chainlesschain 0.162.95 → 0.162.96

package/src/lib/pdh-feedback-ledger.js

@@ -0,0 +1,131 @@
+/**
+ * PDH feedback ledger (design module 101 §3.5.13) — durable, cross-session
+ * persistence of the self-learning feedback the personal-data chat collects.
+ *
+ * The Android 纠正卡 sends {type:feedback,turn_id,kind,comment} to the cc agent;
+ * headless-stream.js consumes it within the session (ack + correction turn /
+ * preference note). That is in-session only. This ledger appends every feedback
+ * to <home>/pdh-feedback.jsonl so future sessions can learn the user's standing
+ * preferences — the "越用越聪明" flywheel (§3.5.13/§8.2). Append-only and
+ * best-effort: a learning ledger must never break the live chat.
+ *
+ * Pure CLI, no Android dependency, fully unit-testable through `_deps`.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { getHomeDir } from "./paths.js";
+
+const VALID_KINDS = new Set(["positive", "negative", "correction"]);
+
+export const _deps = {
+  homeDir: () => getHomeDir(),
+  appendFile: (p, s) => fs.appendFileSync(p, s, "utf-8"),
+  readFile: (p) => fs.readFileSync(p, "utf-8"),
+  exists: (p) => fs.existsSync(p),
+  mkdir: (d) => fs.mkdirSync(d, { recursive: true }),
+  now: () => Date.now(),
+};
+
+/** `<home>/pdh-feedback.jsonl`. */
+export function feedbackLedgerPath(deps = _deps) {
+  return path.join(deps.homeDir(), "pdh-feedback.jsonl");
+}
+
+/**
+ * Append one feedback entry. Best-effort: never throws (a learning ledger must
+ * not break the live chat). Returns the written record, or null on skip/failure.
+ * A `comment` is only kept for `correction` (thumbs carry no ground truth).
+ */
+export function appendFeedback(entry, deps = _deps) {
+  const kind = String(entry?.kind || "").toLowerCase();
+  if (!VALID_KINDS.has(kind)) return null;
+  const rec = {
+    ts: deps.now(),
+    sessionId: entry.sessionId != null ? String(entry.sessionId) : null,
+    turnId: entry.turnId != null ? String(entry.turnId) : null,
+    kind,
+    comment:
+      kind === "correction" &&
+      typeof entry.comment === "string" &&
+      entry.comment
+        ? entry.comment
+        : null,
+  };
+  try {
+    const file = feedbackLedgerPath(deps);
+    const dir = path.dirname(file);
+    if (!deps.exists(dir)) deps.mkdir(dir);
+    deps.appendFile(file, JSON.stringify(rec) + "\n");
+    return rec;
+  } catch {
+    return null; // persistence is best-effort; the live turn carries on
+  }
+}
+
+/** Read all ledger entries (oldest-first), skipping malformed/invalid lines. */
+export function readFeedback(deps = _deps) {
+  const file = feedbackLedgerPath(deps);
+  let raw;
+  try {
+    if (!deps.exists(file)) return [];
+    raw = deps.readFile(file);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const line of raw.split("\n")) {
+    const t = line.trim();
+    if (!t) continue;
+    try {
+      const o = JSON.parse(t);
+      if (o && VALID_KINDS.has(o.kind)) out.push(o);
+    } catch {
+      /* skip malformed */
+    }
+  }
+  return out;
+}
+
+/**
+ * Summarize the ledger into the user's standing preferences:
+ *   { total, positive, negative, corrections:[newest-first], sentiment }
+ * Pure over a list (caller passes readFeedback()). Corrections are the most
+ * actionable ground truth, so the newest few are surfaced verbatim.
+ */
+export function summarizeFeedback(entries, { maxCorrections = 5 } = {}) {
+  const list = Array.isArray(entries) ? entries : [];
+  let positive = 0;
+  let negative = 0;
+  const corrections = [];
+  for (const e of list) {
+    if (e.kind === "positive") positive++;
+    else if (e.kind === "negative") negative++;
+    else if (e.kind === "correction" && e.comment) corrections.push(e.comment);
+  }
+  return {
+    total: list.length,
+    positive,
+    negative,
+    corrections: corrections.slice(-maxCorrections).reverse(),
+    sentiment: positive - negative,
+  };
+}
+
+/**
+ * A compact Chinese system-note from a summary, for re-injecting learned
+ * preferences into a new session's prompt. "" when nothing has been learned.
+ */
+export function feedbackSystemNote(summary) {
+  if (!summary || !summary.total) return "";
+  const parts = [];
+  if (summary.corrections.length) {
+    parts.push(
+      "用户过往纠正（请遵循）：" +
+        summary.corrections.map((c) => `「${c}」`).join("；"),
+    );
+  }
+  if (summary.sentiment > 0) parts.push("用户总体认可你的回复风格。");
+  else if (summary.sentiment < 0)
+    parts.push("用户对过往回复多有不满，请更严谨、更贴合需求。");
+  return parts.join(" ");
+}

