@webskill/sdk 0.6.0 → 0.8.0

package/dist/{dist-DusANsrn.js → dist-DmI5SBBF.js}

@@ -1,7 +1,69 @@
-import { A as parseSkillMarkdown, L as resolveInsideRoot, O as messageOf, P as renderAvailableSkillsXml, V as validateSkills, f as SkillDiscovery, g as assertSafePathSegment, m as WebSkillError, p as SkillReader, v as buildCatalog } from "./dist-8oQRa8Xz.js";
-import { a as textParts, i as rejectUnsupportedPart, n as partsToText, o as validateLlmMessages, r as promptText, t as MemoryArtifactStore } from "./memoryArtifactStore-52Zn9npI-BMPYwvoy.js";
+import { A as messageOf, I as renderAvailableSkillsXml, M as parseSkillMarkdown, W as validateSkills, f as SkillDiscovery, g as assertSafePathSegment, m as WebSkillError, p as SkillReader, v as buildCatalog, z as resolveInsideRoot } from "./dist-59XlqDuv.js";
+import { a as textParts, i as rejectUnsupportedPart, n as partsToText, o as validateLlmMessages, r as promptText, t as MemoryArtifactStore } from "./memoryArtifactStore-52Zn9npI-upv5OWYf.js";
 
 //#region ../runtime/dist/index.js
+/** 与正常工具结果同构：模型读到的是「这次调用被中断了」，而不是一个凭空消失的调用 */
+function interruptedToolResult(call, options = {}) {
+	const code = options.code ?? "RUN_INTERRUPTED";
+	const because = options.reason === void 0 ? "" : ` (${options.reason})`;
+	return {
+		ok: false,
+		content: [],
+		error: {
+			code,
+			message: `Tool call "${call.name}" produced no result: the run ended before it finished${because}.`
+		}
+	};
+}
+/** 尚无 `role:'tool'` 应答的工具调用，按消息顺序 */
+function findUnpairedToolCalls(messages) {
+	const answered = new Set(messages.filter((m) => m.role === "tool").map((m) => m.toolCallId));
+	return messages.filter((m) => m.role === "assistant" && m.toolCalls?.length).flatMap((m) => m.toolCalls ?? []).filter((call) => !answered.has(call.id));
+}
+/**
+* 为每个未应答的工具调用补一条结构化的中断说明。
+*
+* 补齐消息紧跟在该 assistant 已有的 tool 兄弟之后——供应商装配按相邻块分组，
+* 插到序列末尾会让它归属到别的 assistant 消息上。
+* 本函数**不改写入参**，也不写盘（AC-11.8）。
+*/
+function sealToolCallPairs(messages, options = {}) {
+	const answered = new Set(messages.filter((m) => m.role === "tool").map((m) => m.toolCallId));
+	const code = options.code ?? "RUN_INTERRUPTED";
+	const sealed = [];
+	const out = [];
+	for (let i = 0; i < messages.length; i += 1) {
+		const message = messages[i];
+		out.push(message);
+		if (message.role !== "assistant" || !message.toolCalls?.length) continue;
+		const missing = message.toolCalls.filter((call) => !answered.has(call.id));
+		if (missing.length === 0) continue;
+		while (i + 1 < messages.length && messages[i + 1].role === "tool") {
+			out.push(messages[i + 1]);
+			i += 1;
+		}
+		for (const call of missing) {
+			out.push({
+				role: "tool",
+				toolCallId: call.id,
+				content: textParts(JSON.stringify(interruptedToolResult(call, {
+					...options,
+					code
+				})))
+			});
+			answered.add(call.id);
+			sealed.push({
+				callId: call.id,
+				toolName: call.name,
+				code
+			});
+		}
+	}
+	return {
+		messages: sealed.length === 0 ? [...messages] : out,
+		sealed
+	};
+}
 /**
 * $defs 必须与 type / properties 同级，位于每个工具 inputSchema 的根。
 * 已验证：放进 properties.spec 内层会得到同样的 "Unsupported ref: #" ——
@@ -12,7 +74,7 @@ const DEFS_KEY = "$defs";
 const SELF_REF = "#";
 const NODE_NAME = "Node";
 const COMPONENT_PREFIX = "Component_";
-/** 值为「名称 → 子 schema」的映射。 */
+/** 值为「名称 → 子 schema」的映射。包内导出：vendorSchema 要用同一套下钻规则（两套会漂移）。 */
 const SCHEMA_MAP_KEYS = /* @__PURE__ */ new Set([
 	"properties",
 	"patternProperties",
@@ -41,11 +103,11 @@ const SCHEMA_KEYS = /* @__PURE__ */ new Set([
 	"then",
 	"else"
 ]);
-function isRecord$4(value) {
+function isRecord$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isSelfRef(value) {
-	return isRecord$4(value) && value["$ref"] === SELF_REF;
+	return isRecord$6(value) && value["$ref"] === SELF_REF;
 }
 /**
 * 按 JSON Schema 关键字下降到子 schema。
@@ -55,7 +117,7 @@ function isSelfRef(value) {
 function forEachSubSchema(node, visit) {
 	for (const [key, value] of Object.entries(node)) {
 		if (SCHEMA_MAP_KEYS.has(key)) {
-			if (isRecord$4(value)) for (const name of Object.keys(value)) visit(value[name], [key, name]);
+			if (isRecord$6(value)) for (const name of Object.keys(value)) visit(value[name], [key, name]);
 			continue;
 		}
 		if (SCHEMA_LIST_KEYS.has(key)) {
@@ -74,7 +136,7 @@ function pathKey(path) {
 * `#` 解析到最近的带 `$id` 的祖先；没有则是文档根。
 */
 function collectSelfRefRoots(node, path, resourceRoot, out) {
-	if (!isRecord$4(node)) return;
+	if (!isRecord$6(node)) return;
 	if (isSelfRef(node)) {
 		out.set(pathKey(resourceRoot), resourceRoot);
 		return;
@@ -87,7 +149,7 @@ function collectSelfRefRoots(node, path, resourceRoot, out) {
 function getAt(schema, path) {
 	let current = schema;
 	for (const segment of path) if (Array.isArray(current) && typeof segment === "number") current = current[segment];
-	else if (isRecord$4(current) && typeof segment === "string") current = current[segment];
+	else if (isRecord$6(current) && typeof segment === "string") current = current[segment];
