ai-helper-agent 1.10.0 → 1.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-helper-agent",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "AI Helper 代理服务 - 为 Chrome 扩展提供本地文件读写和系统命令执行能力",
   "type": "module",
   "main": "./src/server.js",
@@ -21,6 +21,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "archiver": "^8.0.0",
     "ws": "^8.18.0",
     "zod": "^4.4.3"
   },

package/src/auth.js

@@ -2,7 +2,7 @@
 import crypto from 'crypto';
 import { loadConfig, loadPairings, savePairing } from './config.js';
 
-// 当前有效的配对码（30秒刷新一次）
+// 当前有效的配对码（定时刷新 + 一次性使用）
 let currentPairCode = null;
 let pairCodeTimer = null;
 
@@ -12,11 +12,26 @@ let lastAuthTime = 0;
 // 判定"活跃"的时间窗口：此时间内有过认证则认为仍有扩展连接
 const ACTIVE_WINDOW_MS = 5 * 60 * 1000; // 5 分钟
 
+// 配对码字符表：排除易混淆字符（0/O、1/I/l）；6 位字母数字（≈21亿种，抗暴破）
+const PAIR_CODE_CHARS = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+const PAIR_CODE_LEN = 6;
+
+// 配对失败锁定：连续失败 PAIR_FAIL_LIMIT 次后锁定 PAIR_LOCK_DURATION_MS 毫秒
+let pairFailCount = 0;
+let pairLockUntil = 0;
+const PAIR_FAIL_LIMIT = 5;
+const PAIR_LOCK_DURATION_MS = 60 * 1000; // 60 秒
+
 /**
- * 生成随机配对码（4位数字，使用密码学安全的随机数）
+ * 生成随机配对码（6位字母数字，使用密码学安全的随机数，排除易混淆字符）
  */
 function generatePairCode() {
-  return String(crypto.randomInt(1000, 10000));
+  const bytes = crypto.randomBytes(PAIR_CODE_LEN);
+  let code = '';
+  for (let i = 0; i < PAIR_CODE_LEN; i++) {
+    code += PAIR_CODE_CHARS[bytes[i] % PAIR_CODE_CHARS.length];
+  }
+  return code;
 }
 
 /**
@@ -39,21 +54,15 @@ function startPairCodeRotation() {
 
   // 有配对且最近有活跃连接，无需刷新配对码
   if (hasPairings && isRecentlyActive) {
-    console.log(`[Agent] 已有 ${Object.keys(pairings).length} 个配对扩展，最近 ${Math.round((Date.now() - lastAuthTime) / 1000)}s 前有认证活动，跳过配对码刷新`);
     currentPairCode = generatePairCode();
-    console.log(`[Agent] 当前配对码（用于新增配对）: ${currentPairCode}`);
+    console.log(`\n[Agent] 配对码: ${currentPairCode}\n`);
     return;
   }
 
-  // 有配对但无活跃连接，给出提示
-  if (hasPairings && !isRecentlyActive) {
-    console.log(`[Agent] 存在配对记录但无活跃连接（超过 ${ACTIVE_WINDOW_MS / 60000} 分钟），恢复配对码刷新`);
-  }
-
   const ttl = (config.pairCodeTTL || 30) * 1000;
 
   currentPairCode = generatePairCode();
-  console.log(`[Agent] 当前配对码: ${currentPairCode}`);
+  console.log(`\n[Agent] 配对码: ${currentPairCode}\n`);
 
   if (pairCodeTimer) clearInterval(pairCodeTimer);
   pairCodeTimer = setInterval(() => {
@@ -89,17 +98,38 @@ function verifyToken(token) {
 
 /**
  * 处理配对请求（异步，支持写入锁）
+ * 安全策略：
+ *   - 失败锁定：连续失败 PAIR_FAIL_LIMIT 次后临时锁定，并立即轮换配对码使已观测码失效
+ *   - 一次性使用：配对成功后立即轮换配对码，防止配对码被重复利用
  */
 async function handlePairRequest(code, extensionId) {
+  // 锁定期内直接拒绝（不泄露是否处于锁定状态细节）
+  if (Date.now() < pairLockUntil) {
+    return { success: false, error: '配对尝试过于频繁，请稍后再试' };
+  }
   if (!code || !extensionId) {
     return { success: false, error: '缺少配对码或扩展ID' };
   }
-  if (code !== currentPairCode) {
+  if (code.toUpperCase() !== currentPairCode) {
+    pairFailCount++;
+    if (pairFailCount >= PAIR_FAIL_LIMIT) {
+      pairLockUntil = Date.now() + PAIR_LOCK_DURATION_MS;
+      pairFailCount = 0;
+      // 锁定时立即轮换配对码，使攻击者已观测到的配对码失效
+      currentPairCode = generatePairCode();
+      console.log('[Agent] 配对失败次数过多，已临时锁定 60s 并轮换配对码');
+    }
     return { success: false, error: '配对码无效' };
   }
+  // 配对码正确：重置失败计数
+  pairFailCount = 0;
+
   // 检查是否已有配对
   const pairings = loadPairings();
   if (pairings[extensionId]) {
+    // 一次性使用：成功后立即轮换配对码
+    currentPairCode = generatePairCode();
+    console.log('[Agent] 配对码校验通过，配对码已轮换（一次性使用）');
     return { success: true, token: pairings[extensionId].token, message: '已配对，返回现有 token' };
   }
   // 生成新 token 并保存
@@ -109,6 +139,9 @@ async function handlePairRequest(code, extensionId) {
   } catch (err) {
     return { success: false, error: `配对保存失败: ${err.message}` };
   }
+  // 一次性使用：成功后立即轮换配对码
+  currentPairCode = generatePairCode();
+  console.log('[Agent] 配对成功，配对码已轮换（一次性使用）');
   return { success: true, token, message: '配对成功' };
 }
 

package/src/mcp/client.js

@@ -33,7 +33,6 @@ export class McpClient {
       case TRANSPORT_SSE: {
         const url = this.serverConfig.url;
         if (!url) throw new Error('SSE 传输需要提供 url');
-        console.log(`[MCP:${this.serverId}] 使用 SSE 传输，URL: ${url}`);
         const opts = {};
         if (Object.keys(headers).length > 0) {
           opts.requestInit = { headers };
@@ -44,7 +43,6 @@ export class McpClient {
       case TRANSPORT_STREAMABLE_HTTP: {
         const url = this.serverConfig.url;
         if (!url) throw new Error('StreamableHTTP 传输需要提供 url');
-        console.log(`[MCP:${this.serverId}] 使用 StreamableHTTP 传输，URL: ${url}`);
         const opts = {};
         if (Object.keys(headers).length > 0) {
           opts.requestInit = { headers };
@@ -55,7 +53,6 @@ export class McpClient {
       case TRANSPORT_WEBSOCKET: {
         const url = this.serverConfig.url;
         if (!url) throw new Error('WebSocket 传输需要提供 url');
-        console.log(`[MCP:${this.serverId}] 使用 WebSocket 传输，URL: ${url}`);
         return new WebSocketClientTransport(new URL(url));
       }
 