package/src/lib/permanent-memory.js

@@ -17,6 +17,34 @@ export const _deps = {
   BM25Search,
 };
 
+/**
+ * Atomically rewrite a UTF-8 file via _deps.fs. MEMORY.md is the memory index
+ * (re-read every session); a crash mid-rewrite truncates it and loses the
+ * index. Temp sibling + rename (atomic within a filesystem). Graceful-degrade
+ * to a direct write when the injected fs has no renameSync (partial test mocks);
+ * the real fs always has it, so production is always atomic.
+ */
+function _atomicWriteFile(filePath, data) {
+  const fsx = _deps.fs;
+  if (typeof fsx.renameSync !== "function") {
+    fsx.writeFileSync(filePath, data, "utf-8");
+    return;
+  }
+  const tmp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    fsx.writeFileSync(tmp, data, "utf-8");
+    fsx.renameSync(tmp, filePath);
+  } catch (err) {
+    try {
+      if (fsx.existsSync && fsx.existsSync(tmp) && fsx.unlinkSync)
+        fsx.unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 export class CLIPermanentMemory {
   /**
    * @param {object} options
@@ -148,13 +176,13 @@ export class CLIPermanentMemory {
           existing.slice(0, sectionIdx) +
           `${sectionHeader}\n\n${content}\n` +
           existing.slice(endIdx);
-        _deps.fs.writeFileSync(filePath, newContent, "utf-8");
+        _atomicWriteFile(filePath, newContent);
       } else {
         // Append new section
         const append = existing
           ? `\n${sectionHeader}\n\n${content}\n`
           : `# Memory\n\n${sectionHeader}\n\n${content}\n`;
-        _deps.fs.writeFileSync(filePath, existing + append, "utf-8");
+        _atomicWriteFile(filePath, existing + append);
       }
 
       this._loadMemoryFile();

package/src/lib/permission-rules.cjs

@@ -113,9 +113,17 @@ function globToRegExp(glob) {
     const c = s[i];
     if (c === "*") {
       if (s[i + 1] === "*") {
-        re += ".*";
-        i++;
-        if (s[i + 1] === "/") i++; // `**/` also matches zero segments
+        i++; // consume the second `*`
+        if (s[i + 1] === "/") {
+          i++; // consume the `/` too
+          // `**/` = zero or more WHOLE path segments. Must be boundary-aware:
+          // `.*` here would let `**/secret` match `notsecret` (no `/` before the
+          // suffix), over-matching permission patterns. `(?:.*/)?` requires the
+          // suffix to start a path segment (or sit at the root).
+          re += "(?:.*/)?";
+        } else {
+          re += ".*"; // bare `**` (no trailing slash) — matches across segments
+        }
       } else {
         re += "[^/]*";
       }

package/src/lib/personal-data-hub-aichat-wizard.js

@@ -15,12 +15,42 @@
  * Reference: docs/design/Personal_Data_Hub_Phase_10_3_AIChat_WebView_Wizard.md §2 §11
  */
 
-import { readFileSync, writeFileSync, mkdirSync, unlinkSync } from "node:fs";
+import {
+  readFileSync,
+  writeFileSync,
+  mkdirSync,
+  unlinkSync,
+  renameSync,
+  existsSync,
+} from "node:fs";
 import { join } from "node:path";
 import { createRequire } from "node:module";
 
 const _require = createRequire(import.meta.url);
 
