@cjhyy/code-shell-core 0.8.8 → 0.8.10

package/dist/plugins/pluginHookApproval.js

@@ -1,4 +1,4 @@
-import { readInstalledPlugins, writeInstalledPlugins } from "./installedPlugins.js";
+import { mutateInstalledPlugins, readInstalledPlugins } from "./installedPlugins.js";
 import { inspectPluginHooks, pluginHookReviewSnapshot, pluginHookApprovalState, } from "./pluginHookIntegrity.js";
 function pluginNameFromKey(key) {
     const at = key.lastIndexOf("@");
@@ -86,75 +86,71 @@ export function reviewPluginHooks(target) {
 }
 /** Approve the exact install-time digest; changed-on-disk hooks cannot be blessed. */
 export function approvePluginHooks(target) {
-    const data = readInstalledPlugins();
-    const keys = matchingInstallKeys(data, target);
-    const out = [];
-    let writeNeeded = false;
-    for (const installKey of keys) {
-        for (const entry of data.plugins[installKey] ?? []) {
-            let entryChanged = false;
-            const snapshot = inspectPluginHooks(entry.installPath);
-            if (snapshot.state === "invalid") {
-                throw new Error(`plugin "${installKey}" hooks definition is invalid and cannot be approved: ${snapshot.error ?? "unknown error"}`);
-            }
-            if (entry.hookDigest && snapshot.digest !== entry.hookDigest) {
-                throw new Error(`plugin "${installKey}" hooks changed after install; reinstall or update before approving`);
-            }
-            if (!entry.hookDigest) {
-                entry.hookDigest = snapshot.digest;
-                entryChanged = true;
-                writeNeeded = true;
-            }
-            if (entry.approvedHookDigest !== entry.hookDigest) {
-                entry.approvedHookDigest = entry.hookDigest;
-                entryChanged = true;
-                writeNeeded = true;
-            }
-            const nextReview = pluginHookReviewSnapshot(snapshot);
-            if (JSON.stringify(entry.approvedHookSnapshot) !== JSON.stringify(nextReview)) {
-                entry.approvedHookSnapshot = nextReview;
-                entryChanged = true;
-                writeNeeded = true;
+    return (mutateInstalledPlugins((data) => {
+        const keys = matchingInstallKeys(data, target);
+        const out = [];
+        let writeNeeded = false;
+        for (const installKey of keys) {
+            for (const entry of data.plugins[installKey] ?? []) {
+                let entryChanged = false;
+                const snapshot = inspectPluginHooks(entry.installPath);
+                if (snapshot.state === "invalid") {
+                    throw new Error(`plugin "${installKey}" hooks definition is invalid and cannot be approved: ${snapshot.error ?? "unknown error"}`);
+                }
+                if (entry.hookDigest && snapshot.digest !== entry.hookDigest) {
+                    throw new Error(`plugin "${installKey}" hooks changed after install; reinstall or update before approving`);
+                }
+                if (!entry.hookDigest) {
+                    entry.hookDigest = snapshot.digest;
+                    entryChanged = true;
+                }
+                if (entry.approvedHookDigest !== entry.hookDigest) {
+                    entry.approvedHookDigest = entry.hookDigest;
+                    entryChanged = true;
+                }
+                const nextReview = pluginHookReviewSnapshot(snapshot);
+                if (JSON.stringify(entry.approvedHookSnapshot) !== JSON.stringify(nextReview)) {
+                    entry.approvedHookSnapshot = nextReview;
+                    entryChanged = true;
+                }
+                writeNeeded ||= entryChanged;
+                out.push(result(installKey, entry, entryChanged, snapshot));
             }
-            out.push(result(installKey, entry, entryChanged, snapshot));
         }
-    }
-    if (writeNeeded)
-        writeInstalledPlugins(data);
-    return out;
+        return { ...(writeNeeded ? { value: data } : {}), result: out };
+    }) ?? []);
 }
 /**
  * Revoke hook execution. Legacy entries are first migrated to a recorded
  * digest so revocation fails closed instead of falling back to legacy trust.
  */
 export function revokePluginHooks(target) {
-    const data = readInstalledPlugins();
-    const keys = matchingInstallKeys(data, target);
-    const out = [];
-    let writeNeeded = false;
-    for (const installKey of keys) {
-        for (const entry of data.plugins[installKey] ?? []) {
-            let entryChanged = false;
-            const snapshot = inspectPluginHooks(entry.installPath);
-            if (!entry.hookDigest) {
-                entry.hookDigest = snapshot.digest;
-                entryChanged = true;
-            }
-            if (snapshot.hasExecutableHooks || snapshot.state === "invalid") {
-                if (entry.approvedHookDigest !== undefined) {
-                    delete entry.approvedHookDigest;
+    return (mutateInstalledPlugins((data) => {
+        const keys = matchingInstallKeys(data, target);
+        const out = [];
+        let writeNeeded = false;
+        for (const installKey of keys) {
+            for (const entry of data.plugins[installKey] ?? []) {
+                let entryChanged = false;
+                const snapshot = inspectPluginHooks(entry.installPath);
+                if (!entry.hookDigest) {
+                    entry.hookDigest = snapshot.digest;
                     entryChanged = true;
                 }
+                if (snapshot.hasExecutableHooks || snapshot.state === "invalid") {
+                    if (entry.approvedHookDigest !== undefined) {
+                        delete entry.approvedHookDigest;
+                        entryChanged = true;
+                    }
+                }
+                else if (entry.approvedHookDigest !== entry.hookDigest) {
+                    entry.approvedHookDigest = entry.hookDigest;
+                    entryChanged = true;
+                }
+                writeNeeded ||= entryChanged;
+                out.push(result(installKey, entry, entryChanged, snapshot));
             }
-            else if (entry.approvedHookDigest !== entry.hookDigest) {
-                entry.approvedHookDigest = entry.hookDigest;
-                entryChanged = true;
-            }
-            writeNeeded ||= entryChanged;
-            out.push(result(installKey, entry, entryChanged, snapshot));
         }
-    }
-    if (writeNeeded)
-        writeInstalledPlugins(data);
-    return out;
+        return { ...(writeNeeded ? { value: data } : {}), result: out };
+    }) ?? []);
 }

