cli-blueprint 7.0.39 → 7.0.41

package/broker-account-storage.mjs

@@ -13,6 +13,18 @@ const ACL_SID_ALIASES = Object.freeze({ SY: SYSTEM_SID, WD: 'S-1-1-0', BA: 'S-1-
   BU: 'S-1-5-32-545', AU: 'S-1-5-11', CO: 'S-1-3-0', CG: 'S-1-3-1', AN: 'S-1-5-7' })
 const SID_PATTERN = /^S-1-(?:[0-9]+-)*[0-9]+$/
 const ACL_TIMEOUT_MS = 15_000
+const WINDOWS_SYSTEM_EXECUTABLES = new Set(['whoami.exe', 'icacls.exe', 'where.exe'])
+
+export function windowsSystemExecutable(name, environment = process.env) {
+  if (!WINDOWS_SYSTEM_EXECUTABLES.has(name)) throw new Error('Unsupported Windows system executable')
+  const root = environment.SystemRoot
+  if (typeof root !== 'string' || !/^[A-Za-z]:[\\/]/.test(root)
+    || /[\u0000-\u001f"<>|?*]/.test(root) || root.slice(2).includes(':')
+    || root.split(/[\\/]/).includes('..')) {
+    throw new Error('SystemRoot must identify an absolute Windows installation directory')
+  }
+  return win32.join(root, 'System32', name)
+}
 
 export function currentAccountHome() {
   const home = userInfo().homedir
@@ -69,17 +81,19 @@ export function assertRestrictedWindowsAcl(text, ownerSid) {
   if (expected.size) throw new Error('Windows account ACL is missing the user or SYSTEM')
 }
 
-async function windowsOwnerSid(run) {
-  const result = await run('whoami.exe', ['/user', '/fo', 'csv', '/nh'], { windowsHide: true, timeout: ACL_TIMEOUT_MS })
+async function windowsOwnerSid(run, environment) {
+  const result = await run(windowsSystemExecutable('whoami.exe', environment), ['/user', '/fo', 'csv', '/nh'],
+    { shell: false, windowsHide: true, timeout: ACL_TIMEOUT_MS })
   const candidates = result.stdout.match(/S-1-(?:[0-9]+-)*[0-9]+/g)
   if (candidates === null || candidates.length !== 1 || !SID_PATTERN.test(candidates[0])) throw new Error('Current Windows account SID could not be verified')
   return candidates[0]
 }
 
-async function readWindowsAcl(path, run) {
+async function readWindowsAcl(path, run, environment) {
   const temporary = join(dirname(path), '.acl-' + randomUUID() + '.txt')
   try {
-    await run('icacls.exe', [path, '/save', temporary, '/q'], { windowsHide: true, timeout: ACL_TIMEOUT_MS })
+    await run(windowsSystemExecutable('icacls.exe', environment), [path, '/save', temporary, '/q'],
+      { shell: false, windowsHide: true, timeout: ACL_TIMEOUT_MS })
     return aclText(await readFile(temporary))
   } finally {
     try { await rm(temporary) } catch (error) { if (error.code !== 'ENOENT') throw error }
@@ -88,19 +102,21 @@ async function readWindowsAcl(path, run) {
 
 async function protectWindowsPath(path, directory, dependencies) {
   const run = dependencies.execFile === undefined ? runFile : dependencies.execFile
-  const owner = await windowsOwnerSid(run)
+  const environment = dependencies.environment === undefined ? process.env : dependencies.environment
+  const owner = await windowsOwnerSid(run, environment)
   const flags = directory ? '(OI)(CI)F' : 'F'
-  await run('icacls.exe', [path, '/inheritance:r', '/grant:r', '*' + owner + ':' + flags,
-    '*' + SYSTEM_SID + ':' + flags], { windowsHide: true, timeout: ACL_TIMEOUT_MS })
-  const { entries } = windowsAclEntries(await readWindowsAcl(path, run))
+  const icacls = windowsSystemExecutable('icacls.exe', environment)
+  await run(icacls, [path, '/inheritance:r', '/grant:r', '*' + owner + ':' + flags,
+    '*' + SYSTEM_SID + ':' + flags], { shell: false, windowsHide: true, timeout: ACL_TIMEOUT_MS })
+  const { entries } = windowsAclEntries(await readWindowsAcl(path, run, environment))
   for (const entry of entries) {
     const sid = Object.hasOwn(ACL_SID_ALIASES, entry.sid) ? ACL_SID_ALIASES[entry.sid] : entry.sid
     if (entry.type === 'A' && [owner, SYSTEM_SID].includes(sid)) continue
     if (!SID_PATTERN.test(sid)) throw new Error('Unexpected Windows ACL trustee')
-    await run('icacls.exe', [path, entry.type === 'D' ? '/remove:d' : '/remove:g', '*' + sid],
-      { windowsHide: true, timeout: ACL_TIMEOUT_MS })
+    await run(icacls, [path, entry.type === 'D' ? '/remove:d' : '/remove:g', '*' + sid],
+      { shell: false, windowsHide: true, timeout: ACL_TIMEOUT_MS })
   }
-  assertRestrictedWindowsAcl(await readWindowsAcl(path, run), owner)
+  assertRestrictedWindowsAcl(await readWindowsAcl(path, run, environment), owner)
 }
 
