kaijibot 2026.7.19 → 2026.7.23-2

package/CHANGELOG.md

@@ -11,6 +11,87 @@ Repo: https://github.com/Kaiji-Z/kaijibot · Backup: https://gitee.com/kaiji1126
 
 ---
 
+## 2026.7.19 — Adversarial audit fixes (distribution readiness)
+
+### ⚠️ Breaking
+
+- **Tool schema shape changed for 7 feishu/memory/evolution tools.** `Type.Union([Type.Object({action: Literal("...")}), ...])`
+  flattened to `Type.Object({ action: stringEnum([...]), ...allFieldsOptional })`. LLM-visible schema is now flatter;
+  per-action required fields enforced at runtime via `requiredParam()` helper (clear error: `Missing required parameter: space_id`
+  instead of cryptic TypeError). Affected: `feishu_wiki`, `feishu_doc`, `feishu_drive`, `feishu_perm`, `feishu_task`,
+  `feishu_vc`, `memory_save`, `manage_archived_skills`. Smaller models (Qwen / Kimi / MiniMax) now generate valid tool
+  calls significantly more reliably.
+- **`/v1/*` and `/api/*` unmatched routes return JSON error body** instead of bare `Not Found` text. SDK clients now get
+  `{ error: { message, type: "not_found", code } }` with actionable hints (e.g. `chat_completions_endpoint_disabled`).
+- **Docker `.env` file mode changed from 0644 to 0600.** `scripts/docker/setup.sh` now sets `umask 077` and `chmod 600`
+  after every `update_env_var`. Existing deployments: run `chmod 600 ~/.kaijibot/.env` once.
+- **`install.sh` no longer forces npmmirror.com for non-China users.** Detection now uses `TZ=Asia/Shanghai` or
+  `LANG=zh_CN*`; everywhere else gets the upstream npm registry. Users who previously relied on the forced mirror should
+  `npm config set registry https://registry.npmmirror.com` explicitly.
+
+### Highlights — Distribution blockers (B-1..B-5)
+
+- **Config clobber protection (B-1).** New `ConfigClobberProtectionError` refuses writes that would shrink `kaijibot.json`
+  by >50% vs the last-known-good snapshot when the prior config had `gateway.mode` set. Eliminates the silent-overwrite
+  pattern caused by env-var typos (e.g. `KAIJIBOT_CONFIG_DIR` is not honored — the correct name is `KAIJIBOT_STATE_DIR`;
+  docs now consistent across `.env.example` / `README.en.md` / `DOCKER.md`). Bypass via
+  `KAIJIBOT_ALLOW_CONFIG_CLOBBER_SHRINK=1` env or `allowConfigClobberShrink: true` write option. 5 unit tests.
+- **Postinstall transparency (B-2).** Two kill switches documented in README + `.env.example`:
+  `KAIJIBOT_DISABLE_BUNDLED_PLUGIN_POSTINSTALL=1` (skip all postinstall) and
+  `KAIJIBOT_DISABLE_LARK_SKILLS_INSTALL=1` (skip lark-cli skills only).
+- **`install.sh` locale-aware mirror (B-3).** See breaking section above.
+- **Channel docs reconciliation (B-4).** `README.md` / `docs/index.md` / `docs/channels/index.md` now agree: Feishu + WeChat
+  first-class, 16 upstream-inherited (was inconsistently 18/20). New `docs/channels/wechat.md` (was missing despite README
+  promoting WeChat as first-class).
+- **JSON error body for unmatched routes (B-5).** See breaking section above.
+
+### Highlights — Hardening (M-1..M-12)
+
+- **Dependency overrides bumped (M-1).** `protobufjs 7.5.5 → 7.6.5`, `axios 1.15.2 → 1.16.0`, `form-data 2.5.5 → 2.5.6`,
+  `basic-ftp 5.3.0 → 5.3.1`; new overrides: `undici 8.7.0`, `fast-uri 3.1.3`, `ws 8.21.1`. **high CVEs 27 → 3 (-89%)**.
+  Remaining 3 (`simple-git`, `fast-xml-builder`, `linkify-it`) are deep transitive, require upstream PRs; all unreachable
+  from chat input (verified via call-graph analysis).
