openworkgraph 0.2.12 → 0.3.0

package/dist/runtime-backend.js

@@ -29,13 +29,15 @@ export class RuntimeBackend {
     dirs;
     adapter;
     probe;
+    skillSessions;
     contexts = new Map();
     runContexts;
-    constructor(runs, dirs, adapter, probe = new ProjectProbe()) {
+    constructor(runs, dirs, adapter, probe = new ProjectProbe(), skillSessions) {
         this.runs = runs;
         this.dirs = dirs;
         this.adapter = adapter;
         this.probe = probe;
+        this.skillSessions = skillSessions;
         this.runContexts = new RunContexts(runs, dirs);
     }
     snapshot(snapshot, context, expectedRunId) {
@@ -83,6 +85,11 @@ export class RuntimeBackend {
         let inputFiles;
         let upstreamContext;
         try {
+            if (snapshot.skills?.length) {
+                if (!this.skillSessions)
+                    throw new ServiceError('INPUT_BLOCKED', '冻结技能上下文不可用。');
+                await this.skillSessions.environment(snapshot.skills, true);
+            }
             if (runtime.details.kind === 'execution')
                 upstreamContext = this.runContexts.lineage(run.id);
             const inspect = await this.probe.inspect([path]);
@@ -144,7 +151,7 @@ export class RuntimeBackend {
             context.emit({ type: 'stopped' });
             return;
         }
-        const result = await this.adapter.start({ runId: run.id, kind: runtime.details.kind, projectPath: path, inputPath: directories.input, outputPath: directories.output, serviceRoot: this.dirs.root, prompt: snapshot.prompt, resources: snapshot.resources, projectFiles: snapshot.projectFiles ?? [], files: inputFiles, model: snapshot.model, ...(upstreamContext ? { upstreamContext } : {}), ...(snapshot.imageRoute?.type === 'codex' && snapshot.imageRoute.options ? { imageOptions: snapshot.imageRoute.options } : {}), sandboxMode: sandboxMode(runtime.details.sandboxMode ?? 'read-only') }, {
+        const result = await this.adapter.start({ runId: run.id, kind: runtime.details.kind, projectPath: path, inputPath: directories.input, outputPath: directories.output, serviceRoot: this.dirs.root, prompt: snapshot.prompt, resources: snapshot.resources, projectFiles: snapshot.projectFiles ?? [], files: inputFiles, model: snapshot.model, skills: snapshot.skills ?? [], ...(upstreamContext ? { upstreamContext } : {}), ...(snapshot.imageRoute?.type === 'codex' && snapshot.imageRoute.options ? { imageOptions: snapshot.imageRoute.options } : {}), sandboxMode: sandboxMode(runtime.details.sandboxMode ?? 'read-only') }, {
             onSnapshot: value => this.snapshot(value, context, run.id),
             onInteraction: value => {
                 if (!this.runs.db.prepare('SELECT 1 FROM runs WHERE id=?').get(run.id))
@@ -160,6 +167,8 @@ export class RuntimeBackend {
             },
             queryHistory: async (query) => this.queryHistory(run.id, query),
             readRunContext: async (request) => this.runContexts.read(run.id, request),
+            ...(this.skillSessions ? { skillEnvironment: async (skillId) => this.skillSessions.forSkill(snapshot.skills ?? [], skillId) } : {}),
+            ...(this.skillSessions ? { withSkillEnvironment: (skillId, dispatch) => this.skillSessions.withEnvironment(snapshot.skills ?? [], skillId, dispatch) } : {}),
         });
         this.snapshot(result, context, run.id);
     }

