@webskill/sdk 0.4.0 → 0.6.0

package/dist/{dist-C-Sh0MDU.js → dist-DusANsrn.js}

@@ -1,7 +1,201 @@
 import { A as parseSkillMarkdown, L as resolveInsideRoot, O as messageOf, P as renderAvailableSkillsXml, V as validateSkills, f as SkillDiscovery, g as assertSafePathSegment, m as WebSkillError, p as SkillReader, v as buildCatalog } from "./dist-8oQRa8Xz.js";
-import { a as validateLlmMessages, i as textParts, n as partsToText, r as rejectUnsupportedPart, t as MemoryArtifactStore } from "./memoryArtifactStore-BtOeB_hm-tj3fC5ip.js";
+import { a as textParts, i as rejectUnsupportedPart, n as partsToText, o as validateLlmMessages, r as promptText, t as MemoryArtifactStore } from "./memoryArtifactStore-52Zn9npI-BMPYwvoy.js";
 
 //#region ../runtime/dist/index.js
+/**
+* $defs 必须与 type / properties 同级，位于每个工具 inputSchema 的根。
+* 已验证：放进 properties.spec 内层会得到同样的 "Unsupported ref: #" ——
+* Qwen / LM Studio 按当前 schema 上下文解析 $defs，不回溯根文档。
+* 因此本模块只在**根**写入 $defs，不得改成就近放置。
+*/
+const DEFS_KEY = "$defs";
+const SELF_REF = "#";
+const NODE_NAME = "Node";
+const COMPONENT_PREFIX = "Component_";
+/** 值为「名称 → 子 schema」的映射。 */
+const SCHEMA_MAP_KEYS = /* @__PURE__ */ new Set([
+	"properties",
+	"patternProperties",
+	"dependentSchemas",
+	"$defs",
+	"definitions"
+]);
+/** 值为「子 schema 数组」。 */
+const SCHEMA_LIST_KEYS = /* @__PURE__ */ new Set([
+	"oneOf",
+	"anyOf",
+	"allOf",
+	"prefixItems"
+]);
+/** 值为单个子 schema（items 在 draft-07 遗留写法里也可能是数组）。 */
+const SCHEMA_KEYS = /* @__PURE__ */ new Set([
+	"items",
+	"additionalItems",
+	"additionalProperties",
+	"unevaluatedItems",
+	"unevaluatedProperties",
+	"contains",
+	"propertyNames",
+	"not",
+	"if",
+	"then",
+	"else"
+]);
+function isRecord$4(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSelfRef(value) {
+	return isRecord$4(value) && value["$ref"] === SELF_REF;
+}
+/**
+* 按 JSON Schema 关键字下降到子 schema。
+* 只走 schema 位置，`enum` / `const` / `default` 等数据位置一律不进——
+* 那里出现的 `{ $ref: '#' }` 是字面数据而非引用，改写它会破坏语义。
+*/
+function forEachSubSchema(node, visit) {
+	for (const [key, value] of Object.entries(node)) {
+		if (SCHEMA_MAP_KEYS.has(key)) {
+			if (isRecord$4(value)) for (const name of Object.keys(value)) visit(value[name], [key, name]);
+			continue;
+		}
+		if (SCHEMA_LIST_KEYS.has(key)) {
+			if (Array.isArray(value)) value.forEach((item, index) => visit(item, [key, index]));
+			continue;
+		}
+		if (SCHEMA_KEYS.has(key)) if (Array.isArray(value)) value.forEach((item, index) => visit(item, [key, index]));
+		else visit(value, [key]);
+	}
+}
+function pathKey(path) {
+	return path.join("\0");
+}
+/**
+* 找出所有 `$ref: '#'` 所属的 schema resource 根。
+* `#` 解析到最近的带 `$id` 的祖先；没有则是文档根。
+*/
+function collectSelfRefRoots(node, path, resourceRoot, out) {
+	if (!isRecord$4(node)) return;
+	if (isSelfRef(node)) {
+		out.set(pathKey(resourceRoot), resourceRoot);
+		return;
+	}
+	const nextRoot = typeof node["$id"] === "string" && path.length > 0 ? path : resourceRoot;
+	forEachSubSchema(node, (child, childPath) => {
+		collectSelfRefRoots(child, [...path, ...childPath], nextRoot, out);
+	});
+}
+function getAt(schema, path) {
+	let current = schema;
+	for (const segment of path) if (Array.isArray(current) && typeof segment === "number") current = current[segment];
+	else if (isRecord$4(current) && typeof segment === "string") current = current[segment];
+	else return void 0;
+	return current;
+}
+/** 返回把 `path` 处替换为 `replacement` 后的新对象；沿途节点浅拷贝，其余共享。 */
+function setAt(schema, path, replacement) {
+	if (path.length === 0) return replacement;
+	const [head, ...rest] = path;
+	const child = getAt(schema, [head]);
+	const nextChild = rest.length === 0 ? replacement : setAt(child, rest, replacement);
+	if (Array.isArray(schema) && typeof head === "number") {
+		const copy = [...schema];
+		copy[head] = nextChild;
+		return copy;
+	}
+	return {
+		...schema,
+		[head]: nextChild
+	};
+}
+/**
+* 深拷贝并把 `{ $ref: '#' }` 改写为指向根 `$defs` 中的具名节点。
+* 同时剥掉非根位置的 `$id` / `$schema`：它们会重设 base URI，
+* 正是严格解析器无法解析 `#` 的直接原因。
+*/
+function rewriteSelfRefs(node, target, depth) {
+	if (!isRecord$4(node)) return node;
+	if (depth > 8) throw new WebSkillError("TOOL_SCHEMA_UNAVAILABLE", `Tool schema nesting exceeds 8 levels; cannot produce a portable form`);
+	if (isSelfRef(node)) {
+		const rest = {};
+		for (const [key, value] of Object.entries(node)) if (key !== "$ref") rest[key] = value;
+		return {
+			$ref: `#/${DEFS_KEY}/${target}`,
+			...rest
+		};
+	}
+	const result = {};
+	for (const [key, value] of Object.entries(node)) {
+		if (key === "$id" || key === "$schema") continue;
+		if (SCHEMA_MAP_KEYS.has(key) && isRecord$4(value)) {
+			const mapped = {};
+			for (const [name, child] of Object.entries(value)) mapped[name] = rewriteSelfRefs(child, target, depth + 1);
+			result[key] = mapped;
+			continue;
+		}
+		if (SCHEMA_LIST_KEYS.has(key) || SCHEMA_KEYS.has(key)) {
+			result[key] = Array.isArray(value) ? value.map((child) => rewriteSelfRefs(child, target, depth + 1)) : rewriteSelfRefs(value, target, depth + 1);
+			continue;
+		}
+		result[key] = value;
+	}
+	return result;
+}
+function uniqueName(base, taken) {
+	if (!taken.has(base)) return base;
+	const prefixed = `Portable${base}`;
+	if (!taken.has(prefixed)) return prefixed;
+	let index = 2;
+	while (taken.has(`${prefixed}_${index}`)) index += 1;
+	return `${prefixed}_${index}`;
+}
+/**
+* 把工具 inputSchema 重写为严格解析器可接受的 JSON Schema 2020-12 形态：
+* 自引用的 schema resource 提到根 `$defs`，所有 `$ref: '#'` 改写为 `$ref: '#/$defs/<Node>'`。
+*
+* 幂等：不含自引用的 schema 原样返回。
+*
+* 这是**传输层适配**，只应在出站请求体上调用；不要下沉到 AgentLoop，
+* 否则 trace / eventBus 观测到的 schema 会与技能作者写的不一致。
+*/
+function toPortableToolSchema(schema) {
+	const roots = /* @__PURE__ */ new Map();
+	collectSelfRefRoots(schema, [], [], roots);
+	if (roots.size === 0) return schema;
+	if (roots.size > 1) throw new WebSkillError("TOOL_SCHEMA_UNAVAILABLE", "Tool schema contains self references in more than one schema resource; cannot produce a portable form");
+	const rootPath = [...roots.values()][0] ?? [];
+	const resource = getAt(schema, rootPath);
+	if (!isRecord$4(resource)) return schema;
+	const existingDefs = isRecord$4(schema[DEFS_KEY]) ? schema[DEFS_KEY] : void 0;
+	const taken = new Set(Object.keys(existingDefs ?? {}));
+	const nodeName = uniqueName(NODE_NAME, taken);
+	taken.add(nodeName);
+	const added = {};
+	const branches = resource["oneOf"];
+	if (Array.isArray(branches)) {
+		const refs = branches.map((branch, index) => {
+			const name = uniqueName(`${COMPONENT_PREFIX}${index}`, taken);
+			taken.add(name);
+			added[name] = rewriteSelfRefs(branch, nodeName, 1);
+			return { $ref: `#/${DEFS_KEY}/${name}` };
+		});
+		const description = resource["description"];
+		added[nodeName] = typeof description === "string" ? {
+			description,
+			oneOf: refs
+		} : { oneOf: refs };
+	} else {
+		const body = {};
+		for (const [key, value] of Object.entries(resource)) if (key !== DEFS_KEY) body[key] = value;
+		added[nodeName] = rewriteSelfRefs(body, nodeName, 1);
+	}
+	return {
+		...setAt(schema, rootPath, { $ref: `#/${DEFS_KEY}/${nodeName}` }),
+		[DEFS_KEY]: {
+			...existingDefs ?? {},
+			...added
+		}
+	};
+}
 function createSseFrameReader() {
 	let buffer = "";
 	let data = [];
@@ -113,7 +307,7 @@ const toOpenAiTools = (tools) => tools.map((tool) => ({
 	function: {
 		name: tool.name,
 		...tool.description ? { description: tool.description } : {},
-		parameters: tool.inputSchema
+		parameters: toPortableToolSchema(tool.inputSchema)
 	}
 }));
 const errorMessage$2 = (e) => e instanceof Error ? e.message : String(e);
@@ -264,11 +458,18 @@ var OpenAiCompatibleClient = class {
 			const choice = data.choices?.[0]?.message;
 			if (!choice) throw new Error("response has no choices[0].message");
 			const toolCalls = choice["tool_calls"]?.map((tc) => {
-				const rawArgs = tc.function?.arguments ?? "{}";
+				let args = {};
+				let parseError;
+				try {
+					args = JSON.parse(tc.function?.arguments ?? "{}");
+				} catch (e) {
+					parseError = e instanceof Error ? e.message : String(e);
+				}
 				return {
 					id: tc.id,
 					name: tc.function?.name ?? "",
-					arguments: JSON.parse(rawArgs)
+					arguments: args,
+					...parseError ? { argumentsParseError: parseError } : {}
 				};
 			});
 			const content = choice["content"];
@@ -363,7 +564,7 @@ function toAnthropicMessages(messages) {
 const toAnthropicTools = (tools) => tools.map((tool) => ({
 	name: tool.name,
 	...tool.description ? { description: tool.description } : {},
-	input_schema: tool.inputSchema
+	input_schema: toPortableToolSchema(tool.inputSchema)
 }));
 /** Anthropic Messages API 客户端（零依赖 fetch；Node/浏览器通用） */
 var AnthropicClient = class {
@@ -606,7 +807,7 @@ function toGenAiContents(messages) {
 const toGenAiTools = (tools) => [{ functionDeclarations: tools.map((tool) => ({
 	name: tool.name,
 	...tool.description ? { description: tool.description } : {},
-	parameters: tool.inputSchema
+	parameters: toPortableToolSchema(tool.inputSchema)
 })) }];
 /** Google GenAI（generateContent / streamGenerateContent）客户端（零依赖 fetch） */
 var GoogleGenAiClient = class {
@@ -800,7 +1001,9 @@ Skills are disclosed progressively: the catalog below only shows metadata. To us
 1. Call the "read_skill_file" tool to load the skill's SKILL.md instructions. Reading SKILL.md activates the skill's script tools, which are named "<skillName>__<scriptName>".