+- **`Type.Union` → `stringEnum` refactor (M-2).** See breaking section.
+- **Docker `.env` permissions (M-3).** See breaking section.
+- **Web search prompt injection defense (M-4).** Search results wrapped in `<untrusted_source url="...">` tags with HTML
+  escaping. Post-generation filter rejects insight candidates matching imperative-injection patterns
+  (send money / click link / download file / share API key / etc). 8 pattern classes.
+- **Correction store stored-injection defense (M-5).** `CorrectionRecord` fields (domain / trigger / mistake / correction)
+  now pass through 10 injection-phrase patterns (ignore previous / system: / you are now / ChatML `<|im_start|>` / etc);
+  matched segments redacted to `[redacted-injection]`. 2000-char per-field cap. 5 sanitization unit tests.
+- **Cognitive stores file locks (M-6).** `PersonaStore` / `CorrectionStore` / `FragmentStore` now wrap all writes in
+  per-`(agentId, userId)` `createAsyncLock`. New `PersonaStore.update(agentId, userId, mutator)` atomic API. Migrated
+  `dispatch.ts` feedback collector and `server.impl.ts` consolidation `mergeTypedInsights` to `update()`. Scheduler
+  `savePersona` auto-protected via locked `save()`. Eliminates the race where 5 concurrent writers could silently drop
+  each other's updates.
+- **AuditLog rotation (M-7).** Rotate-before-append at 5MB threshold; keep last 5 `audit-<timestamp>.jsonl.rotated`
+  archives. `query()` no longer at risk of loading unbounded files on long-running deployments. 4 rotation unit tests.
+- **Plugin SDK drift cleanup (M-8 / M-9 / M-10).** `pnpm plugin-sdk:sync-exports` removed 6 broken export paths
+  (`github-copilot-token`, `ollama-runtime`, `lmstudio-runtime`, `proxy-capture`, `diagnostics-otel`, `voice-call`);
+  added new test-runtime and provider-_ paths. `plugin-sdk:api:gen` regenerated baseline SHA256 (was drifting since
+  2026-06-19). `pnpm format` cleared 13 unformatted files (README.md, VERIFICATION.md, ui/_, etc).
+- **CI gap closed (M-11).** `.github/workflows/ci.yml` check job now runs `pnpm format:check`,
+  `pnpm plugin-sdk:check-exports`, `NODE_OPTIONS=--max-old-space-size=8192 pnpm plugin-sdk:api:check`. All three drift
+  classes caught at PR time going forward.
+- **Cron + scheduler lifecycle (M-12).** New `backgroundStoppable` registry collects 3 Crontime handles (consolidation
+  / skill-cleanup / wiki-ingest) + ProactiveScheduler. Gateway `close` handler calls `.stop()` on each. Fixes the
+  pre-existing timer leak where `pnpm gw:deploy` could hit a port-bind conflict with the old process.
+
+### New environment variables
+
+- `KAIJIBOT_ALLOW_CONFIG_CLOBBER_SHRINK=1` — bypass config clobber protection (B-1).
+- `KAIJIBOT_DISABLE_BUNDLED_PLUGIN_POSTINSTALL=1` — skip all npm postinstall hooks (B-2).
+- `KAIJIBOT_DISABLE_LARK_SKILLS_INSTALL=1` — skip only the lark-cli skills install step (B-2).
+
+### Migration notes
+
+- If you have a Feishu bot running: no action needed. Tool schemas changed but execute behavior is identical for valid calls.
+- If you maintain a third-party KaijiBot plugin: use `stringEnum` from `kaijibot/plugin-sdk/core` for tool action fields;
+  avoid `Type.Union([Type.Literal(...)])`. See `docs/plugins/building-plugins.md` for the updated guidance.
+- If you deploy via Docker: run `chmod 600 ~/.kaijibot/.env` once on existing deployments to pick up the new default.
+
+---
+
 ## 2026.7.x — Cognitive identity system & live model discovery
 
