wechatbridge-cli 1.3.0__tar.gz → 1.3.2__tar.gz

wechatbridge_cli-1.3.2/PKG-INFO

@@ -0,0 +1,287 @@
+Metadata-Version: 2.4
+Name: wechatbridge-cli
+Version: 1.3.2
+Summary: Bridge WeChat messages to agy or Grok Build CLIs — text/image/file/voice in, CLI replies and generated files back.
+Author: WeChatBridge contributors
+License: MIT
+Project-URL: Homepage, https://github.com/dorokuma/wechatbridge
+Project-URL: Repository, https://github.com/dorokuma/wechatbridge
+Project-URL: Issues, https://github.com/dorokuma/wechatbridge/issues
+Project-URL: Changelog, https://github.com/dorokuma/wechatbridge/blob/main/CHANGELOG.md
+Keywords: wechat,bot,bridge,agy,grok
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Natural Language :: Chinese (Simplified)
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Communications :: Chat
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: httpx
+Requires-Dist: qrcode
+Requires-Dist: Pillow
+Requires-Dist: cryptography
+Dynamic: license-file
+
+# WeChatBridge
+
+[English](README.md) | [简体中文](README.zh-CN.md)
+
+![license](https://img.shields.io/badge/license-MIT-blue.svg)
+![python](https://img.shields.io/badge/python-3.10+-blue.svg)
+
+WeChatBridge connects a WeChat bot to agentic coding CLIs (Google's agy / Antigravity, or xAI's Grok Build). From WeChat you can send text, images, files, and voice-as-text to the active CLI, get replies back, and receive certain generated files over the WeChat CDN. Switch backends per user with `/backend` — no restart.
+
+```
+WeChat (phone)  ⇄  iLink bot API  ⇄  WeChatBridge  ⇄  agy / grok CLI
+                                     (this project)    (runs tools)
+```
+
+The bridge process stays up and long-polls iLink. For prompts that go to a CLI, it spawns one `agy` or `grok` child (`-p` single-turn) and exits that child when done — the child does not stay resident. Many slash commands (`/help`, `/backend`, `/persona`, …) are handled inside the bridge and never start a CLI. Only artifacts the bridge can detect under the user's allowed session paths are pushed back via CDN.
+
+## Features
+
+- Text, image, file, and voice (WeChat server-side transcription only) go to the **active** backend (`agy` or `grok`)
+- Detected CLI artifacts under the per-user allowed tree can be sent back (size-capped); not every file the CLI touches
+- Each WeChat user gets an isolated workspace; model / effort / mode are remembered **per backend**
+- Runtime backend switch: `/backend agy` or `/backend grok` (clears the “continue session” flag so the next CLI turn starts without `-c` / `--continue`; does not immediately wipe history files on disk)
+- Slash commands for model, session reset, persona, and more (see below)
+- Dangerous-prompt gate: a **keyword list** of concrete destructive patterns asks for confirmation before run
+- Sender whitelist (`WECHATBRIDGE_ALLOWED_SENDERS`; empty = allow all)
+- `/mcp` returns short usage text; `/agent` rewrites into a natural-language subagent prompt for the CLI (not a native MCP bridge)
+- Media over WeChat CDN with AES-128-ECB encrypt/decrypt
+- Multi-instance: one codebase, set `WECHATBRIDGE_INSTANCE` per process (state / session / QR paths derive from it)
+- Deploy templates: systemd (Linux), launchd (macOS), Task Scheduler notes (Windows)
+
+## Platform Support
+
+- **Linux** — primary (systemd unit included)
+- **macOS** — supported (launchd plist included)
+- **Windows** — supported (Task Scheduler guide included)
+
+Default data paths expand from `~` (e.g. `~/.local/share/wechatbridge/<instance>/`).
+
+## CLI Backends
+
+- **agy** (default) — Google Antigravity CLI
+- **grok** — xAI Grok Build CLI
+
