
+//#endregion
+//#region src/memory/fileMemoryStore.d.ts
+/**
+ * FileMemoryStore：兼容别名，语义同阶段 3。
+ * 实现已上移到 runtime 的 FsMemoryStore；node 侧保留 NodeFS 默认值。
+ */
+declare class FileMemoryStore extends FsMemoryStore {
+  constructor(deps: {
+    root: string;
+    fs?: FileSystemProvider;
+  });
+}
+//#endregion
+//#region src/ui/cliUiBridge.d.ts
+/**
+ * 命令行 UiBridge：ask→问答，confirm→y/n（带默认值），
+ * form→逐字段提示（显示默认值与必填标记），select→编号列表，
+ * authorize→授权询问（默认拒绝，仅显式 y/yes 批准）。
+ * 输入/输出流可注入（测试用 PassThrough）。
+ */
+declare class CliUiBridge implements UiBridge {
+  #private;
+  constructor(deps?: {
+    input?: Readable;
+    output?: Writable;
+  });
+  request(input: InteractionRequest): Promise<InteractionResponse>;
+  progress(input: {
+    runId: string;
+    message: string;
+    value?: number;
+  }): Promise<void>;
+  renderResult(input: RenderResultRequest): Promise<void>;
+}
+//#endregion
+//#region src/skillManagement/skillManager.d.ts
+/**
+ * 技能管理门面：统一安装管线（staging → 解析 name → 校验 → 拷贝 → manifest → lockfile），
+ * 任何失败清理现场抛 INSTALL_FAILED。
+ * @stable
+ */
+declare class SkillManager implements SkillManagerPort {
+  #private;
+  constructor(deps: {
+    managedRoot: string;
+    fs?: FileSystemProvider;
+    fetchImpl?: typeof fetch;
+    /** D2 安装期 schema 预推导（默认 true，可关） */
+    schemaInference?: boolean;
+    /** 归档体积三重上限（缺省 DEFAULT_ARCHIVE_LIMITS） */
+    archiveLimits?: ArchiveLimits;
+    /** install/uninstall 成功后的变更回调（宿主接线缓存失效，如 WebSkillRuntime.invalidate） */
+    onChanged?: () => void;
+    /**
+     * 供应链信任（design 03 §5.1）。未注入时仍会验签，只是信任库为空——
+     * 未签名的包不受影响（默认策略 warn），带着不受信公钥的包则装不上。
+     */
+    signature?: {
+      trustedKeys?: TrustedKeyStore;
+      /** 未签名包的处置，默认 warn */
+      unsigned?: UnsignedPolicy;
+      /** 验签结论落审计（governance 的 FsAuditLog 结构上兼容） */
+      audit?: SignatureAuditSink;
+    };
+    /** 安装期告警（当前仅未签名放行）；宿主接线日志/UI */
+    onWarning?: (warning: {
+      skill: string;
+      message: string;
+    }) => void;
+  });
+  /** 托管根目录（治理发布归档捕获等只读场景） */
+  get managedRoot(): string;
+  install(source: SkillInstallSource, options?: {
+    expectedSha256?: string;
+  }): Promise<SkillManifest>;
+  uninstall(name: string): Promise<void>;
+  verifyIntegrity(name: string): Promise<VerifyResult>;
+  listInstalled(): Promise<SkillsLockfile>;
+  exportArchive(name: string, options: {
+    format: 'zip' | 'tar';
+    outPath: string;
+  }): Promise<string>;
+  /** 多技能包集导出（webskill.skill-pack.json + 各技能目录含 manifest），写 outPath 并返回 */
+  exportPack(names: string[], options: {
+    outPath: string;
+  }): Promise<string>;
+}
+//#endregion
+//#region src/mcp/connectStdioEndpoint.d.ts
+interface StdioEndpointConfig {
+  /** registry 中的名字（endpoint:tool 引用） */
+  endpoint: string;
+  /**
+   * 可执行文件。**只能来自宿主配置**：从技能 frontmatter / manifest 到这里没有任何代码路径。
+   * 因为 env 不继承父进程，PATH 默认为空——请传绝对路径，或在 env 里显式给出 PATH。
+   */
+  command: string;
+  args?: readonly string[];
+  cwd?: string;
+  /** 子进程环境变量。**不默认继承 process.env**：MCP server 是宿主机上的任意程序 */
+  env?: Record<string, string>;
+  /** 连接与调用超时；0/缺省 = 不超时 */
+  timeoutMs?: number;
+  /** 子进程 stderr 观测（默认丢弃，仅保留尾部用于错误消息） */
+  onStderr?: (chunk: string) => void;
+}
+/**
+ * stdio MCP endpoint 装配：spawn 宿主配置的可执行程序，经 stdin/stdout 说 MCP，
+ * 注册进 EndpointRegistry——endpoint:tool 解析、TTL+版本缓存、临时技能消费自动生效。
+ * 返回 close 句柄：断开后 unregister 并确保子进程真的退出（不留僵尸）。
+ *
+ * registry 参数写成结构型而非 `EndpointRegistry<McpClientLike>`：只要从 `@webskill/mcp`