package/dist/plugins/pluginMcpApproval.js

@@ -1,4 +1,4 @@
-import { readInstalledPlugins, writeInstalledPlugins } from "./installedPlugins.js";
+import { mutateInstalledPlugins, readInstalledPlugins } from "./installedPlugins.js";
 import { readPluginMcp } from "./installer/loadPluginMcp.js";
 import { pluginMcpApprovalState, pluginMcpDigest, } from "./pluginMcpIntegrity.js";
 function pluginNameFromKey(key) {
@@ -44,67 +44,65 @@ export function listPluginMcpTrust() {
 }
 /** Approve only the install-time MCP bytes; tampered bytes require update/reinstall. */
 export function approvePluginMcp(target) {
-    const data = readInstalledPlugins();
-    const keys = matchingInstallKeys(data, target);
-    const out = [];
-    let writeNeeded = false;
-    for (const installKey of keys) {
-        for (const entry of data.plugins[installKey] ?? []) {
-            let entryChanged = false;
-            const currentDigest = pluginMcpDigest(entry.installPath);
-            if (entry.mcpDigest && currentDigest !== entry.mcpDigest) {
-                throw new Error(`plugin "${installKey}" MCP config changed after install; reinstall or update before approving`);
-            }
-            if (!entry.mcpDigest) {
-                entry.mcpDigest = currentDigest;
-                entryChanged = true;
-            }
-            if (entry.approvedMcpDigest !== entry.mcpDigest) {
-                entry.approvedMcpDigest = entry.mcpDigest;
-                entryChanged = true;
+    return (mutateInstalledPlugins((data) => {
+        const keys = matchingInstallKeys(data, target);
+        const out = [];
+        let writeNeeded = false;
+        for (const installKey of keys) {
+            for (const entry of data.plugins[installKey] ?? []) {
+                let entryChanged = false;
+                const currentDigest = pluginMcpDigest(entry.installPath);
+                if (entry.mcpDigest && currentDigest !== entry.mcpDigest) {
+                    throw new Error(`plugin "${installKey}" MCP config changed after install; reinstall or update before approving`);
+                }
+                if (!entry.mcpDigest) {
+                    entry.mcpDigest = currentDigest;
+                    entryChanged = true;
+                }
+                if (entry.approvedMcpDigest !== entry.mcpDigest) {
+                    entry.approvedMcpDigest = entry.mcpDigest;
+                    entryChanged = true;
+                }
+                writeNeeded ||= entryChanged;
+                out.push(trustEntry(installKey, entry, entryChanged));
             }
-            writeNeeded ||= entryChanged;
-            out.push(trustEntry(installKey, entry, entryChanged));
         }
-    }
-    if (writeNeeded)
-        writeInstalledPlugins(data);
-    return out;
+        return { ...(writeNeeded ? { value: data } : {}), result: out };
+    }) ?? []);
 }
 /**
  * Revoke plugin MCP execution. Legacy entries first record their current
  * digest, preventing revocation from falling back to legacy compatibility.
  */
 export function revokePluginMcp(target) {
-    const data = readInstalledPlugins();
-    const keys = matchingInstallKeys(data, target);
-    const out = [];
-    let writeNeeded = false;
-    for (const installKey of keys) {
-        const plugin = pluginNameFromKey(installKey);
-        for (const entry of data.plugins[installKey] ?? []) {
-            let entryChanged = false;
-            const hasServers = Object.keys(readPluginMcp(entry.installPath, plugin)).length > 0;
-            const currentDigest = pluginMcpDigest(entry.installPath);
-            if (!entry.mcpDigest) {
-                entry.mcpDigest = currentDigest;
-                entryChanged = true;
-            }
-            if (hasServers || currentDigest !== entry.mcpDigest) {
-                if (entry.approvedMcpDigest !== undefined) {
-                    delete entry.approvedMcpDigest;
+    return (mutateInstalledPlugins((data) => {
+        const keys = matchingInstallKeys(data, target);
+        const out = [];
+        let writeNeeded = false;
+        for (const installKey of keys) {
+            const plugin = pluginNameFromKey(installKey);
+            for (const entry of data.plugins[installKey] ?? []) {
+                let entryChanged = false;
+                const hasServers = Object.keys(readPluginMcp(entry.installPath, plugin)).length > 0;
+                const currentDigest = pluginMcpDigest(entry.installPath);
+                if (!entry.mcpDigest) {
+                    entry.mcpDigest = currentDigest;
                     entryChanged = true;
                 }
+                if (hasServers || currentDigest !== entry.mcpDigest) {
+                    if (entry.approvedMcpDigest !== undefined) {
+                        delete entry.approvedMcpDigest;
+                        entryChanged = true;
+                    }
+                }
+                else if (entry.approvedMcpDigest !== entry.mcpDigest) {
+                    entry.approvedMcpDigest = entry.mcpDigest;
+                    entryChanged = true;
+                }
+                writeNeeded ||= entryChanged;
+                out.push(trustEntry(installKey, entry, entryChanged));
             }
-            else if (entry.approvedMcpDigest !== entry.mcpDigest) {
-                entry.approvedMcpDigest = entry.mcpDigest;
-                entryChanged = true;
-            }
-            writeNeeded ||= entryChanged;
-            out.push(trustEntry(installKey, entry, entryChanged));
         }
-    }
-    if (writeNeeded)
-        writeInstalledPlugins(data);
-    return out;
+        return { ...(writeNeeded ? { value: data } : {}), result: out };
+    }) ?? []);
 }