 	else return void 0;
 	return current;
 }
@@ -113,7 +175,7 @@ function setAt(schema, path, replacement) {
 * 正是严格解析器无法解析 `#` 的直接原因。
 */
 function rewriteSelfRefs(node, target, depth) {
-	if (!isRecord$4(node)) return node;
+	if (!isRecord$6(node)) return node;
 	if (depth > 8) throw new WebSkillError("TOOL_SCHEMA_UNAVAILABLE", `Tool schema nesting exceeds 8 levels; cannot produce a portable form`);
 	if (isSelfRef(node)) {
 		const rest = {};
@@ -126,7 +188,7 @@ function rewriteSelfRefs(node, target, depth) {
 	const result = {};
 	for (const [key, value] of Object.entries(node)) {
 		if (key === "$id" || key === "$schema") continue;
-		if (SCHEMA_MAP_KEYS.has(key) && isRecord$4(value)) {
+		if (SCHEMA_MAP_KEYS.has(key) && isRecord$6(value)) {
 			const mapped = {};
 			for (const [name, child] of Object.entries(value)) mapped[name] = rewriteSelfRefs(child, target, depth + 1);
 			result[key] = mapped;
@@ -164,8 +226,8 @@ function toPortableToolSchema(schema) {
 	if (roots.size > 1) throw new WebSkillError("TOOL_SCHEMA_UNAVAILABLE", "Tool schema contains self references in more than one schema resource; cannot produce a portable form");
 	const rootPath = [...roots.values()][0] ?? [];
 	const resource = getAt(schema, rootPath);
-	if (!isRecord$4(resource)) return schema;
-	const existingDefs = isRecord$4(schema[DEFS_KEY]) ? schema[DEFS_KEY] : void 0;
+	if (!isRecord$6(resource)) return schema;
+	const existingDefs = isRecord$6(schema[DEFS_KEY]) ? schema[DEFS_KEY] : void 0;
 	const taken = new Set(Object.keys(existingDefs ?? {}));
 	const nodeName = uniqueName(NODE_NAME, taken);
 	taken.add(nodeName);
@@ -196,6 +258,136 @@ function toPortableToolSchema(schema) {
 		}
 	};
 }
+/** 各家都认的基础关键字。Google `FunctionDeclaration.parameters` 是其中最窄的一家。 */
+const BASE_KEYWORDS = /* @__PURE__ */ new Set([
+	"type",
+	"description",
+	"title",
+	"default",
+	"enum",
+	"const",
+	"properties",
+	"required",
+	"items",
+	"anyOf",
+	"oneOf",
+	"minimum",
+	"maximum",
+	"minItems",
+	"maxItems",
+	"nullable",
+	"format"
+]);
+/** 宽松侧：保留 0.6.0 的透传行为，本版不主动收紧（没有实证之前收紧只会制造新的破坏） */
+const PERMISSIVE_KEYWORDS = /* @__PURE__ */ new Set([
+	...BASE_KEYWORDS,
+	"additionalProperties",
+	"patternProperties",
+	"dependentSchemas",
+	"definitions",
+	"$defs",
+	"$ref",
+	"$schema",
+	"$id",
+	"allOf",
+	"not",
+	"if",
+	"then",
+	"else",
+	"prefixItems",
+	"additionalItems",
+	"unevaluatedItems",
+	"unevaluatedProperties",
+	"contains",
+	"propertyNames",
+	"exclusiveMinimum",
+	"exclusiveMaximum",
+	"multipleOf",
+	"minLength",
+	"maxLength",
+	"pattern",
+	"uniqueItems",
+	"examples",
+	"readOnly",
+	"writeOnly",
+	"deprecated"
+]);
+const OPENAI_SCHEMA_PROFILE = {
+	id: "openai-compatible",
+	allowedKeywords: PERMISSIVE_KEYWORDS,
+	supportsRefs: true
+};
+const ANTHROPIC_SCHEMA_PROFILE = {
+	id: "anthropic",
+	allowedKeywords: PERMISSIVE_KEYWORDS,
+	supportsRefs: true
+};
+/**
+* Google Gen AI 的 `FunctionDeclaration.parameters` 收到 `additionalProperties`
+* 直接回 400 `Unknown name "additionalProperties"`，且不解析 `$ref` / `$defs`。
+*/
+const GOOGLE_SCHEMA_PROFILE = {
+	id: "google",
+	allowedKeywords: BASE_KEYWORDS,
+	supportsRefs: false
+};
+function isRecord$5(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** 只在 schema 位置上找 `$ref`：enum / const / default 里的同名键是字面数据，不是引用 */
+function containsRef(node) {
+	if (Array.isArray(node)) return node.some(containsRef);
+	if (!isRecord$5(node)) return false;
+	if (typeof node["$ref"] === "string") return true;
+	for (const [key, value] of Object.entries(node)) {
+		if (SCHEMA_MAP_KEYS.has(key)) {
+			if (isRecord$5(value) && Object.values(value).some(containsRef)) return true;
+			continue;
+		}
+		if (SCHEMA_LIST_KEYS.has(key)) {
+			if (Array.isArray(value) && value.some(containsRef)) return true;
+			continue;
+		}
+		if (SCHEMA_KEYS.has(key) && containsRef(value)) return true;
+	}
+	return false;
+}
+function sanitizeNode(node, profile) {
+	if (Array.isArray(node)) return node.map((item) => sanitizeNode(item, profile));
+	if (!isRecord$5(node)) return node;
+	const out = {};
+	for (const [key, value] of Object.entries(node)) {
+		if (!profile.allowedKeywords.has(key)) continue;
+		if (SCHEMA_MAP_KEYS.has(key) && isRecord$5(value)) {
+			const mapped = {};
+			for (const [name, child] of Object.entries(value)) mapped[name] = sanitizeNode(child, profile);
+			out[key] = mapped;
+			continue;
+		}
+		if (SCHEMA_LIST_KEYS.has(key) && Array.isArray(value)) {
+			out[key] = value.map((child) => sanitizeNode(child, profile));
+			continue;
+		}
+		if (SCHEMA_KEYS.has(key)) {
+			out[key] = sanitizeNode(value, profile);
+			continue;
+		}
+		out[key] = value;
+	}
+	return out;
+}
+/**
+* 按供应商 profile 清洗出站 schema。产出新对象，不修改入参（工具源可能复用同一个实例）。
+*
+* 这是**传输层适配**，只应在出站请求体上调用；不要下沉到 AgentLoop，
+* 否则 trace / eventBus 观测到的 schema 会与技能作者写的不一致。
+*
+* @throws WebSkillError `TOOL_SCHEMA_UNAVAILABLE` — schema 依赖该供应商不支持的引用
+*/
+function sanitizeForVendor(schema, profile, toolName) {