 ### ⚠️ Breaking (2026.7.18-1)

package/README.md

@@ -368,6 +368,14 @@ KaijiBot 最初 fork 自 [OpenClaw](https://github.com/openclaw/openclaw) 的 Ga
 
 基座层面的工程改造(TypeBox 类型迁移、pi-ai SDK 升级、1220 处 lint 修复、Windows/Android bug 修复、Plugin SDK 补完)对使用者基本不可见,详见 commit 历史。
 
+v2026.7.19 起，KaijiBot 在基座之上加固了多项安全机制，这些是 KaijiBot 独有、不向上游贡献的差异化：
+
+- **配置覆盖保护**：gateway 拒绝静默写入会让 kaijibot.json 缩水 50% 的 stub 写入（防止 env-var 拼写错误吞掉真实 operator 配置）
+- **认知层并发安全**：persona / correction / fragment 三个 store 全部加 per-user 文件锁，5 个并发 writer 不再互踩
+- **Prompt injection 防御**：web search 结果用 `<untrusted_source>` 包装 + 后过滤拒绝指令性洞察；correction 记录字段做注入短语过滤 + 长度上限
+- **工具 schema LLM 友好化**：所有 17 处 `Type.Union` 改为 `stringEnum` + flat Object，国内中小模型（Qwen / Kimi / MiniMax）调用工具的成功率显著提升
+- **供应链卫生**：`pnpm.overrides` 强制升级 7 个高危依赖；high CVE 从 27 降到 3（剩余 3 个为深层 transitive，不可达 chat-input）
+
 > 想要精简的体验?配置里设 `cognitive.enabled: false` 即可关闭整个认知层,回到「加固基座 + 重写记忆层」的状态。
 
 ## 致谢

package/dist/.buildstamp

@@ -1 +1 @@
-{"builtAt":1784422681041,"head":"8f4a63424f0e6b99f66d090cc2169927841918fc"}
+{"builtAt":1784782748574,"head":"26c61c603fd39cd5310bc64c5b98207fbf7051a8"}