package/dist/profile/catalog-store.js

@@ -8,7 +8,7 @@
  *   ~/.code-shell/human-repos.json        —— 注册表（owner/repo 列表）
  *   ~/.code-shell/human-repos/<key>/      —— 各仓库的浅克隆
  */
-import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { basename, dirname, join } from "node:path";
 import { codeShellHome } from "../session/session-manager.js";
@@ -19,6 +19,7 @@ import { acquireLockOnPath, mutateJsonFile } from "../utils/file-mutex.js";
 import { gitClone, githubRepoToCloneUrl } from "../plugins/gitOps.js";
 import { CATALOG_REPO_RE, readCatalogFromDir, sourceToRepoKey, } from "./catalog.js";
 const MAX_REPOS = 32;
+const MAX_REPO_REGISTRY_BYTES = 256 * 1024;
 export function humanReposRoot() {
     return join(codeShellHome(), "human-repos");
 }
@@ -29,13 +30,32 @@ export function humanRepoDir(repo) {
     return join(humanReposRoot(), sourceToRepoKey(repo));
 }
 export function listHumanRepos() {
+    let descriptor;
     try {
         // Missing or corrupt registry reads as "no repos" — never fatal.
-        return parseRegistry(readFileSync(registryPath(), "utf-8"));
+        const path = registryPath();
+        const metadata = lstatSync(path);
+        if (metadata.isSymbolicLink() ||
+            !metadata.isFile() ||
+            metadata.size > MAX_REPO_REGISTRY_BYTES) {
+            throw new Error("invalid digital-human repo registry");
+        }
+        descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        const opened = fstatSync(descriptor);
+        if (!opened.isFile() || opened.size > MAX_REPO_REGISTRY_BYTES) {
+            throw new Error("invalid digital-human repo registry");
+        }
+        return parseRegistry(readFileSync(descriptor, "utf-8"));
     }
-    catch {
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
         return [];
     }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
 }
 function parseRegistry(raw) {
     if (raw === undefined)
@@ -44,12 +64,26 @@ function parseRegistry(raw) {
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed.repos))
             return [];
+        const seen = new Set();
         return parsed.repos
+            .slice(0, MAX_REPOS)
             .filter((r) => !!r &&
             typeof r === "object" &&
             typeof r.repo === "string" &&
             CATALOG_REPO_RE.test(r.repo))
-            .map((r) => ({ repo: r.repo, addedAt: Number(r.addedAt) || 0 }));
+            .filter((r) => {
+            const normalized = r.repo.toLowerCase();
+            if (seen.has(normalized))
+                return false;
+            seen.add(normalized);
+            return true;
+        })
+            .map((r) => ({
+            repo: r.repo,
+            addedAt: typeof r.addedAt === "number" && Number.isSafeInteger(r.addedAt) && r.addedAt >= 0
+                ? r.addedAt
+                : 0,
+        }));
     }
     catch {
         return [];
@@ -101,6 +135,7 @@ function updateRegistry(change) {
         serialize: (repos) => `${JSON.stringify({ repos }, null, 2)}\n`,
         mutation: (current) => ({ value: change(current) }),
         mode: 0o600,
+        maxBytes: MAX_REPO_REGISTRY_BYTES,
     });
 }
 /**

