chainlesschain 0.162.175 → 0.162.177

package/src/lib/secret-store.js

@@ -0,0 +1,159 @@
+/**
+ * Small OS-backed secret store used by plugin options and other user-scoped
+ * credentials.  Secrets never fall back to plaintext JSON:
+ *   - Windows: DPAPI (CurrentUser) encrypted blobs in the user data dir
+ *   - macOS:   Keychain via `security`
+ *   - Linux:   Secret Service via `secret-tool`
+ *
+ * The command runner is injectable so the protocol is deterministic in unit
+ * tests and so callers can route it through ProcessExecutionBroker.
+ */
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { getElectronUserDataDir } from "./paths.js";
+import { executionBroker } from "./process-execution-broker/index.js";
+
+const DPAPI_SCRIPT = [
+  "$ErrorActionPreference='Stop'",
+  "Add-Type -AssemblyName System.Security",
+  "$raw=[Console]::In.ReadToEnd()",
+  "$b=[Convert]::FromBase64String($raw)",
+  "$p=[Security.Cryptography.ProtectedData]::Protect($b,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser)",
+  "[Console]::Write([Convert]::ToBase64String($p))",
+].join("; ");
+
+const DPAPI_UNPROTECT_SCRIPT = [
+  "$ErrorActionPreference='Stop'",
+  "Add-Type -AssemblyName System.Security",
+  "$raw=[Console]::In.ReadToEnd()",
+  "$b=[Convert]::FromBase64String($raw)",
+  "$p=[Security.Cryptography.ProtectedData]::Unprotect($b,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser)",
+  "[Console]::Write([Convert]::ToBase64String($p))",
+].join("; ");
+
+function defaultRunner(file, args, input = undefined) {
+  const result = executionBroker.spawnSync(file, args, {
+    origin: "secret-store",
+    policy: "allow",
+    stdio: ["ignore", "pipe", "pipe"],
+    encoding: "utf8",
+    windowsHide: true,
+    ...(input !== undefined ? { input } : {}),
+  });
+  if (result.status !== 0) {
+    throw new Error(String(result.stderr || "secret store command failed").trim());
+  }
+  return String(result.stdout || "").trim();
+}
+
+function safeToken(value) {
+  return crypto
+    .createHash("sha256")
+    .update(String(value || ""))
+    .digest("hex")
+    .slice(0, 32);
+}
+
+function chooseBackend(platform = process.platform) {
+  if (platform === "win32") return "dpapi";
+  if (platform === "darwin") return "keychain";
+  if (platform === "linux" || platform === "freebsd") return "secret-service";
+  return "unavailable";
+}
+
+function readJson(file, readFile = fs.readFileSync) {
+  try {
+    const value = JSON.parse(readFile(file, "utf8"));
+    return value && typeof value === "object" && !Array.isArray(value)
+      ? value
+      : {};
+  } catch {
+    return {};
+  }
+}
+
+function writeJson(file, value, deps = {}) {
+  const mkdirSync = deps.mkdirSync || fs.mkdirSync;
+  const writeFileSync = deps.writeFileSync || fs.writeFileSync;
+  mkdirSync(path.dirname(file), { recursive: true });
+  writeFileSync(file, JSON.stringify(value, null, 2), { encoding: "utf8", mode: 0o600 });
+  try { fs.chmodSync(file, 0o600); } catch {}
+}
+
+function createDpapiBackend({ file, runner, readFile, writeFile, mkdirSync } = {}) {
+  const storeFile = file || path.join(getElectronUserDataDir(), "plugin-secrets.dpapi.json");
+  const load = () => readJson(storeFile, readFile);
+  const save = (v) => writeJson(storeFile, v, { writeFileSync: writeFile, mkdirSync });
+  return {
+    name: "dpapi",
+    set(key, value) {
+      const payload = Buffer.from(String(value), "utf8").toString("base64");
+      const encoded = runner("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", DPAPI_SCRIPT], payload);
+      const data = load(); data[key] = encoded; save(data);
+    },
+    get(key) {
+      const encoded = load()[key];
+      if (!encoded) return null;
+      const plain = runner("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", DPAPI_UNPROTECT_SCRIPT], encoded);
+      return Buffer.from(plain, "base64").toString("utf8");
+    },
+    delete(key) {
+      const data = load();
+      if (!Object.prototype.hasOwnProperty.call(data, key)) return false;
+      delete data[key]; save(data); return true;
+    },
+  };
+}
+
+function createKeychainBackend({ service, runner } = {}) {
+  const name = service || "com.chainlesschain.plugin";
+  return {
+    name: "keychain",
+    set(key, value) {
+      runner("security", ["add-generic-password", "-a", key, "-s", name, "-w", String(value), "-U"]);
+    },
+    get(key) {
+      try { return runner("security", ["find-generic-password", "-a", key, "-s", name, "-w"]) || null; } catch { return null; }
+    },
+    delete(key) {
+      try { runner("security", ["delete-generic-password", "-a", key, "-s", name]); return true; } catch { return false; }
+    },
+  };
+}
+
+function createSecretServiceBackend({ service, runner } = {}) {
+  const name = service || "chainlesschain-plugin";
+  return {
+    name: "secret-service",
+    set(key, value) {
+      runner("secret-tool", ["store", "--label", `${name}:${key}`, "service", name, "account", key], String(value));
+    },
+    get(key) {
+      try { return runner("secret-tool", ["lookup", "service", name, "account", key]) || null; } catch { return null; }
+    },
+    delete(key) {
+      try { runner("secret-tool", ["clear", "service", name, "account", key]); return true; } catch { return false; }
+    },
+  };
+}
+
+/** Create a fail-closed secret store. `memory` is intended for tests only. */
+export function createSecretStore(options = {}) {
+  const backend = options.backend || chooseBackend(options.platform);
+  const runner = options.runner || defaultRunner;
+  if (backend === "memory") {
+    const values = options.values || new Map();
+    return { name: "memory", set: (k, v) => values.set(k, String(v)), get: (k) => values.get(k) ?? null, delete: (k) => values.delete(k) };
+  }
+  if (backend === "dpapi") return createDpapiBackend({ ...options, runner });
+  if (backend === "keychain") return createKeychainBackend({ ...options, runner });
+  if (backend === "secret-service") return createSecretServiceBackend({ ...options, runner });
+  throw new Error(`No OS secret store available for platform ${options.platform || process.platform}`);
+}
+
+export function secretRef(key) { return { __cc_secret_ref: String(key) }; }
+export function isSecretRef(value) { return Boolean(value && typeof value === "object" && value.__cc_secret_ref); }
+export { chooseBackend };