+	if (!profile.supportsRefs && containsRef(schema)) throw new WebSkillError("TOOL_SCHEMA_UNAVAILABLE", `Tool "${toolName}" requires $ref support that provider "${profile.id}" does not accept`);
+	return sanitizeNode(schema, profile);
+}
 function createSseFrameReader() {
 	let buffer = "";
 	let data = [];
@@ -307,7 +499,7 @@ const toOpenAiTools = (tools) => tools.map((tool) => ({
 	function: {
 		name: tool.name,
 		...tool.description ? { description: tool.description } : {},
-		parameters: toPortableToolSchema(tool.inputSchema)
+		parameters: sanitizeForVendor(toPortableToolSchema(tool.inputSchema), OPENAI_SCHEMA_PROFILE, tool.name)
 	}
 }));
 const errorMessage$2 = (e) => e instanceof Error ? e.message : String(e);
@@ -564,7 +756,7 @@ function toAnthropicMessages(messages) {
 const toAnthropicTools = (tools) => tools.map((tool) => ({
 	name: tool.name,
 	...tool.description ? { description: tool.description } : {},
-	input_schema: toPortableToolSchema(tool.inputSchema)
+	input_schema: sanitizeForVendor(toPortableToolSchema(tool.inputSchema), ANTHROPIC_SCHEMA_PROFILE, tool.name)
 }));
 /** Anthropic Messages API 客户端（零依赖 fetch；Node/浏览器通用） */
 var AnthropicClient = class {
@@ -807,7 +999,7 @@ function toGenAiContents(messages) {
 const toGenAiTools = (tools) => [{ functionDeclarations: tools.map((tool) => ({
 	name: tool.name,
 	...tool.description ? { description: tool.description } : {},
-	parameters: toPortableToolSchema(tool.inputSchema)
+	parameters: sanitizeForVendor(toPortableToolSchema(tool.inputSchema), GOOGLE_SCHEMA_PROFILE, tool.name)
 })) }];
 /** Google GenAI（generateContent / streamGenerateContent）客户端（零依赖 fetch） */
 var GoogleGenAiClient = class {
@@ -1260,22 +1452,22 @@ function createScriptContext(deps) {
 		...onWarning ? { onWarning } : {}
 	};
 }
-const isRecord$3 = (v) => typeof v === "object" && v !== null;
+const isRecord$4 = (v) => typeof v === "object" && v !== null;
 /**
 * $chart 约定的形状校验：JSON content 的 data 含 $chart 键且形状合法 → ChartSpec；
 * 任何畸形（kind 非法 / labels 非字符串数组 / series 项缺数值 data）→ undefined（忽略不炸）。
 */
 function extractChartSpec(data) {
-	if (!isRecord$3(data)) return void 0;
+	if (!isRecord$4(data)) return void 0;
 	const raw = data["$chart"];
-	if (!isRecord$3(raw)) return void 0;
+	if (!isRecord$4(raw)) return void 0;
 	const { kind, labels, series } = raw;
 	if (kind !== "bar" && kind !== "line" && kind !== "pie") return void 0;
 	if (!Array.isArray(labels) || !labels.every((l) => typeof l === "string")) return void 0;
 	if (!Array.isArray(series)) return void 0;
 	const validSeries = [];
 	for (const item of series) {
-		if (!isRecord$3(item) || !Array.isArray(item["data"]) || !item["data"].every((n) => typeof n === "number")) return;
+		if (!isRecord$4(item) || !Array.isArray(item["data"]) || !item["data"].every((n) => typeof n === "number")) return;
 		const name = item["name"];
 		validSeries.push({
 			...typeof name === "string" ? { name } : {},
@@ -1293,13 +1485,18 @@ function extractChartSpec(data) {
 /**
 * 默认的结果渲染构造：run 内收集的 renderBlocks（chart 等）在前，
 * LLM 最终输出 → markdown block，run.artifacts → file blocks 在后；summary 取 terminationReason。
+* 注入 output block 时一并记下它的下标（S7），供消费方按来源去重。
 */
 function buildRenderResult(run, output, renderBlocks = []) {
 	const blocks = [...renderBlocks];
-	if (output.trim() !== "") blocks.push({
-		type: "markdown",
-		text: output
-	});
+	let outputBlockIndex;
+	if (output.trim() !== "") {
+		outputBlockIndex = blocks.length;
+		blocks.push({
+			type: "markdown",
+			text: output
+		});
+	}
 	for (const artifact of run.artifacts) blocks.push({
 		type: "file",
 		path: artifact.path,
@@ -1310,7 +1507,8 @@ function buildRenderResult(run, output, renderBlocks = []) {
 		runId: run.id,
 		summary: run.terminationReason,
 		blocks,
-		artifacts: run.artifacts
+		artifacts: run.artifacts,
+		...outputBlockIndex === void 0 ? {} : { outputBlockIndex }
 	};
 }
 const MAX_SURFACE_BYTES = 256 * 1024;
@@ -1326,7 +1524,7 @@ const actionIntents = /* @__PURE__ */ new Set([
 	"download",
 	"refresh"
 ]);
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function reject(message) {
@@ -1343,7 +1541,7 @@ function isJsonValue(value, depth = 0) {
 	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
 	if (typeof value === "number") return Number.isFinite(value);
 	if (Array.isArray(value)) return value.every((item) => isJsonValue(item, depth + 1));
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$3(value)) return false;
 	return Object.keys(value).every((key) => key !== "__proto__" && key !== "constructor" && isJsonValue(value[key], depth + 1));
 }
 /**
@@ -1353,10 +1551,10 @@ function isJsonValue(value, depth = 0) {
 function assertNode(value, path, depth, counter) {
 	if (depth > MAX_NODE_DEPTH) reject(`A UI spec tree must not nest deeper than ${MAX_NODE_DEPTH} levels`);
 	if (++counter.nodes > MAX_NODES) reject(`A UI spec tree must contain at most ${MAX_NODES} nodes`);