package/dist/profile/catalog.js

@@ -9,13 +9,18 @@
  *
  * 本模块只做**读取与校验**，克隆/更新由 host 驱动（涉及网络与磁盘写入）。
  */
-import { existsSync, readFileSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, openSync, readFileSync, } from "node:fs";
 import { join } from "node:path";
 import { WorkspaceProfileSchema } from "./types.js";
 /** `owner/repo`，与 SKILL_REPO_RE 同源，供仓库地址复用。 */
 export const CATALOG_REPO_RE = /^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
 /** 单个目录段的安全名，挡住 `..`、分隔符与 NUL。 */
 const SAFE_SEGMENT_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+const MAX_MANIFEST_BYTES = 1024 * 1024;
+const MAX_PROFILE_BYTES = 256 * 1024;
+const MAX_MANIFEST_HUMANS = 1_000;
+const MAX_MANIFEST_TEAMS = 500;
+const MAX_ENTRY_TAGS = 64;
 /**
  * `owner/repo` → 一个安全的目录段。小写化保证同一仓库不同大小写写法命中同一份
  * 缓存；斜杠换成 `-` 后仍需通过 SAFE_SEGMENT_RE，杜绝路径逃逸。
@@ -37,44 +42,63 @@ export function sourceToRepoKey(repo) {
 export function parseHumansManifest(raw) {
     const value = JSON.parse(raw);
     const rawHumans = Array.isArray(value.humans) ? value.humans : [];
+    if (rawHumans.length > MAX_MANIFEST_HUMANS)
+        throw new Error("too many humans in manifest");
     const humans = [];
     for (const item of rawHumans) {
         if (!item || typeof item !== "object" || Array.isArray(item))
             continue;
         const entry = item;
-        if (typeof entry.name !== "string" || !entry.name)
+        if (typeof entry.name !== "string" || !entry.name || entry.name.length > 64)
             continue;
         humans.push({
             name: entry.name,
-            ...(typeof entry.label === "string" ? { label: entry.label } : {}),
-            ...(typeof entry.description === "string" ? { description: entry.description } : {}),
-            ...(typeof entry.category === "string" ? { category: entry.category } : {}),
+            ...(typeof entry.label === "string" && entry.label.length <= 120
+                ? { label: entry.label }
+                : {}),
+            ...(typeof entry.description === "string" && entry.description.length <= 4_096
+                ? { description: entry.description }
+                : {}),
+            ...(typeof entry.category === "string" && entry.category.length <= 120
+                ? { category: entry.category }
+                : {}),
             tags: Array.isArray(entry.tags)
-                ? entry.tags.filter((t) => typeof t === "string")
+                ? entry.tags
+                    .slice(0, MAX_ENTRY_TAGS)
+                    .filter((t) => typeof t === "string" && t.length <= 120)
                 : [],
         });
     }
     const rawTeams = Array.isArray(value.teams) ? value.teams : [];
+    if (rawTeams.length > MAX_MANIFEST_TEAMS)
+        throw new Error("too many teams in manifest");
     const teams = [];
     for (const item of rawTeams) {
         if (!item || typeof item !== "object" || Array.isArray(item))
             continue;
         const entry = item;
-        if (typeof entry.id !== "string" || !entry.id)
+        if (typeof entry.id !== "string" || !entry.id || entry.id.length > 64)
             continue;