 export async function protectAccountPath(path, directory, dependencies = {}) {
@@ -130,6 +146,7 @@ export async function verifyAccountPath(path, dependencies = {}) {
     return
   }
   const run = dependencies.execFile === undefined ? runFile : dependencies.execFile
-  const owner = await windowsOwnerSid(run)
-  assertRestrictedWindowsAcl(await readWindowsAcl(path, run), owner)
+  const environment = dependencies.environment === undefined ? process.env : dependencies.environment
+  const owner = await windowsOwnerSid(run, environment)
+  assertRestrictedWindowsAcl(await readWindowsAcl(path, run, environment), owner)
 }

package/official-skill-update.mjs

@@ -3,7 +3,7 @@ import { execFile, spawn } from 'node:child_process'
 import { promisify } from 'node:util'
 import { lstat, mkdtemp, readFile, rename, rm } from 'node:fs/promises'
 import { join, win32 } from 'node:path'
-import { assertAccountAncestors, currentAccountHome, ensureAccountDirectory } from './broker-account-storage.mjs'
+import { assertAccountAncestors, currentAccountHome, ensureAccountDirectory, windowsSystemExecutable } from './broker-account-storage.mjs'
 import { pathToFileURL } from 'node:url'
 import { accountBrokerDirectory } from './broker-credentials.mjs'
 import { createBrokerTransport } from './broker-transport.mjs'
@@ -70,7 +70,8 @@ export function windowsNpmEntry(output) {
 
 async function npmInvocation(environment) {
   if (process.platform !== 'win32') return { executable: 'npm', args: [] }
-  const found = await runFile('where.exe', ['npm'], { env: environment, windowsHide: true, timeout: LOOKUP_TIMEOUT_MS })
+  const found = await runFile(windowsSystemExecutable('where.exe', environment), ['npm'],
+    { env: environment, shell: false, windowsHide: true, timeout: LOOKUP_TIMEOUT_MS })
   const entry = windowsNpmEntry(found.stdout)
   for (const path of [entry.command, entry.script]) {
     await assertAccountAncestors(win32.dirname(path), 'win32')

package/package.json

@@ -29,5 +29,5 @@
     "url": "https://github.com/88208555/blueprint-clitax.git"
   },
   "type": "module",
-  "version": "7.0.39"
+  "version": "7.0.41"
 }

package/skill/SKILL.md

@@ -5,7 +5,7 @@ description: '把一个目标编译为可执行、可验证、可追溯的工程
 
 # Blueprint Skill
 
-Package version: v7.0.39
+Package version: v7.0.41
 
 远端 Hermes 编译器版本：0.4.0（独立于 npm 包版本）
 
@@ -253,8 +253,7 @@ After `capabilities`, read `officialCatalog`. Default allowlist is official skil
 | B3 | 业务模板库与粗粒度模式 | 规划中 | 当前没有模板操作，`template` 与 `coarseMode` 均不是受支持输入。 |
 | B4 | 验收回传、开放问题闭环、Validator 桥接 | 部分实现 | `acceptance-report` 已逐项核对共享 TestEvidence；`answer-questions` 与自动调用 Validator 仍未实现。 |
 
-只调用 `capabilities` 返回的六个操作。不要根据规划中条目构造请求，也不要把 npm 包版本 `v7.0.39` 与远端 Hermes 编译器版本 `0.4.0` 混为一谈。
-
+只调用 `capabilities` 返回的六个操作。不要根据规划中条目构造请求，也不要把 npm 包版本 `v7.0.41` 与远端 Hermes 编译器版本 `0.4.0` 混为一谈。
 