+ * `import type`，tsdown 就会把整个 mcp 的 d.ts chunk 拖进 `@webskill/sdk/node`，
+ * 把 optional peer `@modelcontextprotocol/sdk` 变成 node 子路径的类型硬依赖
+ * （install-smoke 的消费方 typecheck 探针会因此变红）。结构类型保证真实的
+ * `EndpointRegistry<McpClientLike>` 仍可直接传入。
+ */
+declare function connectStdioEndpoint<TClient>(registry: {
+  register(endpoint: string, client: TClient): void;
+  unregister(endpoint: string): void;
+}, config: StdioEndpointConfig): Promise<{
+  close(): Promise<void>;
+}>;
+//#endregion
+//#region src/skillManagement/export/archiveExporter.d.ts
+/** 导出技能目录全部文件（含 manifest）为 zip/tar 归档，返回 outPath */
+declare function exportArchive(fs: FileSystemProvider, skillRoot: string, options: {
+  format: 'zip' | 'tar';
+  outPath: string;
+}): Promise<string>;
+/** 只解出归档中的 webskill.skill-manifest.json 条目（安装前预览） */
+declare function readArchiveManifest(fs: FileSystemProvider, archivePath: string): Promise<SkillManifest>;
+//#endregion
 //#region ../governance/dist/node.d.ts
 //#region src/approval/approvalWorkflow.d.ts
 /** 审批工作流：review（UiBridge confirm 真实接线）/ publish（校验→安装→版本→审计） */
@@ -47,4 +336,4 @@ declare function createEvaluationRuntime(deps: WebSkillRuntimeDeps & {
   executor?: ScriptExecutor;
 }): WebSkillRuntime;
 //#endregion
-export { ApprovalWorkflow, CliUiBridge, FileArtifactStore, FileMemoryStore, type LlmCapabilities, type LlmEnvConfig, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, type ProcessSandboxOptions, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, type SandboxOptions, SandboxedScriptExecutor, type SkillInstallSource, SkillManager, type SkillManifest, type SkillsLockfile, type VerifyResult, createEvaluationRuntime, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };
+export { ApprovalWorkflow, CliUiBridge, FileArtifactStore, FileMemoryStore, type LlmCapabilities, type LlmEnvConfig, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, type ProcessSandboxOptions, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, type SandboxOptions, SandboxedScriptExecutor, type SkillInstallSource, SkillManager, type SkillManifest, type SkillsLockfile, type StdioEndpointConfig, type VerifyResult, connectStdioEndpoint, createEvaluationRuntime, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };

package/dist/node.js

@@ -1,5 +1,5 @@
-import { A as resolveArchiveLimits, C as messageOf, D as readResponseWithLimit, E as parseSkillPackManifest, M as unzipWithLimits, N as validateSkills, P as verifyManifest, T as parseSkillMarkdown, b as exportSkills, d as assertRemoteUrlAllowed, f as assertSafePathSegment, h as buildManifest, i as SKILL_MANIFEST_FILE, j as resolveInsideRoot, p as atomicWriteText, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, x as isValidSkillName } from "./dist-BQzncxXg.js";
-import { C as bridgeError, I as normalizeToolContent, L as normalizeToolError, N as networkPolicyLibSource, R as parseBridgeRequest, S as WebSkillRuntime, T as createScriptContext, c as FsArtifactStore, l as FsMemoryStore, o as CapabilityApproval } from "./dist-B9VLwOME.js";
+import { A as parseSkillMarkdown, B as unzipWithLimits, H as verifyManifest, I as resolveArchiveLimits, L as resolveInsideRoot, M as readResponseWithLimit, N as readSkillSignature, O as messageOf, T as isValidSkillName, U as verifySkillSignature, V as validateSkills, _ as atomicWriteText, g as assertSafePathSegment, h as assertRemoteUrlAllowed, j as parseSkillPackManifest, m as WebSkillError, o as SKILLS_LOCKFILE, r as MANIFEST_EXCLUDED_FILES, s as SKILL_MANIFEST_FILE, u as SKILL_PACK_FILE, w as exportSkills, y as buildManifest } from "./dist-8oQRa8Xz.js";