+/**
+ * Atomically persist the accounts JSON at mode 0600. The store holds AI-chat
+ * vendor API keys, and `_readAll` swallows a parse error → returns {}, so a
+ * crash mid-write would silently drop every saved vendor. Temp sibling (created
+ * 0600 so the secret is never world-readable) + rename, atomic within a
+ * filesystem. (Mirrors the config / mcp-oauth / sync-credentials / PDH-account
+ * atomic-write fixes.) Exported as a test seam.
+ */
+export function _atomicWriteAccounts(filePath, data) {
+  const tmp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    writeFileSync(tmp, data, { mode: 0o600 });
+    renameSync(tmp, filePath);
+  } catch (err) {
+    try {
+      if (existsSync(tmp)) unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 // Lazy-load `@chainlesschain/personal-data-hub/adapters/ai-chat-history` —
 // older nested copies of the hub package (e.g. PDH 0.2.0 left in
 // `packages/cli/node_modules/@chainlesschain/personal-data-hub/` by a stale
@@ -76,7 +106,7 @@ export function createAccountsStore({ hubDir }) {
       } catch (err) {
         if (!err || err.code !== "EEXIST") throw err;
       }
-      writeFileSync(filePath, JSON.stringify(all, null, 2), { mode: 0o600 });
+      _atomicWriteAccounts(filePath, JSON.stringify(all, null, 2));
     });
     return writeChain;
   }
@@ -93,7 +123,7 @@ export function createAccountsStore({ hubDir }) {
           /* missing is fine */
         }
       } else {
-        writeFileSync(filePath, JSON.stringify(all, null, 2), { mode: 0o600 });
+        _atomicWriteAccounts(filePath, JSON.stringify(all, null, 2));
       }
     });
     return writeChain;

package/src/lib/personal-data-hub-wiring.js

@@ -126,7 +126,13 @@ const {
   runAnalysisSkill,
   ANALYSIS_SKILL_NAMES,
 } = hub;
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import {
+  readFileSync,
+  writeFileSync,
+  existsSync,
+  renameSync,
+  unlinkSync,
+} from "node:fs";
 import { getElectronUserDataDir } from "./paths.js";
 
 import {
@@ -1382,11 +1388,34 @@ function loadWechatAccounts(filePath) {
   }
 }
 
+/**
+ * Atomically persist a JSON state file at mode 0600. The PDH account stores hold
+ * login credentials (cookies/tokens), so a crash mid-write must not truncate the
+ * file — loadXAccounts swallows a parse error and returns [], silently dropping
+ * every saved account. Temp sibling (created 0600 so the secret is never world-
+ * readable) + rename, which is atomic within a filesystem. Exported as a test
+ * seam. (Mirrors the config / mcp-oauth / sync-credentials atomic-write fixes.)
+ */
+export function _atomicWriteJson600(filePath, obj) {
+  const tmp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify(obj, null, 2), {
+      encoding: "utf-8",
+      mode: 0o600,
+    });
+    renameSync(tmp, filePath);
+  } catch (err) {
+    try {
+      if (existsSync(tmp)) unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 function saveWechatAccounts(filePath, accounts) {
-  writeFileSync(filePath, JSON.stringify(accounts, null, 2), {
-    encoding: "utf-8",
-    mode: 0o600,
-  });
+  _atomicWriteJson600(filePath, accounts);
 }
 
 // ─── Email account persistence (Phase 5.6) ───────────────────────────────
@@ -1403,10 +1432,7 @@ function loadEmailAccounts(filePath) {
 }
 
 function saveEmailAccounts(filePath, accounts) {
-  writeFileSync(filePath, JSON.stringify(accounts, null, 2), {
-    encoding: "utf-8",
-    mode: 0o600,
-  });
+  _atomicWriteJson600(filePath, accounts);
 }
 
 // ─── Alipay account persistence (Phase 6) ───────────────────────────────
@@ -1423,10 +1449,7 @@ function loadAlipayAccounts(filePath) {
 }
 
 function saveAlipayAccounts(filePath, accounts) {
-  writeFileSync(filePath, JSON.stringify(accounts, null, 2), {
-    encoding: "utf-8",
-    mode: 0o600,
-  });
+  _atomicWriteJson600(filePath, accounts);
 }
 
