@liangjie559567/ultrapower 5.0.21 → 5.0.23

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultrapower",
   "description": "Disciplined multi-agent orchestration: workflow enforcement + parallel execution. Combines superpowers' TDD/debugging discipline with OMC's multi-agent execution capabilities.",
-  "version": "5.0.21",
+  "version": "5.0.23",
   "author": {
     "name": "Jesse Vincent & oh-my-claudecode contributors"
   },

package/commands/ax-analyze-error.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 错误分析工作流：根因诊断 → 自动修复 → 知识入队"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-analyze-error skill and follow it exactly as presented to you

package/commands/ax-context.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 上下文管理器：读取/保存短期记忆、长期记忆和状态机"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-context skill and follow it exactly as presented to you

package/commands/ax-decompose.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 任务拆解工作流：Rough PRD → 系统架构 → 原子任务 DAG → Manifest 清单"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-decompose skill and follow it exactly as presented to you

package/commands/ax-draft.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 需求起草工作流：需求澄清循环 → PRD 初稿生成 → 用户评审门禁"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-draft skill and follow it exactly as presented to you

package/commands/ax-evolution.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 进化引擎触发：手动触发知识收割、模式检测和反思"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-evolution skill and follow it exactly as presented to you

package/commands/ax-evolve.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 进化工作流：处理学习队列 → 更新知识库 → 模式检测 → 生成进化报告"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-evolve skill and follow it exactly as presented to you

package/commands/ax-export.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 系统导出：将 Axiom 配置打包为可移植 zip，支持模板模式和完整模式"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-export skill and follow it exactly as presented to you

package/commands/ax-implement.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 实施交付工作流：按 Manifest 顺序执行原子任务，含 CI 门禁和自动修复"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-implement skill and follow it exactly as presented to you

package/commands/ax-knowledge.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 知识库管理：搜索知识库和模式库，返回相关条目"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-knowledge skill and follow it exactly as presented to you

package/commands/ax-reflect.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 反思工作流：会话总结 → 经验提取 → Action Items → 知识入队"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-reflect skill and follow it exactly as presented to you

package/commands/ax-review.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 专家评审工作流：5专家并行评审 → 冲突仲裁 → Rough PRD 生成"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-review skill and follow it exactly as presented to you

package/commands/ax-rollback.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 回滚工作流：回滚到最近检查点，恢复系统状态"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-rollback skill and follow it exactly as presented to you

package/commands/ax-status.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 状态仪表盘：显示当前任务状态、进度、记忆摘要和系统健康"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-status skill and follow it exactly as presented to you

package/commands/ax-suspend.md

@@ -1,6 +1,5 @@
 ---
 description: "Axiom 暂停保存工作流：保存当前状态快照，安全退出会话"
-disable-model-invocation: true
 ---
 
 Invoke the ultrapower:ax-suspend skill and follow it exactly as presented to you

package/commands/brainstorm.md

@@ -1,6 +1,5 @@
 ---
 description: "在任何创意工作之前必须使用此命令——创建功能、构建组件、添加功能或修改行为。在实现之前探索需求和设计。"
-disable-model-invocation: true
 ---
 
 Invoke the superpowers:brainstorming skill and follow it exactly as presented to you

package/commands/execute-plan.md

@@ -1,6 +1,5 @@
 ---
 description: 分批执行计划并设置审查检查点
-disable-model-invocation: true
 ---
 
 Invoke the superpowers:executing-plans skill and follow it exactly as presented to you

package/commands/write-plan.md

@@ -1,6 +1,5 @@
 ---
 description: 创建包含细粒度任务的详细实现计划
-disable-model-invocation: true
 ---
 
 Invoke the superpowers:writing-plans skill and follow it exactly as presented to you

package/dist/__tests__/validateMode.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=validateMode.test.d.ts.map

package/dist/__tests__/validateMode.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateMode.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/validateMode.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/validateMode.test.js

