chainlesschain 0.162.149 → 0.162.151

package/src/commands/init.js

@@ -608,7 +608,7 @@ chainlesschain cli-anything register <tool-name>
  * Auto-detects which backend is available and uses the best one.
  */
 
-const { execSync, spawn } = require("child_process");
+const { execSync, spawn, spawnSync } = require("child_process");
 const fs = require("fs");
 const path = require("path");
 const https = require("https");
@@ -734,9 +734,14 @@ async function audioGenHandler(params) {
   // 2. piper-tts (offline, free)
   if (commandExists("piper")) {
     try {
-      execSync(\`echo "\${text.replace(/"/g, '\\\\"')}" | piper --output_file "\${outputPath}"\`, {
+      // Pass the text via stdin with NO shell — an echo-pipe only escaped
+      // double-quotes, so backticks / \$(...) in \`text\` would still execute.
+      const r = spawnSync("piper", ["--output_file", outputPath], {
+        input: text,
         encoding: "utf-8",
       });
+      if (r.error) throw r.error;
+      if (r.status !== 0) throw new Error(r.stderr || "piper exited " + r.status);
       return {
         success: true,
         backend: "piper-tts",
@@ -1630,6 +1635,40 @@ function callLLM(prompt) {
   return null;
 }
 
+// ── Extract first balanced JSON block (inlined from lib/json-schema-output) ──
+// Must live INSIDE this handler: the module-scope import in init.js is NOT
+// emitted into the generated CJS handler, so referencing it here would throw
+// ReferenceError (swallowed by the surrounding try/catch → xlsx/pptx edits
+// would always report "格式不正确" even on valid LLM output).
+function firstBalancedJson(text, only) {
+  const s = String(text || "");
+  for (let i = 0; i < s.length; i++) {
+    const open = s[i];
+    if (open !== "{" && open !== "[") continue;
+    if (only && open !== only) continue;
+    const close = open === "{" ? "}" : "]";
+    let depth = 0;
+    let inStr = false;
+    let esc = false;
+    for (let j = i; j < s.length; j++) {
+      const c = s[j];
+      if (inStr) {
+        if (esc) esc = false;
+        else if (c === "\\\\") esc = true;
+        else if (c === '"') inStr = false;
+        continue;
+      }
+      if (c === '"') inStr = true;
+      else if (c === open) depth++;
+      else if (c === close) {
+        depth--;
+        if (depth === 0) return s.slice(i, j + 1);
+      }
+    }
+  }
+  return null;
+}
+
 // ── Output path helper ────────────────────────────────────────────────────────
 function buildOutputPath(inputFile, outputDir) {
   const ext = path.extname(inputFile);
@@ -2391,6 +2430,11 @@ The AI assistant will follow these guidelines when working in this project.
   },
 };
 
+// Test-only: expose the skill handler templates so a regression test can load
+// the emitted CJS handler and verify its free identifiers resolve (e.g. that
+// firstBalancedJson is inlined, not left dangling from a module-scope import).
+export const _SKILL_TEMPLATES = SKILL_TEMPLATES;
+
 export function registerInitCommand(program) {
   program
     .command("init")

package/src/commands/kg.js

@@ -11,6 +11,7 @@ import { parseJsonOption } from "../lib/parse-json-option.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensureKnowledgeGraphTables,
+  loadFromDb as loadKgFromDb,
   listEntityTypes,
   addEntity,
   getEntity,
@@ -65,6 +66,9 @@ function _dbFromCtx(ctx) {
   }
   const db = ctx.db.getDatabase();
   ensureKnowledgeGraphTables(db);
+  // The CLI is one-shot: hydrate the in-memory graph from the DB so persisted
+  // entities/relations are visible (and mutations resolve) this invocation.
+  loadKgFromDb(db);
   return db;
 }
 