package/src/lib/service-manager.js

@@ -1,11 +1,26 @@
-import { execSync, spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import logger from "./logger.js";
+import { executionBroker } from "./process-execution-broker/index.js";
+
+export const _deps = {
+  execFileSync: (...args) => executionBroker.execFileSync(...args),
+  spawn: (...args) => executionBroker.spawn(...args),
+};
+
+function syncDocker(command, args, options = {}, origin = "service:docker") {
+  return _deps.execFileSync(command, args, {
+    ...options,
+    origin,
+    policy: "allow",
+    scope: "service",
+    shell: false,
+  });
+}
 
 export function isDockerAvailable() {
   try {
-    execSync("docker --version", { stdio: "ignore" });
+    syncDocker("docker", ["--version"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -14,11 +29,11 @@ export function isDockerAvailable() {
 
 export function isDockerComposeAvailable() {
   try {
-    execSync("docker compose version", { stdio: "ignore" });
+    syncDocker("docker", ["compose", "version"], { stdio: "ignore" });
     return true;
   } catch {
     try {
-      execSync("docker-compose --version", { stdio: "ignore" });
+      syncDocker("docker-compose", ["--version"], { stdio: "ignore" });
       return true;
     } catch {
       return false;
@@ -26,12 +41,12 @@ export function isDockerComposeAvailable() {
   }
 }
 
-function getComposeCommand() {
+export function getComposeInvocation() {
   try {
-    execSync("docker compose version", { stdio: "ignore" });
-    return "docker compose";
+    syncDocker("docker", ["compose", "version"], { stdio: "ignore" });
+    return { command: "docker", prefixArgs: ["compose"] };
   } catch {
-    return "docker-compose";
+    return { command: "docker-compose", prefixArgs: [] };
   }
 }
 