-	if (!isRecord$2(value)) reject(`${path} must be an object`);
+	if (!isRecord$3(value)) reject(`${path} must be an object`);
 	requireString(value["component"], `${path}.component`);
 	if (value["id"] !== void 0) requireString(value["id"], `${path}.id`);
-	if (value["props"] !== void 0 && (!isRecord$2(value["props"]) || !isJsonValue(value["props"]))) reject(`${path}.props must be a JSON object`);
+	if (value["props"] !== void 0 && (!isRecord$3(value["props"]) || !isJsonValue(value["props"]))) reject(`${path}.props must be a JSON object`);
 	const children = value["children"];
 	if (children === void 0) return;
 	if (!Array.isArray(children)) reject(`${path}.children must be an array`);
@@ -1366,7 +1564,7 @@ function assertActions(value) {
 	if (value === void 0) return;
 	if (!Array.isArray(value) || value.length > MAX_ACTIONS) reject(`Surface actions must contain at most ${MAX_ACTIONS} items`);
 	for (const action of value) {
-		if (!isRecord$2(action)) reject("A surface action must be an object");
+		if (!isRecord$3(action)) reject("A surface action must be an object");
 		requireString(action["id"], "Surface action ID");
 		const intent = action["intent"];
 		if (typeof intent !== "string" || !actionIntents.has(intent)) reject("Surface action intent is invalid");
@@ -1382,7 +1580,7 @@ function validateUiSpecNode(value) {
 	return structuredClone(value);
 }
 function assertPatch(value) {
-	if (!isRecord$2(value)) reject("A surface patch operation must be an object");
+	if (!isRecord$3(value)) reject("A surface patch operation must be an object");
 	if (value["op"] !== "replace" && value["op"] !== "merge" && value["op"] !== "append") reject("Surface patch operation is invalid");
 	requireString(value["path"], "Surface patch path");
 	if (!value["path"].startsWith("/")) reject("Surface patch path must be a JSON pointer");
@@ -1390,7 +1588,7 @@ function assertPatch(value) {
 }
 /** Validates an individual event in the framework-neutral surface stream. @experimental */
 function validateUiSpecEvent(value) {
-	if (!isRecord$2(value) || typeof value["type"] !== "string") reject("A UI surface event must have a type");
+	if (!isRecord$3(value) || typeof value["type"] !== "string") reject("A UI surface event must have a type");
 	if (value["runId"] !== void 0) requireString(value["runId"], "Surface event run ID");
 	switch (value["type"]) {
 		case "open":
@@ -1448,7 +1646,7 @@ function validateUiSpecEvent(value) {
 }
 /** Extracts validated surface stream events from structured tool output. @experimental */
 function extractUiSpecEvents(data) {
-	if (!isRecord$2(data) || data["$surface"] === void 0) return [];
+	if (!isRecord$3(data) || data["$surface"] === void 0) return [];
 	const raw = data["$surface"];
 	return (Array.isArray(raw) ? raw : [raw]).map((event) => validateUiSpecEvent(event));
 }
@@ -1481,7 +1679,9 @@ function schemaToForm(schema, providedArgs) {
 function mapFieldType(prop) {
 	if (Array.isArray(prop.enum)) return "select";
 	switch (prop.type) {
-		case "string": return prop["format"] === "binary" || prop["contentEncoding"] === "base64" ? "file" : "text";
+		case "string":
+			if (prop["format"] === "binary" || prop["contentEncoding"] === "base64") return "file";
+			return prop["format"] === "password" || prop["writeOnly"] === true ? "password" : "text";
 		case "number":
 		case "integer": return "number";
 		case "boolean": return "boolean";
@@ -1767,7 +1967,7 @@ var TraceRecorder = class {
 		return [...this.#events];
 	}
 };
-const isRecord$1 = (v) => typeof v === "object" && v !== null;
+const isRecord$2 = (v) => typeof v === "object" && v !== null;
 /** 工具结果可经 `$todo` 标记记入 trace 的事件类型；其余类型不接受，防止工具源伪造 run.* */
 const TODO_TRACE_TYPES = /* @__PURE__ */ new Set([
 	"todo.created",
@@ -1782,12 +1982,12 @@ const TODO_TRACE_TYPES = /* @__PURE__ */ new Set([
 * @experimental
 */
 function extractTodoTraceEvents(data) {
-	if (!isRecord$1(data) || data["$todo"] === void 0) return [];
+	if (!isRecord$2(data) || data["$todo"] === void 0) return [];
 	const raw = data["$todo"];
 	const entries = Array.isArray(raw) ? raw : [raw];
 	const events = [];
 	for (const entry of entries) {
-		if (!isRecord$1(entry)) continue;
+		if (!isRecord$2(entry)) continue;
 		const { type, ...rest } = entry;
 		if (typeof type !== "string" || !TODO_TRACE_TYPES.has(type)) continue;
 		events.push({
@@ -1797,7 +1997,39 @@ function extractTodoTraceEvents(data) {
 	}
 	return events;
 }
-const RUN_SNAPSHOT_SCHEMA_VERSION = 2;
+const isRecord$1 = (v) => typeof v === "object" && v !== null;
+/**
+* `$skillCandidate` 约定的形状校验：JSON content 的 data 含合法 `$skillCandidate` 键 → 候选载荷。
+*
+* 与 `$chart` / `$todo` / `$surface` 同一条既有通道，是第四个。
+* 候选的生成与存储全部在 `@webskill/agent`，runtime 只认这个形状，畸形忽略不炸。
+* @experimental
+*/
+function extractSkillCandidate(data) {
+	if (!isRecord$1(data)) return void 0;
+	const raw = data["$skillCandidate"];
+	if (!isRecord$1(raw)) return void 0;
+	const { id, name } = raw;