-        if (typeof entry.name !== "string" || !entry.name)
+        if (typeof entry.name !== "string" || !entry.name || entry.name.length > 120)
             continue;
         const rawMembers = Array.isArray(entry.members) ? entry.members : [];
-        const members = rawMembers.filter((m) => typeof m === "string" && m.length > 0);
-        if (members.length < 2)
+        const members = rawMembers.filter((m) => typeof m === "string" && SAFE_SEGMENT_RE.test(m));
+        if (members.length < 2 || members.length > 8 || new Set(members).size !== members.length) {
             continue;
+        }
         teams.push({
             id: entry.id,
             name: entry.name,
-            ...(typeof entry.description === "string" ? { description: entry.description } : {}),
+            ...(typeof entry.description === "string" && entry.description.length <= 1_000
+                ? { description: entry.description }
+                : {}),
             members,
-            ...(typeof entry.lead === "string" && entry.lead ? { lead: entry.lead } : {}),
-            ...(typeof entry.playbook === "string" && entry.playbook ? { playbook: entry.playbook } : {}),
+            ...(typeof entry.lead === "string" && SAFE_SEGMENT_RE.test(entry.lead)
+                ? { lead: entry.lead }
+                : {}),
+            ...(typeof entry.playbook === "string" && entry.playbook.length <= 4_000
+                ? { playbook: entry.playbook }
+                : {}),
         });
     }
     return {
@@ -84,6 +108,22 @@ export function parseHumansManifest(raw) {
         teams,
     };
 }
+function readBoundedRegularFile(path, maxBytes) {
+    const pathInfo = lstatSync(path);
+    if (pathInfo.isSymbolicLink() || !pathInfo.isFile() || pathInfo.size > maxBytes) {
+        throw new Error("not a bounded regular file");
+    }
+    const descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const opened = fstatSync(descriptor);
+        if (!opened.isFile() || opened.size > maxBytes)
+            throw new Error("not a bounded regular file");
+        return readFileSync(descriptor, "utf8");
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
 /** 读取一个已克隆的数字人仓库目录。 */
 export function readCatalogFromDir(dir, sourceRepo) {
     const manifestPath = join(dir, "humans.json");
@@ -92,7 +132,7 @@ export function readCatalogFromDir(dir, sourceRepo) {
     }
     let manifest;
     try {
-        manifest = parseHumansManifest(readFileSync(manifestPath, "utf-8"));
+        manifest = parseHumansManifest(readBoundedRegularFile(manifestPath, MAX_MANIFEST_BYTES));
     }
     catch (error) {
         return {
@@ -112,7 +152,7 @@ export function readCatalogFromDir(dir, sourceRepo) {
         }
         const profilePath = join(dir, "humans", item.name, "profile.json");
         try {
-            const profile = WorkspaceProfileSchema.parse(JSON.parse(readFileSync(profilePath, "utf-8")));
+            const profile = WorkspaceProfileSchema.parse(JSON.parse(readBoundedRegularFile(profilePath, MAX_PROFILE_BYTES)));
             entries.push({
                 profile,
                 sourceRepo,