@@ -0,0 +1,100 @@
+import { describe, it, expect } from 'vitest';
+import { validateMode, assertValidMode, VALID_MODES } from '../lib/validateMode.js';
+describe('validateMode', () => {
+    it('should return true for all 8 valid modes', () => {
+        const expected = ['autopilot', 'ultrapilot', 'team', 'pipeline', 'ralph', 'ultrawork', 'ultraqa', 'swarm'];
+        expect(VALID_MODES).toHaveLength(8);
+        for (const mode of expected) {
+            expect(validateMode(mode)).toBe(true);
+        }
+    });
+    it('should return false for unknown mode strings', () => {
+        expect(validateMode('unknown')).toBe(false);
+        expect(validateMode('auto')).toBe(false);
+        expect(validateMode('AUTOPILOT')).toBe(false);
+    });
+    it('should return false for path traversal attempts', () => {
+        expect(validateMode('../../etc/passwd')).toBe(false);
+        expect(validateMode('../autopilot')).toBe(false);
+        expect(validateMode('autopilot/../../../etc')).toBe(false);
+    });
+    it('should return false for empty string', () => {
+        expect(validateMode('')).toBe(false);
+    });
+    it('should return false for non-string types', () => {
+        expect(validateMode(null)).toBe(false);
+        expect(validateMode(undefined)).toBe(false);
+        expect(validateMode(42)).toBe(false);
+        expect(validateMode({})).toBe(false);
+        expect(validateMode([])).toBe(false);
+        expect(validateMode(true)).toBe(false);
+        expect(validateMode(Symbol('autopilot'))).toBe(false);
+    });
+    it('should return false for whitespace-only strings', () => {
+        expect(validateMode(' ')).toBe(false);
+        expect(validateMode('\t')).toBe(false);
+        expect(validateMode('\n')).toBe(false);
+        expect(validateMode('   ')).toBe(false);
+    });
+    it('should return false for null byte injection', () => {
+        expect(validateMode('autopilot\x00')).toBe(false);
+        expect(validateMode('autopilot\x00../../etc')).toBe(false);
+    });
+    it('should return false for prototype pollution vectors', () => {
+        expect(validateMode('__proto__')).toBe(false);
+        expect(validateMode('constructor')).toBe(false);
+        expect(validateMode('prototype')).toBe(false);
+    });
+    it('should handle very long strings without throwing', () => {
+        const longString = 'a'.repeat(1_000_000);
+        expect(validateMode(longString)).toBe(false);
+    });
+});
+describe('assertValidMode', () => {
+    it('should return the mode string for valid modes', () => {
+        expect(assertValidMode('autopilot')).toBe('autopilot');
+        expect(assertValidMode('swarm')).toBe('swarm');
+        expect(assertValidMode('ralph')).toBe('ralph');
+    });
+    it('should throw for invalid mode strings', () => {
+        expect(() => assertValidMode('unknown')).toThrow('Invalid mode');
+        expect(() => assertValidMode('../../etc')).toThrow('Invalid mode');
+    });
+    it('should throw for non-string input', () => {
+        expect(() => assertValidMode(null)).toThrow('Invalid mode');
+        expect(() => assertValidMode(undefined)).toThrow('Invalid mode');
+    });
+    it('error message should list valid modes', () => {
+        expect(() => assertValidMode('bad')).toThrow('autopilot');
+    });
+    it('error message should truncate very long input to prevent DoS', () => {
+        const longInput = 'x'.repeat(1_000_000);
+        let errorMessage = '';
+        try {
+            assertValidMode(longInput);
+        }
+        catch (e) {
+            errorMessage = e.message;
+        }
+        expect(errorMessage.length).toBeLessThan(500);
+        expect(errorMessage).toContain('truncated');
+    });
+    it('error message should not expose raw non-string input verbatim', () => {
+        const obj = { secret: 'password123' };
+        let errorMessage = '';
+        try {
+            assertValidMode(obj);
+        }
+        catch (e) {
+            errorMessage = e.message;
+        }
+        expect(errorMessage).not.toContain('password123');
+    });
+    it('returned value should be usable in path construction without traversal risk', () => {
+        const mode = assertValidMode('autopilot');
+        const path = `.omc/state/${mode}-state.json`;
+        expect(path).toBe('.omc/state/autopilot-state.json');
+        expect(path).not.toContain('..');
+    });
+});
+//# sourceMappingURL=validateMode.test.js.map