+	if (typeof id !== "string" || id === "" || typeof name !== "string" || name === "") return void 0;
+	return {
+		id,
+		name
+	};
+}
+/**
+* Agent loop 的运行上限默认值。**全仓唯一来源**（S8）。
+*
+* 在 0.7.0 之前这三个数字在 `AgentLoop` 的构造与 ui-kit 的 `defaultRuntimeConfig()`
+* 里各写了一遍。两份值今天恰好相等，所以不出事；一旦其中一处被改，
+* 「恢复默认值」会恢复到 agent loop 根本不用的值——验收绿、行为错。
+* @stable
+*/
+const DEFAULT_LOOP_LIMITS = {
+	maxTurns: 10,
+	totalTimeoutMs: 12e4,
+	toolTimeoutMs: 3e4
+};
+const RUN_SNAPSHOT_SCHEMA_VERSION = 3;
 /** @experimental */
 function isUnsupportedRunSnapshot(entry) {
 	return entry.unsupported === true;
@@ -1842,7 +2074,7 @@ var FsRunSnapshotStore = class {
 			throw new WebSkillError("RUN_SNAPSHOT_INCOMPATIBLE", `Snapshot for run "${runId}" has an unexpected shape and was deleted`);
 		}
 		const schemaVersion = typeof snapshot.schemaVersion === "number" ? snapshot.schemaVersion : 0;
-		if (schemaVersion !== 2) throw new WebSkillError("RUN_SNAPSHOT_SCHEMA_UNSUPPORTED", `Snapshot for run "${runId}" uses schema version ${schemaVersion}; this runtime reads version 2. The file was kept for read-only inspection.`);
+		if (schemaVersion !== 3) throw new WebSkillError("RUN_SNAPSHOT_SCHEMA_UNSUPPORTED", `Snapshot for run "${runId}" uses schema version ${schemaVersion}; this runtime reads version 3. The file was kept for read-only inspection.`);
 		if (snapshot.runId !== runId) {
 			await this.#fs.remove(path).catch(() => void 0);
 			throw new WebSkillError("RUN_SNAPSHOT_INCOMPATIBLE", `Snapshot for run "${runId}" has an unexpected shape and was deleted`);
@@ -1862,7 +2094,7 @@ var FsRunSnapshotStore = class {
 			try {
 				const parsed = JSON.parse(await this.#fs.readText(entry.path));
 				const schemaVersion = typeof parsed.schemaVersion === "number" ? parsed.schemaVersion : 0;
-				if (schemaVersion === 2) {
+				if (schemaVersion === 3) {
 					out.push(parsed);
 					continue;
 				}
@@ -1975,6 +2207,45 @@ const redactFileValue = (value) => {
 	return rest;
 };
 /**
+* 密码字段名集合（FR-23.7）。
+*
+* 既有的三处脱敏各有各的判别口径（看 request.type、看值是否标量、看值里有没有 data/mimeType），
+* 没有一处按**字段类型**判。行为记录那处尤其危险：它的安全假设是「标量是安全的」，
+* 而密码恰好是字符串标量——假设失效了。
+*/
+const passwordFieldNames = (request) => new Set(request.type === "form" ? request.fields.filter((f) => f.type === "password").map((f) => f.name) : []);
+/** 去掉密码字段的值；不是掩码而是**不存**，掩码存下来仍然泄露长度与存在性 */
+const withoutPasswords = (value, passwords) => {
+	if (passwords.size === 0 || typeof value !== "object" || value === null || Array.isArray(value)) return value;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (!passwords.has(key)) out[key] = entry;
+	return out;
+};
+/**
+* 触顶失败的结构化细节（FR-21.2）。由终止原因推出上限字段，而不是在每个终止点各写一遍——
+* 终止点有四个，写四遍就迟早有一处对不上。
+*/
+const limitDetails = (state, reason) => {
+	if (reason === "timeout") return {
+		limit: "totalTimeoutMs",
+		value: state.totalTimeoutMs
+	};
+	if (reason === "max-turns") return {
+		limit: "maxTurns",
+		value: state.maxTurns
+	};
+};
+/** 补齐消息里带的错误码：能说清「为什么没结果」的，就不要退化成 RUN_INTERRUPTED（设计 11 §2.5） */
+const sealCodeFor = (reason, errorCode) => {
+	switch (reason) {
+		case "interaction-timeout": return "RUN_INTERACTION_TIMEOUT";
+		case "user-cancelled": return "RUN_CANCELLED";
+		case "timeout": return "RUN_TIMEOUT";
+		case "tool-resolution-exhausted": return "TOOL_RESOLUTION_EXHAUSTED";
+		default: return errorCode ?? "RUN_INTERRUPTED";
+	}
+};
+/**
 * 多轮 Agent 循环。
 * 工具失败一律转为 ToolResult{ok:false} 回喂 LLM 继续循环；
 * 缺参/确认/提问经 UiBridge 行内 await 暂停恢复；取消/超时/LLM 异常/护栏超限才终止 run。
@@ -1993,9 +2264,9 @@ var AgentLoop = class {
 			artifactStore: deps.artifactStore ?? new MemoryArtifactStore()
 		};
 		this.#config = {
-			maxTurns: config.maxTurns ?? 10,
-			totalTimeoutMs: config.totalTimeoutMs ?? 12e4,
-			toolTimeoutMs: config.toolTimeoutMs ?? 3e4,
+			maxTurns: config.maxTurns ?? DEFAULT_LOOP_LIMITS.maxTurns,
+			totalTimeoutMs: config.totalTimeoutMs ?? DEFAULT_LOOP_LIMITS.totalTimeoutMs,
+			toolTimeoutMs: config.toolTimeoutMs ?? DEFAULT_LOOP_LIMITS.toolTimeoutMs,
 			toolResultMaxBytes: config.toolResultMaxBytes ?? 1e5,
 			paramHistoryLimit: config.paramHistoryLimit ?? 50,
 			toolCallingDisabled: config.toolCallingDisabled ?? false,
@@ -2210,6 +2481,7 @@ var AgentLoop = class {
 					return finish("failed", "llm-error", messageOf(e), code);
 				}
 				const responseText = partsToText(response.content);
+				if (!llm.stream && responseText !== "") await this.#deps.uiBridge?.onTextDelta?.(state.runId, responseText);
 				trace.record("llm.response", { data: {
 					turn,
 					hasToolCalls: Boolean(response.toolCalls?.length),
@@ -2279,7 +2551,8 @@ var AgentLoop = class {
 			message: output,
 			data: {
 				reason,
-				...errorCode ? { code: errorCode } : {}
+				...errorCode ? { code: errorCode } : {},
+				...limitDetails(state, reason) ?? {}
 			}
 		});
 		const bridge = this.#deps.uiBridge;
@@ -2303,6 +2576,7 @@ var AgentLoop = class {
 		} catch (e) {
 			trace.record("run.warning", { message: `Terminal lifecycle hook failed: ${messageOf(e)}` });