@@ -63,7 +60,6 @@ export class McpClient {
       default: {
         const command = this.serverConfig.command;
         if (!command) throw new Error('stdio 传输需要提供 command');
-        console.log(`[MCP:${this.serverId}] 使用 stdio 传输，命令: ${command}`);
         return new StdioClientTransport({
           command: this.serverConfig.command,
           args: this.serverConfig.args || [],
@@ -92,12 +88,10 @@ export class McpClient {
         serverInfo: this.client.getServerVersion(),
         capabilities: this.client.getServerCapabilities()
       };
-      console.log(`[MCP:${this.serverId}] Initialize 成功, server:`, this.serverInfo.serverInfo?.name);
 
       const toolsResult = await this.client.listTools({});
       if (toolsResult && toolsResult.tools) {
         this.tools = toolsResult.tools;
-        console.log(`[MCP:${this.serverId}] 发现 ${this.tools.length} 个工具`);
       } else {
         this.tools = [];
       }
@@ -155,8 +149,6 @@ export class McpClient {
       try { await this.transport.close(); } catch {}
       this.transport = null;
     }
-
-    console.log(`[MCP:${this.serverId}] 已断开连接`);
   }
 
   getStatus() {

package/src/mcp/registry.js

@@ -14,14 +14,10 @@ export async function initializeMcpRegistry() {
   const config = loadMcpConfig();
   let connected = 0;
   let failed = 0;
-
-  console.log(`[MCP Registry] 初始化，共配置 ${config.servers.length} 个 MCP Server`);
+  const failedServers = [];
 
   for (const server of config.servers) {
-    if (!server.enabled) {
-      console.log(`[MCP Registry] 跳过禁用的 Server: ${server.id}`);
-      continue;
-    }
+    if (!server.enabled) continue;
 
     const client = new McpClient(server);
     const result = await client.connect();
@@ -29,12 +25,21 @@ export async function initializeMcpRegistry() {
       clients.set(server.id, client);
       connected++;
     } else {
-      console.error(`[MCP Registry] 连接失败 "${server.id}":`, result.error);
       failed++;
+      failedServers.push({ id: server.id, error: result.error });
     }
   }
 
-  console.log(`[MCP Registry] 初始化完成: ${connected} 已连接, ${failed} 失败`);
+  if (config.servers.length > 0) {
+    if (failed > 0) {
+      console.log(`[MCP] ${connected}/${config.servers.length} 已连接`);
+      for (const fs of failedServers) {
+        console.error(`[MCP] ${fs.id} 连接失败: ${fs.error}`);
+      }
+    } else if (connected > 0) {
+      console.log(`[MCP] ${connected} 个 Server 已连接`);
+    }
+  }
   return { connected, failed };
 }
 
@@ -154,7 +159,6 @@ export async function disconnectMcpServer(serverId) {
  * 关闭所有 MCP 连接（Agent 关闭时调用）
  */
 export async function shutdownMcpRegistry() {
-  console.log('[MCP Registry] 关闭所有 MCP 连接...');
   for (const [id, client] of clients) {
     try { await client.disconnect(); } catch {}
   }

package/src/search.js

@@ -1,6 +1,7 @@
 // agent/src/search.js - 文件搜索（fd/rg 优先 + Node.js 回退）
 import { spawn } from 'child_process';
 import { readdir, stat, readFile } from 'fs/promises';
+import { statSync } from 'fs';
 import { join, basename, extname, resolve } from 'path';
 import { checkPath } from './security.js';
 
@@ -43,8 +44,6 @@ export async function initSearchTools() {
     const [fd, rg] = await Promise.all([checkFdAvailable(), checkRgAvailable()]);
     fdAvailable = fd;
     rgAvailable = rg;
-    console.log(`[Agent] fd (文件搜索): ${fd ? '✅ 可用' : '❌ 未安装，使用 Node.js 回退'}`);
-    console.log(`[Agent] rg (内容搜索): ${rg ? '✅ 可用' : '❌ 未安装，使用 Node.js 回退'}`);
     return { fd: fdAvailable, rg: rgAvailable };
   })();
   return searchToolsInitPromise;
@@ -81,11 +80,15 @@ function matchGlob(filename, pattern) {
 }
 
 /**
- * 使用 fd 搜索文件（快速）
+ * 使用 fd 搜索文件和目录（快速）
  */
 function searchWithFd(rootPath, filePattern, recursive, maxResults) {
   return new Promise((resolve) => {
-    const args = ['--glob', filePattern, '--type', 'f', '--max-results', String(maxResults)];
+    const args = ['--glob', filePattern, '--type', 'f', '--type', 'd', '--max-results', String(maxResults)];
+    // 排除默认忽略的目录
+    for (const dir of DEFAULT_IGNORE_DIRS) {
+      args.push('--exclude', dir);
+    }
     if (!recursive) args.push('--max-depth', '1');
     args.push(rootPath);
 
@@ -111,9 +114,9 @@ function searchWithFd(rootPath, filePattern, recursive, maxResults) {
       const results = lines.map(p => {
         try {
           const s = statSync(p);
-          return { path: p, name: basename(p), size: s.size, mtime: s.mtimeMs };
+          return { path: p, name: basename(p), type: s.isDirectory() ? 'directory' : 'file', size: s.size, mtime: s.mtimeMs };
         } catch {
-          return { path: p, name: basename(p), size: 0, mtime: 0 };
+          return { path: p, name: basename(p), type: 'file', size: 0, mtime: 0 };
         }
       });
       resolve(results);
@@ -131,7 +134,7 @@ function yieldEventLoop() {
 }
 
 /**
- * Node.js 原生递归搜索文件（回退方案，异步 + 分片防止阻塞事件循环）
+ * Node.js 原生递归搜索文件和目录（回退方案，异步 + 分片防止阻塞事件循环）
  */
 async function searchFilesNative(rootPath, filePattern, recursive, maxResults) {
   const results = [];
@@ -154,14 +157,23 @@ async function searchFilesNative(rootPath, filePattern, recursive, maxResults) {
       if (entry.isDirectory()) {
         if (DEFAULT_IGNORE_DIRS.has(entry.name)) continue;
         if (entry.name.startsWith('.')) continue;
+        // 目录也参与搜索匹配
+        if (matchGlob(entry.name, filePattern)) {
+          try {
+            const s = await stat(fullPath);
+            results.push({ path: fullPath, name: entry.name, type: 'directory', size: s.size, mtime: s.mtimeMs });
+          } catch {
+            results.push({ path: fullPath, name: entry.name, type: 'directory', size: 0, mtime: 0 });
+          }
+        }
         await walk(fullPath, depth + 1);
       } else if (entry.isFile()) {
         if (matchGlob(entry.name, filePattern)) {
           try {
             const s = await stat(fullPath);
-            results.push({ path: fullPath, name: entry.name, size: s.size, mtime: s.mtimeMs });
+            results.push({ path: fullPath, name: entry.name, type: 'file', size: s.size, mtime: s.mtimeMs });
           } catch {
-            results.push({ path: fullPath, name: entry.name, size: 0, mtime: 0 });
+            results.push({ path: fullPath, name: entry.name, type: 'file', size: 0, mtime: 0 });
           }
         }
       }