@@ -54,30 +69,37 @@ export function findComposeFile(searchPaths) {
 }
 
 export function servicesUp(composePath, options = {}) {
-  const cmd = getComposeCommand();
+  const invocation = getComposeInvocation();
   const args = ["-f", composePath, "up", "-d"];
   if (options.services) {
     args.push(...options.services);
   }
-  return runCompose(cmd, args);
+  return runCompose(invocation, args);
 }
 
 export function servicesDown(composePath) {
-  const cmd = getComposeCommand();
-  return runCompose(cmd, ["-f", composePath, "down"]);
+  const invocation = getComposeInvocation();
+  return runCompose(invocation, ["-f", composePath, "down"]);
 }
 
 export function servicesLogs(composePath, options = {}) {
-  const cmd = getComposeCommand();
+  const invocation = getComposeInvocation();
   const args = ["-f", composePath, "logs"];
   if (options.follow) args.push("-f");
   if (options.tail) args.push("--tail", String(options.tail));
   if (options.services) args.push(...options.services);
 
-  const parts = cmd.split(" ");
-  const child = spawn(parts[0], [...parts.slice(1), ...args], {
-    stdio: "inherit",
-  });
+  const child = _deps.spawn(
+    invocation.command,
+    [...invocation.prefixArgs, ...args],
+    {
+      stdio: "inherit",
+      origin: "service:compose-logs",
+      policy: "allow",
+      scope: "service",
+      shell: false,
+    },
+  );
 
   return new Promise((resolve, reject) => {
     child.on("close", (code) => {
@@ -89,17 +111,22 @@ export function servicesLogs(composePath, options = {}) {
 }
 
 export function servicesPull(composePath) {
-  const cmd = getComposeCommand();
-  return runCompose(cmd, ["-f", composePath, "pull"]);
+  const invocation = getComposeInvocation();
+  return runCompose(invocation, ["-f", composePath, "pull"]);
 }
 
 export function getServiceStatus(composePath) {
-  const cmd = getComposeCommand();
+  const invocation = getComposeInvocation();
   try {
-    const output = execSync(`${cmd} -f "${composePath}" ps --format json`, {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "ignore"],
-    });
+    const output = syncDocker(
+      invocation.command,
+      [...invocation.prefixArgs, "-f", composePath, "ps", "--format", "json"],
+      {
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "ignore"],
+      },
+      "service:compose-status",
+    );
     try {
       return JSON.parse(`[${output.trim().split("\n").join(",")}]`);
     } catch {
@@ -110,14 +137,22 @@ export function getServiceStatus(composePath) {
   }
 }
 
-function runCompose(cmd, args) {
-  const fullCmd = `${cmd} ${args.map((a) => (a.includes(" ") ? `"${a}"` : a)).join(" ")}`;
-  logger.verbose(`Running: ${fullCmd}`);
+function runCompose(invocation, args) {
+  const fullArgs = [...invocation.prefixArgs, ...args];
+  const display = [invocation.command, ...fullArgs]
+    .map((part) => JSON.stringify(String(part)))
+    .join(" ");
+  logger.verbose(`Running: ${display}`);
   try {
-    execSync(fullCmd, { stdio: "inherit" });
+    syncDocker(
+      invocation.command,
+      fullArgs,
+      { stdio: "inherit" },
+      "service:compose",
+    );
     return true;
   } catch (err) {
-    logger.error(`Command failed: ${fullCmd}`);
+    logger.error(`Command failed: ${display}`);
     throw err;
   }
 }

package/src/lib/settings-hook-events.cjs

@@ -17,10 +17,31 @@
  */
 
 const { collectHooks } = require("./settings-hooks.cjs");
-const { runHooks } = require("./hook-runner.cjs");
+const hookRunner = require("./hook-runner.cjs");
+const _deps = { runHooks: hookRunner.runHooks };
 const { buildHookEnvelope } = require("./hook-event-bus.cjs");
 const hookEventLog = require("./hook-event-log.cjs");
 