+import { B as normalizeToolContent, D as bridgeError, E as WebSkillRuntime, H as parseBridgeRequest, L as networkPolicyLibSource, V as normalizeToolError, c as FsArtifactStore, k as createScriptContext, l as FsMemoryStore, o as CapabilityApproval } from "./dist-rorEJsNi.js";
 import { i as probeLlmCapabilities } from "./env--jJB-TSX-04klhTYi.js";
 import { createRequire } from "node:module";
 import { unzipSync, zipSync } from "fflate";
@@ -10,7 +10,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { format, promisify } from "node:util";
 import { Worker } from "node:worker_threads";
 import { mkdtemp, rm } from "node:fs/promises";
-import { execFile, fork } from "node:child_process";
+import { execFile, fork, spawn } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 import { createHash } from "node:crypto";
 
@@ -1597,7 +1597,6 @@ async function removeLockEntry(fs, managedRoot, name) {
 async function writeLockfileAtomic(fs, managedRoot, lockfile) {
 	await atomicWriteText(fs, `${managedRoot}/${SKILLS_LOCKFILE}`, JSON.stringify(lockfile, null, 2));
 }
-const EXCLUDED_FILES = /* @__PURE__ */ new Set([SKILL_MANIFEST_FILE, SKILLS_LOCKFILE]);
 /** 递归收集技能目录内的文件（相对路径，posix 分隔） */
 async function walkFiles(fs, root, prefix = "") {
 	const out = [];
@@ -1605,7 +1604,7 @@ async function walkFiles(fs, root, prefix = "") {
 		const name = entry.path.split("/").pop() ?? "";
 		const rel = prefix === "" ? name : `${prefix}/${name}`;
 		if (entry.type === "directory") out.push(...await walkFiles(fs, entry.path, rel));
-		else if (!EXCLUDED_FILES.has(name)) out.push(rel);
+		else if (!MANIFEST_EXCLUDED_FILES.has(name)) out.push(rel);
 	}
 	return out;
 }
@@ -1649,7 +1648,29 @@ async function verifyIntegrity(fs, skillRoot) {
 	for (const rel of actualFiles) actualHashes.set(rel, sha256Hex(await fs.readBinary(`${skillRoot}/${rel}`)));
 	return verifyManifest(manifest, actualHashes, actualFiles);
 }
-const asInstallFailed = (e) => e instanceof WebSkillError && e.code === "INSTALL_FAILED" ? e : new WebSkillError("INSTALL_FAILED", `Install failed: ${messageOf(e)}`, e);
+/**
+* 验签失败不能被折叠成 INSTALL_FAILED：四种失败的宿主处置完全不同
+* （引导选策略 / 提示重下 / 引导添加密钥 / 安全事件），见 design 03 §3.1。
+*/
+const PRESERVED_INSTALL_CODES = /* @__PURE__ */ new Set([
+	"SIGNATURE_MISSING",
+	"SIGNATURE_MALFORMED",
+	"SIGNATURE_UNTRUSTED_KEY",
+	"SIGNATURE_MISMATCH",
+	"SIGNATURE_UNSUPPORTED"
+]);
+const asInstallFailed = (e) => e instanceof WebSkillError && (e.code === "INSTALL_FAILED" || PRESERVED_INSTALL_CODES.has(e.code)) ? e : new WebSkillError("INSTALL_FAILED", `Install failed: ${messageOf(e)}`, e);
+/** 未注入信任库时的空库：任何签名都不受信，比「验不了就放行」安全 */
+const EMPTY_TRUSTED_KEYS = {
+	list: async () => [],
+	get: async () => void 0,
+	add: async () => {
+		throw new WebSkillError("SIGNATURE_UNTRUSTED_KEY", "This SkillManager has no trusted key store configured");
+	},
+	remove: async () => {
+		throw new WebSkillError("SIGNATURE_UNTRUSTED_KEY", "This SkillManager has no trusted key store configured");
+	}
+};
 /**
 * 技能管理门面：统一安装管线（staging → 解析 name → 校验 → 拷贝 → manifest → lockfile），
 * 任何失败清理现场抛 INSTALL_FAILED。
@@ -1662,6 +1683,10 @@ var SkillManager = class {
 	#schemaInference;
 	#archiveLimits;
 	#onChanged;
+	#trustedKeys;
+	#unsignedPolicy;
+	#signatureAudit;
+	#onWarning;