 2. Call the activated script tools to do the work.
 3. If a tool call fails, read the error, adjust your approach and retry, or continue without it.
-4. When the task is complete, answer in plain text without calling any tool.`;
+4. When the task is complete, answer in plain text without calling any tool.
+
+Never claim to have created, saved, or installed a skill unless a skill tool call actually succeeded.`;
 /** 渐进披露路由（默认）：system prompt 只注入 Catalog 元数据 + 工具使用说明 */
 var ProgressiveRouter = class {
 	async route(catalog) {
@@ -814,7 +1017,9 @@ var ProgressiveRouter = class {
 const INSTRUCTIONS = `You are an agent that completes tasks by using skills.
 The full instructions of every available skill are injected below. Follow them directly.
 Script tools are named "<skillName>__<scriptName>".
-When the task is complete, answer in plain text without calling any tool.`;
+When the task is complete, answer in plain text without calling any tool.
+
+Never claim to have created, saved, or installed a skill unless a skill tool call actually succeeded.`;
 /** 全量披露路由（对照用）：注入每个技能的完整 SKILL.md 正文 */
 var FullDisclosureRouter = class {
 	#discovery;
@@ -841,7 +1046,7 @@ var FullDisclosureRouter = class {
 * 3. `mcp#` 前缀 → TOOL_UNSUPPORTED（WebMCP 阶段实现）
 * 4. 其余 → TOOL_NOT_FOUND
 */
-function resolveToolName(name, activatedSkills) {
+function resolveToolName(name, activatedSkills, activatedTools = []) {
 	const sep = name.indexOf("__");
 	if (sep > 0) {
 		const skillName = name.slice(0, sep);
@@ -862,10 +1067,12 @@ function resolveToolName(name, activatedSkills) {
 		code: "TOOL_UNSUPPORTED",
 		message: `Tool "${name}" is a WebMCP tool, which is not supported yet`
 	};
+	const availableTools = [...activatedTools].sort();
 	return {
 		kind: "not-found",
 		code: "TOOL_NOT_FOUND",
-		message: `Unknown tool "${name}". Activate the owning skill first by reading its SKILL.md`
+		message: `Unknown tool "${name}".${availableTools.length > 0 ? ` Available tools right now: ${availableTools.join(", ")}.` : " No skill tools are activated yet; read the SKILL.md of the owning skill first."}`,
+		data: { availableTools }
 	};
 }
 /** ToolDefinition → LLM 工具 spec；缺 schema 时用宽松 object 兜底并在描述中标记 */
@@ -875,7 +1082,7 @@ function toLlmToolSpec(tool) {
 		...tool.description ? { description: tool.description } : {},
 		inputSchema: tool.inputSchema
 	};
-	const note = "Input schema unavailable; call with no arguments or a simple object.";
+	const note = "Input schema unavailable for this script. Inspect the skill documentation before calling; do not assume it takes no arguments.";
 	return {
 		name: tool.name,
 		description: tool.description ? `${tool.description} (${note})` : note,
@@ -885,10 +1092,57 @@ function toLlmToolSpec(tool) {
 		}
 	};
 }
+/** 工具名规则：技能**目录名**加双下划线加脚本名，与 frontmatter 的 name 无关 */
+function scriptToolName(skillName, scriptName) {
+	return `${skillName}__${scriptName}`;
+}
+const SCHEMA_SOURCE_TEXT = {
+	"module-export": "from module export",
+	sidecar: "from the .schema.json sidecar",
+	inferred: "inferred from source",
+	unavailable: "unavailable",
+	unknown: "not loaded yet"
+};
+/** 展示用的 schema 来源文案（console 与模型清单共用一套措辞） */
+function schemaSourceLabel(source) {
+	return SCHEMA_SOURCE_TEXT[source];
+}
+/** allowed-tools 排除的脚本对模型不可见；清单里必须写明原因，否则作者只会看到工具凭空消失 */
+const ALLOWED_TOOLS_EXCLUSION_REASON = "excluded by the allowed-tools list in SKILL.md";
+/**
+* 从技能文件清单中挑出脚本并给出工具名映射。
+* @param files 技能根目录下的相对路径（如 `scripts/parse.ts`、`SKILL.md`）
+* @param allowedTools SKILL.md 声明的 allowed-tools；未声明传 undefined（全部暴露）
+*/
+function listSkillScripts(skillName, files, allowedTools) {
+	const sidecars = new Set(files.filter((path) => path.startsWith("scripts/") && path.endsWith(".schema.json")));
+	const out = [];
+	for (const path of [...files].sort()) {
+		const scriptName = /^scripts\/([^/]+)\.(?:ts|js)$/.exec(path)?.[1];
+		if (scriptName === void 0 || scriptName === "") continue;
+		const excluded = allowedTools !== void 0 && !allowedTools.includes(scriptName);
+		out.push({
+			path,
+			scriptName,
+			...excluded ? { unexposedReason: ALLOWED_TOOLS_EXCLUSION_REASON } : { toolName: scriptToolName(skillName, scriptName) },
+			schemaSource: excluded ? "unavailable" : sidecars.has(`scripts/${scriptName}.schema.json`) ? "sidecar" : "unknown"
+		});
+	}
+	return out;
+}
+/**
+* 清单 → 喂给模型的文本（FR-18.1）。
+* 「authoritative」这句是给模型的信号：以目录为准，别照 SKILL.md 的描述猜文件名。
+*/
+function formatSkillScriptManifest(descriptors) {
+	if (descriptors.length === 0) return "";
+	return `\n\nAvailable scripts in this skill (from directory listing, authoritative):\n${descriptors.map((item) => item.toolName === void 0 ? `- ${item.path} → not exposed as a tool (${item.unexposedReason ?? "no loadable definition"})` : `- ${item.path} → tool "${item.toolName}" (input schema: ${SCHEMA_SOURCE_TEXT[item.schemaSource]})`).join("\n")}`;
+}
 const MCP_CONTENT_RE = /^(text|json|image|resource|audio)$/;
 /**
 * 脚本返回值归一到 MCP content 格式：数组沿用（逐项归一），
 * 字符串包装为 text，其他值序列化包装。Node/浏览器执行器共享。
+* 产出只有文本型分片：脚本侧没有下发图像的通道（图像只来自页面取像）。
 */
 function normalizeToolContent(value) {
 	if (Array.isArray(value)) return value.map((item) => {
@@ -946,16 +1200,31 @@ const READ_SKILL_FILE_TOOL = {
 const ASK_USER_TOOL_NAME = "ask_user";
 const ASK_USER_INPUT_SCHEMA = {
 	type: "object",
-	properties: { question: {
-		type: "string",
-		description: "The question to ask the user"
-	} },
+	properties: {
+		question: {
+			type: "string",
+			description: "The question to ask the user"
+		},
+		choices: {
+			type: "array",
+			items: { type: "string" },
+			description: "Closed set of acceptable answers. Provide it whenever the answer must be one of a known finite set, for example when asking which installed skill to use. The user then picks from a list instead of typing free text."
+		},
+		suggestion: {
+			type: "string",
+			description: "A value you believe the user is likely to answer, based only on the profile in the system prompt. It is shown as a suggestion the user may accept; it is never filled in for them. Omit it when nothing in the profile supports a value."
+		},
+		suggestionReason: {
+			type: "string",
+			description: "Short reason for the suggestion, shown next to it so the user can judge whether to accept it."