package/src/server.js

@@ -1,19 +1,20 @@
 // agent/src/server.js - HTTP Router + WebSocket 服务器
 import http from 'http';
 import { WebSocketServer } from 'ws';
-import { readFileSync } from 'fs';
-import { readFile, writeFile, readdir, stat, unlink, rmdir, chmod, mkdir } from 'fs/promises';
+import { readFileSync, createWriteStream, statSync, existsSync } from 'fs';
+import { readFile, writeFile, readdir, stat, unlink, rmdir, chmod, mkdir, rename } from 'fs/promises';
 import { join, dirname, basename } from 'path';
 import { fileURLToPath } from 'url';
+import { ZipArchive } from 'archiver';
 import { homedir, tmpdir } from 'os';
-import { spawn, execSync } from 'child_process';
+import { spawn } from 'child_process';
 import { randomBytes } from 'crypto';
 import os from 'os';
 import { loadConfig } from './config.js';
-import { verifyToken, getCurrentPairCode, startPairCodeRotation, stopPairCodeRotation, handlePairRequest } from './auth.js';
+import { verifyToken, startPairCodeRotation, stopPairCodeRotation, handlePairRequest } from './auth.js';
 import { checkPath, checkCommand } from './security.js';
 import { executeCommand, executeCommandSync, addWsClient, disconnectWsClient, killProcess, getRunningProcesses } from './executor.js';
-import { setConsoleOutput, logAuth, logFs, logExec, logSecurity, logSystem, logError, queryLogs, getLogDates } from './logger.js';
+import { setConsoleOutput, logAuth, logFs, logExec, logSecurity, logSystem, logError } from './logger.js';
 import { initSearchTools, getSearchToolsAvailable, searchFiles, searchContent } from './search.js';
 import {
   initializeMcpRegistry,
@@ -41,15 +42,54 @@ import {
   getAgentSkillPrompt,
   getSkillsDir
 } from './skill/registry.js';
-import { getSkillExecutionStatus } from './skill/executor.js';
 import { saveMarkdownSkill, importMarkdownSkillFromZip, importMarkdownSkillFromUrl } from './skill/loader.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const AGENT_VERSION = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8')).version;
 
+/**
+ * 跨平台 ZIP 打包（使用 archiver，替换 spawn zip）
+ * @param {string[]} sourceNames - 源文件/目录名（basename）
+ * @param {string} cwd - 工作目录（压缩时以此为当前目录）
+ * @param {string} outputPath - 输出 ZIP 文件路径
+ * @returns {Promise<Buffer>} ZIP 文件 Buffer
+ */
+async function createZipBuffer(sourceNames, cwd, outputPath) {
+  return new Promise((resolve, reject) => {
+    const output = createWriteStream(outputPath);
+    const archive = new ZipArchive({ zlib: { level: 9 } });
+    const chunks = [];
+
+    output.on('close', () => {
+      resolve(Buffer.concat(chunks));
+    });
+    output.on('error', reject);
+
+    archive.on('error', reject);
+    archive.on('data', (chunk) => chunks.push(chunk));
+
+    archive.pipe(output);
+
+    for (const name of sourceNames) {
+      const fullPath = join(cwd, name);
+      try {
+        const s = statSync(fullPath);
+        if (s.isDirectory()) {
+          archive.directory(fullPath, name);
+        } else {
+          archive.file(fullPath, { name });
+        }
+      } catch {
+        // 跳过不存在的文件
+      }
+    }
+
+    archive.finalize();
+  });
+}
+
 const MAX_BODY_SIZE = 10 * 1024 * 1024; // 10MB
 const MAX_SEARCH_RESULTS = 5000;         // 单次搜索最大结果数
-const MAX_LOG_QUERY_LIMIT = 1000;        // 日志查询最大条数
 const PID_FILE = join(homedir(), '.ai-helper-agent', 'agent.pid');
 const DEFAULT_MAX_SIZE = 50 * 1024 * 1024; // 文件默认大小限制
 
@@ -72,7 +112,7 @@ function detectShell() {
       ];
       for (const path of gitBashPaths) {
         try {
-          if (require('fs').existsSync(path)) {
+          if (existsSync(path)) {
             return path;
           }
         } catch {}
@@ -150,16 +190,36 @@ const PLATFORM_INFO = {
   nodeVersion: process.version
 };
 
+/**
+ * 判断请求来源是否允许跨域读取响应
+ * 安全策略：仅放行 Chrome 扩展来源（chrome-extension://<id>）。
+ *   - 恶意网页（http/https origin）不返回 ACAO，浏览器阻止其跨域读取（保护无认证端点 /api/status、/api/pair 等）
+ *   - 无 Origin 的请求（curl / 本地脚本）：不设 ACAO，非浏览器客户端不受 CORS 限制仍可访问
+ *   - 扩展请求：返回其 Origin，扩展 fetch 可正常跨域读取
+ */
+function getAllowedOrigin(req) {
+  const origin = req?.headers?.origin;
+  if (typeof origin === 'string' && origin.startsWith('chrome-extension://')) {
+    return origin;
+  }
+  return null;
+}
+
 /**
  * JSON 响应辅助
  */
 function jsonResponse(res, status, data) {
-  res.writeHead(status, {
+  const headers = {
     'Content-Type': 'application/json; charset=utf-8',
-    'Access-Control-Allow-Origin': '*',
     'Access-Control-Allow-Headers': 'Content-Type, Authorization',
     'Access-Control-Allow-Methods': 'GET, POST, OPTIONS'
-  });
+  };
+  const allowedOrigin = getAllowedOrigin(res.req);
+  if (allowedOrigin) {
+    headers['Access-Control-Allow-Origin'] = allowedOrigin;
+    headers['Vary'] = 'Origin';
+  }
+  res.writeHead(status, headers);
   res.end(JSON.stringify(data));
 }
 
@@ -189,8 +249,10 @@ function parseBody(req) {
 
     req.on('end', () => {
       const body = Buffer.concat(chunks).toString();
+      // 空 body 视为 {}（兼容无 body 的 POST 请求，如 /api/skill/reload）
+      if (body.trim() === '') { resolve({}); return; }
       try { resolve(JSON.parse(body)); }
-      catch { resolve({}); }
+      catch { reject(new Error('请求体不是有效的 JSON')); }
     });
 
     req.on('error', () => reject(new Error('读取请求失败')));
@@ -304,13 +366,18 @@ export function startServer() {
   });
 
   async function handleRequest(req, res) {
-    // CORS 预检
+    // CORS 预检（仅放行 Chrome 扩展来源）
     if (req.method === 'OPTIONS') {
-      res.writeHead(204, {
-        'Access-Control-Allow-Origin': '*',
+      const optHeaders = {
         'Access-Control-Allow-Headers': 'Content-Type, Authorization',
         'Access-Control-Allow-Methods': 'GET, POST, OPTIONS'
-      });
+      };
+      const allowedOrigin = getAllowedOrigin(req);
+      if (allowedOrigin) {
+        optHeaders['Access-Control-Allow-Origin'] = allowedOrigin;
+        optHeaders['Vary'] = 'Origin';
+      }
+      res.writeHead(204, optHeaders);
       return res.end();
     }
 