package/dist/runtime.d.ts

@@ -17,12 +17,16 @@ import type { DataDirectories } from './directories.js';
 import { ExecutionSettingsStore } from './execution-settings.js';
 import { ImageProviders } from './image-providers.js';
 import { ImageCredentials } from './image-credentials.js';
+import { BuiltinSkills, type BuiltinSkillsOptions } from './builtin-skills.js';
+import { SkillConfigs } from './skill-configs.js';
+import { SkillSessions } from './skill-sessions.js';
 export interface WorkflowRuntimeOptions {
     backend?: SchedulerBackend;
     models?: BackendModel[];
     /** Default: discover on model reads/submission. True also probes at startup; false disables execution and discovery. */
     enableBackend?: boolean;
     backendOptions?: AdapterOptions;
+    skillsOptions?: BuiltinSkillsOptions;
 }
 export declare class WorkflowRuntime {
     readonly db: DatabaseSync;
@@ -44,6 +48,9 @@ export declare class WorkflowRuntime {
     readonly executionSettings: ExecutionSettingsStore;
     readonly imageProviders: ImageProviders;
     readonly imageCredentials: ImageCredentials;
+    readonly skills: BuiltinSkills;
+    readonly skillConfigs: SkillConfigs;
+    readonly skillSessions: SkillSessions;
     private readonly probe;
     private readonly adapter;
     private availableModels;

package/dist/runtime.js

@@ -29,6 +29,9 @@ import { ImageProviders } from './image-providers.js';
 import { ImageCredentials } from './image-credentials.js';
 import { ApiImageAgent, RoutedImageBackend } from './api-image-agent.js';
 import { planOpenAiImage, discoverOpenAiModels } from './openai-image-driver.js';
+import { BuiltinSkills } from './builtin-skills.js';
+import { SkillConfigs } from './skill-configs.js';
+import { SkillSessions } from './skill-sessions.js';
 class RuntimeRuns extends Runs {
     available;
     constructor(db, serviceId, dependencies, available) {
@@ -62,6 +65,9 @@ export class WorkflowRuntime {
     executionSettings;
     imageProviders;
     imageCredentials;
+    skills;
+    skillConfigs;
+    skillSessions;
     probe = new ProjectProbe();
     adapter;
     availableModels;
@@ -88,6 +94,9 @@ export class WorkflowRuntime {
         this.executionSettings = new ExecutionSettingsStore(db);
         this.imageCredentials = new ImageCredentials(directories, serviceId);
         this.imageProviders = new ImageProviders(db, this.imageCredentials);
+        this.skills = new BuiltinSkills(directories, serviceId, options.skillsOptions);
+        this.skillConfigs = new SkillConfigs(directories, serviceId);
+        this.skillSessions = new SkillSessions(this.skills, this.skillConfigs, options.backendOptions);
         this.inputs = new InputPreparation(db, { plugins: this.plugins, readRepresentation: resource => this.resources.readPreparedRepresentation(resource) });
         this.models = new ModelDefaultsStore(db);
         this.runs = new RuntimeRuns(db, serviceId, { freeze: () => { throw new ServiceError('INPUT_BLOCKED', 'Use prepareSubmission outside the auth transaction'); }, ...(!options.backend ? { validateReply: (interaction, answer) => { backendReply(interaction, answer); } } : {}) }, (_run, snapshot) => snapshot.imageRoute?.type === 'api'
@@ -97,7 +106,7 @@ export class WorkflowRuntime {
         this.publication = new Publication(db, directories, this.resources, this.graphs, this.runs);