+/**
+ * Publish lifecycle events to Hooks v2 without making the legacy settings hook
+ * path depend on the ESM runtime. Payloads are deliberately reduced before
+ * publication: prompt text and file contents must never become durable hook
+ * context merely because a lifecycle producer fired.
+ */
+function publishHooksV2Event(event, payload = {}) {
+  const safe = { ...payload };
+  delete safe.prompt;
+  delete safe.content;
+  delete safe.files;
+  void import("./hooks-v2-producers.js")
+    .then(({ emitHooksV2Event }) => {
+      emitHooksV2Event(event, safe);
+    })
+    .catch(() => {
+      // Optional producer bridge; legacy settings hooks remain authoritative.
+    });
+}
+
 /**
  * Stamp a unified-bus delivery id (event_id) onto a hook payload (P2 event bus).
  * Additive — a hook that ignores it is unaffected; a hook that reads it gets a
@@ -104,6 +125,10 @@ function runUserPromptSubmitHooks(
   settingsHooks,
   { prompt, cwd, sessionId } = {},
 ) {
+  publishHooksV2Event("UserPromptSubmit", {
+    cwd: cwd || null,
+    session_id: sessionId || null,
+  });
   if (!settingsHooks) return { blocked: false, additionalContext: null };
   const matched = collectHooks(settingsHooks, "UserPromptSubmit", "");
   if (matched.length === 0) return { blocked: false, additionalContext: null };
@@ -119,7 +144,7 @@ function runUserPromptSubmitHooks(
     },
     { sessionId },
   );
-  const outcome = runHooks(sync, payload, {
+  const outcome = _deps.runHooks(sync, payload, {
     cwd,
     event: "UserPromptSubmit",
   });
@@ -159,7 +184,7 @@ function dispatchAsyncHooks(settingsHooks, event, payload = {}, opts = {}) {
   return supervisor.dispatch(
     asyncHooks,
     { hook_event_name: event, cwd: opts.cwd, ...payload },
-    { cwd: opts.cwd },
+    { cwd: opts.cwd, broker: opts.broker },
   );
 }
 
@@ -169,6 +194,11 @@ function dispatchAsyncHooks(settingsHooks, event, payload = {}, opts = {}) {
  * @returns {{ additionalContext:string|null }}
  */
 function runSessionStartHooks(settingsHooks, { source, cwd, sessionId } = {}) {
+  publishHooksV2Event("SessionStart", {
+    source: source || "startup",
+    cwd: cwd || null,
+    session_id: sessionId || null,
+  });
   if (!settingsHooks) return { additionalContext: null };
   const matched = collectHooks(settingsHooks, "SessionStart", source || "");
   if (matched.length === 0) return { additionalContext: null };
@@ -182,7 +212,10 @@ function runSessionStartHooks(settingsHooks, { source, cwd, sessionId } = {}) {
     },
     { sessionId },
   );
-  const outcome = runHooks(matched, payload, { cwd, event: "SessionStart" });
+  const outcome = _deps.runHooks(matched, payload, {
+    cwd,
+    event: "SessionStart",
+  });
   return { additionalContext: aggregateContext(outcome.results) };
 }
 