package/src/commands/loop.js

@@ -379,7 +379,12 @@ export function registerLoopCommand(program) {
               res.durationMs = Date.now() - t0;
               // --dynamic: read the iteration's [[loop:next]] / [[loop:stop]]
               // directive and surface it to runLoop as done / nextDelayMs.
-              if (options.dynamic) {
+              // Use the RESOLVED `dynamic` (not raw options.dynamic): on
+              // `cc loop --resume`, dynamic is rehydrated from saved config while
+              // options.dynamic is false — gating on the raw flag would skip
+              // directive parsing and the model's [[loop:stop]] would be ignored,
+              // running the loop forever.
+              if (dynamic) {
                 const d = parseLoopDirectives(res.output);
                 res.done = d.done;
                 if (d.nextDelayMs != null) res.nextDelayMs = d.nextDelayMs;

package/src/commands/lowcode.js

@@ -684,8 +684,18 @@ export function registerLowcodeCommand(program) {
       let ctx;
       try {
         ctx = await bootstrap();
-        ensureLowcodeTables(ctx.db);
-        const result = deployApp(ctx.db, appId, {
+        if (!ctx.db) {
+          spinner.fail("Database not available");
+          process.exitCode = 1;
+          return;
+        }
+        // Every sibling unwraps the raw better-sqlite3 handle before use;
+        // ensureLowcodeTables/deployApp call db.exec()/db.prepare(), which the
+        // ctx.db WRAPPER doesn't expose — passing the wrapper threw "db.exec is
+        // not a function" and made `lowcode deploy` fail 100% of the time.
+        const db = ctx.db.getDatabase();
+        ensureLowcodeTables(db);
+        const result = deployApp(db, appId, {
           outputDir: options.output || undefined,
         });
         spinner.succeed(
@@ -696,6 +706,9 @@ export function registerLowcodeCommand(program) {
         logger.log(`  Deployed:  ${result.deployedAt}`);
       } catch (err) {
         spinner.fail(chalk.red(`Deploy failed: ${err.message}`));
+        // Signal failure to the shell (siblings exit(1)); exitCode (not exit())
+        // so the finally teardown below still runs.
+        process.exitCode = 1;
       } finally {
         if (ctx) await shutdown(ctx);
       }

package/src/commands/marketplace.js

@@ -11,6 +11,7 @@ import { parseJsonOption } from "../lib/parse-json-option.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensureMarketplaceTables,
+  loadFromDb as loadMarketplaceFromDb,
   listServiceStatus,
   listInvocationStatus,
   publishService,
@@ -55,6 +56,11 @@ function _dbFromCtx(ctx) {
   }
   const db = ctx.db.getDatabase();
   ensureMarketplaceTables(db);
+  // Rehydrate the in-memory _services/_invocations Maps from the DB — the CLI is
+  // one-shot, so without this every read is Map-only-empty and a service
+  // published in a prior invocation is invisible (record/show/status throw
+  // "Service not found").
+  loadMarketplaceFromDb(db);
   return db;
 }
 
@@ -155,7 +161,7 @@ export function registerMarketplaceCommand(program) {
     )
     .option("-o, --owner <did>", "Filter by owner DID")
     .option("-n, --name <substring>", "Name substring filter")
-    .option("--limit <n>", "Maximum entries", parseInt, 50)
+    .option("--limit <n>", "Maximum entries", (v) => parseInt(v, 10), 50)
     .option("--json", "Output as JSON")
     .action(async (options) => {
       try {
@@ -286,7 +292,7 @@ export function registerMarketplaceCommand(program) {
     .option("-s, --service <id>", "Filter by service")
     .option("-c, --caller <did>", "Filter by caller")
     .option("-S, --status <s>", "Filter by status")
-    .option("--limit <n>", "Maximum entries", parseInt, 50)
+    .option("--limit <n>", "Maximum entries", (v) => parseInt(v, 10), 50)
     .option("--json", "Output as JSON")
     .action(async (options) => {
       try {
@@ -467,7 +473,11 @@ export function registerMarketplaceCommand(program) {
   mp.command("complete-invocation <invocation-id>")
     .description("Complete a V2 invocation (RUNNING → SUCCESS)")
     .option("-o, --output <json>", "JSON-encoded output")
-    .option("-d, --duration-ms <n>", "Duration in milliseconds", intArg("--duration-ms"))
+    .option(
+      "-d, --duration-ms <n>",
+      "Duration in milliseconds",
+      intArg("--duration-ms"),
+    )
     .option("--json", "Output as JSON")
     .action(async (invocationId, options) => {
       try {
@@ -497,7 +507,11 @@ export function registerMarketplaceCommand(program) {
   mp.command("fail-invocation <invocation-id>")
     .description("Fail a V2 invocation")
     .option("-m, --message <msg>", "Error message")
-    .option("-d, --duration-ms <n>", "Duration in milliseconds", intArg("--duration-ms"))
+    .option(
+      "-d, --duration-ms <n>",
+      "Duration in milliseconds",
+      intArg("--duration-ms"),
+    )
     .action(async (invocationId, options) => {
       try {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
@@ -516,7 +530,11 @@ export function registerMarketplaceCommand(program) {
 