         this.executionChains = new ExecutionChains(this.runs, this.graphs, this.resources);
         this.adapter = options.backend ? undefined : new CodexBackendAdapter(options.backendOptions);
-        const codexBackend = options.backend ?? new RuntimeBackend(this.runs, directories, this.adapter, this.probe);
+        const codexBackend = options.backend ?? new RuntimeBackend(this.runs, directories, this.adapter, this.probe, this.skillSessions);
         const backend = new RoutedImageBackend(codexBackend, new ApiImageAgent(this.runs, this.resources, this.imageProviders, this.imageCredentials, directories), this.runs);
         this.scheduler = new Scheduler(this.runs, backend, { publish: (run, token) => this.publication.publish(run, token), acquireProjectLock: (_run, path) => acquireProjectLock(path) });
     }
@@ -320,6 +329,11 @@ export class WorkflowRuntime {
         }
         const scopedInputs = new InputPreparation(this.db, { plugins: this.plugins, readRepresentation: resource => prepared.get(resourceKey(resource)) ?? null });
         const scopedPreview = scopedInputs.inputPreview(request.graphId, request.nodeId, !!apiRoute);
+        const targetContent = this.db.prepare('SELECT v.content FROM nodes n JOIN node_versions v ON v.node_id=n.id AND v.version=n.current_version WHERE n.id=? AND n.graph_id=?').get(request.nodeId, request.graphId);
+        const skillReferences = targetContent ? JSON.parse(String(targetContent.content)).skillReferences : undefined;
+        if (apiRoute && Array.isArray(skillReferences) && skillReferences.length)
+            throw new ServiceError('INPUT_BLOCKED', '独立图片 API 不支持技能引用，请切换到 Codex 或移除技能引用。');
+        const frozenSkills = apiRoute ? [] : await this.skillSessions.freeze(scopedPreview.prompt, skillReferences, path);
         if (apiRoute) {
             const references = [];
             for (const envelope of scopedPreview.resources) {
@@ -357,7 +371,7 @@ export class WorkflowRuntime {
             },
             freeze: () => scopedInputs.build(request.graphId, request.nodeId, apiRoute
                 ? { expectedExecutionRevision: request.expectedExecutionRevision, imageRoute: apiRoute }
-                : { expectedExecutionRevision: request.expectedExecutionRevision, model: this.models.freeze(request.modelOverride, this.availableModels), ...(request.kind === 'image_generation' ? { imageRoute: request.imageRoute?.type === 'codex' ? request.imageRoute : { type: 'codex' } } : {}) }),
+                : { expectedExecutionRevision: request.expectedExecutionRevision, model: this.models.freeze(request.modelOverride, this.availableModels), skills: frozenSkills, ...(request.kind === 'image_generation' ? { imageRoute: request.imageRoute?.type === 'codex' ? request.imageRoute : { type: 'codex' } } : {}) }),
         });
         return principal => scoped.submit(request, principal, request.kind === 'execution' && holdExecution);
     }
@@ -380,6 +394,7 @@ export class WorkflowRuntime {
         else {
             this.requireAvailable({ kind: token.details.kind });
             await this.refreshModels();
+            await this.skillSessions.environment(snapshot.skills ?? [], true);
         }
         const project = this.db.prepare('SELECT state,canonical_path FROM projects WHERE id=?').get(run.projectId);
         if (!project || project.state !== 'active')