@@ -338,25 +405,19 @@ export function startServer() {
       return jsonResponse(res, result.success ? 200 : 400, result);
     }
 
-    // 健康检查 + 平台信息
+    // 健康检查 + 平台信息（无认证：仅返回必要的平台标识，不泄露 hostname/homeDir/shell 等宿主敏感信息）
     if (req.method === 'GET' && pathname === '/api/status') {
       return jsonResponse(res, 200, {
         success: true,
         version: AGENT_VERSION,
         running: true,
-        ...PLATFORM_INFO,
+        platform: PLATFORM_INFO.platform,
+        arch: PLATFORM_INFO.arch,
+        nodeVersion: PLATFORM_INFO.nodeVersion,
         searchTools: getSearchToolsAvailable()
       });
     }
 
-    // Agent 关闭（无需认证，仅限本地访问）
-    if (req.method === 'POST' && pathname === '/api/shutdown') {
-      logSystem('shutdown', { reason: 'api_request' });
-      jsonResponse(res, 200, { success: true, message: 'Agent 正在关闭...' });
-      shutdown();
-      return;
-    }
-
     // ---------- 需要认证的接口 ----------
     const authHeader = req.headers.authorization;
     if (!authHeader || !authHeader.startsWith('Bearer ')) {
@@ -370,14 +431,27 @@ export function startServer() {
       return jsonResponse(res, 403, { success: false, error: '认证 token 无效' });
     }
 
+    // Agent 关闭（需认证 + 仅限本地来源，防止远程无认证关闭 Agent 造成 DoS）
+    if (req.method === 'POST' && pathname === '/api/shutdown') {
+      const remoteAddr = req.socket.remoteAddress || '';
+      const isLocal = remoteAddr === '127.0.0.1' || remoteAddr === '::1' || remoteAddr === '::ffff:127.0.0.1';
+      if (!isLocal) {
+        logSecurity('shutdown_remote_blocked', { remoteAddr, extId });
+        return jsonResponse(res, 403, { success: false, error: '关闭 Agent 仅允许本地请求' });
+      }
+      logSystem('shutdown', { reason: 'api_request', extId });
+      jsonResponse(res, 200, { success: true, message: 'Agent 正在关闭...' });
+      shutdown();
+      return;
+    }
+
     const maxSize = config.fileMaxSize || DEFAULT_MAX_SIZE;
 
-    // 认证后的状态信息
+    // 认证后的状态信息（不再下发 pairCode：配对码仅用于一次性配对，避免已配对端横向获取）
     if (req.method === 'GET' && pathname === '/api/status/detail') {
       return jsonResponse(res, 200, {
         success: true,
         version: AGENT_VERSION,
-        pairCode: getCurrentPairCode(),
         pairCodeTTL: config.pairCodeTTL,
         workdir: config.workdir,
         allowedPaths: config.allowedPaths,
@@ -592,12 +666,7 @@ export function startServer() {
             try {
               const dirName = basename(check.resolved);
               const parentDir = dirname(check.resolved);
-              execSync(`cd "${parentDir}" && zip -rq "${tmpFile}" "${dirName}"`, {
-                timeout: 120000,
-                maxBuffer: 10 * 1024 * 1024,
-                stdio: ['ignore', 'pipe', 'pipe']
-              });
-              const zipBuffer = await readFile(tmpFile);
+              const zipBuffer = await createZipBuffer([dirName], parentDir, tmpFile);
               logFs('download', { path: check.resolved, type: 'directory', zipSize: zipBuffer.length });
               return jsonResponse(res, 200, {
                 success: true,
@@ -656,24 +725,22 @@ export function startServer() {
         try {
           const tmpFile = join(tmpdir(), `ws-dl-${randomBytes(6).toString('hex')}.zip`);
           try {
-            const zipArgs = resolvedPaths.map(p => `"${basename(p)}"`).join(' ');
+            const zipArgs = resolvedPaths.map(p => basename(p));
             const commonParent = resolvedPaths.reduce((a, b) => {
-              const partsA = a.split('/').filter(Boolean);
-              const partsB = b.split('/').filter(Boolean);
+              const sep = '/';
+              const partsA = a.replace(/\\/g, '/').split('/').filter(Boolean);
+              const partsB = b.replace(/\\/g, '/').split('/').filter(Boolean);
               const common = [];
               for (let i = 0; i < Math.min(partsA.length, partsB.length); i++) {
                 if (partsA[i] === partsB[i]) common.push(partsA[i]);
                 else break;
               }
-              return '/' + common.join('/');
+              const result = sep + common.join(sep);
+              // Windows 盘符处理：C:/Users -> 而不是 /C:/Users
+              return result;
             });
 
-            execSync(`cd "${commonParent}" && zip -rq "${tmpFile}" ${zipArgs}`, {
-              timeout: 120000,
-              maxBuffer: 10 * 1024 * 1024,
-              stdio: ['ignore', 'pipe', 'pipe']
-            });
-            const zipBuffer = await readFile(tmpFile);
+            const zipBuffer = await createZipBuffer(zipArgs, commonParent, tmpFile);
             logFs('download_multi', { paths: resolvedPaths, zipSize: zipBuffer.length });
             return jsonResponse(res, 200, {
               success: true,
@@ -692,6 +759,202 @@ export function startServer() {
         }
       }
 