 		}
+		await this.#sealToolCalls(state, reason, errorCode);
 		run.trace = trace.list();
 		return {
 			output,
@@ -2310,12 +2584,45 @@ var AgentLoop = class {
 			messages: state.messages.map((m) => ({ ...m }))
 		};
 	}
+	/**
+	* S1 出口守卫（FR-11.1）：中断留下的未应答工具调用在这里补齐。
+	*
+	* 放在 `#finish` 而不是四个早退点：它是唯一的汇流出口，写四遍就迟早漏一处。
+	* 补齐产物只进 `LlmMessage[]`（下一轮请求装配用），不进 chatbot 的消息流（AC-11.2）。
+	*/
+	async #sealToolCalls(state, reason, errorCode) {
+		const pending = findUnpairedToolCalls(state.messages);
+		if (pending.length === 0) return;
+		const code = sealCodeFor(reason, errorCode);
+		for (const call of pending) {
+			const result = interruptedToolResult(call, {
+				code,
+				reason
+			});
+			state.messages.push({
+				role: "tool",
+				toolCallId: call.id,
+				content: await this.#toolResultParts(call, result, state)
+			});
+			state.trace.record("run.warning", {
+				message: `Sealed unanswered tool call "${call.name}": the run ended before it produced a result.`,
+				data: {
+					kind: "tool-call-sealed",
+					callId: call.id,
+					toolName: call.name,
+					side: "write",
+					reason,
+					code
+				}
+			});
+		}
+	}
 	/** D3 快照写入（含 pendingInteraction 与过期时间；写失败降级 run.warning） */
 	async #saveSnapshot(state, pending) {
 		const store = this.#deps.snapshotStore;
 		if (!store) return;
 		const snapshot = {
-			schemaVersion: 2,
+			schemaVersion: 3,
 			runId: state.runId,
 			sessionId: state.run.sessionId,
 			userPrompt: state.run.userPrompt,
@@ -2490,6 +2797,15 @@ var AgentLoop = class {
 			throw e;
 		}
 	}
+	/**
+	* 工具的技能归属。内置工具与外部工具没有归属，返回 `undefined`——
+	* 拿 `activated[0]` 顶替会把内置工具的失败栽给一个无关技能，比不归因更糟（设计 26 §2.3）。
+	*/
+	#skillOf(call, state) {
+		if (call.name === "read_skill_file" || call.name === "ask_user") return void 0;
+		const resolution = resolveToolName(call.name, state.activated, state.activatedTools.keys());
+		return resolution.kind === "script" ? resolution.skillName : void 0;
+	}
 	/** 最后一条 assistant 消息里第一个尚无 tool 响应的工具调用（即中断时正在处理的那个） */
 	#findPendingToolCall(messages) {
 		const lastAssistant = [...messages].reverse().find((m) => m.role === "assistant" && m.toolCalls?.length);
@@ -2680,11 +2996,14 @@ var AgentLoop = class {
 	}
 	async #executeCall(call, state) {
 		const argsSummary = summarizeArgs(call.arguments);
+		const owner = this.#skillOf(call, state);
+		const attribution = owner === void 0 ? {} : { skillName: owner };
 		const callStartMs = Date.parse(state.now());
 		state.trace.record("tool.started", { data: {
 			name: call.name,
 			callId: call.id,
-			args: argsSummary
+			args: argsSummary,
+			...attribution
 		} });
 		this.#emitTool(state, "started", call);
 		let result;
@@ -2710,7 +3029,8 @@ var AgentLoop = class {
 				name: call.name,
 				callId: call.id,
 				args: argsSummary,
-				durationMs
+				durationMs,
+				...attribution
 			} });
 			this.#emitTool(state, "completed", call);
 			for (const item of result.content) {
@@ -2721,6 +3041,12 @@ var AgentLoop = class {
 					chart
 				});
 				for (const todo of extractTodoTraceEvents(item.data)) state.trace.record(todo.type, { data: todo.data });
+				const candidate = extractSkillCandidate(item.data);
+				if (candidate) try {
+					await this.#deps.uiBridge?.onSkillCandidate?.(state.runId, candidate);
+				} catch (e) {
+					state.trace.record("run.warning", { message: `Skill candidate was not handed off to the UI: ${messageOf(e)}` });
+				}
 				try {
 					for (const event of extractUiSpecEvents(item.data)) await this.#renderSurface(state, event);
 				} catch (e) {
@@ -2738,7 +3064,8 @@ var AgentLoop = class {
 					callId: call.id,
 					code: result.error?.code,
 					args: argsSummary,
-					durationMs
+					durationMs,
+					...attribution
 				}
 			});
 			this.#emitTool(state, "failed", call, result.error?.code);
@@ -2905,10 +3232,17 @@ var AgentLoop = class {
 	async #replaySurfaceEvents(state) {
 		const bridge = this.#deps.uiBridge;
 		if (!bridge?.renderSurface || state.surfaceEvents.length === 0) return;
-		try {
-			for (const event of state.surfaceEvents) await bridge.renderSurface(structuredClone(event));
+		for (const event of state.surfaceEvents) try {
+			await bridge.renderSurface(structuredClone(event));
 		} catch (e) {
-			state.trace.record("run.warning", { message: `Failed to replay UI surfaces: ${messageOf(e)}` });
+			state.trace.record("ui.degraded", {
+				message: `Failed to replay UI surface "${event.id}": ${messageOf(e)}`,
+				data: {
+					kind: "replay-failed",
+					surfaceId: event.id,
+					eventType: event.type
+				}
+			});
 		}
 	}
 	/**
@@ -3332,7 +3666,8 @@ var AgentLoop = class {
 				if (fresh.length > 0) result.artifacts = [...result.artifacts ?? [], ...fresh];
 			}
 			await this.#bumpSkillStat(skillName, result.ok ? "successes" : "failures", state);
-			if (!result.ok) await this.#reportSkillFailure(skillName, state, {
+			if (result.ok) await this.#reportSkillSuccess(skillName, state);