package/dist/service.js

@@ -136,14 +136,15 @@ export function createService(dataDir, options = {}) {
             const rawPath = request.url ?? "";
             const fileRoute = /^[/]v1[/]projects[/][a-zA-Z0-9_-]+[/]files(?:[/](?:search|content|link-content|media|thumbnail|stat))?(?:[?]|$)/.test(rawPath);
             const skillsRoute = /^[/]v1[/]projects[/][a-zA-Z0-9_-]+[/]skills[/]search(?:[?]|$)/.test(rawPath);
+            const skillsManagementRoute = /^[/]v1[/]skills(?:[/][^/?#]+(?:[/](?:install|update|uninstall|config|files))?)?(?:[?]|$)/.test(rawPath);
             const mediaRoute = /^[/]v1[/]projects[/][a-zA-Z0-9_-]+[/](?:assets[/][a-zA-Z0-9_-]+[/]versions[/][1-9][0-9]*|graphs[/][a-zA-Z0-9_-]+[/]resources[/][a-zA-Z0-9_-]+[/]versions[/][1-9][0-9]*)[/](?:thumbnail|preview|content)(?:[?]|$)/.test(rawPath);
-            const queryRoute = fileRoute || skillsRoute || mediaRoute;
+            const queryRoute = fileRoute || skillsRoute || skillsManagementRoute || mediaRoute;
             const path = queryRoute ? rawPath.split('?')[0] : rawPath;
             if (!path.startsWith("/") ||
                 path.startsWith("//") ||
                 (!queryRoute && path.includes("?")) ||
                 path.includes("#") ||
-                path.includes("%") ||
+                (!skillsManagementRoute && path.includes("%")) ||
                 path.includes("\\"))
                 throw new ServiceError("INVALID_REQUEST", "请使用标准 API 路径；凭据只能放在 Authorization 请求头，不能放入 URL。");
             if (queryRoute && (rawPath.includes('#') || rawPath.length > 8192 || rawPath.split('?').length > 2))
@@ -170,11 +171,12 @@ export function createService(dataDir, options = {}) {
                     .split(",")
                     .map((value) => value.trim())
                     .filter(Boolean);
+                const allowedMethods = /^[/]v1[/]skills[/][^/]+[/]config$/.test(path) ? ["GET", "POST", "PUT", "DELETE"] : ["GET", "POST", "DELETE"];
                 if (typeof method !== "string" ||
-                    !["GET", "POST", "DELETE"].includes(method) ||
+                    !allowedMethods.includes(method) ||
                     headers.some((header) => !CORS_HEADERS.includes(header)))
                     throw new ServiceError("ORIGIN_DENIED", "不允许的跨来源方法或请求头。");
-                response.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE");
+                response.setHeader("Access-Control-Allow-Methods", allowedMethods.join(", "));
                 response.setHeader("Access-Control-Allow-Headers", CORS_HEADERS.join(", "));
                 response.setHeader("Access-Control-Max-Age", "300");
                 response.writeHead(204);
@@ -288,7 +290,7 @@ export function createService(dataDir, options = {}) {
                 events.stream(request, response, token, origin);
                 return;
             }
-            const business = await api.handle(request, fileRoute || skillsRoute ? rawPath : path, token, origin);
+            const business = await api.handle(request, fileRoute || skillsRoute || skillsManagementRoute ? rawPath : path, token, origin);
             if (business.handled) {
                 const body = auth.withSession(token, origin, (current) => business.binary ?? (business.binaryParts ? undefined : events.decorate(business.body, current.id)));
                 if (business.status)

package/dist/skill-configs.d.ts

@@ -0,0 +1,43 @@
+import type { SkillConfigSchema, SkillConfiguration, SkillConfigurationWrite } from "./vendor/protocol/index.js";
+import type { DataDirectories } from './directories.js';
+/** Omit schema to validate an automatic skill without loading its env/defaults. */
+export interface SkillConfigRevisionRequest {
+    skillId: string;
+    revision: number;
+    schema?: SkillConfigSchema;
+}
+/** Workspace-private, immutable revisions. Uninstall deliberately does not call clear. */
+export declare class SkillConfigs {
+    private readonly directories;
+    private readonly serviceId;
+    private sid;
+    constructor(directories: DataDirectories, serviceId: string);
+    private windowsSid;
+    private windowsAcl;
+    private directory;
+    private locked;
+    private claim;
+    private owner;
+    private dead;
+    private recover;
+    private load;
+    private manifest;
+    private removeRevoked;
+    private snapshot;
+    private atomic;
+    private effective;
+    private view;
+    read(skillId: string, schema: SkillConfigSchema): Promise<SkillConfiguration>;
+    write(skillId: string, schema: SkillConfigSchema, body: SkillConfigurationWrite): Promise<SkillConfiguration>;
+    clear(skillId: string, expectedRevision: number): Promise<SkillConfiguration>;
+    revision(skillId: string): Promise<number>;
+    hasRevision(skillId: string, revision: number): Promise<boolean>;
+    environment(skillId: string, schema: SkillConfigSchema, revision: number): Promise<Record<string, string>>;
+    private snapshotEnvironment;
+    /** Deterministic multi-skill locking prevents clear between the final revision
+     * check, secret read, and synchronous spawn/request. No nested public store
+     * methods may be awaited inside dispatch. Never await a returned command. */
+    withRevisions<T>(requests: readonly SkillConfigRevisionRequest[], dispatch: (environments: ReadonlyMap<string, Record<string, string>>) => T): Promise<{
+        value: T;
+    }>;
+}