package/dist/__tests__/validateMode.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateMode.test.js","sourceRoot":"","sources":["../../src/__tests__/validateMode.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAEpF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3G,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAY,GAAI,CAAW,CAAC,OAAO,CAAC;QACtC,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtC,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,eAAe,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAY,GAAI,CAAW,CAAC,OAAO,CAAC;QACtC,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,cAAc,IAAI,aAAa,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/validateMode.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Mode parameter validation for ultrapower.
+ * Prevents path traversal attacks by enforcing a strict whitelist of valid mode names.
+ *
+ * Security boundary: mode values are used to construct file paths like
+ * `.omc/state/${mode}-state.json`. Direct string interpolation without
+ * validation would allow path traversal (e.g., mode = "../../etc/passwd").
+ *
+ * Source of truth: src/hooks/mode-registry/index.ts
+ * Spec: docs/standards/runtime-protection.md §2.4
+ */
+/**
+ * All valid execution mode names (8 total).
+ * Derived from src/hooks/mode-registry/index.ts.
+ * Note (D-03): PRD originally listed 7 modes; 'swarm' was added, making 8.
+ */
+export declare const VALID_MODES: readonly ["autopilot", "ultrapilot", "team", "pipeline", "ralph", "ultrawork", "ultraqa", "swarm"];
+/** Union type of all valid mode strings. */
+export type ValidMode = (typeof VALID_MODES)[number];
+/**
+ * Check whether a string is a valid mode name.
+ *
+ * @param mode - Untrusted input to validate
+ * @returns `true` if `mode` is one of the 8 valid modes, `false` otherwise
+ *
+ * @example
+ * validateMode('autopilot') // true
+ * validateMode('../../etc') // false
+ * validateMode('')          // false
+ */
+export declare function validateMode(mode: unknown): mode is ValidMode;
+/**
+ * Assert that a string is a valid mode name, throwing on invalid input.
+ * Use this when constructing file paths from user-supplied mode values.
+ *
+ * @param mode - Untrusted input to validate
+ * @returns The validated mode string (narrowed to `ValidMode`)
+ * @throws {Error} If `mode` is not a valid mode name
+ *
+ * @example
+ * // Safe path construction
+ * const validMode = assertValidMode(mode);
+ * const stateFilePath = `.omc/state/${validMode}-state.json`;
+ *
+ * // ❌ Never do this — path traversal risk:
+ * // const stateFilePath = `.omc/state/${mode}-state.json`;
+ */
+export declare function assertValidMode(mode: unknown): ValidMode;
+//# sourceMappingURL=validateMode.d.ts.map

package/dist/lib/validateMode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateMode.d.ts","sourceRoot":"","sources":["../../src/lib/validateMode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,eAAO,MAAM,WAAW,oGASd,CAAC;AAEX,4CAA4C;AAC5C,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,SAAS,CAE7D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAYxD"}