+			else await this.#reportSkillFailure(skillName, state, {
 				code: result.error?.code ?? "TOOL_EXECUTION_FAILED",
 				message: result.error?.message ?? `Tool "${call.name}" returned a failure result`
 			});
@@ -3369,6 +3704,22 @@ var AgentLoop = class {
 			state.trace.record("run.warning", { message: `Skill failure report for "${skillName}" was not recorded: ${messageOf(e)}` });
 		}
 	}
+	/**
+	* D-5 技能成功上报：把失败计数从「累计」变成「连续」的那半边信号。
+	* 与失败上报同样是可选 port，未注入即整段跳过。
+	*/
+	async #reportSkillSuccess(skillName, state) {
+		const report = this.#deps.skillOutcomeReporter?.onSkillSucceeded;
+		if (report === void 0) return;
+		try {
+			await report.call(this.#deps.skillOutcomeReporter, {
+				skillName,
+				runId: state.runId
+			});
+		} catch (e) {
+			state.trace.record("run.warning", { message: `Skill success report for "${skillName}" was not recorded: ${messageOf(e)}` });
+		}
+	}
 	/** context.confirm 触发点：默认真实询问；auto-approve 直通；无 bridge 降级直通 + warning */
 	async #confirm(message, state) {
 		if (this.#policy.confirmations === "auto-approve") return true;
@@ -3455,7 +3806,8 @@ var AgentLoop = class {
 		if (!this.#deps.memory) return;
 		const scope = `session:${state.run.sessionId}`;
 		const limit = this.#config.paramHistoryLimit;
-		const recorded = request.type === "file-pick" ? redactFileValue(value) : value;
+		const passwords = passwordFieldNames(request);
+		const recorded = request.type === "file-pick" ? redactFileValue(value) : withoutPasswords(value, passwords);
 		await this.#memoryMutate(scope, "paramHistory", state, (current) => {
 			const history = current ?? [];
 			history.push({
@@ -3522,6 +3874,7 @@ var AgentLoop = class {
 		else if (request.type === "form" && typeof value === "object" && value !== null) {
 			const submitted = value;
 			for (const field of request.fields) {
+				if (field.type === "password") continue;
 				const next = submitted[field.name];
 				if (typeof next !== "string" && typeof next !== "number" && typeof next !== "boolean") continue;
 				if (next === "") continue;
@@ -3675,6 +4028,7 @@ var WebSkillRuntime = class {
 		if (!this.#catalogCache) await this.discover();
 		const cache = this.#catalogCache;
 		if (!cache) throw new Error("discover() did not populate the catalog cache");
+		const sealedHistory = options.history ? sealToolCallPairs(options.history) : void 0;
 		const providerFailures = [];
 		const providerEntries = (await Promise.all((this.#deps.skillProviders ?? []).map(async (p) => {
 			try {
@@ -3721,11 +4075,25 @@ var WebSkillRuntime = class {
 				userPrompt,
 				route,
 				runId,
-				...options.history ? { history: options.history } : {}
+				...sealedHistory ? { history: sealedHistory.messages } : {}
 			});
 		} finally {
 			this.#loops.delete(runId);
 		}
+		for (const record of sealedHistory?.sealed ?? []) result.run.trace.push({
+			id: `evt-seal-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+			runId: result.run.id,
+			ts: (/* @__PURE__ */ new Date()).toISOString(),
+			type: "run.warning",
+			message: `Sealed unanswered tool call "${record.toolName}" carried over from an earlier interrupted run.`,
+			data: {
+				kind: "tool-call-sealed",
+				callId: record.callId,
+				toolName: record.toolName,
+				side: "read",
+				code: record.code
+			}
+		});
 		for (const failure of providerFailures) result.run.trace.push({
 			id: `evt-provider-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
 			runId: result.run.id,
@@ -4221,7 +4589,6 @@ function parseUserProfileExport(raw) {
 		entries
 	};
 }
-/** 导入前给用户看的差异（FR-19.7）：新增哪些、覆盖哪些 @experimental */
 function diffUserProfile(current, incoming) {
 	const byId = new Map(current.entries.map((entry) => [entry.id, entry]));
 	const added = [];
@@ -4783,6 +5150,7 @@ const toMeta = (record) => ({
 	...record.title !== void 0 ? { title: record.title } : {},
 	...record.titleLocked === true ? { titleLocked: true } : {},
 	...record.archived === true ? { archived: true } : {},
+	...record.modelId !== void 0 ? { modelId: record.modelId } : {},
 	messageCount: record.messages.length
 });
 const newSessionId = () => `session-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
@@ -4829,6 +5197,7 @@ function parseSessionFile(raw, path) {
 		...typeof file.title === "string" ? { title: file.title } : {},
 		...file.titleLocked === true ? { titleLocked: true } : {},
 		...file.archived === true ? { archived: true } : {},
+		...typeof file.modelId === "string" ? { modelId: file.modelId } : {},
 		messages: Array.isArray(file.messages) ? file.messages : [],
 		messageCount: Array.isArray(file.messages) ? file.messages.length : 0
 	};
@@ -4870,6 +5239,7 @@ var FsSessionStore = class {
 			...record.title !== void 0 ? { title: record.title } : {},
 			...record.titleLocked === true ? { titleLocked: true } : {},
 			...record.archived === true ? { archived: true } : {},
+			...record.modelId !== void 0 ? { modelId: record.modelId } : {},