+      // 流式下载（直接返回二进制流，避免 base64 膨胀和前端同步解码）
+      // 支持单文件/目录（path）或多文件打包（paths）
+      if (pathname === '/api/fs/download-stream') {
+        const targetPath = body.path;
+        const paths = body.paths;
+
+        // 辅助：设置下载响应头并返回二进制
+        const sendBinary = (buffer, filename, mimeType) => {
+          const encodedName = encodeURIComponent(filename);
+          res.writeHead(200, {
+            'Content-Type': mimeType || 'application/octet-stream',
+            'Content-Disposition': `attachment; filename="${encodedName}"; filename*=UTF-8''${encodedName}`,
+            'Content-Length': buffer.length
+          });
+          res.end(buffer);
+        };
+
+        try {
+          if (paths && Array.isArray(paths) && paths.length > 0) {
+            // 多文件打包流式下载
+            const resolvedPaths = [];
+            for (const p of paths) {
+              const check = await checkPath(p);
+              if (!check.allowed) {
+                logSecurity('fs_download_blocked', { path: p, reason: check.reason });
+                return jsonResponse(res, 403, { success: false, error: `路径 "${p}" 不允许访问` });
+              }
+              if (!await exists(check.resolved)) {
+                return jsonResponse(res, 404, { success: false, error: `路径 "${p}" 不存在` });
+              }
+              resolvedPaths.push(check.resolved);
+            }
+
+            const tmpFile = join(tmpdir(), `ws-dl-${randomBytes(6).toString('hex')}.zip`);
+            try {
+              const zipArgs = resolvedPaths.map(p => basename(p));
+              const commonParent = resolvedPaths.reduce((a, b) => {
+                const partsA = a.split('/').filter(Boolean);
+                const partsB = b.split('/').filter(Boolean);
+                const common = [];
+                for (let i = 0; i < Math.min(partsA.length, partsB.length); i++) {
+                  if (partsA[i] === partsB[i]) common.push(partsA[i]);
+                  else break;
+                }
+                return '/' + common.join('/');
+              });
+              const zipBuffer = await createZipBuffer(zipArgs, commonParent, tmpFile);
+              logFs('download_multi_stream', { paths: resolvedPaths, zipSize: zipBuffer.length });
+              const zipName = `workspace_${new Date().toISOString().slice(0, 19).replace(/:/g, '-')}.zip`;
+              return sendBinary(zipBuffer, zipName, 'application/zip');
+            } finally {
+              try { await unlink(tmpFile); } catch {}
+            }
+          } else if (targetPath && typeof targetPath === 'string') {
+            // 单文件/目录流式下载
+            const check = await checkPath(targetPath);
+            if (!check.allowed) {
+              logSecurity('fs_download_blocked', { path: targetPath, reason: check.reason });
+              return jsonResponse(res, 403, { success: false, error: check.reason });
+            }
+            if (!await exists(check.resolved)) {
+              return jsonResponse(res, 404, { success: false, error: '文件/目录不存在' });
+            }
+
+            const fstat = await stat(check.resolved);
+            if (fstat.isDirectory()) {
+              // 目录打包
+              const tmpFile = join(tmpdir(), `ws-dl-${randomBytes(6).toString('hex')}.zip`);
+              try {
+                const dirName = basename(check.resolved);
+                const parentDir = dirname(check.resolved);
+                const zipBuffer = await createZipBuffer([dirName], parentDir, tmpFile);
+                logFs('download_stream', { path: check.resolved, type: 'directory', zipSize: zipBuffer.length });
+                return sendBinary(zipBuffer, `${dirName}.zip`, 'application/zip');
+              } finally {
+                try { await unlink(tmpFile); } catch {}
+              }
+            } else {
+              // 单文件直接返回（不受 maxSize 限制，流式传输）
+              const buf = await readFile(check.resolved);
+              const mimeType = getMimeType(check.resolved);
+              logFs('download_stream', { path: check.resolved, type: 'file', size: buf.length });
+              return sendBinary(buf, basename(check.resolved), mimeType);
+            }
+          } else {
+            return jsonResponse(res, 400, { success: false, error: '缺少 path 或 paths 参数' });
+          }
+        } catch (err) {
+          logError('fs', 'download_stream_error', { path: targetPath, paths, error: err.message });
+          return jsonResponse(res, 500, { success: false, error: `下载失败: ${err.message}` });
+        }
+      }
+
+      // 创建目录
+      if (pathname === '/api/fs/mkdir') {
+        const dirPath = body.path;
+        if (!dirPath || typeof dirPath !== 'string') {
+          return jsonResponse(res, 400, { success: false, error: '缺少 path 参数' });
+        }
+        const check = await checkPath(dirPath);
+        if (!check.allowed) {
+          logSecurity('fs_mkdir_blocked', { path: dirPath, reason: check.reason });
+          return jsonResponse(res, 403, { success: false, error: check.reason });
+        }
+        try {
+          await mkdir(check.resolved, { recursive: false });
+          logFs('mkdir', { path: check.resolved });
+          return jsonResponse(res, 200, { success: true, path: check.resolved });
+        } catch (err) {
+          if (err.code === 'EEXIST') {
+            return jsonResponse(res, 409, { success: false, error: '目录已存在' });
+          }
+          throw err;
+        }
+      }
+
+      // 重命名文件/目录（仅修改文件名，不跨目录）
+      if (pathname === '/api/fs/rename') {
+        const oldPath = body.path;
+        const newName = body.newName;
+        if (!oldPath || typeof oldPath !== 'string' || !newName || typeof newName !== 'string') {
+          return jsonResponse(res, 400, { success: false, error: '缺少 path 或 newName 参数' });
+        }
+        if (newName.includes('/') || newName.includes('\\')) {
+          return jsonResponse(res, 400, { success: false, error: '新名称不能包含路径分隔符' });
+        }
+        const check = await checkPath(oldPath);
+        if (!check.allowed) {
+          logSecurity('fs_rename_blocked', { path: oldPath, reason: check.reason });
+          return jsonResponse(res, 403, { success: false, error: check.reason });
+        }
+        if (!await exists(check.resolved)) {
+          return jsonResponse(res, 404, { success: false, error: '文件/目录不存在' });
+        }
+        const newFullPath = join(dirname(check.resolved), newName);
+        // 确保目标路径也在允许范围内
+        const newCheck = await checkPath(newFullPath);
+        if (!newCheck.allowed) {
+          logSecurity('fs_rename_blocked', { path: newFullPath, reason: newCheck.reason });
+          return jsonResponse(res, 403, { success: false, error: `目标路径不允许: ${newCheck.reason}` });
+        }
+        try {
+          await rename(check.resolved, newFullPath);
+          logFs('rename', { from: check.resolved, to: newFullPath });
+          return jsonResponse(res, 200, { success: true, newPath: newFullPath, newName });
+        } catch (err) {
+          if (err.code === 'ENOTEMPTY' || err.code === 'EEXIST') {
+            return jsonResponse(res, 409, { success: false, error: '目标名称已存在' });
+          }
+          throw err;
+        }
+      }
+
+      // 移动文件/目录
+      if (pathname === '/api/fs/move') {
+        const srcPath = body.path;
+        const destDir = body.destDir;
+        if (!srcPath || typeof srcPath !== 'string' || !destDir || typeof destDir !== 'string') {
+          return jsonResponse(res, 400, { success: false, error: '缺少 path 或 destDir 参数' });
+        }
+        const srcCheck = await checkPath(srcPath);
+        if (!srcCheck.allowed) {
+          logSecurity('fs_move_blocked', { path: srcPath, reason: srcCheck.reason });
+          return jsonResponse(res, 403, { success: false, error: srcCheck.reason });
+        }
+        const destCheck = await checkPath(destDir);
+        if (!destCheck.allowed) {
+          logSecurity('fs_move_blocked', { path: destDir, reason: destCheck.reason });
+          return jsonResponse(res, 403, { success: false, error: destCheck.reason });
+        }
+        if (!await exists(srcCheck.resolved)) {
+          return jsonResponse(res, 404, { success: false, error: '源文件/目录不存在' });
+        }
+        const destStat = await stat(destCheck.resolved).catch(() => null);
+        if (!destStat || !destStat.isDirectory()) {
+          return jsonResponse(res, 400, { success: false, error: '目标不是有效目录' });
+        }
+        const itemName = basename(srcCheck.resolved);
+        const destPath = join(destCheck.resolved, itemName);
+        const destCheck2 = await checkPath(destPath);
+        if (!destCheck2.allowed) {
+          logSecurity('fs_move_blocked', { path: destPath, reason: destCheck2.reason });
+          return jsonResponse(res, 403, { success: false, error: `移动目标路径不允许: ${destCheck2.reason}` });
+        }
+        try {
+          await rename(srcCheck.resolved, destPath);
+          logFs('move', { from: srcCheck.resolved, to: destPath });
+          return jsonResponse(res, 200, { success: true, newPath: destPath });
+        } catch (err) {
+          if (err.code === 'ENOTEMPTY' || err.code === 'EEXIST') {
+            return jsonResponse(res, 409, { success: false, error: '目标位置已存在同名文件/目录' });
+          }
+          throw err;
+        }
+      }
+
       // 在本地浏览器中打开文件
       if (pathname === '/api/browser/open') {
         const targetPath = body.path;
@@ -996,27 +1259,6 @@ export function startServer() {
       }
     }
 