+Per-user switch: `/backend agy` or `/backend grok`. Each backend keeps its own model / effort / mode memory and persona file layout. Global default is `WECHATBRIDGE_BACKEND`.
+
+## Prerequisites
+
+- At least one CLI installed and signed in:
+  - **agy** on `PATH`, or set `AGY_BIN_PATH`
+  - **and/or grok** on `PATH`, or set `GROK_BIN_PATH`
+  - Antigravity is Google's terminal agentic coding CLI (successor to Gemini CLI). Grok Build is xAI's counterpart.
+- A WeChat account with a [ClawBot / iLink](https://ilinkai.weixin.qq.com) bot (QR bind on first run)
+- Python 3.10+
+
+## Install
+
+The recommended way is with [pipx](https://pypa.github.io/pipx/) (Python >= 3.10 required):
+
+```bash
+pipx install wechatbridge-cli
+```
+
+After installation, verify:
+
+```bash
+wechatbridge --version
+```
+
+### Install pipx
+
+**Debian / Ubuntu:**
+
+```bash
+sudo apt install pipx
+```
+
+**Other systems (or to get the latest version):**
+
+```bash
+python3 -m pip install --user pipx && python3 -m pipx ensurepath
+```
+
+Then start a new shell or re-source your shell config so `pipx` is on `PATH`.
+
+### Developers
+
+If you want to hack on the source:
+
+```bash
+git clone https://github.com/dorokuma/wechatbridge.git
+cd wechatbridge
+pip install -e .
+```
+
+## Configure
+
+Configuration is loaded from the first location found:
+
+1. `$WECHATBRIDGE_ENV_FILE` — explicit path
+2. `$XDG_CONFIG_HOME/wechatbridge/<instance>.env` (defaults to `~/.config/wechatbridge/<instance>.env`)
+3. `$XDG_CONFIG_HOME/wechatbridge/.env` (defaults to `~/.config/wechatbridge/.env`)
+4. `.env` in the repository root — **deprecated** (prints a warning on startup)
+
+The instance name defaults to `default`; override with `WECHATBRIDGE_INSTANCE`.
+
+Get the example config:
+
+```bash
+mkdir -p ~/.config/wechatbridge
+curl -o ~/.config/wechatbridge/.env https://raw.githubusercontent.com/dorokuma/wechatbridge/main/deploy/wechatbridge.env.example
+```
+
+Then edit `~/.config/wechatbridge/.env` with your settings.
+
+Key variables (all have defaults):
+
+| Variable | Default | Purpose |
+|---|---|---|
+| `AGY_BIN_PATH` | `agy` | path to the agy binary |
+| `GROK_BIN_PATH` | `grok` | path to the grok binary |
+| `WECHATBRIDGE_BACKEND` | `agy` | global default backend (`agy` / `grok`; overridable per user via `/backend`) |
+| `WECHATBRIDGE_INSTANCE` | `default` | instance name; state / session / QR paths derive from it |
+| `WECHATBRIDGE_ALLOWED_SENDERS` | _empty_ | comma-separated WeChat IDs (empty = allow all) |
+| `AGY_TIMEOUT` | `600` | CLI run timeout in seconds (both backends) |
+| `WECHATBRIDGE_MAX_OUTBOUND_BYTES` | `104857600` | max file size sent back to WeChat (100 MB) |
+| `WECHATBRIDGE_MAX_INBOUND_BYTES` | `20971520` | max inbound image/file after download (20 MB) |
+| `WECHATBRIDGE_MAX_CONCURRENT` | `4` | global concurrent handlers; extras get a busy reply |
+| `WECHATBRIDGE_CONFIRM_TOKEN` | `y` | reply this token to approve a gated dangerous prompt |
+| `WECHATBRIDGE_ENABLE_MCP` | `true` | enable the `/mcp` help text command |
+| `WECHATBRIDGE_ENABLE_SUBAGENT` | `true` | enable the `/agent` prompt-rewrite command |
+| `WECHATBRIDGE_ADMINS` | _empty_ | comma-separated wxid list; admins receive WeChat notification when a new version is detected |
+| `WECHATBRIDGE_UPDATE_CHECK` | `true` | check PyPI for new versions on startup and every 24h; failures are silent |
+| `WECHATBRIDGE_UPDATE_CHECK_INTERVAL` | `86400` | update check interval in seconds |
+
+Full list: [`deploy/wechatbridge.env.example`](deploy/wechatbridge.env.example).
+
+> **Why the new config location?** With pipx the package is installed globally, so a `.env` next to the source no longer makes sense. The XDG base directory layout keeps your config separate and instance-aware.