   mp.command("timeout-invocation <invocation-id>")
     .description("Timeout a V2 invocation")
-    .option("-d, --duration-ms <n>", "Duration in milliseconds", intArg("--duration-ms"))
+    .option(
+      "-d, --duration-ms <n>",
+      "Duration in milliseconds",
+      intArg("--duration-ms"),
+    )
     .action(async (invocationId, options) => {
       try {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
@@ -616,7 +634,23 @@ export function registerMarketplaceCommand(program) {
     .option("--json", "Output JSON")
     .action(async (itemId, options) => {
       try {
-        const threshold = options.thresholdFen ?? LARGE_PURCHASE_THRESHOLD_FEN;
+        // A malformed --threshold-fen becomes NaN (parseInt("abc")), and
+        // `NaN ?? default` keeps NaN (nullish coalescing only catches
+        // null/undefined) — so `amountFen >= NaN` is always false and a large
+        // order that must route through M-of-N multisig would silently take the
+        // direct path. Reject a non-finite explicit override (mirrors the
+        // --amount-fen guard below); fall back to the default only when omitted.
+        let threshold = LARGE_PURCHASE_THRESHOLD_FEN;
+        if (options.thresholdFen !== undefined) {
+          if (
+            !Number.isFinite(options.thresholdFen) ||
+            options.thresholdFen < 0
+          ) {
+            logger.error("--threshold-fen must be a non-negative integer");
+            process.exit(2);
+          }
+          threshold = options.thresholdFen;
+        }
         const amountFen = options.amountFen;
         if (!Number.isFinite(amountFen) || amountFen <= 0) {
           logger.error("--amount-fen must be positive integer");

package/src/commands/matrix.js

@@ -9,6 +9,7 @@ import { logger } from "../lib/logger.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensureMatrixTables,
+  loadFromDb,
   login,
   listRooms,
   sendMessage,
@@ -45,6 +46,7 @@ export function registerMatrixCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureMatrixTables(db);
+        loadFromDb(db);
 
         const result = login(
           db,
@@ -75,6 +77,7 @@ export function registerMatrixCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureMatrixTables(db);
+        loadFromDb(db);
 
         const rooms = listRooms();
         if (options.json) {
@@ -108,6 +111,7 @@ export function registerMatrixCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureMatrixTables(db);
+        loadFromDb(db);
 
         const result = sendMessage(db, roomId, message, options.type);
         logger.success(`Message sent to ${chalk.cyan(roomId)}`);
@@ -133,9 +137,15 @@ export function registerMatrixCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureMatrixTables(db);
+        loadFromDb(db);
 
         const messages = getMessages(roomId, {
-          limit: numericOption(options.limit, { name: "--limit", integer: true, min: 1, fallback: 50 }),
+          limit: numericOption(options.limit, {
+            name: "--limit",
+            integer: true,
+            min: 1,
+            fallback: 50,
+          }),
         });
         if (options.json) {
           console.log(JSON.stringify(messages, null, 2));
@@ -165,6 +175,7 @@ export function registerMatrixCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureMatrixTables(db);
+        loadFromDb(db);
 