 ## 机器任务与验收回传
 
@@ -323,13 +322,13 @@ After `capabilities`, read `officialCatalog`. Default allowlist is official skil
 3. 自报、回复送达和动作完成不等于工程交付验证。reported始终待验收；Swarm接受工程任务时复用Validator校验签名、有效期、计划/产物/任务绑定。无证据、伪造runner或失败检查不得成为绿色完成。
 4. 原任务交接前保存检查点并释放旧锁；回程只发持久通知，宿主消费后重新核验基线、快照与写入权限。历史恢复结果不是新授权。技能不能自行唤醒未接入的IDE。
 5. 心跳停止仅允许自动回收尚未开工的assigned任务；claimed/running进入执行结果待核对状态，禁止盲目重复执行。已回传、已验收、失败和取消任务不会被自动重派。服务器停滞回收同时保存会员通知，对话界面定期读取展示。
-6. 预计长任务在预算初始化后、深读前提出一次精确自动续时策略；只有真实授权才自动续时。时间、文件数、token和写入权限分别计量；额度/次数耗尽、撤销和完成必须明确停止并说明下一步。读取预算不是付费充值，计时器由宿主运行。
-7. 云端沙箱开关按调用会员读取；关闭时仅允许当前受审官方源码摘要在受控worker中直接执行，并记录executionIsolation。未知或修改过的源码明确要求sandbox，不伪造隔离结果；worker直接执行不是OS沙箱。
+6. 读取预算、截止和续时确认仅在云端沙箱已开启且本任务实际使用 sandbox 时生效。纯本地或权威响应确认的非沙箱执行，在已授权目标和范围内自动持续，不因旧预算过期、文件数或token额度暂停，也不生成扩展或续时确认；宿主可保留budget-read审计。远端状态未知时只读查询原调用，不推定关闭，不要求扩预算；纯本地无需查询云端。仅实际沙箱内预计长任务在预算初始化后、深读前提出一次精确自动续时策略，真实授权后才自动续时；时间、文件数、token和写入权限分别计量，额度/次数耗尽、撤销和完成保留明确停止规则。读取预算不是付费充值，续时由宿主在读取时触发。
+7. 云端沙箱开关按调用会员读取；关闭时仅允许当前受审官方源码摘要在受控worker中直接执行，并记录executionIsolation。预算上下文取同一任务成功runtime响应顶层executionContext，包含cloudSandboxEnabled与executionIsolation；仅true且sandbox启用预算，不用模型自报、调用方参数或旧截图代替真实执行状态。纯本地显式使用{executionIsolation:"local"}；已有预算通过budget-context绑定或更新实际环境，保留原用量、期限和授权。未知或修改过的源码明确要求sandbox，不伪造隔离结果；worker直接执行不是OS沙箱。
 8. 使用技能前检查官方发布版本并自动升级可管理的安装副本与客户端；配置失败或升级失败停止并报告。通过configure的JSON标准输入导入一次账号凭据，后续项目/分支/任务共享；密钥不进入源码、URL或命令参数。显式环境覆盖必须是绝对路径。网页复制在点击时获取当前凭据，页面仅展示无密钥地址；已撤销密钥没有权限自动获取新密钥，需已认证网页重新同步一次。
 
-English: keep simple work with the main agent. Delegate only substantial independent business deliverables when benefits exceed coordination costs; use the fewest needed agents, never create idle management agents. Enabling Aimlock does not authorize delegation. Finish all authorized work; a cost complaint is not a stop request. Preserve the original goal; verify execution evidence; resume from durable checkpoints; never replay uncertain side effects. Read-time renewal requires bounded approval. Reuse account credentials and check managed skill updates before use; revoked credentials require an authenticated refresh.
+English: keep simple work with the main agent. Delegate only substantial independent business deliverables when benefits exceed coordination costs; use the fewest needed agents, never create idle management agents. Enabling Aimlock does not authorize delegation. Finish all authorized work; a cost complaint is not a stop request. Preserve the original goal; verify execution evidence; resume from durable checkpoints; never replay uncertain side effects. Read budgets and bounded renewal approvals apply only when cloud sandboxing is enabled and actually used for this task. Local or confirmed non-sandbox work continues within its authorized scope without budget prompts; unknown remote state requires a read-only query, never an assumed opt-out or an extension request. Reuse account credentials and check managed skill updates before use; revoked credentials require an authenticated refresh.
 
-Русский: сохраняйте исходную цель, проверяйте доказательства выполнения и возобновляйте работу из сохранённой точки. Не повторяйте операции с неизвестным результатом. Продление чтения требует ограниченного разрешения; ключи учётной записи используются повторно, обновления навыков проверяются перед вызовом.
+Русский: сохраняйте исходную цель, проверяйте доказательства выполнения и возобновляйте работу из сохранённой точки. Не повторяйте операции с неизвестным результатом. Бюджет чтения и ограниченное разрешение на продление действуют только при включённой облачной песочнице, фактически используемой этой задачей. Локальная работа и подтверждённое выполнение без песочницы продолжаются в разрешённых пределах без запросов бюджета; неизвестное удалённое состояние требует запроса только для чтения, а не предположения об отключении или запроса расширения. Ключи учётной записи используются повторно, обновления навыков проверяются перед вызовом.
 
 ## 账号共享凭据与自动更新
 

package/skill/skill.json

@@ -6,5 +6,5 @@
   "name": "blueprint",
   "schemaVersion": "blueprint.skill.request/1.0",
   "type": "Skill",
-  "version": "v7.0.39"
+  "version": "v7.0.41"
 }