package/dist/lib/validateMode.js

@@ -0,0 +1,68 @@
+/**
+ * Mode parameter validation for ultrapower.
+ * Prevents path traversal attacks by enforcing a strict whitelist of valid mode names.
+ *
+ * Security boundary: mode values are used to construct file paths like
+ * `.omc/state/${mode}-state.json`. Direct string interpolation without
+ * validation would allow path traversal (e.g., mode = "../../etc/passwd").
+ *
+ * Source of truth: src/hooks/mode-registry/index.ts
+ * Spec: docs/standards/runtime-protection.md §2.4
+ */
+/**
+ * All valid execution mode names (8 total).
+ * Derived from src/hooks/mode-registry/index.ts.
+ * Note (D-03): PRD originally listed 7 modes; 'swarm' was added, making 8.
+ */
+export const VALID_MODES = [
+    'autopilot',
+    'ultrapilot',
+    'team',
+    'pipeline',
+    'ralph',
+    'ultrawork',
+    'ultraqa',
+    'swarm',
+];
+/**
+ * Check whether a string is a valid mode name.
+ *
+ * @param mode - Untrusted input to validate
+ * @returns `true` if `mode` is one of the 8 valid modes, `false` otherwise
+ *
+ * @example
+ * validateMode('autopilot') // true
+ * validateMode('../../etc') // false
+ * validateMode('')          // false
+ */
+export function validateMode(mode) {
+    return typeof mode === 'string' && VALID_MODES.includes(mode);
+}
+/**
+ * Assert that a string is a valid mode name, throwing on invalid input.
+ * Use this when constructing file paths from user-supplied mode values.
+ *
+ * @param mode - Untrusted input to validate
+ * @returns The validated mode string (narrowed to `ValidMode`)
+ * @throws {Error} If `mode` is not a valid mode name
+ *
+ * @example
+ * // Safe path construction
+ * const validMode = assertValidMode(mode);
+ * const stateFilePath = `.omc/state/${validMode}-state.json`;
+ *
+ * // ❌ Never do this — path traversal risk:
+ * // const stateFilePath = `.omc/state/${mode}-state.json`;
+ */
+export function assertValidMode(mode) {
+    if (!validateMode(mode)) {
+        // Truncate input to prevent DoS via memory amplification and avoid
+        // leaking large attacker-controlled payloads into logs/notifications.
+        const raw = typeof mode === 'string' ? mode : String(mode);
+        const display = raw.length > 50 ? `${raw.slice(0, 50)}...(truncated)` : raw;
+        throw new Error(`Invalid mode: "${display}". ` +
+            `Valid modes are: ${VALID_MODES.join(', ')}`);
+    }
+    return mode;
+}
+//# sourceMappingURL=validateMode.js.map

package/dist/lib/validateMode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateMode.js","sourceRoot":"","sources":["../../src/lib/validateMode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,WAAW;IACX,YAAY;IACZ,MAAM;IACN,UAAU;IACV,OAAO;IACP,WAAW;IACX,SAAS;IACT,OAAO;CACC,CAAC;AAKX;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAK,WAAiC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,mEAAmE;QACnE,sEAAsE;QACtE,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,kBAAkB,OAAO,KAAK;YAC5B,oBAAoB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/docs/CLAUDE.md

@@ -1,5 +1,5 @@
 <!-- OMC:START -->
-<!-- OMC:VERSION:5.0.21 -->
+<!-- OMC:VERSION:5.0.23 -->
 # ultrapower - Multi-Agent Orchestration 智能多 Agent 编排
 