         const result = joinRoom(db, roomId);
         logger.success(`Joined room ${chalk.cyan(result.room.roomId)}`);
@@ -203,6 +214,7 @@ export function registerMatrixCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureMatrixTables(db);
+        loadFromDb(db);
 
         const result = sendThreadReply(db, {
           roomId,
@@ -239,6 +251,7 @@ export function registerMatrixCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureMatrixTables(db);
+        loadFromDb(db);
 
         const messages = getThreadMessages(roomId, rootEventId);
         if (options.json) {
@@ -270,6 +283,7 @@ export function registerMatrixCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureMatrixTables(db);
+        loadFromDb(db);
 
         const roots = getThreadRoots(roomId);
         if (options.json) {
@@ -310,6 +324,7 @@ export function registerMatrixCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureMatrixTables(db);
+        loadFromDb(db);
 
         const result = createSpace(db, { name, topic: options.topic });
         if (options.json) {
@@ -339,6 +354,7 @@ export function registerMatrixCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureMatrixTables(db);
+        loadFromDb(db);
 
         const result = addSpaceChild(db, {
           spaceId,
@@ -372,6 +388,7 @@ export function registerMatrixCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureMatrixTables(db);
+        loadFromDb(db);
 
         const result = removeSpaceChild(db, { spaceId, childRoomId });
         if (result.removed) {
@@ -401,6 +418,7 @@ export function registerMatrixCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureMatrixTables(db);
+        loadFromDb(db);
 
         const children = listSpaceChildren(spaceId);
         if (options.json) {
@@ -432,6 +450,7 @@ export function registerMatrixCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureMatrixTables(db);
+        loadFromDb(db);
 
         const spaces = listSpaces();
         if (options.json) {

package/src/commands/memory.js

@@ -603,7 +603,10 @@ export function registerMemoryCommand(program) {
             (process.platform === "win32" ? "notepad" : "nano");
           const filePath = `${memoryDir}/MEMORY.md`;
           try {
-            execSync(`${editor} "${filePath}"`, { stdio: "inherit" });
+            // Escape any `"` in the path so it can't break out of the quoted
+            // arg (editor stays unquoted so `$EDITOR` values with args work).
+            const safePath = filePath.replace(/"/g, '\\"');
+            execSync(`${editor} "${safePath}"`, { stdio: "inherit" });
             logger.success("Memory file updated");
           } catch {
             logger.error(

package/src/commands/mtc.js

@@ -2355,7 +2355,13 @@ function registerFederationGovernanceCommands(fed) {
     .action((hostFed, trustedFed, options) => {
       try {
         const roster = (options.member || []).map((entry) => {
-          const [member_id, pubkey_id] = entry.split(":", 2);
+          // Split on the FIRST colon only: a pubkey_id is itself colon-delimited
+          // (`sha256:<base64url>`), so `split(":", 2)` would silently DROP the
+          // digest tail (pubkey_id becomes just "sha256") and write a corrupt
+          // trust anchor that can never match a real member at verification.
+          const idx = entry.indexOf(":");
+          const member_id = idx >= 0 ? entry.slice(0, idx) : "";
+          const pubkey_id = idx >= 0 ? entry.slice(idx + 1) : "";
           if (!member_id || !pubkey_id) {
             throw new Error(
               `bad --member entry "${entry}", expected id:pubkey_id`,

package/src/commands/nostr.js

@@ -9,6 +9,7 @@ import { logger } from "../lib/logger.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensureNostrTables,
+  loadFromDb,
   listRelays,
   addRelay,
   publishEvent,
@@ -39,6 +40,7 @@ export function registerNostrCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureNostrTables(db);
+        loadFromDb(db);
 
         const relays = listRelays();
         if (options.json) {
@@ -73,6 +75,7 @@ export function registerNostrCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureNostrTables(db);
+        loadFromDb(db);
 