package/dist/abort-4KIaA6YF.js

@@ -0,0 +1,202 @@
+import { r as formatErrorMessage } from "./errors-CGMew-1w.js";
+import { o as normalizeOptionalLowercaseString, s as normalizeOptionalString } from "./string-coerce-CIT1-v_a.js";
+import { s as parseAgentSessionKey } from "./session-key-utils-Ix5VOQOP.js";
+import { v as resolveSessionAgentId } from "./agent-scope-kPGFvthr.js";
+import { r as logVerbose } from "./globals-BZWRdOIN.js";
+import { a as resolveSessionStoreEntry, c as updateSessionStore } from "./store-CVb-PgxR.js";
+import "./sessions-CTt5HCX6.js";
+import { l as resolveStorePath } from "./paths-DSl3hU-R.js";
+import { t as loadSessionStore } from "./store-load-BxI--Q71.js";
+import { o as getLatestSubagentRunByChildSessionKey, p as markSubagentRunTerminated, u as listSubagentRunsForController } from "./subagent-registry-Bi686d2R.js";
+import { b as resolveMainSessionAlias, y as resolveInternalSessionKey } from "./subagents-format-zmw3ySSQ.js";
+import { i as clearSessionQueues } from "./queue-CKoiy0cm.js";
+import { h as replyRunRegistry, t as abortEmbeddedPiRun } from "./runs-D529myUb.js";
+import { n as getAcpSessionManager } from "./manager-D-qELyT3.js";
+import "./pi-embedded-BJfp6u-k.js";
+import { i as setAbortMemory, n as isAbortRequestText } from "./abort-primitives-DvDwgEzz.js";
+import { o as stripMentions, s as stripStructuralPrefixes } from "./mentions-CmVlRfs6.js";
+import { t as resolveCommandAuthorization } from "./command-auth-BRSJRW_4.js";
+import { a as shouldPersistAbortCutoff, i as resolveAbortCutoffFromContext, t as applyAbortCutoffToSessionEntry } from "./abort-cutoff-B1HW8Caz.js";
+const abortDeps = {
+	getAcpSessionManager,
+	abortEmbeddedPiRun,
+	getLatestSubagentRunByChildSessionKey,
+	listSubagentRunsForController,
+	markSubagentRunTerminated
+};
+function formatAbortReplyText(stoppedSubagents) {
+	if (typeof stoppedSubagents !== "number" || stoppedSubagents <= 0) return "⚙️ Agent was aborted.";
+	return `⚙️ Agent was aborted. Stopped ${stoppedSubagents} ${stoppedSubagents === 1 ? "sub-agent" : "sub-agents"}.`;
+}
+function resolveSessionEntryForKey(store, sessionKey) {
+	if (!store || !sessionKey) return {};
+	const resolved = resolveSessionStoreEntry({
+		store,
+		sessionKey
+	});
+	if (resolved.existing) return resolved.legacyKeys.length > 0 ? {
+		entry: resolved.existing,
+		key: resolved.normalizedKey,
+		legacyKeys: resolved.legacyKeys
+	} : {
+		entry: resolved.existing,
+		key: resolved.normalizedKey
+	};
+	return {};
+}
+function normalizeRequesterSessionKey(cfg, key) {
+	const cleaned = normalizeOptionalString(key);
+	if (!cleaned) return;
+	const { mainKey, alias } = resolveMainSessionAlias(cfg);
+	return resolveInternalSessionKey({
+		key: cleaned,
+		alias,
+		mainKey
+	});
+}
+function stopSubagentsForRequester(params) {
+	const requesterKey = normalizeRequesterSessionKey(params.cfg, params.requesterSessionKey);
+	if (!requesterKey) return { stopped: 0 };
+	const dedupedRunsByChildKey = /* @__PURE__ */ new Map();
+	for (const run of abortDeps.listSubagentRunsForController(requesterKey)) {
+		const childKey = normalizeOptionalString(run.childSessionKey);
+		if (!childKey) continue;
+		const latest = abortDeps.getLatestSubagentRunByChildSessionKey(childKey);
+		if (!latest) {
+			const existing = dedupedRunsByChildKey.get(childKey);
+			if (!existing || run.createdAt >= existing.createdAt) dedupedRunsByChildKey.set(childKey, run);
+			continue;
+		}
+		const latestControllerSessionKey = normalizeOptionalString(latest?.controllerSessionKey) ?? normalizeOptionalString(latest?.requesterSessionKey);
+		if (latest.runId !== run.runId || latestControllerSessionKey !== requesterKey) continue;
+		const existing = dedupedRunsByChildKey.get(childKey);
+		if (!existing || run.createdAt >= existing.createdAt) dedupedRunsByChildKey.set(childKey, run);
+	}
+	const runs = Array.from(dedupedRunsByChildKey.values());
+	if (runs.length === 0) return { stopped: 0 };
+	const storeCache = /* @__PURE__ */ new Map();
+	const seenChildKeys = /* @__PURE__ */ new Set();
+	let stopped = 0;
+	for (const run of runs) {
+		const childKey = normalizeOptionalString(run.childSessionKey);
+		if (!childKey || seenChildKeys.has(childKey)) continue;
+		seenChildKeys.add(childKey);
+		if (!run.endedAt) {
+			const cleared = clearSessionQueues([childKey]);
+			const parsed = parseAgentSessionKey(childKey);
+			const storePath = resolveStorePath(params.cfg.session?.store, { agentId: parsed?.agentId });