 	#schemaInferer = new OxcSchemaInferer();
 	constructor(deps) {
 		this.#managedRoot = deps.managedRoot.replace(/\/+$/, "");
@@ -1670,6 +1695,10 @@ var SkillManager = class {
 		this.#schemaInference = deps.schemaInference ?? true;
 		this.#archiveLimits = deps.archiveLimits;
 		this.#onChanged = deps.onChanged;
+		this.#trustedKeys = deps.signature?.trustedKeys ?? EMPTY_TRUSTED_KEYS;
+		this.#unsignedPolicy = deps.signature?.unsigned ?? "warn";
+		this.#signatureAudit = deps.signature?.audit;
+		this.#onWarning = deps.onWarning;
 	}
 	/** 托管根目录（治理发布归档捕获等只读场景） */
 	get managedRoot() {
@@ -1728,6 +1757,7 @@ var SkillManager = class {
 				...version ? { version } : {},
 				source: staged.source
 			});
+			await this.#verifySignature(finalDir, manifest);
 			targetDir = `${this.#managedRoot}/${name}`;
 			const backupDir = `${stagingRoot}/backup`;
 			const hadPrevious = await fs.exists(targetDir);
@@ -1797,6 +1827,7 @@ var SkillManager = class {
 					source
 				});
 				if (manifest.integrity.digest !== entry.digest) throw new WebSkillError("INSTALL_FAILED", `Skill "${entry.name}" digest mismatch: expected ${entry.digest}, got ${manifest.integrity.digest}`);
+				await this.#verifySignature(`${finalRoot}/${entry.name}`, manifest);
 				manifests.push(manifest);
 			}
 			const swapped = [];
@@ -1836,6 +1867,33 @@ var SkillManager = class {
 		}
 	}
 	/**
+	* 安装期验签（design 03 §5.1）：manifest 生成之后、lockfile 提交之前。
+	* 失败直接抛出，暂存目录由 install 的 finally 清理，不落盘。
+	* 未签名且策略放行时也记一条审计——「当时是 warn 放过去的」事后必须查得到。
+	*/
+	async #verifySignature(skillDir, manifest) {
+		const verdict = await verifySkillSignature({
+			manifest,
+			signature: await readSkillSignature(this.#fs, skillDir),
+			trustedKeys: this.#trustedKeys,
+			policy: { unsigned: this.#unsignedPolicy }
+		});
+		if (verdict.warning !== void 0) this.#onWarning?.({
+			skill: manifest.name,
+			message: verdict.warning
+		});
+		await this.#signatureAudit?.append({
+			type: "skill.signature-verified",
+			target: manifest.name,
+			data: {
+				...verdict.keyId !== void 0 ? { keyId: verdict.keyId } : {},
+				verdict: verdict.unsigned ? "unsigned-allowed" : "signed",
+				policy: this.#unsignedPolicy,
+				at: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		});
+	}
+	/**
 	* D2 安装期预推导：scripts/ 下无显式 inputSchema 导出且无 sidecar 的脚本，
 	* 经 OXC 推导写 sidecar（计入 manifest.files；重装重新生成）
 	*/
@@ -1898,6 +1956,222 @@ var SkillManager = class {
 		return options.outPath;
 	}
 };
+async function loadMcpSdk() {
+	try {
+		const [client, stdio] = await Promise.all([import("./client-BCM6Z3yq-qUQNkKrK.js"), import("./stdio-CFMoANJJ-BxrTeXh7.js")]);
+		return {
+			Client: client.Client,
+			ReadBuffer: stdio.ReadBuffer,
+			serializeMessage: stdio.serializeMessage
+		};
+	} catch (e) {
+		throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", "The \"@modelcontextprotocol/sdk\" package is required for stdio MCP endpoints; install it first (npm i @modelcontextprotocol/sdk)", e);
+	}
+}
+/** SIGTERM 后等待自行退出的宽限期，超时改 SIGKILL */
+const KILL_GRACE_MS = 2e3;
+function describeExit(exit) {
+	return exit.signal !== null ? `signal ${exit.signal}` : `exit code ${exit.code}`;
+}
+async function spawnServer(config) {
+	const child = spawn(config.command, [...config.args ?? []], {
+		...config.cwd !== void 0 ? { cwd: config.cwd } : {},
+		env: { ...config.env },
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		shell: false,
+		windowsHide: true
+	});
+	let tail = "";