+		}
+	},
 	required: ["question"]
 };
 /** 内建工具：LLM 信息不足时主动向用户提问；仅当配置了 UiBridge 时注册 */
 const ASK_USER_TOOL = {
 	name: ASK_USER_TOOL_NAME,
-	description: "Ask the user a question when information is missing and continue with their answer.",
+	description: "Ask the user a question when information is missing and continue with their answer. When the answer belongs to a known finite set, you must pass \"choices\".",
 	inputSchema: ASK_USER_INPUT_SCHEMA,
 	source: "builtin"
 };
@@ -991,22 +1260,22 @@ function createScriptContext(deps) {
 		...onWarning ? { onWarning } : {}
 	};
 }
-const isRecord$2 = (v) => typeof v === "object" && v !== null;
+const isRecord$3 = (v) => typeof v === "object" && v !== null;
 /**
 * $chart 约定的形状校验：JSON content 的 data 含 $chart 键且形状合法 → ChartSpec；
 * 任何畸形（kind 非法 / labels 非字符串数组 / series 项缺数值 data）→ undefined（忽略不炸）。
 */
 function extractChartSpec(data) {
-	if (!isRecord$2(data)) return void 0;
+	if (!isRecord$3(data)) return void 0;
 	const raw = data["$chart"];
-	if (!isRecord$2(raw)) return void 0;
+	if (!isRecord$3(raw)) return void 0;
 	const { kind, labels, series } = raw;
 	if (kind !== "bar" && kind !== "line" && kind !== "pie") return void 0;
 	if (!Array.isArray(labels) || !labels.every((l) => typeof l === "string")) return void 0;
 	if (!Array.isArray(series)) return void 0;
 	const validSeries = [];
 	for (const item of series) {
-		if (!isRecord$2(item) || !Array.isArray(item["data"]) || !item["data"].every((n) => typeof n === "number")) return;
+		if (!isRecord$3(item) || !Array.isArray(item["data"]) || !item["data"].every((n) => typeof n === "number")) return;
 		const name = item["name"];
 		validSeries.push({
 			...typeof name === "string" ? { name } : {},
@@ -1057,7 +1326,7 @@ const actionIntents = /* @__PURE__ */ new Set([
 	"download",
 	"refresh"
 ]);
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function reject(message) {
@@ -1074,7 +1343,7 @@ function isJsonValue(value, depth = 0) {
 	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
 	if (typeof value === "number") return Number.isFinite(value);
 	if (Array.isArray(value)) return value.every((item) => isJsonValue(item, depth + 1));
-	if (!isRecord$1(value)) return false;
+	if (!isRecord$2(value)) return false;
 	return Object.keys(value).every((key) => key !== "__proto__" && key !== "constructor" && isJsonValue(value[key], depth + 1));
 }
 /**
@@ -1084,10 +1353,10 @@ function isJsonValue(value, depth = 0) {
 function assertNode(value, path, depth, counter) {
 	if (depth > MAX_NODE_DEPTH) reject(`A UI spec tree must not nest deeper than ${MAX_NODE_DEPTH} levels`);
 	if (++counter.nodes > MAX_NODES) reject(`A UI spec tree must contain at most ${MAX_NODES} nodes`);
-	if (!isRecord$1(value)) reject(`${path} must be an object`);
+	if (!isRecord$2(value)) reject(`${path} must be an object`);
 	requireString(value["component"], `${path}.component`);
 	if (value["id"] !== void 0) requireString(value["id"], `${path}.id`);
-	if (value["props"] !== void 0 && (!isRecord$1(value["props"]) || !isJsonValue(value["props"]))) reject(`${path}.props must be a JSON object`);
+	if (value["props"] !== void 0 && (!isRecord$2(value["props"]) || !isJsonValue(value["props"]))) reject(`${path}.props must be a JSON object`);
 	const children = value["children"];
 	if (children === void 0) return;
 	if (!Array.isArray(children)) reject(`${path}.children must be an array`);
@@ -1097,7 +1366,7 @@ function assertActions(value) {
 	if (value === void 0) return;
 	if (!Array.isArray(value) || value.length > MAX_ACTIONS) reject(`Surface actions must contain at most ${MAX_ACTIONS} items`);
 	for (const action of value) {
-		if (!isRecord$1(action)) reject("A surface action must be an object");
+		if (!isRecord$2(action)) reject("A surface action must be an object");
 		requireString(action["id"], "Surface action ID");
 		const intent = action["intent"];
 		if (typeof intent !== "string" || !actionIntents.has(intent)) reject("Surface action intent is invalid");
@@ -1113,7 +1382,7 @@ function validateUiSpecNode(value) {
 	return structuredClone(value);
 }
 function assertPatch(value) {
-	if (!isRecord$1(value)) reject("A surface patch operation must be an object");
+	if (!isRecord$2(value)) reject("A surface patch operation must be an object");
 	if (value["op"] !== "replace" && value["op"] !== "merge" && value["op"] !== "append") reject("Surface patch operation is invalid");
 	requireString(value["path"], "Surface patch path");
 	if (!value["path"].startsWith("/")) reject("Surface patch path must be a JSON pointer");
@@ -1121,7 +1390,7 @@ function assertPatch(value) {
 }
 /** Validates an individual event in the framework-neutral surface stream. @experimental */
 function validateUiSpecEvent(value) {
-	if (!isRecord$1(value) || typeof value["type"] !== "string") reject("A UI surface event must have a type");
+	if (!isRecord$2(value) || typeof value["type"] !== "string") reject("A UI surface event must have a type");
 	if (value["runId"] !== void 0) requireString(value["runId"], "Surface event run ID");
 	switch (value["type"]) {
 		case "open":
@@ -1179,7 +1448,7 @@ function validateUiSpecEvent(value) {
 }
 /** Extracts validated surface stream events from structured tool output. @experimental */
 function extractUiSpecEvents(data) {
-	if (!isRecord$1(data) || data["$surface"] === void 0) return [];
+	if (!isRecord$2(data) || data["$surface"] === void 0) return [];
 	const raw = data["$surface"];
 	return (Array.isArray(raw) ? raw : [raw]).map((event) => validateUiSpecEvent(event));
 }
@@ -1212,7 +1481,7 @@ function schemaToForm(schema, providedArgs) {
 function mapFieldType(prop) {
 	if (Array.isArray(prop.enum)) return "select";
 	switch (prop.type) {
-		case "string": return "text";
+		case "string": return prop["format"] === "binary" || prop["contentEncoding"] === "base64" ? "file" : "text";
 		case "number":
 		case "integer": return "number";
 		case "boolean": return "boolean";
@@ -1302,6 +1571,176 @@ var SerializingMemoryStore = class {
 		return this.#serialize(scope, () => fn(this.#inner));
 	}
 };
+/** @experimental */
+const DEFAULT_USER_PROFILE_LIMITS = {
+	recordLimit: 500,
+	valueMaxChars: 2e3,
+	sampleLimit: 80,
+	injectMaxBytes: 2e3,
+	entryLimit: 40
+};
+/** @experimental */
+const EMPTY_USER_PROFILE = {
+	version: 1,
+	entries: [],
+	refinedAt: 0
+};
+/** 注入段的标题。宿主/测试要判断「有没有注入画像」时对它取子串，不要自己再拼一份 @experimental */
+const USER_PROFILE_PROMPT_HEADER = "## About this user (inferred from past behavior; may be outdated)";
+/**
+* 无画像时也要下发的约束（AC-19.11）：没有依据就把字段留空，
+* 不写这一句时模型会把「建议值」当成必填项去编。
+* @experimental
+*/
+const USER_PROFILE_NO_INVENTION_RULE = "Only offer a suggested value for a question when the profile above actually supports it. With no relevant profile entry, omit the suggestion and leave the field empty; never invent one.";
+const byPriority = (a, b) => a.confidence === b.confidence ? b.updatedAt - a.updatedAt : a.confidence === "high" ? -1 : 1;
+const byteLength = (text) => new TextEncoder().encode(text).length;
+/**
+* 画像 → 系统提示片段，按 confidence + updatedAt 优先级排序后逐条累加，
+* 超出字节上限的部分丢弃并标注（FR-19.4 / AC-19.9）。
+* 空画像返回空串：只有标题的空段落白占 token，还会诱导模型编造。
+* @experimental
+*/
+function renderUserProfileContext(profile = EMPTY_USER_PROFILE, maxBytes = DEFAULT_USER_PROFILE_LIMITS.injectMaxBytes) {
+	const entries = [...profile.entries].sort(byPriority);
+	if (entries.length === 0 || maxBytes <= 0) return "";
+	const lines = entries.map((entry) => `- ${entry.text}`);
+	const render = (keptCount) => {
+		const omitted = lines.length - keptCount;
+		const body = [USER_PROFILE_PROMPT_HEADER, ...lines.slice(0, keptCount)];
+		if (omitted > 0) body.push(`(truncated: ${omitted} more entries omitted)`);
+		return body.join("\n");
+	};
+	let kept = lines.length;
+	while (kept > 0 && byteLength(render(kept)) > maxBytes) kept -= 1;
+	return kept === 0 ? "" : render(kept);
+}
+/** `user:{id}` scope 下的行为记录 key @experimental */
+const BEHAVIOR_RECORDS_KEY = "behaviorRecords";
+/** `user:{id}` scope 下的画像 key @experimental */
+const USER_PROFILE_KEY = "userProfile";
+const KINDS = [
+	"question",
+	"choice",
+	"text-input",
+	"stated-preference"
+];
+const isKind = (value) => KINDS.includes(value);
+const stringList = (raw) => Array.isArray(raw) ? raw.filter((item) => typeof item === "string") : void 0;
+/** 存储里的形状不受控（宿主可能手改文件），逐条筛而不是整体信任 @experimental */
+function readBehaviorRecords(raw) {
+	if (!Array.isArray(raw)) return [];
+	const out = [];
+	for (const item of raw) {
+		if (typeof item !== "object" || item === null) continue;
+		const record = item;
+		const scene = record.scene;
+		if (typeof record.id !== "string" || !isKind(record.kind)) continue;
+		if (typeof record.at !== "number" || typeof record.value !== "string") continue;
+		if (typeof scene !== "object" || scene === null || typeof scene.sessionId !== "string") continue;
+		const options = stringList(scene.options);
+		out.push({
+			id: record.id,
+			kind: record.kind,
+			at: record.at,
+			value: record.value,
+			...record.confirmed === true ? { confirmed: true } : {},
+			scene: {
+				sessionId: scene.sessionId,
+				...typeof scene.skillName === "string" ? { skillName: scene.skillName } : {},
+				...typeof scene.interactionId === "string" ? { interactionId: scene.interactionId } : {},
+				...typeof scene.fieldName === "string" ? { fieldName: scene.fieldName } : {},
+				...typeof scene.fieldSemantics === "string" ? { fieldSemantics: scene.fieldSemantics } : {},
+				...options && options.length > 0 ? { options } : {}
+			}
+		});
+	}
+	return out;
+}
+/**
+* 追加并按容量淘汰最旧（FR-19.2）。`value` 同时截断：
+* 一条被粘贴进来的长文本能把整个 JSON 撑爆，而提炼只需要语义。
+* @experimental