-    // 运行中进程列表（需认证）
-    if (req.method === 'GET' && pathname === '/api/exec/running') {
-      return jsonResponse(res, 200, { success: true, processes: getRunningProcesses() });
-    }
-
-    // 日志查询（需认证）
-    if (req.method === 'GET' && pathname === '/api/logs') {
-      const date = url.searchParams.get('date') || undefined;
-      const category = url.searchParams.get('category') || undefined;
-      const rawLimit = parseInt(url.searchParams.get('limit') || '200', 10);
-      const limit = Math.min(isNaN(rawLimit) ? 200 : rawLimit, MAX_LOG_QUERY_LIMIT);
-      const offset = parseInt(url.searchParams.get('offset') || '0', 10);
-      const result = queryLogs({ date, category, limit, offset });
-      return jsonResponse(res, 200, { success: true, ...result });
-    }
-
-    // 日志日期列表（需认证）
-    if (req.method === 'GET' && pathname === '/api/logs/dates') {
-      return jsonResponse(res, 200, { success: true, dates: getLogDates() });
-    }
-
     // ========== Skill 管理接口（仅 GET 路由） ==========
 
     // Skill 列表
@@ -1031,13 +1273,6 @@ export function startServer() {
       return jsonResponse(res, 200, getSkill(name));
     }
 
-    // Skill 执行状态查询
-    if (req.method === 'GET' && pathname === '/api/skill/status') {
-      const execId = url.searchParams.get('execId');
-      if (!execId) return jsonResponse(res, 400, { success: false, error: '缺少 execId 参数' });
-      return jsonResponse(res, 200, getSkillExecutionStatus(execId));
-    }
-
     // Agent Skill Prompts（用于 AI System Prompt 注入）
     if (req.method === 'GET' && pathname === '/api/skill/agent-prompts') {
       const prompts = getAgentSkillPrompts();
@@ -1143,6 +1378,9 @@ export function startServer() {
     if (pathParts[1] === 'ws' && pathParts[2] === 'exec') {
       const execId = pathParts[3];
 
+      // WebSocket 认证：优先用 Authorization Header；回退到 ?token= query 是因为
+      // 浏览器 WebSocket API 不支持自定义 Header（插件端 new WebSocket() 无法设置 Header）。
+      // 安全注意：query token 可能被代理日志/Referer 记录，故此处绝不将 token 写入任何日志。
       const authHeader = request.headers.authorization;
       let token = null;
       if (authHeader && authHeader.startsWith('Bearer ')) {
@@ -1185,25 +1423,25 @@ export function startServer() {
     }
   });
 
-  server.listen(port, host, async () => {
+  server.listen(port, host, () => {
     console.log(`[Agent] HTTP 服务已启动: http://${host}:${port}`);
     console.log(`[Agent] WebSocket 服务已启动: ws://${host}:${port}`);
     startPairCodeRotation();
 
-    // 初始化 MCP 注册表（异步，不阻塞请求）
-    try {
-      await initializeMcpRegistry();
-    } catch (err) {
-      console.error('[Agent] MCP 注册表初始化失败:', err.message);
-    }
+    // 后台异步初始化 MCP 和 Skill，不阻塞主流程
+    (async () => {
+      try {
+        await initializeMcpRegistry();
+      } catch (err) {
+        console.error('[Agent] MCP 注册表初始化失败:', err.message);
+      }
 
-    // 初始化 Skill 注册表
-    try {
-      const skillCount = initializeSkillRegistry();
-      console.log(`[Agent] Skill 注册表已初始化: ${skillCount} 个 Skill`);
-    } catch (err) {
-      console.error('[Agent] Skill 注册表初始化失败:', err.message);
-    }
+      try {
+        await initializeSkillRegistry();
+      } catch (err) {
+        console.error('[Agent] Skill 注册表初始化失败:', err.message);
+      }
+    })();
   });
 
   // 优雅关闭（异步 + 防并发 + 超时兜底）

package/src/skill/loader.js

@@ -182,7 +182,6 @@ export function loadAllSkills() {
   const agentSkills = loadAllMarkdownSkills(SKILLS_DIR);
   allSkills = allSkills.concat(agentSkills);
 
-  console.log(`[Skill Loader] 共加载 ${allSkills.length} 个 Skill (${allSkills.filter(s => s.type === 'workflow').length} Workflow + ${allSkills.filter(s => s.type === 'agent').length} Agent)`);
   return allSkills;
 }
 
@@ -264,18 +263,12 @@ export function seedSkillCreator() {
   const skillDir = join(SKILLS_DIR, SKILL_CREATOR_DIR);
   const skillMdPath = join(skillDir, 'SKILL.md');
 
-  console.log(`[Skill Loader] seedSkillCreator: 检查路径 ${skillMdPath}`);
-  console.log(`[Skill Loader] seedSkillCreator: 文件存在? ${existsSync(skillMdPath)}`);
-
   if (existsSync(skillMdPath)) {
-    // 已存在，检查是否需要升级（版本号不同则覆盖）
     try {
       const content = readFileSync(skillMdPath, 'utf-8');
       const versionMatch = content.match(/^version:\s*([\d.]+)/m);
       const currentVersion = versionMatch ? versionMatch[1] : '0.0.0';
-      console.log(`[Skill Loader] seedSkillCreator: 已有文件版本=${currentVersion}, 目标版本=1.1.0`);
       if (currentVersion === '1.1.0') {
-        console.log('[Skill Loader] seedSkillCreator: 版本匹配，跳过写入');
         return false;
       }
     } catch { /* 读取失败则覆盖 */ }
@@ -286,10 +279,9 @@ export function seedSkillCreator() {
       mkdirSync(skillDir, { recursive: true });
     }
     writeFileSync(skillMdPath, SKILL_CREATOR_SEED_MD, 'utf-8');
-    console.log('[Skill Loader] 已种子写入 skill-creator SKILL.md (v1.1.0)');
     return true;
   } catch (err) {
-    console.warn('[Skill Loader] 种子写入 skill-creator 失败:', err.message);
+    console.warn('[Skill] 种子写入 skill-creator 失败:', err.message);
     return false;
   }
 }

package/src/skill/markdown-loader.js

@@ -1,12 +1,17 @@
 // skill/markdown-loader.js - Markdown Skill 加载器
 // 扫描子目录中的 SKILL.md，解析 YAML frontmatter 和正文内容
 import { readFileSync, readdirSync, existsSync, statSync, writeFileSync, mkdirSync, rmSync } from 'fs';
-import { join, basename, extname } from 'path';
-import { execSync } from 'child_process';
+import { join, basename, extname, normalize, sep } from 'path';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { randomBytes } from 'crypto';
 import { tmpdir } from 'os';
+import { lookup as dnsLookup } from 'dns/promises';
 import https from 'https';
 import http from 'http';
 