+	child.stderr?.on("data", (chunk) => {
+		const text = chunk.toString("utf8");
+		config.onStderr?.(text);
+		tail = (tail + text).slice(-4096);
+	});
+	child.stdin?.on("error", () => {});
+	child.stderr?.on("error", () => {});
+	let exit;
+	const exited = new Promise((resolve) => {
+		child.once("exit", (code, signal) => {
+			exit = {
+				code,
+				signal
+			};
+			resolve();
+		});
+	});
+	try {
+		await new Promise((resolve, reject) => {
+			child.once("spawn", resolve);
+			child.once("error", reject);
+		});
+	} catch (e) {
+		throw new WebSkillError("MCP_STDIO_SPAWN_FAILED", `Failed to spawn stdio MCP endpoint "${config.endpoint}" (${config.command}): ${messageOf(e)}`, e);
+	}
+	child.on("error", () => {});
+	return {
+		child,
+		stderrTail: () => tail,
+		exit: () => exit,
+		terminate: async () => {
+			if (exit !== void 0) return;
+			child.kill("SIGTERM");
+			const killer = setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS);
+			try {
+				await exited;
+			} finally {
+				clearTimeout(killer);
+			}
+		}
+	};
+}
+/**
+* 子进程 stdio 上的 MCP transport。帧解析复用 SDK 的 ReadBuffer / serializeMessage，
+* 不自己写协议解析；进程由 connectStdioEndpoint 先行 spawn，
+* 好把「命令起不来」和「起来后立刻退出」分成两个错误码。
+*/
+var ChildStdioTransport = class {
+	onclose;
+	onerror;
+	onmessage;
+	#child;
+	#sdk;
+	#readBuffer;
+	constructor(child, sdk) {
+		this.#child = child;
+		this.#sdk = sdk;
+		this.#readBuffer = new sdk.ReadBuffer();
+	}
+	async start() {
+		if (this.#child.exitCode !== null || this.#child.signalCode !== null) {
+			this.onclose?.();
+			return;
+		}
+		this.#child.stdout?.on("data", (chunk) => {
+			this.#readBuffer.append(chunk);
+			for (;;) {
+				let message;
+				try {
+					message = this.#readBuffer.readMessage();
+				} catch (e) {
+					this.onerror?.(e instanceof Error ? e : new Error(String(e)));
+					return;
+				}
+				if (message === null) return;
+				this.onmessage?.(message);
+			}
+		});
+		this.#child.stdout?.on("error", (e) => this.onerror?.(e));
+		this.#child.once("exit", () => this.onclose?.());
+	}
+	async send(message) {
+		const stdin = this.#child.stdin;
+		if (!stdin || stdin.destroyed) throw new WebSkillError("MCP_STDIO_EXITED", "The stdio MCP server process is no longer writable");
+		await new Promise((resolve, reject) => {
+			stdin.write(this.#sdk.serializeMessage(message), (e) => e ? reject(e) : resolve());
+		});
+	}
+	async close() {
+		this.#child.stdin?.end();
+		this.#readBuffer.clear();
+	}
+};
+function withTimeout(work, timeoutMs, onTimeout) {
+	if (timeoutMs <= 0) return work;
+	let timer;
+	const timeout = new Promise((_resolve, reject) => {
+		timer = setTimeout(() => reject(onTimeout()), timeoutMs);
+	});
+	return Promise.race([work, timeout]).finally(() => clearTimeout(timer));
+}
+const CLIENT_METHODS = [
+	"listTools",
+	"callTool",
+	"listPrompts",
+	"getPrompt",
+	"listResources",
+	"readResource"
+];
+/**
+* 给每次调用套上 timeoutMs。超时按「server 挂住了」处理：先终止进程再上抛，
+* 免得留下一个谁都不再理会的子进程。
+*/
+function guardCalls(client, config, abort) {
+	const timeoutMs = config.timeoutMs ?? 0;
+	if (timeoutMs <= 0) return client;
+	const source = client;
+	const guarded = {};
+	for (const method of CLIENT_METHODS) guarded[method] = async (input) => {
+		try {
+			return await withTimeout(source[method](input), timeoutMs, () => new WebSkillError("MCP_STDIO_TIMEOUT", `Call "${method}" on stdio MCP endpoint "${config.endpoint}" timed out after ${timeoutMs}ms`));