+*/
+function appendBehaviorRecords(current, incoming, limits = DEFAULT_USER_PROFILE_LIMITS) {
+	if (limits.recordLimit <= 0) return [];
+	const truncated = incoming.map((record) => record.value.length > limits.valueMaxChars ? {
+		...record,
+		value: record.value.slice(0, limits.valueMaxChars)
+	} : record);
+	const merged = [...current, ...truncated];
+	return merged.slice(Math.max(0, merged.length - limits.recordLimit));
+}
+/** @experimental */
+function readUserProfile(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return EMPTY_USER_PROFILE;
+	const value = raw;
+	return {
+		version: 1,
+		entries: readProfileEntries(value.entries),
+		refinedAt: typeof value.refinedAt === "number" ? value.refinedAt : 0
+	};
+}
+/** @experimental */
+function readProfileEntries(raw) {
+	if (!Array.isArray(raw)) return [];
+	const out = [];
+	for (const item of raw) {
+		if (typeof item !== "object" || item === null) continue;
+		const entry = item;
+		if (typeof entry.id !== "string" || entry.id === "") continue;
+		if (typeof entry.text !== "string" || entry.text.trim() === "") continue;
+		out.push({
+			id: entry.id,
+			text: entry.text,
+			confidence: entry.confidence === "high" ? "high" : "low",
+			updatedAt: typeof entry.updatedAt === "number" ? entry.updatedAt : 0,
+			sourceKinds: (stringList(entry.sourceKinds) ?? []).filter(isKind)
+		});
+	}
+	return out;
+}
+/**
+* 合并提炼结果：同 id 更新，新 id 追加，超上限按 `updatedAt` 淘汰最旧（设计 09 §1.4）。
+* @experimental
+*/
+function mergeProfileEntries(current, incoming, options) {
+	const limits = options.limits ?? DEFAULT_USER_PROFILE_LIMITS;
+	const byId = new Map(current.entries.map((entry) => [entry.id, entry]));
+	for (const entry of incoming) byId.set(entry.id, entry);
+	return {
+		version: 1,
+		entries: [...byId.values()].sort((a, b) => b.updatedAt - a.updatedAt).slice(0, Math.max(0, limits.entryLimit)),
+		refinedAt: options.now
+	};
+}
+/**
+* 提炼采样（FR-19.3）：最近的 + 高频的 + 被用户显式确认过的，去重后截到上限。
+* 三个维度缺一不可——只取最近会让长期偏好被一次突发淹没，只取高频则学不到新变化。
+* @experimental
+*/
+function sampleBehaviorRecords(records, limits = DEFAULT_USER_PROFILE_LIMITS) {
+	const limit = Math.max(0, limits.sampleLimit);
+	if (limit === 0 || records.length === 0) return [];
+	if (records.length <= limit) return [...records].sort((a, b) => a.at - b.at);
+	const picked = /* @__PURE__ */ new Map();
+	const take = (record) => {
+		if (picked.size < limit) picked.set(record.id, record);
+	};
+	for (const record of records) if (record.confirmed === true) take(record);
+	const frequency = /* @__PURE__ */ new Map();
+	const bucketOf = (record) => `${record.scene.skillName ?? ""}#${record.scene.fieldName ?? record.kind}`;
+	for (const record of records) frequency.set(bucketOf(record), (frequency.get(bucketOf(record)) ?? 0) + 1);
+	const byFrequency = [...records].sort((a, b) => (frequency.get(bucketOf(b)) ?? 0) - (frequency.get(bucketOf(a)) ?? 0));
+	for (const record of byFrequency.slice(0, Math.ceil(limit / 2))) take(record);
+	for (const record of [...records].reverse()) take(record);
+	return [...picked.values()].sort((a, b) => a.at - b.at);
+}
+/**
+* 无工具模型的系统提示（0.6.0 FR-14.3）。
+* 最后一句是重点：不明说「没有工具」，模型会凭训练记忆自己编造 tool_call 标记。
+*/
+const PLAIN_CHAT_SYSTEM_PROMPT = "You are a helpful assistant. Answer the user's question directly and concisely. You have no tools available; do not describe or simulate tool calls.";
 /** 结构化 trace 记录器；时钟与 id 工厂可注入（golden trace 用固定值保证确定性） */
 var TraceRecorder = class {
 	#runId;
@@ -1328,6 +1767,36 @@ var TraceRecorder = class {
 		return [...this.#events];
 	}
 };
+const isRecord$1 = (v) => typeof v === "object" && v !== null;
+/** 工具结果可经 `$todo` 标记记入 trace 的事件类型；其余类型不接受，防止工具源伪造 run.* */
+const TODO_TRACE_TYPES = /* @__PURE__ */ new Set([
+	"todo.created",
+	"todo.updated",
+	"todo.cleared"
+]);
+/**
+* `$todo` 约定的形状校验：JSON content 的 data 含 `$todo` 键（单条或数组）→ trace 事件。
+*
+* 与 `$chart` / `$surface` 同一条既有通道——待办清单的状态机全部在 `@webskill/agent`，
+* runtime 只认这三个事件类型名，不含任何计划态逻辑。畸形条目忽略不炸。
+* @experimental
+*/
+function extractTodoTraceEvents(data) {
+	if (!isRecord$1(data) || data["$todo"] === void 0) return [];
+	const raw = data["$todo"];
+	const entries = Array.isArray(raw) ? raw : [raw];
+	const events = [];
+	for (const entry of entries) {
+		if (!isRecord$1(entry)) continue;
+		const { type, ...rest } = entry;
+		if (typeof type !== "string" || !TODO_TRACE_TYPES.has(type)) continue;
+		events.push({
+			type,
+			data: rest
+		});
+	}
+	return events;
+}
 const RUN_SNAPSHOT_SCHEMA_VERSION = 2;
 /** @experimental */
 function isUnsupportedRunSnapshot(entry) {
@@ -1481,13 +1950,13 @@ var RunTerminated = class extends Error {
 };
 /** bridge.request 自身异常（非超时）：恢复 running 后转为工具错误回喂 */
 var BridgeRequestError = class extends Error {};
-const baseName = (p) => p.split("/").pop() ?? p;
-const toolError = (code, message) => ({
+const toolError = (code, message, data) => ({
 	ok: false,
 	content: [],
 	error: {
 		code,
-		message
+		message,
+		...data !== void 0 ? { data } : {}
 	}
 });
 /** 工具参数摘要（JSON 截断 100 字符；trace 与实时事件同一口径，ToolCallCard 展开详情用） */
@@ -1496,6 +1965,16 @@ const summarizeArgs = (args) => {
 	return json.length > 100 ? `${json.slice(0, 100)}…` : json;
 };
 /**
+* file-pick 的回填值带整个文件的 base64，落进 `paramHistory` 会把用户选的文件
+* 原样长期留在记忆里（体积与隐私都不可接受）。只留可辨识的描述，正文不留。
+*/
+const redactFileValue = (value) => {
+	if (Array.isArray(value)) return value.map(redactFileValue);
+	if (typeof value !== "object" || value === null) return typeof value === "string" ? "[file]" : value;
+	const { data: _data, ...rest } = value;
+	return rest;
+};
+/**
 * 多轮 Agent 循环。
 * 工具失败一律转为 ToolResult{ok:false} 回喂 LLM 继续循环；
 * 缺参/确认/提问经 UiBridge 行内 await 暂停恢复；取消/超时/LLM 异常/护栏超限才终止 run。
@@ -1519,6 +1998,8 @@ var AgentLoop = class {
 			toolTimeoutMs: config.toolTimeoutMs ?? 3e4,
 			toolResultMaxBytes: config.toolResultMaxBytes ?? 1e5,
 			paramHistoryLimit: config.paramHistoryLimit ?? 50,
+			toolCallingDisabled: config.toolCallingDisabled ?? false,
+			maxUnknownToolRetries: config.maxUnknownToolRetries ?? 2,
 			temperature: config.temperature,
 			renderResult: config.renderResult
 		};
@@ -1531,7 +2012,7 @@ var AgentLoop = class {
 	/**
 	* 取消进行中的 run：触发该 run 的 AbortController（与 totalTimeout 硬期限同一通道），
 	* run 以 cancelled（RUN_CANCELLED）终止；未找到（已终态或不属于本实例）返回 false。
-	* 取消在下一个中断点生效（LLM complete/stream 调用；交互等待不强制中断）。
+	* 取消在下一个中断点生效；LLM 调用与交互等待都监听同一个 signal，因此等表单时也能立即停。
 	*/
 	cancel(runId) {
 		const controller = this.#controllers.get(runId);
@@ -1553,7 +2034,7 @@ var AgentLoop = class {
 				sessionId: input.sessionId,
 				status: "running",
 				phase: "route",
-				userPrompt: input.userPrompt,
+				userPrompt: promptText(input.userPrompt),
 				startedAt,
 				activeSkillNames: [],
 				artifacts: [],
@@ -1578,6 +2059,7 @@ var AgentLoop = class {
 			surfacePatchCount: 0,
 			processedSurfaceActionNonces: /* @__PURE__ */ new Set(),
 			emittedToolEvents: /* @__PURE__ */ new Set(),
+			unknownToolCalls: 0,
 			startMs,
 			pausedMs: 0,
 			maxTurns: this.#config.maxTurns,
@@ -1601,7 +2083,7 @@ var AgentLoop = class {
 				candidates: route.catalog.entries.map((e) => e.name)
 			}
 		}, state);
-		const externalSpecs = (await Promise.all((this.#deps.externalTools ?? []).map(async (source) => {
+		const externalSpecs = this.#config.toolCallingDisabled ? [] : (await Promise.all((this.#deps.externalTools ?? []).map(async (source) => {
 			try {
 				return await source.listToolSpecs();
 			} catch (e) {
@@ -1610,7 +2092,7 @@ var AgentLoop = class {
 			}
 		}))).flat();
 		const externalSystemPrompts = [];
-		for (const source of this.#deps.externalTools ?? []) {
+		if (!this.#config.toolCallingDisabled) for (const source of this.#deps.externalTools ?? []) {
 			if (source.systemPrompt === void 0) continue;
 			try {
 				const text = (await source.systemPrompt())?.trim();
@@ -1619,17 +2101,21 @@ var AgentLoop = class {
 				trace.record("run.warning", { message: `External tool source "${source.kind}" failed to build a system prompt: ${messageOf(e)}` });
 			}
 		}
+		const systemPrompt = this.#config.toolCallingDisabled ? PLAIN_CHAT_SYSTEM_PROMPT : [route.systemPrompt, ...externalSystemPrompts].join("\n\n");
+		const profileMessage = await this.#userProfileMessage(state);
 		state.messages = [
 			{
 				role: "system",
-				content: textParts([route.systemPrompt, ...externalSystemPrompts].join("\n\n"))
+				content: textParts(systemPrompt)
 			},
+			...profileMessage ? [profileMessage] : [],
 			...(input.history ?? []).map((m) => ({ ...m })),
 			{
 				role: "user",
-				content: textParts(input.userPrompt)
+				content: typeof input.userPrompt === "string" ? textParts(input.userPrompt) : [...input.userPrompt]
 			}
 		];
+		await this.#recordUserPrompt(state);
 		try {
 			return await this.#turnLoop(state, 1, externalSpecs);
 		} catch (e) {
@@ -1690,7 +2176,7 @@ var AgentLoop = class {
 				if (turn > state.maxTurns) return finish("failed", "max-turns", `Agent loop exceeded the maximum of ${state.maxTurns} turns`, "RUN_MAX_TURNS_EXCEEDED");
 				if (this.#elapsed(state) > state.totalTimeoutMs) return finish("failed", "timeout", `Agent loop exceeded the total timeout of ${state.totalTimeoutMs}ms`, "RUN_TIMEOUT");
 				const skillToolSpecs = [...[...state.activatedTools.values()].map(toLlmToolSpec), ...externalSpecs].filter((spec) => this.#checkToolAccess(state, spec.name));
-				const toolSpecs = [
+				const toolSpecs = this.#config.toolCallingDisabled ? [] : [
 					toLlmToolSpec(READ_SKILL_FILE_TOOL),
 					...this.#deps.uiBridge ? [toLlmToolSpec(ASK_USER_TOOL)] : [],
 					...skillToolSpecs
@@ -1759,9 +2245,14 @@ var AgentLoop = class {
 					messages.push({
 						role: "tool",