@@ -199,6 +232,11 @@ function runCwdChangedHooks(
   settingsHooks,
   { oldCwd, newCwd, cwd, sessionId } = {},
 ) {
+  publishHooksV2Event("CwdChanged", {
+    old_cwd: oldCwd || null,
+    cwd: newCwd || cwd || null,
+    session_id: sessionId || null,
+  });
   if (!settingsHooks) return { additionalContext: null };
   const matched = collectHooks(settingsHooks, "CwdChanged", newCwd || "");
   const { sync } = partitionAsyncHooks(matched);
@@ -213,7 +251,7 @@ function runCwdChangedHooks(
     },
     { sessionId },
   );
-  const outcome = runHooks(sync, payload, {
+  const outcome = _deps.runHooks(sync, payload, {
     cwd: newCwd || cwd,
     event: "CwdChanged",
   });
@@ -234,6 +272,13 @@ function runWorktreeCreateHooks(
   settingsHooks,
   { worktreePath, branch, baseSha, cwd, sessionId } = {},
 ) {
+  publishHooksV2Event("WorktreeCreate", {
+    worktree_path: worktreePath || null,
+    branch: branch || null,
+    base_sha: baseSha || null,
+    cwd: cwd || worktreePath || null,
+    session_id: sessionId || null,
+  });
   if (!settingsHooks) return { additionalContext: null };
   const matched = collectHooks(settingsHooks, "WorktreeCreate", branch || "");
   const { sync } = partitionAsyncHooks(matched);
@@ -250,7 +295,7 @@ function runWorktreeCreateHooks(
     },
     { sessionId },
   );
-  const outcome = runHooks(sync, payload, {
+  const outcome = _deps.runHooks(sync, payload, {
     cwd: cwd || worktreePath,
     event: "WorktreeCreate",
   });
@@ -271,6 +316,14 @@ function runWorktreeRemoveHooks(
   settingsHooks,
   { worktreePath, branch, removed, reason, cwd, sessionId } = {},
 ) {
+  publishHooksV2Event("WorktreeRemove", {
+    worktree_path: worktreePath || null,
+    branch: branch || null,
+    removed: removed === true,
+    reason: reason || null,
+    cwd: cwd || worktreePath || null,
+    session_id: sessionId || null,
+  });
   if (!settingsHooks) return { additionalContext: null };
   const matched = collectHooks(settingsHooks, "WorktreeRemove", branch || "");
   const { sync } = partitionAsyncHooks(matched);
@@ -288,7 +341,7 @@ function runWorktreeRemoveHooks(
     },
     { sessionId },
   );
-  const outcome = runHooks(sync, payload, {
+  const outcome = _deps.runHooks(sync, payload, {
     cwd: cwd || worktreePath,
     event: "WorktreeRemove",
   });
@@ -312,6 +365,11 @@ function runInstructionsLoadedHooks(
   settingsHooks,
   { files, cwd, sessionId } = {},
 ) {
+  publishHooksV2Event("InstructionsLoaded", {
+    count: Array.isArray(files) ? files.length : 0,
+    cwd: cwd || null,
+    session_id: sessionId || null,
+  });
   if (!settingsHooks) return { additionalContext: null };
   const matched = collectHooks(settingsHooks, "InstructionsLoaded", "");
   const { sync } = partitionAsyncHooks(matched);
@@ -332,7 +390,7 @@ function runInstructionsLoadedHooks(
     },
     { sessionId },
   );
-  const outcome = runHooks(sync, payload, {
+  const outcome = _deps.runHooks(sync, payload, {
     cwd,
     event: "InstructionsLoaded",
   });
@@ -353,11 +411,17 @@ function runObserveHooks(
   payload = {},
   { cwd, matchTarget, traceId, parentId } = {},
 ) {
+  publishHooksV2Event(event, {
+    ...payload,
+    cwd: cwd || payload.cwd || null,
+    trace_id: traceId || payload.trace_id || null,
+    parent_id: parentId || payload.parent_id || null,
+  });
   if (!settingsHooks) return { decision: "continue", results: [] };
   const matched = collectHooks(settingsHooks, event, matchTarget || "");
   const { sync } = partitionAsyncHooks(matched);
   if (sync.length === 0) return { decision: "continue", results: [] };
-  return runHooks(
+  return _deps.runHooks(
     sync,
     withDeliveryId(
       event,
@@ -380,4 +444,5 @@ module.exports = {
   aggregateContext,
   partitionAsyncHooks,
   dispatchAsyncHooks,
+  _deps,
 };

package/src/lib/settings-hook-events.js

@@ -0,0 +1,20 @@
+import { runHooks } from "./hook-runner.js";
+import events from "./settings-hook-events.cjs";
+
+events._deps.runHooks = runHooks;
+
+export const {
+  withDeliveryId,
+  runUserPromptSubmitHooks,
+  runSessionStartHooks,
+  runCwdChangedHooks,
+  runWorktreeCreateHooks,
+  runWorktreeRemoveHooks,
+  runInstructionsLoadedHooks,
+  runObserveHooks,
+  aggregateContext,
+  partitionAsyncHooks,
+  dispatchAsyncHooks,
+} = events;
+
+export default events;

package/src/lib/settings-hooks.cjs

@@ -252,6 +252,10 @@ function collectHooks(hooksBlock, event, toolName) {
           event,
           async: h.async === true,
           asyncRewake: h.asyncRewake === true,
+          origin: h.origin || "hook",
+          pluginId: h.pluginId || null,
+          pluginVersion: h.pluginVersion || null,
+          pluginSource: h.pluginSource || null,
         });
     }
   }

package/src/lib/side-effect-ledger.js

@@ -56,6 +56,8 @@ const KIND_IDEMPOTENT = new Map([
   ["network-mutation", false],
   ["payment", false],
   ["file-write", false],
+  ["file-delete", false],
+  ["file-move", false],
   ["file-write-checkpointed", true],
   ["read", true],
   ["compute", true],
@@ -99,6 +101,18 @@ export function classifyToolSideEffect(toolName, args = {}) {
         kind: "file-write",
         key: shortKey(a.path || a.file || a.notebook_path),
       };
+    case "delete_file":
+      return {
+        kind: "file-delete",
+        key: shortKey(a.path || a.file),
+      };
+    case "move_file":
+      return {
+        kind: "file-move",
+        key: shortKey(
+          `${a.path || a.file || ""} -> ${a.target_path || a.targetPath || ""}`,
+        ),
+      };
     case "edit_file_hashed":
       // Hash-guarded: re-applying over an already-changed tree fails safely, so
       // a replay cannot silently double-apply — idempotent-by-construction.
@@ -201,6 +215,14 @@ export class SideEffectLedger {
     ]);
   }
 