+
+## Run
+
+```bash
+wechatbridge
+```
+
+On first run the bridge prints a QR code (and saves PNG under the instance data dir). Scan with WeChat to bind, then it long-polls for messages.
+
+## Upgrading
+
+```bash
+pipx upgrade wechatbridge-cli
+sudo systemctl restart wechatbridge
+```
+
+Or run the upgrade script (no clone needed — fetch it with curl):
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/dorokuma/wechatbridge/main/deploy/update.sh | sudo bash
+```
+
+The script upgrades the pipx installation and restarts the service. If the service runs as a dedicated system user (e.g. `wechatbridge`), running as root automatically runs pipx as that user (override with `WECHATBRIDGE_USER=<user>`).
+
+Data lives under `~/.local/share/wechatbridge/<instance>/` (sessions, SQLite history, QR codes, login state) and is **not** touched during upgrade — your bots stay logged in and conversations are preserved.
+
+Before upgrading a **major** or **minor** version (e.g. 1.2 → 1.3), check the corresponding section in [`CHANGELOG.md`](CHANGELOG.md) for breaking changes and migration steps.
+
+## Deploy
+
+### Linux (systemd)
+
+First, install the bridge under the `wechatbridge` system user:
+
+```bash
+sudo -u wechatbridge pipx install wechatbridge-cli
+```
+
+Then deploy the service unit:
+
+```bash
+sudo cp deploy/wechatbridge.service /etc/systemd/system/
+sudo systemctl enable --now wechatbridge
+```
+
+**Multi-instance:** copy the template `deploy/wechatbridge@.service` and enable instances:
+
+```bash
+sudo cp deploy/wechatbridge@.service /etc/systemd/system/
+sudo systemctl enable --now wechatbridge@bot2
+sudo systemctl enable --now wechatbridge@bot3
+```
+
+Each instance reads its own config file (`~/.config/wechatbridge/bot2.env`) and keeps state under its own data directory (`~/.local/share/wechatbridge/bot2/`).
+
+### macOS (launchd)
+
+```bash
+cp deploy/wechatbridge.plist ~/Library/LaunchAgents/com.wechatbridge.plist
+# edit WorkingDirectory and ProgramArguments in the plist
+launchctl load ~/Library/LaunchAgents/com.wechatbridge.plist
+```
+
+### Windows (Task Scheduler)
+
+See [`deploy/wechatbridge-windows.md`](deploy/wechatbridge-windows.md).
+
+## Slash commands
+
+| Command | Action |
+|---|---|
+| `/help` | list supported commands for the active backend |
+| `/backend <agy\|grok>` | switch CLI backend for this WeChat user (on real change: drop continue flag; history files may remain until retention cleanup) |
+| `/clear` or `/new` | drop continue flag so the next CLI turn is a new conversation (does not instantly delete history files) |
+| `/model <name>` | set model (validated against the backend's model list; see `/models`) |
+| `/models` | list models from the active CLI |
+| `/fast` | set low reasoning effort (**on only** — not a toggle; no “off” command) |
+| `/planning` | set planning mode (**on only** — not a toggle) |
+| `/add-dir <path>` | **agy:** pass `--add-dir` on later runs if path is allowed. **grok:** recorded only; not passed to the CLI yet |
+| `/agents` | list agents via the active CLI |
+| `/persona <text>` | set persona (`show` / `clear` / `reset` subcommands) |
+| `/version` | show current version, instance name, and backend; if a newer version is available, show upgrade hint |
+| `/mcp` | short MCP **usage hint** text (can disable with `WECHATBRIDGE_ENABLE_MCP`) |
+| `/agent <name> <task>` | craft a "invoke subagent …" prompt and run the CLI (can disable with `WECHATBRIDGE_ENABLE_SUBAGENT`) |
+
+Other `/…` commands are either rejected (e.g. `/exit`), reported as unsupported on WeChat (TUI-only panels), or passed through to the active CLI.
+