 export async function getHub() {

package/src/lib/project-instructions.js

@@ -133,9 +133,11 @@ export function findInstructionFiles(opts = {}) {
   for (const d of chain) {
     push(firstExisting(fs, path, d, PROJECT_FILE_NAMES), "project");
     push(firstExisting(fs, path, d, LOCAL_FILE_NAMES), "local");
-    // Template-scaffolded project rules (`cc init -t` writes these) join the
-    // chain too, so scaffold-flow and memory-flow projects both feed the agent.
-    push(path.join(d, ".chainlesschain", "rules.md"), "rules");
+    // NOTE: `.chainlesschain/rules.md` is intentionally NOT loaded here — it is
+    // already injected by buildSystemPrompt() (as "## Project Rules"), which is
+    // the base of every composeSystemPrompt() call. Loading it here too sent it
+    // TWICE in the system prompt on every turn. Path-scoped `.claude/rules/*.md`
+    // below are NOT covered by buildSystemPrompt, so they stay.
     // Path-scoped rule files (`.claude/rules/*.md`, YAML frontmatter `paths:`
     // globs). Glob filtering happens at LOAD time where content is available.
     try {
@@ -211,7 +213,11 @@ export function ruleApplies(globs, relCwd) {
     const star = g.search(/[*?[]/);
     const prefix = (star === -1 ? g : g.slice(0, star)).replace(/\/+$/, "");
     if (!prefix) return true; // "**/*.js" — applies everywhere
-    if (cwd === prefix || cwd.startsWith(`${prefix}/`) || prefix.startsWith(`${cwd}/`)) {
+    if (
+      cwd === prefix ||
+      cwd.startsWith(`${prefix}/`) ||
+      prefix.startsWith(`${cwd}/`)
+    ) {
       return true;
     }
   }

package/src/lib/runnable-provider.js

@@ -92,48 +92,79 @@ export function makeRunnableProviderFallback(
   chatFn,
   { env = process.env, onFallback } = {},
 ) {
+  // Notify at most once per from→to pair: in an agent loop the same fallback
+  // would otherwise re-warn on every turn.
+  const notified = new Set();
   const notify = (info) => {
-    if (typeof onFallback === "function") {
-      try {
-        onFallback(info);
-      } catch {
-        /* notification is best-effort */
-      }
+    if (typeof onFallback !== "function") return;
+    const key = `${info.from}→${info.to}`;
+    if (notified.has(key)) return;
+    notified.add(key);
+    try {
+      onFallback(info);
+    } catch {
+      /* notification is best-effort */
     }
   };
-  return async function runnableProviderFallback(messages, options = {}) {
-    try {
-      return await chatFn(messages, options);
-    } catch (err) {
-      if (!isAuthError(err)) throw err;
-      const failed = options.provider;
 
-      // 1) The endpoint belongs to a different provider than the label.
-      const inferred = inferProviderFromBaseUrl(options.baseUrl);
-      if (inferred && inferred !== failed) {
-        notify({ from: failed, to: inferred, reason: "baseurl-mismatch" });
-        return await chatFn(messages, {
-          ...options,
+  // Compute the fallback for these options WITHOUT calling the model — the
+  // resolution is deterministic (baseUrl-inferred provider, then env-keyed
+  // provider). Returns { to, reason, override } or null. Pure so we can both
+  // react to an auth failure AND pre-empt the known-bad attempt on later turns.
+  const computeFallback = (options) => {
+    const failed = options.provider;
+    const inferred = inferProviderFromBaseUrl(options.baseUrl);
+    if (inferred && inferred !== failed) {
+      return {
+        to: inferred,
+        reason: "baseurl-mismatch",
+        override: {
           provider: inferred,
           model: defaultModelFor(inferred) || options.model,
-        });
-      }
-
-      // 2) Another provider has a usable key in the environment.
-      for (const [name, def] of Object.entries(BUILT_IN_PROVIDERS)) {
-        if (name === failed) continue;
-        if (def.apiKeyEnv && nonEmpty(env[def.apiKeyEnv])) {
-          notify({ from: failed, to: name, reason: "env-key" });
-          return await chatFn(messages, {
-            ...options,
+        },
+      };
+    }
+    for (const [name, def] of Object.entries(BUILT_IN_PROVIDERS)) {
+      if (name === failed) continue;
+      if (def.apiKeyEnv && nonEmpty(env[def.apiKeyEnv])) {
+        return {
+          to: name,
+          reason: "env-key",
+          override: {
             provider: name,
             baseUrl: def.baseUrl,
             apiKey: envKey(name, env),
             model: defaultModelFor(name) || options.model,
-          });
-        }
+          },
+        };
       }
-      throw err; // nowhere runnable to fall back to — surface the clear error
+    }
+    return null;
+  };
+
+  // Providers we have already proven need a fallback — later turns route
+  // straight to the working provider instead of re-attempting the broken one.
+  const stickyFrom = new Set();
+
+  return async function runnableProviderFallback(messages, options = {}) {
+    // Known-bad provider: skip the wasted failed attempt and route directly.
+    if (stickyFrom.has(options.provider)) {
+      const fb = computeFallback(options);
+      if (fb) {
+        notify({ from: options.provider, to: fb.to, reason: fb.reason });
+        return await chatFn(messages, { ...options, ...fb.override });
+      }
+      // Resolution no longer available — fall through to a normal attempt.
+    }
+    try {
+      return await chatFn(messages, options);
+    } catch (err) {
+      if (!isAuthError(err)) throw err;
+      const fb = computeFallback(options);
+      if (!fb) throw err; // nowhere runnable — surface the clear error
+      stickyFrom.add(options.provider);
+      notify({ from: options.provider, to: fb.to, reason: fb.reason });
+      return await chatFn(messages, { ...options, ...fb.override });
     }
   };
 }