 						toolCallId: call.id,
-						content: textParts(await this.#serializeToolResult(call, result, state))
+						content: await this.#toolResultParts(call, result, state)
 					});
-					await this.#drainSurfaceAction(state);
+					try {
+						await this.#drainSurfaceAction(state);
+					} catch (e) {
+						if (e instanceof RunTerminated) return finish(e.outcome.status, e.outcome.reason, e.outcome.message, e.outcome.code);
+						throw e;
+					}
 				}
 			}
 		} finally {
@@ -1898,6 +2389,7 @@ var AgentLoop = class {
 			surfacePatchCount: 0,
 			processedSurfaceActionNonces: new Set(snapshot.processedSurfaceActionNonces ?? []),
 			emittedToolEvents: /* @__PURE__ */ new Set(),
+			unknownToolCalls: 0,
 			startMs,
 			pausedMs: snapshot.pausedMs ?? 0,
 			maxTurns: snapshot.config.maxTurns,
@@ -1934,7 +2426,7 @@ var AgentLoop = class {
 				state.messages.push({
 					role: "tool",
 					toolCallId: pendingCall.id,
-					content: textParts(await this.#serializeToolResult(pendingCall, result, state))
+					content: await this.#toolResultParts(pendingCall, result, state)
 				});
 				await this.#drainSurfaceAction(state);
 			} else if (pending?.type === "ask" && pendingCall) {
@@ -1956,7 +2448,7 @@ var AgentLoop = class {
 				state.messages.push({
 					role: "tool",
 					toolCallId: pendingCall.id,
-					content: textParts(await this.#serializeToolResult(pendingCall, result, state))
+					content: await this.#toolResultParts(pendingCall, result, state)
 				});
 				await this.#drainSurfaceAction(state);
 			} else if (pendingCall) {
@@ -1964,7 +2456,7 @@ var AgentLoop = class {
 				state.messages.push({
 					role: "tool",
 					toolCallId: pendingCall.id,
-					content: textParts(await this.#serializeToolResult(pendingCall, result, state))
+					content: await this.#toolResultParts(pendingCall, result, state)
 				});
 				await this.#drainSurfaceAction(state);
 			}
@@ -1975,7 +2467,7 @@ var AgentLoop = class {
 				state.messages.push({
 					role: "tool",
 					toolCallId: next.id,
-					content: textParts(await this.#serializeToolResult(next, result, state))
+					content: await this.#toolResultParts(next, result, state)
 				});
 				await this.#drainSurfaceAction(state);
 			}
@@ -2090,7 +2582,7 @@ var AgentLoop = class {
 		} });
 		let response;
 		try {
-			response = await this.#withInteractionTimeout(bridge.request(request), this.#policy.interactionTimeoutMs, () => bridge.cancel?.(request.id));
+			response = await this.#withInteractionTimeout(bridge.request(request), this.#policy.interactionTimeoutMs, state, () => bridge.cancel?.(request.id));
 		} catch (e) {
 			run.status = "running";
 			run.interruptExpiresAt = void 0;
@@ -2100,6 +2592,7 @@ var AgentLoop = class {
 				message: e.message,
 				code: "RUN_INTERACTION_TIMEOUT"
 			});
+			if (e instanceof WebSkillError && e.code === "RUN_CANCELLED") throw this.#abortedInteraction(state);
 			state.trace.record("run.warning", { message: `UiBridge request failed: ${messageOf(e)}` });
 			throw new BridgeRequestError(messageOf(e));
 		}
@@ -2125,19 +2618,62 @@ var AgentLoop = class {
 		await this.#appendParamHistory(state, request, response.value);
 		return response.value;
 	}
-	#withInteractionTimeout(promise, timeoutMs, onTimeout) {
+	/**
+	* 交互等待被 abort：cancel() 与 totalTimeout 硬期限共用同一个 controller，
+	* 按 `#cancelled` 区分二者，与 LLM 调用被 abort 时的归类保持一致。
+	*/
+	#abortedInteraction(state) {
+		if (this.#cancelled.has(state.runId)) return new RunTerminated({
+			status: "cancelled",
+			reason: "user-cancelled",
+			message: "Run cancelled by user",
+			code: "RUN_CANCELLED"
+		});
+		return new RunTerminated({
+			status: "failed",
+			reason: "timeout",
+			message: `Agent loop exceeded the total timeout of ${state.totalTimeoutMs}ms`,
+			code: "RUN_TIMEOUT"
+		});
+	}
+	#withInteractionTimeout(promise, timeoutMs, state, onAbandon) {
 		return new Promise((resolve, reject) => {
-			const timer = setTimeout(() => {
+			const signal = state.controller.signal;
+			let settled = false;
+			const abandon = () => {
 				try {
-					onTimeout?.();
+					onAbandon?.();
 				} catch {}
+			};
+			const cleanup = () => {
+				settled = true;
+				clearTimeout(timer);
+				signal.removeEventListener("abort", onAbort);
+			};
+			const onAbort = () => {
+				if (settled) return;
+				cleanup();
+				abandon();
+				reject(new WebSkillError("RUN_CANCELLED", "Interaction aborted because the run was stopped"));
+			};
+			const timer = setTimeout(() => {
+				if (settled) return;
+				cleanup();
+				abandon();
 				reject(new WebSkillError("RUN_INTERACTION_TIMEOUT", `Interaction timed out after ${timeoutMs}ms`));
 			}, timeoutMs);
+			if (signal.aborted) {
+				onAbort();
+				return;
+			}
+			signal.addEventListener("abort", onAbort);
 			promise.then((v) => {
-				clearTimeout(timer);
+				if (settled) return;
+				cleanup();
 				resolve(v);
 			}, (e) => {
-				clearTimeout(timer);
+				if (settled) return;
+				cleanup();
 				reject(e instanceof Error ? e : new Error(String(e)));
 			});
 		});
@@ -2157,11 +2693,15 @@ var AgentLoop = class {
 		else if (call.name === "ask_user") result = await this.#handleAskUser(call, state);
 		else if (!this.#checkToolAccess(state, call.name)) result = this.#deniedToolError(state, call.name);
 		else {
-			const resolution = resolveToolName(call.name, state.activated);
+			const resolution = resolveToolName(call.name, state.activated, state.activatedTools.keys());
 			if (resolution.kind === "script") result = await this.#handleScriptTool(call, resolution.skillName, resolution.scriptName, state);
 			else {
 				const source = (this.#deps.externalTools ?? []).find((s) => s.canHandle(call.name));
-				result = source ? await source.call(call.name, call.arguments) : toolError(resolution.code, resolution.message);
+				if (source) result = await source.call(call.name, call.arguments);
+				else {
+					if (resolution.kind === "not-found") state.unknownToolCalls += 1;
+					result = toolError(resolution.code, resolution.message, resolution.kind === "not-found" ? resolution.data : void 0);
+				}
 			}
 		}
 		const durationMs = Date.parse(state.now()) - callStartMs;
@@ -2180,6 +2720,7 @@ var AgentLoop = class {
 					type: "chart",
 					chart
 				});
+				for (const todo of extractTodoTraceEvents(item.data)) state.trace.record(todo.type, { data: todo.data });
 				try {
 					for (const event of extractUiSpecEvents(item.data)) await this.#renderSurface(state, event);
 				} catch (e) {
@@ -2200,12 +2741,18 @@ var AgentLoop = class {
 					durationMs
 				}
 			});
-			this.#emitTool(state, "failed", call);
+			this.#emitTool(state, "failed", call, result.error?.code);
 		}
 		for (const artifact of result.artifacts ?? []) state.trace.record("artifact.created", { data: {
 			artifactId: artifact.id,
 			path: artifact.path
 		} });
+		if (state.unknownToolCalls > this.#config.maxUnknownToolRetries) throw new RunTerminated({
+			status: "failed",
+			reason: "tool-resolution-exhausted",
+			message: "Repeated calls to non-existent tools. Stopping to avoid consuming the remaining turn budget.",
+			code: "TOOL_RESOLUTION_EXHAUSTED"
+		});
 		return result;
 	}
 	/** Attaches trusted run provenance, then records only events accepted by the configured bridge. */
@@ -2319,7 +2866,7 @@ var AgentLoop = class {
 				nonce: request.nonce,
 				...resumed ? { resumed: true } : {}
 			} });
-			const response = await this.#withInteractionTimeout(pendingResponse, this.#policy.interactionTimeoutMs, () => bridge.cancelSurfaceAction?.(request.nonce));
+			const response = await this.#withInteractionTimeout(pendingResponse, this.#policy.interactionTimeoutMs, state, () => bridge.cancelSurfaceAction?.(request.nonce));
 			run.status = "running";
 			run.interruptExpiresAt = void 0;
 			state.trace.record("ui.surface-action.resolved", { data: {
@@ -2346,6 +2893,7 @@ var AgentLoop = class {
 				message: e.message,
 				code: "RUN_INTERACTION_TIMEOUT"
 			});
+			if (e instanceof WebSkillError && e.code === "RUN_CANCELLED") throw this.#abortedInteraction(state);
 			if (e instanceof RunTerminated || e instanceof BridgeRequestError) throw e;
 			throw new BridgeRequestError(messageOf(e));
 		} finally {
@@ -2375,7 +2923,7 @@ var AgentLoop = class {
 	* 集合挂在 LoopState 上、**不写进快照**：写进快照会让跨进程恢复的
 	* 消费者永远收不到它本来就没见过的事件。
 	*/
-	#emitTool(state, status, call) {
+	#emitTool(state, status, call, errorCode) {
 		const key = `${call.id}:${status}`;
 		if (state.emittedToolEvents.has(key)) return;
 		state.emittedToolEvents.add(key);
@@ -2389,19 +2937,40 @@ var AgentLoop = class {
 				status,
 				name: call.name,
 				callId: call.id,
-				args: summarizeArgs(call.arguments)
+				args: summarizeArgs(call.arguments),
+				...errorCode !== void 0 ? { errorCode } : {}
 			}
 		});
 	}
 	async #handleAskUser(call, state) {
 		const question = call.arguments["question"];
 		if (typeof question !== "string" || question === "") return toolError("TOOL_EXECUTION_FAILED", "ask_user requires a non-empty \"question\" string argument");
+		const rawChoices = call.arguments["choices"];
+		const choices = Array.isArray(rawChoices) ? rawChoices.filter((choice) => typeof choice === "string" && choice !== "") : [];
+		const id = this.#nextInteractionId(state);
+		const rawSuggestion = call.arguments["suggestion"];
+		const rawReason = call.arguments["suggestionReason"];
+		const suggestion = this.#deps.userProfile && typeof rawSuggestion === "string" && rawSuggestion !== "" ? { suggestion: {
+			value: rawSuggestion,
+			...typeof rawReason === "string" && rawReason !== "" ? { reason: rawReason } : {}
+		} } : {};
+		const request = choices.length > 0 ? {