 			messages: record.messages
 		};
 		await this.#fs.writeText(this.#path(record.id), JSON.stringify(file, null, 2));
@@ -4963,6 +5333,18 @@ var FsSessionStore = class {
 			await this.#write(record);
 		});
 	}
+	async setModel(id, modelId) {
+		await this.#serialize(id, async () => {
+			const record = await this.#require(id);
+			if (modelId === void 0) delete record.modelId;
+			else record.modelId = modelId;
+			await this.#write(record);
+		});
+	}
+	async getMeta(id) {
+		const record = await this.get(id);
+		return record === void 0 ? void 0 : toMeta(record);
+	}
 	async delete(id) {
 		await this.#serialize(id, async () => {
 			const path = this.#path(id);
@@ -4972,4 +5354,4 @@ var FsSessionStore = class {
 };
 
 //#endregion
-export { listSkillScripts as $, TraceRecorder as A, buildRenderResult as B, READ_SKILL_FILE_INPUT_SCHEMA as C, validateUiSpecEvent as Ct, RUN_TRACE_SCHEMA_VERSION as D, RUN_SNAPSHOT_SCHEMA_VERSION as E, USER_PROFILE_REFINE_PROMPT as F, extractChartSpec as G, createWebSkillApi as H, WebSkillRuntime as I, formatSkillScriptManifest as J, extractTodoTraceEvents as K, appendBehaviorRecords as L, USER_PROFILE_KEY as M, USER_PROFILE_NO_INVENTION_RULE as N, SESSION_SCHEMA_VERSION as O, USER_PROFILE_PROMPT_HEADER as P, isUnsupportedRunSnapshot as Q, applyUserProfileImport as R, ProgressiveRouter as S, toVercelToolSpecs as St, READ_SKILL_FILE_TOOL_NAME as T, diffUserProfile as U, createScriptContext as V, exportUserProfile as W, fromVercelStreamPart as X, fromVercelResult as Y, isNetworkAllowed as Z, FsSessionStore as _, schemaToForm as _t, AgentLoop as a, normalizeToolContent as at, HookRunner as b, toLlmToolSpec as bt, CapabilityApproval as c, parseUserProfileExport as ct, EventBus as d, readUserProfile as dt, mergeCatalogEntries as et, FS_SESSION_PAGE_SIZE as f, refineUserProfile as ft, FsRunTraceStore as g, schemaSourceLabel as gt, FsRunSnapshotStore as h, sampleBehaviorRecords as ht, ASK_USER_TOOL_NAME as i, normalizeErrorCode as it, USER_PROFILE_EXPORT_VERSION as j, SerializingMemoryStore as k, DEFAULT_USER_PROFILE_LIMITS as l, readBehaviorRecords as lt, FsMemoryStore as m, resolveToolName as mt, ASK_USER_INPUT_SCHEMA as n, networkPolicyLibSource as nt, AnthropicClient as o, normalizeToolError as ot, FsArtifactStore as p, renderUserProfileContext as pt, extractUiSpecEvents as q, ASK_USER_TOOL as r, networkUrlHost as rt, BEHAVIOR_RECORDS_KEY as s, parseBridgeRequest as st, ALLOWED_TOOLS_EXCLUSION_REASON as t, mergeProfileEntries as tt, EMPTY_USER_PROFILE as u, readProfileEntries as ut, FullDisclosureRouter as v, scriptToolName as vt, READ_SKILL_FILE_TOOL as w, validateUiSpecNode as wt, OpenAiCompatibleClient as x, toRecordDigests as xt, GoogleGenAiClient as y, summarizeToolCalls as yt, bridgeError as z };
+export { fromVercelStreamPart as $, SerializingMemoryStore as A, bridgeError as B, ProgressiveRouter as C, sealToolCallPairs as Ct, RUN_SNAPSHOT_SCHEMA_VERSION as D, toVercelToolSpecs as Dt, READ_SKILL_FILE_TOOL_NAME as E, toRecordDigests as Et, USER_PROFILE_PROMPT_HEADER as F, exportUserProfile as G, createScriptContext as H, USER_PROFILE_REFINE_PROMPT as I, extractTodoTraceEvents as J, extractChartSpec as K, WebSkillRuntime as L, USER_PROFILE_EXPORT_VERSION as M, USER_PROFILE_KEY as N, RUN_TRACE_SCHEMA_VERSION as O, validateUiSpecEvent as Ot, USER_PROFILE_NO_INVENTION_RULE as P, fromVercelResult as Q, appendBehaviorRecords as R, OpenAiCompatibleClient as S, scriptToolName as St, READ_SKILL_FILE_TOOL as T, toLlmToolSpec as Tt, createWebSkillApi as U, buildRenderResult as V, diffUserProfile as W, findUnpairedToolCalls as X, extractUiSpecEvents as Y, formatSkillScriptManifest as Z, FsRunTraceStore as _, renderUserProfileContext as _t, AgentLoop as a, mergeProfileEntries as at, GoogleGenAiClient as b, schemaSourceLabel as bt, CapabilityApproval as c, normalizeErrorCode as ct, EMPTY_USER_PROFILE as d, parseBridgeRequest as dt, interruptedToolResult as et, EventBus as f, parseUserProfileExport as ft, FsRunSnapshotStore as g, refineUserProfile as gt, FsMemoryStore as h, readUserProfile as ht, ASK_USER_TOOL_NAME as i, mergeCatalogEntries as it, TraceRecorder as j, SESSION_SCHEMA_VERSION as k, validateUiSpecNode as kt, DEFAULT_LOOP_LIMITS as l, normalizeToolContent as lt, FsArtifactStore as m, readProfileEntries as mt, ASK_USER_INPUT_SCHEMA as n, isUnsupportedRunSnapshot as nt, AnthropicClient as o, networkPolicyLibSource as ot, FS_SESSION_PAGE_SIZE as p, readBehaviorRecords as pt, extractSkillCandidate as q, ASK_USER_TOOL as r, listSkillScripts as rt, BEHAVIOR_RECORDS_KEY as s, networkUrlHost as st, ALLOWED_TOOLS_EXCLUSION_REASON as t, isNetworkAllowed as tt, DEFAULT_USER_PROFILE_LIMITS as u, normalizeToolError as ut, FsSessionStore as v, resolveToolName as vt, READ_SKILL_FILE_INPUT_SCHEMA as w, summarizeToolCalls as wt, HookRunner as x, schemaToForm as xt, FullDisclosureRouter as y, sampleBehaviorRecords as yt, applyUserProfileImport as z };