package/src/lib/session-usage.js

@@ -49,8 +49,23 @@ export function extractUsage(event) {
   const totalTokens = toNumber(
     raw.total_tokens ?? raw.totalTokens ?? inputTokens + outputTokens,
   );
+  // Prompt-cache token counts (Anthropic caching): read tokens are billed at
+  // ~10% and creation/write at ~1.25× the input rate, so they are tracked
+  // separately for accurate cost. Absent on non-caching providers → 0.
+  const cacheReadTokens = toNumber(
+    raw.cache_read_input_tokens ?? raw.cacheReadTokens ?? 0,
+  );
+  const cacheCreationTokens = toNumber(
+    raw.cache_creation_input_tokens ?? raw.cacheCreationTokens ?? 0,
+  );
 
-  if (inputTokens === 0 && outputTokens === 0 && totalTokens === 0) {
+  if (
+    inputTokens === 0 &&
+    outputTokens === 0 &&
+    totalTokens === 0 &&
+    cacheReadTokens === 0 &&
+    cacheCreationTokens === 0
+  ) {
     return null;
   }
 
@@ -60,6 +75,8 @@ export function extractUsage(event) {
     inputTokens,
     outputTokens,
     totalTokens,
+    cacheReadTokens,
+    cacheCreationTokens,
     timestamp: event.timestamp || null,
   };
 }
@@ -73,6 +90,8 @@ export function aggregateUsage(events) {
     inputTokens: 0,
     outputTokens: 0,
     totalTokens: 0,
+    cacheReadTokens: 0,
+    cacheCreationTokens: 0,
     calls: 0,
   };
 
@@ -83,6 +102,8 @@ export function aggregateUsage(events) {
     total.inputTokens += u.inputTokens;
     total.outputTokens += u.outputTokens;
     total.totalTokens += u.totalTokens;
+    total.cacheReadTokens += u.cacheReadTokens || 0;
+    total.cacheCreationTokens += u.cacheCreationTokens || 0;
     total.calls += 1;
 
     const key = `${u.provider || "?"}/${u.model || "?"}`;
@@ -92,11 +113,15 @@ export function aggregateUsage(events) {
       inputTokens: 0,
       outputTokens: 0,
       totalTokens: 0,
+      cacheReadTokens: 0,
+      cacheCreationTokens: 0,
       calls: 0,
     };
     entry.inputTokens += u.inputTokens;
     entry.outputTokens += u.outputTokens;
     entry.totalTokens += u.totalTokens;
+    entry.cacheReadTokens += u.cacheReadTokens || 0;
+    entry.cacheCreationTokens += u.cacheCreationTokens || 0;
     entry.calls += 1;
     byKey.set(key, entry);
   }
@@ -129,6 +154,8 @@ export function allSessionsUsage({ limit = 1000 } = {}) {
     inputTokens: 0,
     outputTokens: 0,
     totalTokens: 0,
+    cacheReadTokens: 0,
+    cacheCreationTokens: 0,
     calls: 0,
   };
   const byKey = new Map();
@@ -137,6 +164,8 @@ export function allSessionsUsage({ limit = 1000 } = {}) {
     total.inputTokens += s.total.inputTokens;
     total.outputTokens += s.total.outputTokens;
     total.totalTokens += s.total.totalTokens;
+    total.cacheReadTokens += s.total.cacheReadTokens || 0;
+    total.cacheCreationTokens += s.total.cacheCreationTokens || 0;
     total.calls += s.total.calls;
     for (const row of s.byModel) {
       const key = `${row.provider || "?"}/${row.model || "?"}`;
@@ -146,11 +175,15 @@ export function allSessionsUsage({ limit = 1000 } = {}) {
         inputTokens: 0,
         outputTokens: 0,
         totalTokens: 0,
+        cacheReadTokens: 0,
+        cacheCreationTokens: 0,
         calls: 0,
       };
       entry.inputTokens += row.inputTokens;
       entry.outputTokens += row.outputTokens;
       entry.totalTokens += row.totalTokens;
+      entry.cacheReadTokens += row.cacheReadTokens || 0;
+      entry.cacheCreationTokens += row.cacheCreationTokens || 0;
       entry.calls += row.calls;
       byKey.set(key, entry);
     }