 你正在使用 ultrapower（OMC），这是 Claude Code 的多 agent 编排层。

package/docs/prd/ultrapower-standards-draft.md

@@ -0,0 +1,191 @@
+# PRD: ultrapower 全链路规范体系 - Draft
+
+> **状态**: DRAFT
+> **作者**: Product Design Expert (axiom-product-designer)
+> **版本**: 0.1
+> **日期**: 2026-02-26
+> **项目**: ultrapower v5.0.21
+
+---
+
+## 1. 背景与目标
+
+### 1.1 背景
+
+ultrapower（OMC）是 Claude Code 的多 agent 编排框架，当前版本 v5.0.21 已具备完整的 agent 目录、skill 体系和 hook 机制。随着功能复杂度提升，三类系统性问题开始显现：
+
+- **运行时 BUG**：Hook 执行顺序不确定、状态文件并发读写冲突、Agent 生命周期管理缺失（参考已知问题：2026-02-12 Race Condition）
+- **使用混乱**：用户不清楚何时用 skill、何时用 agent、何时用 MCP，导致错误路由和资源浪费
+- **贡献无序**：新增 skill/agent/hook 缺乏统一模板和检查清单，引入不一致的实现模式
+
+### 1.2 目标
+
+建立覆盖全链路的规范体系，使 ultrapower 从"能用"升级为"可靠、易用、可扩展"。
+
+### 1.3 成功指标
+
+| 指标 | 当前状态 | 目标 |
+| --- | --- | --- |
+| 并发场景有明确处理指引 | 无 | 100% 覆盖 |
+| 新用户选出正确 skill 的时间 | 未知 | ≤ 5 分钟 |
+| 新增 skill 有完整检查清单 | 无 | 100% 覆盖 |
+| 三类 BUG 来源有对应规范 | 无 | 全覆盖 |
+
+---
+
+## 2. 用户故事
+
+| 角色 | 目标 | 收益 |
+| --- | --- | --- |
+| 框架使用者（新用户） | 快速判断应该调用哪个 skill 或 agent | 5 分钟内做出正确决策，不走弯路 |
+| 框架使用者（老用户） | 在并发/复杂场景下得到明确的操作指引 | 避免状态冲突和运行时错误 |
+| 框架贡献者 | 按照统一模板新增 skill/agent/hook | 一次通过代码审查，不引入不一致模式 |
+| 框架维护者 | 快速定位 BUG 根因并有规范可依 | 减少排查时间，修复有据可查 |
+
+---
+
+## 3. 高层需求（MVP）
+
+### P0 - 运行时防护规范（必须交付）
+
+1. **Hook 执行顺序规范**：定义 PreToolUse / PostToolUse / Stop 三类 hook 的触发时序、优先级和互斥规则
+2. **状态文件读写规范**：明确 `.omc/state/` 下各文件的读写锁策略，禁止并发写入同一状态文件
+3. **Agent 生命周期规范**：定义 agent 从 spawn 到 shutdown 的标准状态机，包含超时和异常退出处理
+
+### P1 - 用户使用规范（核心体验）
+
+4. **Skill 调用决策树**：提供可视化决策流程，帮助用户在 skill / agent / MCP 三者间做出正确选择
+5. **Agent 路由规范**：明确各 agent 角色的适用场景边界，避免错误路由（如用 executor 做分析）
+6. **常见反模式清单**：列举并解释 10 个最常见的错误用法，每条附正确替代方案
+
+### P2 - 开发贡献规范（生态健康）
+
+7. **Skill 标准模板**：包含触发词、约束、输出格式、测试用例的完整模板
+8. **Agent 标准模板**：包含角色定义、工具权限、输入输出契约的标准结构
+9. **Hook 标准模板**：包含事件类型、必需字段、错误处理的标准结构
+10. **贡献检查清单**：新增任何组件前必须通过的 checklist（含测试要求和版本兼容性验证）
+
+---
+
+## 4. 业务流程
+
+### 4.1 用户使用决策流程
+
+```mermaid
+graph TD
+    A[用户有任务] --> B{任务类型判断}
+    B --> |简单单步操作| C[直接处理]
+    B --> |需要代码实现| D{复杂度判断}
+    B --> |需要分析/规划| E[MCP 工具优先]
+    B --> |多文件/多领域| F[Team 模式]
+
+    D --> |标准实现| G[executor / sonnet]
+    D --> |复杂自主任务| H[deep-executor / opus]
+
+    E --> |文档查找| I[Context7 MCP]
+    E --> |架构分析| J[ask_codex]
+    E --> |UI/设计| K[ask_gemini]