         const relay = addRelay(db, url);
         logger.success(`Relay added: ${chalk.cyan(relay.url)}`);
@@ -101,10 +104,15 @@ export function registerNostrCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureNostrTables(db);
+        loadFromDb(db);
 
         const result = publishEvent(
           db,
-          numericOption(options.kind, { name: "--kind", integer: true, min: 0 }),
+          numericOption(options.kind, {
+            name: "--kind",
+            integer: true,
+            min: 0,
+          }),
           content,
           options.pubkey,
           [],
@@ -140,9 +148,24 @@ export function registerNostrCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureNostrTables(db);
-
-        const filter = { limit: numericOption(options.limit, { name: "--limit", integer: true, min: 1, fallback: 50 }) };
-        if (options.kind) filter.kinds = [numericOption(options.kind, { name: "--kind", integer: true, min: 0 })];
+        loadFromDb(db);
+
+        const filter = {
+          limit: numericOption(options.limit, {
+            name: "--limit",
+            integer: true,
+            min: 1,
+            fallback: 50,
+          }),
+        };
+        if (options.kind)
+          filter.kinds = [
+            numericOption(options.kind, {
+              name: "--kind",
+              integer: true,
+              min: 0,
+            }),
+          ];
         const events = getEvents(filter);
         if (options.json) {
           console.log(JSON.stringify(events, null, 2));
@@ -218,6 +241,7 @@ export function registerNostrCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureNostrTables(db);
+        loadFromDb(db);
 
         const result = publishDirectMessage(db, {
           senderPrivkey: options.senderPriv,
@@ -259,6 +283,7 @@ export function registerNostrCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureNostrTables(db);
+        loadFromDb(db);
 
         const events = getEvents({ kinds: [4], limit: 1000 });
         const event = events.find((e) => e.id === eventId);
@@ -305,6 +330,7 @@ export function registerNostrCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureNostrTables(db);
+        loadFromDb(db);
 
         const result = publishDeletion(db, {
           eventIds,
@@ -349,6 +375,7 @@ export function registerNostrCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureNostrTables(db);
+        loadFromDb(db);
 
         const result = publishReaction(db, {
           targetEventId,

package/src/commands/note.js

@@ -7,7 +7,7 @@ import chalk from "chalk";
 import { numericOption } from "../lib/cli-numeric.js";
 import { logger } from "../lib/logger.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
-import { likePrefix } from "../lib/sql-like.js";
+import { likePrefix, escapeLike } from "../lib/sql-like.js";
 import { safeJsonParse } from "../lib/safe-json.js";
 import {
   ensureVersionsTable,
@@ -259,7 +259,7 @@ export function registerNoteCommand(program) {
               `Category: ${note.category}  Created: ${note.created_at}`,
             ),
           );
-          const tags = JSON.parse(note.tags || "[]");
+          const tags = safeJsonParse(note.tags, []);
           if (tags.length > 0) {
             logger.log(chalk.gray(`Tags: ${tags.join(", ")}`));
           }
@@ -291,10 +291,13 @@ export function registerNoteCommand(program) {
         const rawDb = ctx.db.getDatabase();
         ensureNotesTable(rawDb);
 
-        const pattern = `%${query}%`;
+        // Escape LIKE metacharacters so a `%`/`_` in the user's query matches
+        // literally instead of acting as a wildcard (`search "%"` would
+        // otherwise match every note). Mirrors the `id LIKE ? ESCAPE '\'` sites.
+        const pattern = `%${escapeLike(query)}%`;
         const notes = rawDb
           .prepare(
-            "SELECT id, title, category, created_at FROM notes WHERE deleted_at IS NULL AND (title LIKE ? OR content LIKE ?) ORDER BY created_at DESC LIMIT 50",
+            "SELECT id, title, category, created_at FROM notes WHERE deleted_at IS NULL AND (title LIKE ? ESCAPE '\\' OR content LIKE ? ESCAPE '\\') ORDER BY created_at DESC LIMIT 50",
           )
           .all(pattern, pattern);