+const execFileAsync = promisify(execFile);
+
 /**
  * 解析 YAML frontmatter（--- 包裹的元数据）
  * 支持基本类型：string, number, boolean, array, object
@@ -201,7 +206,6 @@ export function loadAllMarkdownSkills(skillsDir) {
     } catch { /* skip */ }
   }
 
-  console.log(`[Markdown Loader] 共加载 ${skills.length} 个 Agent Skill`);
   return skills;
 }
 
@@ -267,6 +271,78 @@ export function deleteMarkdownSkillDir(skillsDir, name) {
   }
 }
 
+// Skill 下载大小上限（20MB）
+const MAX_SKILL_DOWNLOAD_SIZE = 20 * 1024 * 1024;
+
+/**
+ * 判断 IP 字符串是否为私有/环回/链路本地等内网地址
+ */
+function isPrivateIp(ip) {
+  // IPv4
+  const v4 = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (v4) {
+    const a = parseInt(v4[1], 10);
+    const b = parseInt(v4[2], 10);
+    if (a === 10) return true;                            // 10.0.0.0/8
+    if (a === 127) return true;                           // 127.0.0.0/8 环回（全段）
+    if (a === 0) return true;                             // 0.0.0.0/8
+    if (a === 169 && b === 254) return true;              // 169.254.0.0/16 链路本地（含云元数据）
+    if (a === 172 && b >= 16 && b <= 31) return true;     // 172.16.0.0/12
+    if (a === 192 && b === 168) return true;              // 192.168.0.0/16
+    if (a === 100 && b >= 64 && b <= 127) return true;    // 100.64.0.0/10 CGNAT
+    return false;
+  }
+  // IPv6（含 ::ffff:IPv4 映射）
+  const v6 = ip.toLowerCase().replace(/^\[|]$/g, '');
+  const mapped = v6.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (mapped) return isPrivateIp(mapped[1]);
+  if (v6 === '::1' || v6 === '::') return true;           // 环回/未指定
+  if (v6.startsWith('fc') || v6.startsWith('fd')) return true;  // fc00::/7 唯一本地
+  if (/^fe[89ab]/.test(v6)) return true;                  // fe80::/10 链路本地
+  return false;
+}
+
+/**
+ * 校验 URL 主机是否为公网地址（含 DNS 解析，防 DNS 重绑定与 IP 编码绕过）
+ * @returns {Promise<{ ok: boolean, error?: string }>}
+ */
+async function assertPublicHost(hostname) {
+  if (!hostname) return { ok: false, error: '缺少 hostname' };
+  const blockedHostnames = ['localhost', 'ip6-localhost', 'ip6-loopback'];
+  if (blockedHostnames.includes(hostname.toLowerCase())) {
+    return { ok: false, error: '禁止访问本地地址' };
+  }
+  // 直接 IP 形式（含 IPv6）：直接判断
+  const stripped = hostname.replace(/^\[|]$/g, '');
+  if (/^(\d{1,3}\.){3}\d{1,3}$/.test(stripped) || /^[0-9a-f:]+$/i.test(stripped)) {
+    if (isPrivateIp(stripped)) return { ok: false, error: '禁止访问内网地址' };
+    return { ok: true };
+  }
+  // 域名：DNS 解析后判断所有结果（防 DNS 重绑定：解析阶段即拒绝内网 IP）
+  try {
+    const results = await dnsLookup(hostname, { all: true });
+    if (results.length === 0) return { ok: false, error: `域名解析为空: ${hostname}` };
+    for (const r of results) {
+      if (isPrivateIp(r.address)) {
+        return { ok: false, error: `域名 ${hostname} 解析到内网地址 ${r.address}` };
+      }
+    }
+    return { ok: true };
+  } catch {
+    return { ok: false, error: `域名解析失败: ${hostname}` };
+  }
+}
+
+/**
+ * 校验 Skill 名称：仅允许字母、数字、下划线、短横线，防止命令注入与路径穿越
+ */
+function sanitizeSkillName(name) {
+  if (typeof name !== 'string' || !/^[a-zA-Z0-9_-]+$/.test(name)) {
+    return null;
+  }
+  return name;
+}
+
 /**
  * 从 Zip 文件导入 Skill
  * 要求 zip 包内有一个顶层目录，目录中包含 SKILL.md
@@ -276,15 +352,15 @@ export function deleteMarkdownSkillDir(skillsDir, name) {
  * @returns {Promise<{ success: boolean, error?: string, skill?: Object }>}
  */
 export async function importMarkdownSkillFromZip(skillsDir, zipBuffer, skillName) {
-  const tmpDir = join(tmpdir(), `ai-helper-skill-import-${Date.now()}`);
-  const tmpZip = join(tmpdir(), `ai-helper-skill-${Date.now()}.zip`);
+  const tmpDir = join(tmpdir(), `ai-helper-skill-import-${Date.now()}-${randomBytes(4).toString('hex')}`);
+  const tmpZip = join(tmpdir(), `ai-helper-skill-${Date.now()}-${randomBytes(4).toString('hex')}.zip`);
 
   try {
     mkdirSync(tmpDir, { recursive: true });
     writeFileSync(tmpZip, zipBuffer);
 
-    // 解压到临时目录
-    execSync(`unzip -o "${tmpZip}" -d "${tmpDir}"`, { encoding: 'utf-8', timeout: 30000 });
+    // 解压到临时目录（execFile 数组参数，不经 shell，杜绝命令注入）
+    await execFileAsync('unzip', ['-o', tmpZip, '-d', tmpDir], { timeout: 30000 });
 
     // 查找 SKILL.md
     const entries = readdirSync(tmpDir);
@@ -316,15 +392,29 @@ export async function importMarkdownSkillFromZip(skillsDir, zipBuffer, skillName
 
     const content = readFileSync(foundSkillMd, 'utf-8');
     const { frontmatter } = parseFrontmatter(content);
-    const name = skillName || frontmatter.name || basename(skillDir === tmpDir ? tmpDir : skillDir);
+    const rawName = skillName || frontmatter.name || basename(skillDir === tmpDir ? tmpDir : skillDir);
+
+    // 名称安全校验：防止命令注入与路径穿越（name 来源于 zip 内可控内容）
+    const safeName = sanitizeSkillName(rawName);
+    if (!safeName) {
+      return { success: false, error: `无效的 Skill 名称: "${rawName}"（仅允许字母、数字、下划线、短横线）` };
+    }
+
+    // 目标目录越界校验：确保 destDir 仍在 skillsDir 之下
+    const destDir = join(skillsDir, safeName);
+    const normalizedDest = normalize(destDir);
+    const normalizedSkills = normalize(skillsDir);
+    if (normalizedDest !== normalizedSkills &&
+        !(normalizedDest.startsWith(normalizedSkills + sep))) {
+      return { success: false, error: '目标路径越界，拒绝写入' };
+    }
 