package/dist/profile/store.js

@@ -4,11 +4,13 @@
  * core 不内置任何领域 profile；样例见 docs/examples/workspace-profile-sample.md。
  */
 import { randomUUID } from "node:crypto";
-import { lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, opendirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { isAbsolute, join, relative, sep } from "node:path";
 import { logger } from "../logging/logger.js";
 import { codeShellHome } from "../session/session-manager.js";
 import { WORKSPACE_PROFILE_NAME_RE, WorkspaceProfileSchema, } from "./types.js";
+const MAX_PROFILE_FILE_BYTES = 256 * 1024;
+const MAX_PROFILE_LIBRARY_ENTRIES = 10_000;
 export function workspaceProfilesRoot() {
     return join(codeShellHome(), "profiles");
 }
@@ -72,7 +74,7 @@ function checkedProfileFile(name) {
     const info = lstatIfPresent(path);
     if (!info)
         return undefined;
-    if (info.isSymbolicLink() || !info.isFile()) {
+    if (info.isSymbolicLink() || !info.isFile() || info.size > MAX_PROFILE_FILE_BYTES) {
         throw new Error(`Invalid workspace profile file: ${path}`);
     }
     return path;
@@ -81,45 +83,69 @@ export function readWorkspaceProfile(name) {
     if (!WORKSPACE_PROFILE_NAME_RE.test(name))
         return undefined;
     const path = join(workspaceProfileDir(name), "profile.json");
+    let descriptor;
     try {
         const checkedPath = checkedProfileFile(name);
         if (!checkedPath)
             return undefined;
-        return WorkspaceProfileSchema.parse(JSON.parse(readFileSync(checkedPath, "utf-8")));
+        descriptor = openSync(checkedPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        const opened = fstatSync(descriptor);
+        if (!opened.isFile() || opened.size > MAX_PROFILE_FILE_BYTES) {
+            throw new Error("workspace profile file is too large");
+        }
+        return WorkspaceProfileSchema.parse(JSON.parse(readFileSync(descriptor, "utf-8")));
     }
     catch (error) {
         throw new Error(`Invalid workspace profile "${name}" at ${path}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
 }
 export function listWorkspaceProfiles() {
     const root = checkedProfilesRoot();
     if (!root)
         return [];
     const out = [];
-    for (const entry of readdirSync(root, { withFileTypes: true })) {
-        if (!entry.isDirectory()) {
-            if (entry.isSymbolicLink()) {
+    const directory = opendirSync(root);
+    let seen = 0;
+    try {
+        for (;;) {
+            const entry = directory.readSync();
+            if (!entry)
+                break;
+            seen += 1;
+            if (seen > MAX_PROFILE_LIBRARY_ENTRIES) {
+                throw new Error("Workspace profile library contains too many entries");
+            }
+            if (!entry.isDirectory()) {
+                if (entry.isSymbolicLink()) {
+                    logger.warn("profile.library_entry_invalid", {
+                        cat: "profile",
+                        name: entry.name,
+                        error: "symbolic links are not allowed",
+                    });
+                }
+                continue;
+            }
+            try {
+                const profile = readWorkspaceProfile(entry.name);
+                if (profile)
+                    out.push(profile);
+            }
+            catch (error) {
                 logger.warn("profile.library_entry_invalid", {
                     cat: "profile",
                     name: entry.name,
-                    error: "symbolic links are not allowed",
+                    error: error instanceof Error ? error.message : String(error),
                 });
             }
-            continue;
-        }
-        try {
-            const profile = readWorkspaceProfile(entry.name);
-            if (profile)
-                out.push(profile);
-        }
-        catch (error) {
-            logger.warn("profile.library_entry_invalid", {
-                cat: "profile",
-                name: entry.name,
-                error: error instanceof Error ? error.message : String(error),
-            });
         }
     }
+    finally {
+        directory.closeSync();
+    }
     return out.sort((a, b) => a.name.localeCompare(b.name));
 }
 /**
@@ -144,7 +170,11 @@ export function saveWorkspaceProfile(profile) {
     }
     const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
     try {
-        writeFileSync(tmp, `${JSON.stringify(parsed, null, 2)}\n`, {
+        const serialized = `${JSON.stringify(parsed, null, 2)}\n`;
+        if (Buffer.byteLength(serialized, "utf8") > MAX_PROFILE_FILE_BYTES) {
+            throw new Error("workspace profile file is too large");
+        }
+        writeFileSync(tmp, serialized, {
             encoding: "utf-8",
             mode: 0o600,
             flag: "wx",