+			type: "select",
+			id,
+			message: question,
+			options: choices.map((label) => ({
+				label,
+				value: label
+			})),
+			...suggestion
+		} : {
+			type: "ask",
+			id,
+			message: question,
+			...suggestion
+		};
 		try {
-			const value = await this.#interact(state, {
-				type: "ask",
-				id: this.#nextInteractionId(state),
-				message: question
-			}, { tool: call.name });
+			const value = await this.#interact(state, request, { tool: call.name });
 			return {
 				ok: true,
 				content: [{
@@ -2487,6 +3056,26 @@ var AgentLoop = class {
 		return toolError("SKILL_NOT_FOUND", `Skill not found via external providers: ${skillKey}${detail}`);
 	}
 	/**
+	* 工具结果 → tool 消息内容。image 分片单独提出，不进 JSON 也不参与截断计算（0.6.0 §1.1）：
+	* 100 KB 的文本预算遇到一张 200 KB 的图会把整个结果截成垃圾。
+	*/
+	async #toolResultParts(call, result, state) {
+		const images = result.content.filter((part) => part.type === "image");
+		if (images.length === 0) return textParts(await this.#serializeToolResult(call, result, state));
+		const textual = {
+			...result,
+			content: result.content.filter((part) => part.type !== "image")
+		};
+		return [{
+			type: "text",
+			text: await this.#serializeToolResult(call, textual, state)
+		}, ...images.map((image) => ({
+			type: "image",
+			mimeType: image.mimeType,
+			data: image.data
+		}))];
+	}
+	/**
 	* 工具结果回喂序列化：超过 toolResultMaxBytes（默认 100KB）时头尾保留截断，
 	* 完整内容经 artifactStore 落 artifact，回喂摘要含 artifact id。
 	*/
@@ -2590,32 +3179,36 @@ var AgentLoop = class {
 		}
 		const executor = this.#deps.executor;
 		const loaded = [];
+		let scripts = [];
 		if (executor) {
 			let scriptFiles;
 			try {
-				scriptFiles = (await this.#deps.fs.list(`${root}/scripts`)).filter((s) => s.type === "file").map((s) => baseName(s.path));
+				scriptFiles = (await this.#deps.fs.list(`${root}/scripts`)).filter((s) => s.type === "file").map((s) => `scripts/${s.path.split("/").pop() ?? s.path}`);
 			} catch (e) {
 				scriptFiles = [];
 				if (!(e instanceof WebSkillError && e.code === "FS_NOT_FOUND")) state.trace.record("run.warning", { message: `Failed to list scripts of skill "${skillName}": ${messageOf(e)}` });
 			}
-			for (const file of scriptFiles) {
-				const match = /^(.*)\.(ts|js)$/.exec(file);
-				if (!match?.[1]) continue;
-				if (allowedTools && !allowedTools.includes(match[1])) {
-					state.trace.record("run.warning", { message: `Skill "${skillName}" declares allowed-tools, so its script "${match[1]}" is not registered as a tool. Add "${match[1]}" to allowed-tools if that was not intended.` });
+			scripts = listSkillScripts(skillName, scriptFiles, allowedTools);
+			for (const script of scripts) {
+				if (script.toolName === void 0) {
+					state.trace.record("run.warning", { message: `Skill "${skillName}" declares allowed-tools, so its script "${script.scriptName}" is not registered as a tool. Add "${script.scriptName}" to allowed-tools if that was not intended.` });
 					continue;
 				}
 				try {
-					const def = await executor.loadDefinition(root, match[1]);
-					await this.#enrichDefinition(root, match[1], def, state);
+					const def = await executor.loadDefinition(root, script.scriptName);
+					script.schemaSource = await this.#enrichDefinition(root, script.scriptName, def, state);
+					script.toolName = def.name;
 					state.activatedTools.set(def.name, def);
 					loaded.push(def.name);
 				} catch (e) {
-					state.trace.record("run.warning", { message: `Failed to load definition of script "${match[1]}" for skill "${skillName}": ${messageOf(e)}` });
+					state.trace.record("run.warning", { message: `Failed to load definition of script "${script.scriptName}" for skill "${skillName}": ${messageOf(e)}` });
+					delete script.toolName;
+					script.schemaSource = "unavailable";
+					script.unexposedReason = "its definition could not be loaded";
 				}
 			}
 		}
-		let note = loaded.length ? `\n\nActivated tools: ${loaded.join(", ")}` : "";
+		let note = (loaded.length ? `\n\nActivated tools: ${loaded.join(", ")}` : "") + formatSkillScriptManifest(scripts);
 		for (const dep of dependencies) {
 			if (state.activated.has(dep)) continue;
 			if (!this.#deps.skillIndex.has(dep)) {
@@ -2629,51 +3222,86 @@ var AgentLoop = class {
 	/**
 	* D2 Schema 兜底链（同一 run 内激活时只算一次）：
 	* 显式 inputSchema > sidecar scripts/<name>.schema.json > schemaInferer 推导 > schemaUnavailable
+	* 返回值即最终来源，进技能清单告诉模型该信谁（FR-18.1）。
 	*/
 	async #enrichDefinition(skillRoot, scriptName, def, state) {
-		if (def.inputSchema) return;
+		if (def.inputSchema) return "module-export";
 		const sidecar = `${skillRoot}/scripts/${scriptName}.schema.json`;
 		if (await this.#deps.fs.exists(sidecar)) try {
 			def.inputSchema = JSON.parse(await this.#deps.fs.readText(sidecar));
-			return;
+			return "sidecar";
 		} catch (e) {
 			state.trace.record("run.warning", { message: `Failed to parse schema sidecar ${sidecar}: ${messageOf(e)}` });
 		}
-		if (!this.#deps.schemaInferer) return;
+		if (!this.#deps.schemaInferer) return "unavailable";
 		for (const ext of ["ts", "js"]) {
 			const scriptPath = `${skillRoot}/scripts/${scriptName}.${ext}`;
 			if (!await this.#deps.fs.exists(scriptPath)) continue;
 			try {
 				const inferred = this.#deps.schemaInferer.inferSchemaFromSource(await this.#deps.fs.readText(scriptPath), { fileName: `${scriptName}.${ext}` });
-				if (inferred) def.inputSchema = inferred;
+				if (inferred) {
+					def.inputSchema = inferred;
+					return "inferred";
+				}
 			} catch (e) {
 				state.trace.record("run.warning", { message: `Schema inference failed for ${scriptPath}: ${messageOf(e)}` });
 			}
-			return;
+			return "unavailable";
 		}
+		return "unavailable";
 	}
 	async #handleScriptTool(call, skillName, scriptName, state) {
 		const root = this.#deps.skillIndex.get(skillName);
 		if (!root) return toolError("TOOL_NOT_FOUND", `Skill "${skillName}" is not in the catalog`);
 		if (!this.#deps.executor) return toolError("TOOL_UNSUPPORTED", `No script executor is configured; script tool "${call.name}" cannot run`);
 		const def = state.activatedTools.get(call.name);
-		if (!def) return toolError("TOOL_NOT_FOUND", `Tool "${call.name}" is not available for skill "${skillName}"`);
+		if (!def) {
+			state.unknownToolCalls += 1;
+			const availableTools = [...state.activatedTools.keys()].filter((tool) => tool.startsWith(`${skillName}__`)).sort();
+			const detail = availableTools.length > 0 ? ` Available tools for skill "${skillName}": ${availableTools.join(", ")}.` : ` Skill "${skillName}" exposes no script tools.`;
+			return toolError("TOOL_NOT_FOUND", `Tool "${call.name}" is not available.${detail}`, {
+				skillName,
+				availableTools
+			});
+		}
 		let args = call.arguments;
 		const missing = (def.inputSchema?.required ?? []).filter((key) => args[key] === void 0);
 		if (missing.length > 0 && this.#deps.uiBridge && this.#policy.missingParams === "user" && def.inputSchema) try {
-			const value = await this.#interact(state, {
-				type: "form",
-				id: this.#nextInteractionId(state),
-				title: `Missing parameters for ${call.name}`,
-				fields: schemaToForm(def.inputSchema, args)
-			}, {
-				tool: call.name,
-				missing
-			});
-			if (typeof value === "object" && value !== null) args = {
-				...args,
-				...value
-			};
+			const fields = schemaToForm(def.inputSchema, args);
+			const declined = /* @__PURE__ */ new Set();
+			for (const field of fields) {
+				if (field.type !== "file" || !missing.includes(field.name)) continue;
+				const value = await this.#interact(state, {
+					type: "file-pick",
+					id: this.#nextInteractionId(state),
+					message: `Open local file picker to fill field "${field.name}"?`,
+					field: field.name
+				}, {
+					tool: call.name,
+					missing: [field.name]
+				});
+				if (value === void 0 || value === null) declined.add(field.name);
+				else args = {
+					...args,
+					[field.name]: value
+				};
+			}
+			const stillMissing = missing.filter((key) => args[key] === void 0 && !declined.has(key));
+			if (stillMissing.length > 0) {
+				const value = await this.#interact(state, {
+					type: "form",
+					id: this.#nextInteractionId(state),
+					title: `Missing parameters for ${call.name}`,
+					fields: fields.filter((f) => f.type !== "file" && !declined.has(f.name))
+				}, {
+					tool: call.name,
+					missing: stillMissing
+				});
+				if (typeof value === "object" && value !== null) args = {
+					...args,
+					...value
+				};
+			}
 		} catch (e) {
 			if (e instanceof BridgeRequestError) return toolError("UI_UNAVAILABLE", `Parameter form failed: ${e.message}`);
 			throw e;
@@ -2827,16 +3455,111 @@ var AgentLoop = class {
 		if (!this.#deps.memory) return;
 		const scope = `session:${state.run.sessionId}`;
 		const limit = this.#config.paramHistoryLimit;
+		const recorded = request.type === "file-pick" ? redactFileValue(value) : value;
 		await this.#memoryMutate(scope, "paramHistory", state, (current) => {
 			const history = current ?? [];
 			history.push({
 				ts: state.now(),
 				interactionId: request.id,
 				type: request.type,
-				value
+				value: recorded
 			});
 			return history.slice(-limit);
 		});
+		await this.#recordInteractionBehavior(state, request, value);
+	}
+	/** 用户提问 → 行为记录（FR-19.2）。记的是「问了什么」，不是模型答了什么 */
+	async #recordUserPrompt(state) {
+		const prompt = state.run.userPrompt.trim();
+		if (prompt === "") return;
+		await this.#appendBehaviorRecords(state, [{
+			id: `${state.runId}#prompt`,
+			kind: "question",
+			at: Date.parse(state.now()),
+			value: prompt,
+			scene: { sessionId: state.run.sessionId }
+		}]);
+	}
+	/**
+	* 交互提交 → 行为记录（FR-19.2）。写在这里而不是 UiBridge：