-    // 复制到 skills 目录
-    const destDir = join(skillsDir, name);
     if (existsSync(destDir)) {
       rmSync(destDir, { recursive: true, force: true });
     }
 
-    execSync(`cp -r "${skillDir}/" "${destDir}"`, { encoding: 'utf-8' });
+    // 复制（execFile 数组参数，不经 shell）
+    await execFileAsync('cp', ['-r', skillDir + '/.', destDir], { timeout: 30000 });
 
     // 重新加载
     const skill = loadMarkdownSkill(destDir);
@@ -347,31 +437,24 @@ export async function importMarkdownSkillFromZip(skillsDir, zipBuffer, skillName
  * @returns {Promise<{ success: boolean, error?: string, skill?: Object }>}
  */
 export async function importMarkdownSkillFromUrl(skillsDir, url) {
-  // URL 安全检查
+  // URL 基础校验
+  let parsed;
   try {
-    const parsed = new URL(url);
-    if (!['http:', 'https:'].includes(parsed.protocol)) {
-      return { success: false, error: '仅支持 http/https 协议的 URL' };
-    }
-    // 禁止访问内网地址
-    if (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1' || parsed.hostname === '[::1]') {
-      return { success: false, error: '禁止访问本地地址' };
-    }
-    // 禁止访问私有网络
-    const octets = parsed.hostname.split('.');
-    if (octets.length === 4) {
-      const first = parseInt(octets[0], 10);
-      const second = parseInt(octets[1], 10);
-      if (first === 10) return { success: false, error: '禁止访问内网地址' };
-      if (first === 172 && second >= 16 && second <= 31) return { success: false, error: '禁止访问内网地址' };
-      if (first === 192 && second === 168) return { success: false, error: '禁止访问内网地址' };
-    }
+    parsed = new URL(url);
   } catch {
     return { success: false, error: '无效的 URL' };
   }
+  if (!['http:', 'https:'].includes(parsed.protocol)) {
+    return { success: false, error: '仅支持 http/https 协议的 URL' };
+  }
+  // 主机安全校验（含 DNS 解析，防 DNS 重绑定与 IP 编码绕过）
+  const hostCheck = await assertPublicHost(parsed.hostname);
+  if (!hostCheck.ok) {
+    return { success: false, error: hostCheck.error };
+  }
 
   try {
-    const buffer = await downloadFile(url);
+    const buffer = await downloadFile(url, 5);
     return await importMarkdownSkillFromZip(skillsDir, buffer);
   } catch (err) {
     return { success: false, error: `下载失败: ${err.message}` };
@@ -380,31 +463,63 @@ export async function importMarkdownSkillFromUrl(skillsDir, url) {
 
 /**
  * 下载文件到 Buffer（支持 http/https，最多重定向 5 次）
+ * 安全：每次重定向目标都重新校验主机（防 302 跳转到内网/云元数据端点）；限制响应体大小
  */
 function downloadFile(url, maxRedirects = 5) {
   return new Promise((resolve, reject) => {
-    const protocol = url.startsWith('https') ? https : http;
-    const chunks = [];
-
-    protocol.get(url, { timeout: 60000 }, (res) => {
-      // 处理重定向（带次数限制）
-      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-        if (maxRedirects <= 0) {
-          reject(new Error('重定向次数过多'));
-          return;
-        }
-        downloadFile(res.headers.location, maxRedirects - 1).then(resolve).catch(reject);
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch {
+      reject(new Error('无效的重定向 URL'));
+      return;
+    }
+    if (!['http:', 'https:'].includes(parsed.protocol)) {
+      reject(new Error('仅支持 http/https 协议'));
+      return;
+    }
+    // 重定向目标必须重新校验主机（防止 302 跳转到内网/元数据端点）
+    assertPublicHost(parsed.hostname).then((hostCheck) => {
+      if (!hostCheck.ok) {
+        reject(new Error(`重定向被拦截: ${hostCheck.error}`));
         return;
       }
+      const protocol = parsed.protocol === 'https:' ? https : http;
+      const chunks = [];
+      let totalSize = 0;
+
+      const req = protocol.get(url, { timeout: 60000 }, (res) => {
+        // 处理重定向（带次数限制 + 主机重校验）
+        if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+          if (maxRedirects <= 0) {
+            reject(new Error('重定向次数过多'));
+            return;
+          }
+          downloadFile(res.headers.location, maxRedirects - 1).then(resolve).catch(reject);
+          return;
+        }
 
-      if (res.statusCode !== 200) {
-        reject(new Error(`HTTP ${res.statusCode}: ${res.statusMessage}`));
-        return;
-      }
+        if (res.statusCode !== 200) {
+          reject(new Error(`HTTP ${res.statusCode}: ${res.statusMessage}`));
+          return;
+        }
 
-      res.on('data', (chunk) => chunks.push(chunk));
-      res.on('end', () => resolve(Buffer.concat(chunks)));
-      res.on('error', reject);
-    }).on('error', reject);
+        res.on('data', (chunk) => {
+          totalSize += chunk.length;
+          if (totalSize > MAX_SKILL_DOWNLOAD_SIZE) {
+            reject(new Error(`下载内容超过上限 ${MAX_SKILL_DOWNLOAD_SIZE} 字节`));
+            req.destroy();
+            return;
+          }
+          chunks.push(chunk);
+        });
+        res.on('end', () => resolve(Buffer.concat(chunks)));
+        res.on('error', reject);
+      });
+      req.on('error', reject);
+      req.on('timeout', () => {
+        req.destroy(new Error('下载超时'));
+      });
+    }).catch(reject);
   });
 }

package/src/skill/registry.js

@@ -121,9 +121,10 @@ export function initializeSkillRegistry() {
   const workflowCount = [...skills.values()].filter(s => s.type === 'workflow').length;
   const agentCount = [...skills.values()].filter(s => s.type === 'agent').length;
   const enabledCount = [...skills.values()].filter(s => s.enabled !== false).length;
-  const builtinCount = [...skills.values()].filter(s => s.builtin).length;
 
-  console.log(`[Skill Registry] 初始化完成，共注册 ${skills.size} 个 Skill (${workflowCount} Workflow + ${agentCount} Agent)，已启用 ${enabledCount}，内置 ${builtinCount}`);
+  if (skills.size > 0) {
+    console.log(`[Skill] ${skills.size} 个已注册 (${workflowCount} Workflow + ${agentCount} Agent)，已启用 ${enabledCount}`);
+  }
   return skills.size;
 }