+			let store = storeCache.get(storePath);
+			if (!store) {
+				store = loadSessionStore(storePath);
+				storeCache.set(storePath, store);
+			}
+			const entry = store[childKey];
+			const sessionId = replyRunRegistry.resolveSessionId(childKey) ?? entry?.sessionId;
+			const aborted = (childKey ? replyRunRegistry.abort(childKey) : false) || (sessionId ? abortDeps.abortEmbeddedPiRun(sessionId) : false);
+			if (abortDeps.markSubagentRunTerminated({
+				runId: run.runId,
+				childSessionKey: childKey,
+				reason: "killed"
+			}) > 0 || aborted || cleared.followupCleared > 0 || cleared.laneCleared > 0) stopped += 1;
+		}
+		const cascadeResult = stopSubagentsForRequester({
+			cfg: params.cfg,
+			requesterSessionKey: childKey
+		});
+		stopped += cascadeResult.stopped;
+	}
+	if (stopped > 0) logVerbose(`abort: stopped ${stopped} subagent run(s) for ${requesterKey}`);
+	return { stopped };
+}
+async function tryFastAbortFromMessage(params) {
+	const { ctx, cfg } = params;
+	const targetKey = normalizeOptionalString(ctx.CommandTargetSessionKey) ?? normalizeOptionalString(ctx.SessionKey);
+	const raw = stripStructuralPrefixes(ctx.CommandBody ?? ctx.RawBody ?? ctx.Body ?? "");
+	if (!isAbortRequestText(normalizeOptionalLowercaseString(ctx.ChatType) === "group" ? stripMentions(raw, ctx, cfg, resolveSessionAgentId({
+		sessionKey: targetKey ?? ctx.SessionKey ?? "",
+		config: cfg
+	})) : raw)) return {
+		handled: false,
+		aborted: false
+	};
+	const commandAuthorized = ctx.CommandAuthorized;
+	const auth = resolveCommandAuthorization({
+		ctx,
+		cfg,
+		commandAuthorized
+	});
+	if (!auth.isAuthorizedSender) return {
+		handled: false,
+		aborted: false
+	};
+	const agentId = resolveSessionAgentId({
+		sessionKey: targetKey ?? ctx.SessionKey ?? "",
+		config: cfg
+	});
+	const abortKey = targetKey ?? auth.from ?? auth.to;
+	const requesterSessionKey = targetKey ?? ctx.SessionKey ?? abortKey;
+	if (targetKey) {
+		const storePath = resolveStorePath(cfg.session?.store, { agentId });
+		const store = loadSessionStore(storePath);
+		const { entry, key, legacyKeys } = resolveSessionEntryForKey(store, targetKey);
+		const resolvedTargetKey = key ?? targetKey;
+		const acpManager = abortDeps.getAcpSessionManager();
+		if (acpManager.resolveSession({
+			cfg,
+			sessionKey: resolvedTargetKey
+		}).kind !== "none") try {
+			await acpManager.cancelSession({
+				cfg,
+				sessionKey: resolvedTargetKey,
+				reason: "fast-abort"
+			});
+		} catch (error) {
+			logVerbose(`abort: ACP cancel failed for ${resolvedTargetKey}: ${formatErrorMessage(error)}`);
+		}
+		const sessionId = replyRunRegistry.resolveSessionId(resolvedTargetKey) ?? entry?.sessionId;
+		const aborted = replyRunRegistry.abort(resolvedTargetKey) || (sessionId ? abortDeps.abortEmbeddedPiRun(sessionId) : false);
+		const cleared = clearSessionQueues([resolvedTargetKey, sessionId]);
+		if (cleared.followupCleared > 0 || cleared.laneCleared > 0) logVerbose(`abort: cleared followups=${cleared.followupCleared} lane=${cleared.laneCleared} keys=${cleared.keys.join(",")}`);
+		const abortCutoff = shouldPersistAbortCutoff({
+			commandSessionKey: ctx.SessionKey,
+			targetSessionKey: resolvedTargetKey
+		}) ? resolveAbortCutoffFromContext(ctx) : void 0;
+		if (entry && key) {
+			entry.abortedLastRun = true;
+			applyAbortCutoffToSessionEntry(entry, abortCutoff);
+			entry.updatedAt = Date.now();
+			store[key] = entry;
+			for (const legacyKey of legacyKeys ?? []) if (legacyKey !== key) delete store[legacyKey];
+			await updateSessionStore(storePath, (nextStore) => {
+				const nextEntry = nextStore[key] ?? entry;
+				if (!nextEntry) return;
+				nextEntry.abortedLastRun = true;
+				applyAbortCutoffToSessionEntry(nextEntry, abortCutoff);
+				nextEntry.updatedAt = Date.now();
+				nextStore[key] = nextEntry;
+				for (const legacyKey of legacyKeys ?? []) if (legacyKey !== key) delete nextStore[legacyKey];
+			});
+		} else if (abortKey) setAbortMemory(abortKey, true);
+		const { stopped } = stopSubagentsForRequester({
+			cfg,
+			requesterSessionKey
+		});
+		return {
+			handled: true,
+			aborted,
+			stoppedSubagents: stopped
+		};
+	}
+	if (abortKey) setAbortMemory(abortKey, true);
+	const { stopped } = stopSubagentsForRequester({
+		cfg,
+		requesterSessionKey
+	});
+	return {
+		handled: true,
+		aborted: false,
+		stoppedSubagents: stopped
+	};
+}
+//#endregion
+export { tryFastAbortFromMessage as i, resolveSessionEntryForKey as n, stopSubagentsForRequester as r, formatAbortReplyText as t };