+
+    F --> L[team-plan]
+    L --> M[team-prd]
+    M --> N[team-exec]
+    N --> O[team-verify]
+    O --> |通过| P[complete]
+    O --> |失败| Q[team-fix]
+    Q --> N
+```
+
+### 4.2 运行时状态机（Agent 生命周期）
+
+```mermaid
+stateDiagram-v2
+    [*] --> SPAWNED : Task() 调用
+    SPAWNED --> RUNNING : 工具调用开始
+    RUNNING --> WAITING : 等待用户输入
+    WAITING --> RUNNING : 收到输入
+    RUNNING --> IDLE : 当前 turn 结束
+    IDLE --> RUNNING : 收到新消息
+    IDLE --> SHUTDOWN : shutdown_request
+    RUNNING --> ERROR : 异常/超时
+    ERROR --> SHUTDOWN : 错误处理完成
+    SHUTDOWN --> [*]
+```
+
+### 4.3 Hook 执行时序
+
+```mermaid
+sequenceDiagram
+    participant U as 用户
+    participant C as Claude
+    participant H as Hook 系统
+    participant S as 状态文件
+
+    U->>C: 发送指令
+    C->>H: PreToolUse hook
+    H->>S: 读取状态（只读）
+    H-->>C: hook success / block
+    C->>C: 执行工具调用
+    C->>H: PostToolUse hook
+    H->>S: 写入状态（加锁）
+    S-->>H: 写入完成
+    H-->>C: hook success
+    C->>H: Stop hook（turn 结束）
+    H->>S: 清理临时状态
+```
+
+---
+
+## 5. 非功能需求
+
+| 类别 | 要求 |
+| --- | --- |
+| 可读性 | 所有规范文档使用中文，代码示例使用英文 |
+| 可维护性 | 规范文档与代码同仓库，随版本迭代更新 |
+| 向后兼容 | P0/P1 规范不得破坏现有 v5.0.x 用户的使用习惯 |
+| 可发现性 | 规范入口在 README 和 CLAUDE.md 中有明确链接 |
+
+---
+
+## 6. 验收标准
+
+| 编号 | 验收项 | 验证方法 |
+| --- | --- | --- |
+| AC-01 | 并发场景有明确处理指引 | 检查 P0 规范是否覆盖：并行 agent 写同一状态文件的场景 |
+| AC-02 | 新用户 5 分钟内选出正确 skill | 用户测试：给出 3 个典型场景，新用户按决策树选择，准确率 ≥ 80% |
+| AC-03 | 新增 skill 有完整检查清单 | 检查 P2 checklist 是否包含：触发词、测试用例、版本兼容性三项 |
+| AC-04 | 三类 BUG 来源均有对应规范 | 逐一映射：运行时 BUG → P0，使用混乱 → P1，贡献无序 → P2 |
+
+---
+
+## 7. Impact Scope（影响文件范围）
+
+本 PRD 实现后，预期新增/修改的文件范围：
+
+**新增文件（规范文档）：**
+- `docs/standards/runtime-protection.md` — P0 运行时防护规范
+- `docs/standards/user-guide.md` — P1 用户使用规范（含决策树）
+- `docs/standards/contribution-guide.md` — P2 开发贡献规范
+- `docs/standards/templates/skill-template.md` — Skill 标准模板
+- `docs/standards/templates/agent-template.md` — Agent 标准模板
+- `docs/standards/templates/hook-template.md` — Hook 标准模板
+
+**修改文件（入口链接）：**
+- `README.md` — 添加规范文档入口
+- `CLAUDE.md` — 添加规范引用
+
+**不在范围内（v2 延期）：**
+- 自动化规范检查工具（lint 插件）
+- 规范合规性 CI 检查
+- 多语言版本（英文版）
+
+---
+
+## 8. 暂不包含（v2 延期）
+
+- 自动化规范合规检查（需要额外工具链投入）
+- 英文版规范文档（当前用户群以中文为主）
+- 视频教程或交互式引导（超出文档范围）
+- 规范覆盖率度量仪表盘
+- 历史 BUG 的规范回溯标注
+
+