+	* 只有 AgentLoop 同时握有场景（技能、字段语义、候选集）与提交值。
+	*/
+	async #recordInteractionBehavior(state, request, value) {
+		const records = [];
+		const at = Date.parse(state.now());
+		const base = {
+			sessionId: state.run.sessionId,
+			interactionId: request.id
+		};
+		const skill = [...state.activated].at(-1);
+		const scene = skill !== void 0 ? {
+			...base,
+			skillName: skill
+		} : base;
+		if (request.type === "select") records.push({
+			id: `${request.id}#selected`,
+			kind: "choice",
+			at,
+			confirmed: true,
+			value: String(value),
+			scene: {
+				...scene,
+				fieldSemantics: request.message,
+				options: request.options.map((o) => String(o.label))
+			}
+		});
+		else if (request.type === "ask" && typeof value === "string" && value !== "") records.push({
+			id: `${request.id}#answer`,
+			kind: "text-input",
+			at,
+			confirmed: true,
+			value,
+			scene: {
+				...scene,
+				fieldSemantics: request.message
+			}
+		});
+		else if (request.type === "form" && typeof value === "object" && value !== null) {
+			const submitted = value;
+			for (const field of request.fields) {
+				const next = submitted[field.name];
+				if (typeof next !== "string" && typeof next !== "number" && typeof next !== "boolean") continue;
+				if (next === "") continue;
+				records.push({
+					id: `${request.id}#${field.name}`,
+					kind: field.options ? "choice" : "text-input",
+					at,
+					confirmed: true,
+					value: String(next),
+					scene: {
+						...scene,
+						fieldName: field.name,
+						fieldSemantics: field.description ?? field.label,
+						...field.options ? { options: field.options.map((o) => String(o.label)) } : {}
+					}
+				});
+			}
+		}
+		await this.#appendBehaviorRecords(state, records);
+	}
+	/** 行为记录追加（FR-19.2）。默认关闭：未注入 `userProfile` 时零持久化写入 */
+	async #appendBehaviorRecords(state, records) {
+		const profile = this.#deps.userProfile;
+		if (!profile || !this.#deps.memory || records.length === 0) return;
+		const limits = profile.limits ?? DEFAULT_USER_PROFILE_LIMITS;
+		await this.#memoryMutate(`user:${profile.userId}`, BEHAVIOR_RECORDS_KEY, state, (current) => appendBehaviorRecords(readBehaviorRecords(current), records, limits));
+	}
+	/** 画像 → 系统消息（FR-19.4）。读不到或为空时不注入任何内容 */
+	async #userProfileMessage(state) {
+		const profile = this.#deps.userProfile;
+		if (!profile || !this.#deps.memory) return void 0;
+		const limits = profile.limits ?? DEFAULT_USER_PROFILE_LIMITS;
+		const context = renderUserProfileContext(readUserProfile(await this.#memoryGet(`user:${profile.userId}`, USER_PROFILE_KEY, state)), limits.injectMaxBytes);
+		if (context === "") return void 0;
+		return {
+			role: "system",
+			content: textParts(`${context}\n\n${USER_PROFILE_NO_INVENTION_RULE}`)
+		};
 	}
 };
 /**
@@ -2948,6 +3671,7 @@ var WebSkillRuntime = class {
 		return result;
 	}
 	async run(userPrompt, options = {}) {
+		if (options.skillName !== void 0 && this.#deps.config?.toolCallingDisabled === true) throw new WebSkillError("MODEL_TOOLS_UNSUPPORTED", "The selected model does not support skill invocation. Switch to a model with tool calling.");
 		if (!this.#catalogCache) await this.discover();
 		const cache = this.#catalogCache;
 		if (!cache) throw new Error("discover() did not populate the catalog cache");
@@ -2962,7 +3686,9 @@ var WebSkillRuntime = class {
 		}))).flat();
 		const catalog = providerEntries.length > 0 ? { entries: mergeCatalogEntries(cache.catalog.entries, providerEntries) } : cache.catalog;
 		const filteredCatalog = this.#deps.catalogFilter ? { entries: await this.#deps.catalogFilter(catalog.entries) } : catalog;
-		const route = await this.#router.route(filteredCatalog);
+		const routedCatalog = options.skillName === void 0 ? filteredCatalog : { entries: filteredCatalog.entries.filter((entry) => entry.name === options.skillName) };
+		if (options.skillName !== void 0 && routedCatalog.entries.length === 0) throw new WebSkillError("SKILL_NOT_FOUND", `Skill "${options.skillName}" is not available in this catalog`);
+		const route = await this.#router.route(routedCatalog);
 		const loop = new AgentLoop({
 			llm: this.#deps.llm,
 			executor: this.#deps.executor,
@@ -2977,6 +3703,7 @@ var WebSkillRuntime = class {
 			hooks: this.#deps.hooks,
 			eventBus: this.#events,
 			longTerm: this.#deps.longTerm,
+			userProfile: this.#deps.userProfile,
 			externalTools: this.#deps.externalTools,
 			skillProviders: this.#deps.skillProviders,
 			catalogFilter: this.#deps.catalogFilter,
@@ -3007,7 +3734,7 @@ var WebSkillRuntime = class {
 			message: `Skill provider listSkills() failed: ${failure}`
 		});
 		if (this.#deps.onSkillMiss && result.run.activeSkillNames.length === 0) this.#deps.onSkillMiss({
-			prompt: userPrompt,
+			prompt: promptText(userPrompt),
 			run: result.run
 		}).catch((e) => {
 			result.run.trace.push({
@@ -3083,6 +3810,7 @@ var WebSkillRuntime = class {
 			hooks: this.#deps.hooks,
 			eventBus: this.#events,
 			longTerm: this.#deps.longTerm,
+			userProfile: this.#deps.userProfile,
 			externalTools: this.#deps.externalTools,
 			skillProviders: this.#deps.skillProviders,
 			catalogFilter: this.#deps.catalogFilter,
@@ -3337,6 +4065,191 @@ var FsMemoryStore = class {
 		for (const entry of await this.#fs.list(this.#root)) await this.#fs.remove(entry.path, { recursive: true });
 	}
 };
+/**
+* 提炼提示词。要求返回结论列表而不是散文：条目化是「可见、可编辑、可删除」的前提（FR-19.3）。
+* `id` 由模型给出稳定 slug，才能在下一次提炼时更新同一条而不是无限追加。
+*/
+const USER_PROFILE_REFINE_PROMPT = `You summarize what a single user is like, based on records of what they did in a chat application.
+
+Return ONLY a JSON object with this shape, and nothing else:
+
+{
+  "entries": [
+    { "id": "slug-case-stable-id", "text": "One sentence about the user.", "confidence": "high" | "low" }
+  ]
+}
+
+Rules:
+- Each entry is one durable, reusable fact or preference about the user — how they like answers, what they work on, values they keep entering, languages they use.
+- Reuse the same "id" across runs for the same conclusion so it can be updated instead of duplicated. Use lowercase words joined by hyphens.
+- Use "high" only when several records agree. A single record is "low".
+- Do not restate individual records. Do not include secrets, credentials, or full personal identifiers.
+- Do not invent anything the records do not support. If the records say nothing useful, return {"entries": []}.`;
+/** 采样后的记录 → 送模型的摘要。导出供测试与宿主复核实际请求内容（AC-19.6） @experimental */
+function toRecordDigests(records) {
+	return records.map((record) => ({
+		kind: record.kind,
+		at: new Date(record.at).toISOString(),
+		value: record.value,
+		...record.scene.skillName !== void 0 ? { skill: record.scene.skillName } : {},
+		...record.scene.fieldName !== void 0 ? { field: record.scene.fieldName } : {},
+		...record.scene.fieldSemantics !== void 0 ? { meaning: record.scene.fieldSemantics } : {},
+		...record.scene.options !== void 0 ? { options: record.scene.options } : {},
+		...record.confirmed === true ? { confirmed: true } : {}
+	}));
+}
+/** 模型可能把 JSON 包在 ```json 里；只取第一个对象，解析不出就当没结论 */
+function parseEntries(content, now) {
+	const text = promptText(content ?? []);
+	const start = text.indexOf("{");
+	const end = text.lastIndexOf("}");
+	if (start < 0 || end <= start) return [];
+	let parsed;
+	try {
+		parsed = JSON.parse(text.slice(start, end + 1));
+	} catch {
+		return [];
+	}
+	const raw = parsed?.entries;
+	return readProfileEntries(Array.isArray(raw) ? raw.map((item) => ({
+		updatedAt: now,
+		...item
+	})) : []);
+}
+/**
+* 一次提炼（FR-19.3）。调用方负责持久化返回值；本函数不碰存储，
+* 也不吞异常——「失败不影响会话结束」由调用点的 fire-and-forget 保证，
+* 在这里吞掉会让手动提炼入口无法报错。
+* @experimental
+*/
+async function refineUserProfile(input) {
+	const limits = input.limits ?? DEFAULT_USER_PROFILE_LIMITS;
+	const now = (input.now ?? Date.now)();
+	const current = input.profile ?? EMPTY_USER_PROFILE;
+	const sampled = sampleBehaviorRecords(input.records, limits);
+	if (sampled.length === 0) return current;
+	const existing = current.entries.map((entry) => ({
+		id: entry.id,
+		text: entry.text
+	}));
+	const entries = parseEntries((await input.llm.complete({
+		...input.model !== void 0 ? { model: input.model } : {},
+		...input.signal !== void 0 ? { signal: input.signal } : {},
+		messages: [{
+			role: "system",
+			content: [{
+				type: "text",
+				text: USER_PROFILE_REFINE_PROMPT
+			}]
+		}, {
+			role: "user",
+			content: [{
+				type: "text",
+				text: `Existing conclusions:\n${JSON.stringify(existing)}\n\nRecords:\n${JSON.stringify(toRecordDigests(sampled))}`
+			}]
+		}]
+	})).content, now);
+	if (entries.length === 0) return current;
+	return mergeProfileEntries(current, entries, {
+		now,
+		limits
+	});
+}
+/** 导出文件的版本；导入时逐字校验，不做向前兼容猜测 @experimental */
+const USER_PROFILE_EXPORT_VERSION = 1;
+/** 与偏好导出同一套判据：归一化后按子串匹配，命中即拒 */
+const CREDENTIAL_MARKERS = [
+	"apikey",
+	"secret",
+	"token",
+	"password",
+	"passphrase",
+	"credential",
+	"privatekey"
+];
+const isCredentialKey = (key) => {
+	const normalized = key.toLowerCase().replace(/[-_\s]/g, "");
+	return CREDENTIAL_MARKERS.some((marker) => normalized.includes(marker));
+};
+function findCredentialKey(value) {
+	if (Array.isArray(value)) {
+		for (const item of value) {
+			const hit = findCredentialKey(item);
+			if (hit !== void 0) return hit;
+		}
+		return;
+	}
+	if (typeof value !== "object" || value === null) return void 0;
+	for (const [key, child] of Object.entries(value)) {
+		if (isCredentialKey(key)) return key;
+		const hit = findCredentialKey(child);
+		if (hit !== void 0) return hit;
+	}
+}
+/**
+* 导出画像（FR-19.7）。`excludeIds` 来自导出前的审阅界面：用户勾掉的条目不进文件。
+* @experimental
+*/