package/src/lib/skill-loader.js

@@ -199,7 +199,10 @@ export function substituteArguments(body, args) {
   // Protect literal $$
   const MARKER = "\u0000DOLLAR\u0000";
   let out = body.replace(/\$\$/g, MARKER);
-  out = out.replace(/\$ARGUMENTS\b/g, full);
+  // Insert the args via a function so $-sequences in the user's arguments
+  // ($&, $`, $', $$) are placed literally instead of being interpreted as
+  // String.replace patterns (which would otherwise mangle the args).
+  out = out.replace(/\$ARGUMENTS\b/g, () => full);
   out = out.replace(/\$(\d+)/g, (match, idx) => {
     const i = parseInt(idx, 10) - 1;
     if (i < 0 || i >= positional.length) return match;

package/src/lib/skill-packs/generator.js

@@ -158,7 +158,7 @@ ${commandDocs}
 /**
  * Generate handler.js content for a direct-execution pack
  */
-function generateDirectHandler(domainKey, domainDef) {
+export function generateDirectHandler(domainKey, domainDef) {
   const commandList = Object.keys(domainDef.commands).join('", "');
   const commandGuide = Object.entries(domainDef.commands)
     .map(
@@ -241,6 +241,17 @@ ${commandGuide}
     const useJson = JSON_SUPPORTED_COMMANDS.has(command) && !cliArgs.includes("--json");
     if (useJson) cliArgs.push("--json");
 
+    // Security: spawnSync uses shell:true (needed to run the chainlesschain.cmd
+    // shim on Windows), which joins cliArgs into a shell command. Reject shell
+    // metacharacters so a crafted skill input can't inject commands.
+    const unsafeArg = cliArgs.find((a) => /[;&|\`$<>()\\n\\r]/.test(a));
+    if (unsafeArg) {
+      return {
+        success: false,
+        error: "参数包含不安全的 shell 字符，已拒绝执行: " + JSON.stringify(unsafeArg),
+      };
+    }
+
     // Execute via child process
     const result = spawnSync("chainlesschain", cliArgs, {
       encoding: "utf-8",
@@ -371,7 +382,7 @@ module.exports = handler;
 /**
  * Generate handler.js content for hybrid-mode pack
  */
-function generateHybridHandler(domainKey, domainDef) {
+export function generateHybridHandler(domainKey, domainDef) {
   const agentCmds = Object.entries(domainDef.commands)
     .filter(([cmd, info]) => info.isAgentMode || AGENT_MODE_COMMANDS.has(cmd))
     .map(([cmd]) => `"${cmd}"`)
@@ -458,6 +469,18 @@ const handler = {
 
     // Direct execution for other commands
     const cliArgs = [...args, "--quiet"];
+
+    // Security: spawnSync uses shell:true (needed to run the chainlesschain.cmd
+    // shim on Windows), which joins cliArgs into a shell command. Reject shell
+    // metacharacters so a crafted skill input can't inject commands.
+    const unsafeArg = cliArgs.find((a) => /[;&|\`$<>()\\n\\r]/.test(a));
+    if (unsafeArg) {
+      return {
+        success: false,
+        error: "参数包含不安全的 shell 字符，已拒绝执行: " + JSON.stringify(unsafeArg),
+      };
+    }
+
     const result = spawnSync("chainlesschain", cliArgs, {
       encoding: "utf-8",
       shell: true,