package/dist/abort-cutoff.runtime-Bpvpy6BJ.js

@@ -0,0 +1,20 @@
+import { c as updateSessionStore } from "./store-CVb-PgxR.js";
+import { n as hasAbortCutoff, t as applyAbortCutoffToSessionEntry } from "./abort-cutoff-B1HW8Caz.js";
+//#region src/auto-reply/reply/abort-cutoff.runtime.ts
+async function clearAbortCutoffInSessionRuntime(params) {
+	const { sessionEntry, sessionStore, sessionKey, storePath } = params;
+	if (!sessionEntry || !sessionStore || !sessionKey || !hasAbortCutoff(sessionEntry)) return false;
+	applyAbortCutoffToSessionEntry(sessionEntry, void 0);
+	sessionEntry.updatedAt = Date.now();
+	sessionStore[sessionKey] = sessionEntry;
+	if (storePath) await updateSessionStore(storePath, (store) => {
+		const existing = store[sessionKey] ?? sessionEntry;
+		if (!existing) return;
+		applyAbortCutoffToSessionEntry(existing, void 0);
+		existing.updatedAt = Date.now();
+		store[sessionKey] = existing;
+	});
+	return true;
+}
+//#endregion
+export { clearAbortCutoffInSessionRuntime };

package/dist/abort-cutoff.runtime.js

@@ -1 +1 @@
-export * from "./abort-cutoff.runtime-UyMUJEBF.js";
+export * from "./abort-cutoff.runtime-Bpvpy6BJ.js";

package/dist/abort.runtime-7O2INzkJ.js

@@ -0,0 +1,2 @@
+import { i as tryFastAbortFromMessage, t as formatAbortReplyText } from "./abort-4KIaA6YF.js";
+export { formatAbortReplyText, tryFastAbortFromMessage };

package/dist/abort.runtime.js

@@ -1 +1 @@
-export * from "./abort.runtime-DivIpMOU.js";
+export * from "./abort.runtime-7O2INzkJ.js";