+function exportUserProfile(profile, options) {
+	const excluded = new Set(options.excludeIds ?? []);
+	const result = {
+		kind: "webskill.user-profile",
+		version: 1,
+		origin: options.origin,
+		exportedAt: (options.now ?? Date.now)(),
+		entries: profile.entries.filter((entry) => !excluded.has(entry.id))
+	};
+	const leaked = findCredentialKey(result);
+	if (leaked !== void 0) throw new WebSkillError("PROFILE_IMPORT_CREDENTIAL_REJECTED", `A user profile export must not contain credentials, but "${leaked}" was present`);
+	return result;
+}
+/** 解析并校验导入内容（FR-19.7）。含凭据是**拒绝**而不是忽略 @experimental */
+function parseUserProfileExport(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new WebSkillError("PROFILE_IMPORT_INVALID", "A user profile file must be a JSON object");
+	const record = raw;
+	if (record["kind"] !== "webskill.user-profile") throw new WebSkillError("PROFILE_IMPORT_INVALID", "A user profile file must have \"kind\": \"webskill.user-profile\"");
+	if (record["version"] !== 1) throw new WebSkillError("PROFILE_IMPORT_VERSION_UNSUPPORTED", `Unsupported user profile file version ${JSON.stringify(record["version"])}; expected 1`);
+	const leaked = findCredentialKey(record);
+	if (leaked !== void 0) throw new WebSkillError("PROFILE_IMPORT_CREDENTIAL_REJECTED", `The user profile file contains a credential field "${leaked}"; the import was rejected`);
+	const entries = readProfileEntries(record["entries"]);
+	if (entries.length === 0) throw new WebSkillError("PROFILE_IMPORT_INVALID", "The user profile file has no usable entries");
+	return {
+		kind: "webskill.user-profile",
+		version: 1,
+		origin: typeof record["origin"] === "string" ? record["origin"] : "unknown",
+		exportedAt: typeof record["exportedAt"] === "number" ? record["exportedAt"] : 0,
+		entries
+	};
+}
+/** 导入前给用户看的差异（FR-19.7）：新增哪些、覆盖哪些 @experimental */
+function diffUserProfile(current, incoming) {
+	const byId = new Map(current.entries.map((entry) => [entry.id, entry]));
+	const added = [];
+	const updated = [];
+	for (const entry of incoming.entries) {
+		const existing = byId.get(entry.id);
+		if (existing === void 0) added.push(entry);
+		else if (existing.text !== entry.text) updated.push(entry);
+	}
+	return {
+		added,
+		updated
+	};
+}
+/** 确认后落库：同 id 覆盖，其余保留；不触碰模型配置与凭据 @experimental */
+function applyUserProfileImport(current, incoming, options = {}) {
+	const now = (options.now ?? Date.now)();
+	const byId = new Map(current.entries.map((entry) => [entry.id, entry]));
+	for (const entry of incoming.entries) byId.set(entry.id, {
+		...entry,
+		updatedAt: now
+	});
+	return {
+		version: 1,
+		entries: [...byId.values()].sort((a, b) => b.updatedAt - a.updatedAt).slice(0, DEFAULT_USER_PROFILE_LIMITS.entryLimit),
+		refinedAt: current.refinedAt
+	};
+}
 const INDEX_FILE$1 = "index.json";
 /**
 * 基于 FileSystemProvider 的 ArtifactStore：产物落盘 <root>/<runId>/<path>，
@@ -3688,12 +4601,16 @@ var FsRunTraceStore = class {
 	#root;
 	#fs;
 	#onError;
+	#onIndexError;
 	constructor(deps) {
 		this.#root = deps.root.replace(/\/+$/, "");
 		this.#fs = deps.fs;
 		this.#onError = deps.onError ?? ((error, run) => {
 			console.warn(`Failed to persist run trace "${run.id}": ${messageOf(error)}`);
 		});
+		this.#onIndexError = deps.onIndexError ?? ((error, run) => {
+			console.warn(`Run trace "${run.id}" was saved but its index entry could not be appended: ${messageOf(error)}. The index will be rebuilt on the next read.`);
+		});
 	}
 	#path(runId) {
 		return resolveInsideRoot(this.#root, `${runId}.json`);
@@ -3711,9 +4628,14 @@ var FsRunTraceStore = class {
 		};
 		try {
 			await this.#fs.writeText(this.#path(run.id), JSON.stringify(trace, null, 2));
-			await this.#fs.appendText(`${this.#root}/${INDEX_FILE}`, `${JSON.stringify(summarize(trace))}\n`);
 		} catch (e) {
 			this.#onError(e, run);
+			return;
+		}
+		try {
+			await this.#fs.appendText(`${this.#root}/${INDEX_FILE}`, `${JSON.stringify(summarize(trace))}\n`);
+		} catch (e) {
+			this.#onIndexError(e, run);
 		}
 	}
 	async get(runId) {
@@ -3839,12 +4761,15 @@ function summarizeToolCalls(run) {
 		if (typeof name !== "string" || typeof callId !== "string") continue;
 		const args = event.data?.["args"];
 		const durationMs = event.data?.["durationMs"];
+		const errorCode = event.data?.["code"];
 		calls.push({
 			callId,
 			name,
 			status: event.type === "tool.completed" ? "completed" : "failed",
 			...typeof args === "string" ? { args } : {},
-			...typeof durationMs === "number" ? { durationMs } : {}
+			...typeof durationMs === "number" ? { durationMs } : {},
+			...typeof errorCode === "string" ? { errorCode } : {},
+			...event.type === "tool.failed" && typeof event.message === "string" ? { errorMessage: event.message } : {}
 		});
 	}
 	return calls;
@@ -3861,6 +4786,7 @@ const toMeta = (record) => ({
 	messageCount: record.messages.length
 });
 const newSessionId = () => `session-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+const baseName = (path) => path.split("/").pop() ?? path;
 /**
 * 从新到旧的一页：无游标取末尾 `limit` 条，有游标取该位置**之前**的 `limit` 条。
 * 游标编码成「本页起点下标」——对会话文件这种整体重写的存储来说下标是稳定的，
@@ -3954,8 +4880,13 @@ var FsSessionStore = class {
 		return record;
 	}
 	async list(options = {}) {
-		if (!await this.#fs.exists(this.#root)) return { items: [] };
+		if (!await this.#fs.exists(this.#root)) return {
+			items: [],
+			source: "missing-root",
+			skipped: []
+		};
 		const metas = [];
+		const skipped = [];
 		for (const entry of await this.#fs.list(this.#root)) {
 			if (entry.type !== "file" || !entry.path.endsWith(".json")) continue;
 			let record;
@@ -3963,13 +4894,18 @@ var FsSessionStore = class {
 				record = parseSessionFile(await this.#fs.readText(entry.path), entry.path);
 			} catch (e) {
 				console.warn(`Skipping unreadable session file "${entry.path}": ${e instanceof Error ? e.message : String(e)}`);
+				skipped.push(baseName(entry.path));
 				continue;
 			}
 			if (record.archived === true && options.includeArchived !== true) continue;
 			metas.push(toMeta(record));
 		}
 		metas.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
-		return takeTailPage(metas, options, "session");
+		return {
+			...takeTailPage(metas, options, "session"),
+			source: "ok",
+			skipped
+		};
 	}
 	/**
 	* 整文件读后切片。磁盘 I/O 复杂度没有改善（备案 D25），
@@ -4036,4 +4972,4 @@ var FsSessionStore = class {
 };
 
 //#endregion
-export { createScriptContext as A, networkUrlHost as B, RUN_TRACE_SCHEMA_VERSION as C, WebSkillRuntime as D, TraceRecorder as E, fromVercelStreamPart as F, resolveToolName as G, normalizeToolContent as H, isNetworkAllowed as I, toLlmToolSpec as J, schemaToForm as K, isUnsupportedRunSnapshot as L, extractChartSpec as M, extractUiSpecEvents as N, bridgeError as O, fromVercelResult as P, mergeCatalogEntries as R, RUN_SNAPSHOT_SCHEMA_VERSION as S, SerializingMemoryStore as T, normalizeToolError as U, normalizeErrorCode as V, parseBridgeRequest as W, validateUiSpecEvent as X, toVercelToolSpecs as Y, validateUiSpecNode as Z, OpenAiCompatibleClient as _, AnthropicClient as a, READ_SKILL_FILE_TOOL as b, FS_SESSION_PAGE_SIZE as c, FsRunSnapshotStore as d, FsRunTraceStore as f, HookRunner as g, GoogleGenAiClient as h, AgentLoop as i, createWebSkillApi as j, buildRenderResult as k, FsArtifactStore as l, FullDisclosureRouter as m, ASK_USER_TOOL as n, CapabilityApproval as o, FsSessionStore as p, summarizeToolCalls as q, ASK_USER_TOOL_NAME as r, EventBus as s, ASK_USER_INPUT_SCHEMA as t, FsMemoryStore as u, ProgressiveRouter as v, SESSION_SCHEMA_VERSION as w, READ_SKILL_FILE_TOOL_NAME as x, READ_SKILL_FILE_INPUT_SCHEMA as y, networkPolicyLibSource as z };
+export { listSkillScripts as $, TraceRecorder as A, buildRenderResult as B, READ_SKILL_FILE_INPUT_SCHEMA as C, validateUiSpecEvent as Ct, RUN_TRACE_SCHEMA_VERSION as D, RUN_SNAPSHOT_SCHEMA_VERSION as E, USER_PROFILE_REFINE_PROMPT as F, extractChartSpec as G, createWebSkillApi as H, WebSkillRuntime as I, formatSkillScriptManifest as J, extractTodoTraceEvents as K, appendBehaviorRecords as L, USER_PROFILE_KEY as M, USER_PROFILE_NO_INVENTION_RULE as N, SESSION_SCHEMA_VERSION as O, USER_PROFILE_PROMPT_HEADER as P, isUnsupportedRunSnapshot as Q, applyUserProfileImport as R, ProgressiveRouter as S, toVercelToolSpecs as St, READ_SKILL_FILE_TOOL_NAME as T, diffUserProfile as U, createScriptContext as V, exportUserProfile as W, fromVercelStreamPart as X, fromVercelResult as Y, isNetworkAllowed as Z, FsSessionStore as _, schemaToForm as _t, AgentLoop as a, normalizeToolContent as at, HookRunner as b, toLlmToolSpec as bt, CapabilityApproval as c, parseUserProfileExport as ct, EventBus as d, readUserProfile as dt, mergeCatalogEntries as et, FS_SESSION_PAGE_SIZE as f, refineUserProfile as ft, FsRunTraceStore as g, schemaSourceLabel as gt, FsRunSnapshotStore as h, sampleBehaviorRecords as ht, ASK_USER_TOOL_NAME as i, normalizeErrorCode as it, USER_PROFILE_EXPORT_VERSION as j, SerializingMemoryStore as k, DEFAULT_USER_PROFILE_LIMITS as l, readBehaviorRecords as lt, FsMemoryStore as m, resolveToolName as mt, ASK_USER_INPUT_SCHEMA as n, networkPolicyLibSource as nt, AnthropicClient as o, normalizeToolError as ot, FsArtifactStore as p, renderUserProfileContext as pt, extractUiSpecEvents as q, ASK_USER_TOOL as r, networkUrlHost as rt, BEHAVIOR_RECORDS_KEY as s, parseBridgeRequest as st, ALLOWED_TOOLS_EXCLUSION_REASON as t, mergeProfileEntries as tt, EMPTY_USER_PROFILE as u, readProfileEntries as ut, FullDisclosureRouter as v, scriptToolName as vt, READ_SKILL_FILE_TOOL as w, validateUiSpecNode as wt, OpenAiCompatibleClient as x, toRecordDigests as xt, GoogleGenAiClient as y, summarizeToolCalls as yt, bridgeError as z };