+  /** Merge bounded correlation metadata discovered after an effect started. */
+  annotate(opId, metadata = {}) {
+    const rec = this._rec(opId);
+    if (!rec || !metadata || typeof metadata !== "object") return this;
+    rec.meta = { ...rec.meta, ...metadata };
+    return this;
+  }
+
   /** Confirm the effect applied. Only from `started`. */
   commit(opId) {
     return this._advance(

package/src/lib/skill-packs/generator.js

@@ -115,6 +115,7 @@ cli-version-hash: "${hash}"
 tags: [${allTags}]
 user-invocable: true
 handler: handler.js
+capabilities: [shell-exec]
 ---
 
 # ${domainDef.displayName}
@@ -176,7 +177,6 @@ export function generateDirectHandler(domainKey, domainDef) {
  * 自动生成 — 请勿手动修改，运行 \`chainlesschain skill sync-cli\` 重新生成
  */
 
-const { spawnSync } = require("child_process");
 
 /** 解析输入字符串为指令+参数数组 */
 function parseInput(input) {
@@ -241,7 +241,7 @@ ${commandGuide}
     const useJson = JSON_SUPPORTED_COMMANDS.has(command) && !cliArgs.includes("--json");
     if (useJson) cliArgs.push("--json");
 
-    // Security: spawnSync uses shell:true (needed to run the chainlesschain.cmd
+    // Security: Broker execution uses shell:true (needed to run the chainlesschain.cmd
     // shim on Windows), which joins cliArgs into a shell command. Reject shell
     // metacharacters so a crafted skill input can't inject commands.
     const unsafeArg = cliArgs.find((a) => /[;&|\`$<>()\\n\\r]/.test(a));
@@ -252,11 +252,16 @@ ${commandGuide}
       };
     }
 
-    // Execute via child process
-    const result = spawnSync("chainlesschain", cliArgs, {
+    const processBroker = context?.processBroker;
+    if (!processBroker || typeof processBroker.runSync !== "function") {
+      return { success: false, error: "Process Broker unavailable for skill execution." };
+    }
+
+    // Execute via the host-scoped Process Broker facade.
+    const result = processBroker.runSync("chainlesschain", cliArgs, {
       encoding: "utf-8",
       shell: true,
-      cwd: context.projectRoot || process.cwd(),
+      cwd: context?.projectRoot || process.cwd(),
       timeout: 30000,
       env: { ...process.env },
     });
@@ -407,7 +412,6 @@ export function generateHybridHandler(domainKey, domainDef) {
  * 自动生成 — 请勿手动修改，运行 \`chainlesschain skill sync-cli\` 重新生成
  */
 
-const { spawnSync } = require("child_process");
 
 const AGENT_ONLY_COMMANDS = new Set([${agentCmds}]);
 const VALID_COMMANDS = new Set(["${commandList}"]);
@@ -470,7 +474,7 @@ const handler = {
     // Direct execution for other commands
     const cliArgs = [...args, "--quiet"];
 
-    // Security: spawnSync uses shell:true (needed to run the chainlesschain.cmd
+    // Security: Broker execution uses shell:true (needed to run the chainlesschain.cmd
     // shim on Windows), which joins cliArgs into a shell command. Reject shell
     // metacharacters so a crafted skill input can't inject commands.
     const unsafeArg = cliArgs.find((a) => /[;&|\`$<>()\\n\\r]/.test(a));
@@ -481,10 +485,15 @@ const handler = {
       };
     }
 
-    const result = spawnSync("chainlesschain", cliArgs, {
+    const processBroker = context?.processBroker;
+    if (!processBroker || typeof processBroker.runSync !== "function") {
+      return { success: false, error: "Process Broker unavailable for skill execution." };
+    }
+
+    const result = processBroker.runSync("chainlesschain", cliArgs, {
       encoding: "utf-8",
       shell: true,
-      cwd: context.projectRoot || process.cwd(),
+      cwd: context?.projectRoot || process.cwd(),
       timeout: 30000,
       env: { ...process.env },
     });