package/dist/prompt/composer.d.ts

@@ -96,6 +96,14 @@ export interface ComposerOptions {
      * See MemoryManager.buildInjectionIndex(currentProjectOnly).
      */
     memoryCurrentProjectOnly?: boolean;
+    /** Isolated runs can omit repository/user instruction discovery entirely. */
+    disableInstructions?: boolean;
+    /** Isolated runs can omit persistent-memory context entirely. */
+    disableMemoryContext?: boolean;
+    /** Isolated runs can omit capability-owned volatile context providers. */
+    disableCapabilityContext?: boolean;
+    /** Isolated runs can omit bound-source metadata. */
+    disableSourcesContext?: boolean;
 }
 export declare class PromptComposer {
     private readonly options;

package/dist/prompt/composer.js

@@ -30,6 +30,8 @@ export class PromptComposer {
      * Build the userContext prefix message (CLAUDE.md content as <system-reminder>).
      */
     buildUserContextMessage() {
+        if (this.options.disableInstructions === true)
+            return null;
         const instructions = this.getInstructions();
         // NOTE: memory is intentionally NOT here. It used to be, but memory mutates
         // constantly (extraction, recall usage++/lastUsed, approve/demote), and this
@@ -51,6 +53,8 @@ export class PromptComposer {
     }
     /** Build volatile context contributed by installed capability modules. */
     async buildSystemContext() {
+        if (this.options.disableCapabilityContext === true)
+            return "";
         const preset = this.options.preset ?? resolveAgentPreset();
         const parts = await Promise.all((this.options.dynamicContextProviders ?? []).map(async (provider) => {
             try {
@@ -107,6 +111,8 @@ export class PromptComposer {
         const [capabilityContext, sourcesContext] = await Promise.all([
             this.buildSystemContext(),
             (async () => {
+                if (this.options.disableSourcesContext === true)
+                    return "";
                 try {
                     return (await this.options.sourcesContextProvider?.()) ?? "";
                 }
@@ -265,6 +271,8 @@ export class PromptComposer {
         return this.cachedInstructions;
     }
     getMemoryContext() {
+        if (this.options.disableMemoryContext === true)
+            return "";
         try {
             // Three-layer injection (用户拍板): a compact index merging GLOBAL +
             // DIGITAL-HUMAN + PROJECT memories. Global memories are surfaced every