+		} catch (e) {
+			if (e instanceof WebSkillError && e.code === "MCP_STDIO_TIMEOUT") await abort();
+			throw e;
+		}
+	};
+	return guarded;
+}
+/**
+* stdio MCP endpoint 装配：spawn 宿主配置的可执行程序，经 stdin/stdout 说 MCP，
+* 注册进 EndpointRegistry——endpoint:tool 解析、TTL+版本缓存、临时技能消费自动生效。
+* 返回 close 句柄：断开后 unregister 并确保子进程真的退出（不留僵尸）。
+*
+* registry 参数写成结构型而非 `EndpointRegistry<McpClientLike>`：只要从 `@webskill/mcp`
+* `import type`，tsdown 就会把整个 mcp 的 d.ts chunk 拖进 `@webskill/sdk/node`，
+* 把 optional peer `@modelcontextprotocol/sdk` 变成 node 子路径的类型硬依赖
+* （install-smoke 的消费方 typecheck 探针会因此变红）。结构类型保证真实的
+* `EndpointRegistry<McpClientLike>` 仍可直接传入。
+*/
+async function connectStdioEndpoint(registry, config) {
+	const sdk = await loadMcpSdk();
+	const proc = await spawnServer(config);
+	const transport = new ChildStdioTransport(proc.child, sdk);
+	const client = new sdk.Client({
+		name: "webskill-stdio-client",
+		version: "0.1.0"
+	});
+	let timedOut = false;
+	try {
+		await withTimeout(client.connect(transport), config.timeoutMs ?? 0, () => {
+			timedOut = true;
+			return new WebSkillError("MCP_STDIO_TIMEOUT", `Timed out after ${config.timeoutMs}ms connecting stdio MCP endpoint "${config.endpoint}"`);
+		});
+	} catch (e) {
+		await proc.terminate();
+		if (timedOut) throw e;
+		const exit = proc.exit();
+		if (exit !== void 0) {
+			const tail = proc.stderrTail().trim();
+			throw new WebSkillError("MCP_STDIO_EXITED", `Stdio MCP endpoint "${config.endpoint}" exited before it was ready (${describeExit(exit)})` + (tail === "" ? "" : `; stderr: ${tail}`), e);
+		}
+		throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", `Failed to connect stdio MCP endpoint "${config.endpoint}": ${messageOf(e)}`, e);
+	}
+	let closed = false;
+	const close = async () => {
+		if (closed) return;
+		closed = true;
+		registry.unregister(config.endpoint);
+		try {
+			await client.close();
+		} finally {
+			await proc.terminate();
+		}
+	};
+	try {
+		registry.register(config.endpoint, guardCalls(client, config, close));
+	} catch (e) {
+		try {
+			await client.close();
+		} finally {
+			await proc.terminate();
+		}
+		throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", `Failed to register stdio MCP endpoint "${config.endpoint}": ${messageOf(e)}`, e);
+	}
+	return { close };
+}
 
 //#endregion
 //#region ../governance/dist/node.js
@@ -2063,4 +2337,4 @@ function createEvaluationRuntime(deps) {
 }
 
 //#endregion
-export { ApprovalWorkflow, CliUiBridge, FileArtifactStore, FileMemoryStore, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SandboxedScriptExecutor, SkillManager, createEvaluationRuntime, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };
+export { ApprovalWorkflow, CliUiBridge, FileArtifactStore, FileMemoryStore, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SandboxedScriptExecutor, SkillManager, connectStdioEndpoint, createEvaluationRuntime, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };

package/dist/{openUiLibrary-B8-Cvou9-D3RsU2EB.js → openUiLibrary-B8-Cvou9-BbpNTXS3.js}

@@ -1,4 +1,4 @@
-import { ft as uiCatalog } from "./dist-CtBLBbEz.js";
+import { ft as uiCatalog } from "./dist-ZKaM8j06.js";
 import { n as catalogComponentImpls } from "./catalogComponents-C_V39rbF-BOHveMWa.js";
 import { z } from "zod";
 import { Component, Fragment, createContext, useCallback, useContext, useEffect, useInsertionEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";