+`/add-dir` only accepts paths under the user's session directory or roots listed in `WECHATBRIDGE_ADD_DIR_ROOTS`.
+
+## Ops & security (what the bridge actually enforces)
+
+- **Whitelist first.** Empty `WECHATBRIDGE_ALLOWED_SENDERS` means anyone who can message the bot can use it.
+- **Auto-approve CLIs.** agy runs with `--dangerously-skip-permissions`; grok with `--always-approve` (unless planning mode). Treat this as trusted-user tooling, not a multi-tenant sandbox.
+- **Danger gate is keyword-based**, not full intent understanding. Defaults target concrete patterns (`rm -rf /`, pipe-to-shell, `mkfs`, `format c:`, a few heavy Chinese phrases, …). Everyday wording like bare “delete” is **not** gated. Override list via `WECHATBRIDGE_CONFIRM_KEYWORDS`; approve with `WECHATBRIDGE_CONFIRM_TOKEN` (default `y`), TTL `WECHATBRIDGE_PENDING_TTL`.
+- **Inbound media** is size-capped (default 20 MB), streamed, and CDN hosts are allowlisted. Missing `aes_key` returns a clear error.
+- **Outbound artifacts** only leave the allowed per-user tree (agy: session scratch; grok: under session dir), after `realpath` checks, and only if under `WECHATBRIDGE_MAX_OUTBOUND_BYTES`.
+- **Concurrency:** global cap (`WECHATBRIDGE_MAX_CONCURRENT`, default 4); same user is serialized, different users can run in parallel.
+- **Long replies** are split into chunks (`WECHATBRIDGE_MESSAGE_CHUNK`, default 2000 characters).
+- **Data layout:** instance data under `~/.local/share/wechatbridge/<instance>/` (override with env). Runtime dirs prefer `0700`; token/QR files prefer `0600` (Unix; Windows relies on NTFS ACLs).
+- **Retention:** session temps vs dialogue history use separate TTLs (`WECHATBRIDGE_SESSION_RETENTION_DAYS`, `WECHATBRIDGE_HISTORY_RETENTION_DAYS`). Prefs/auth are kept.
+- **Child env** is sanitized (strips common secret-style variable names) and points `HOME` (and `USERPROFILE` on Windows) at the per-user session dir.
+
+## Limitations
+
+- Not a standalone agent — requires agy and/or grok.
+- Voice is WeChat speech-to-text only; no local ASR; empty transcript → “type instead”.
+- No video send/receive; no native WeChat voice-bubble replies (no silk encode).
+- One WeChat binding per process; multiple accounts need multiple instances (`WECHATBRIDGE_INSTANCE`).
+- Artifact send-back is best-effort detection under allowed paths, not “every file the CLI created anywhere”.
+- `/mcp` / `/agent` do not implement MCP protocol or spawn process supervisors inside the bridge — they only guide or rephrase for the CLI.
+- Deploy only for trusted users behind a whitelist when possible.
+
+## Contributing
+
+See [`CONTRIBUTING.md`](CONTRIBUTING.md). Semantic Versioning from 1.0.0; record changes in [`CHANGELOG.md`](CHANGELOG.md).
+
+## License
+
+MIT. See [`LICENSE`](LICENSE).

{wechatbridge_cli-1.3.0 → wechatbridge_cli-1.3.2}/pyproject.toml

@@ -3,6 +3,7 @@ name = "wechatbridge-cli"
 dynamic = ["version"]
 description = "Bridge WeChat messages to agy or Grok Build CLIs — text/image/file/voice in, CLI replies and generated files back."
 requires-python = ">=3.10"
+readme = "README.md"
 license = { text = "MIT" }
 urls = { Homepage = "https://github.com/dorokuma/wechatbridge", Repository = "https://github.com/dorokuma/wechatbridge", Issues = "https://github.com/dorokuma/wechatbridge/issues", Changelog = "https://github.com/dorokuma/wechatbridge/blob/main/CHANGELOG.md" }
 authors = [

{wechatbridge_cli-1.3.0 → wechatbridge_cli-1.3.2}/wechatbridge/__init__.py

@@ -1,2 +1,2 @@
 """WeChatBridge — bridge WeChat messages to agy or Grok Build CLIs."""
-__version__ = "1.3.0"
+__version__ = "1.3.2"

{wechatbridge_cli-1.3.0 → wechatbridge_cli-1.3.2}/wechatbridge/agy.py

@@ -23,6 +23,9 @@ from .runner_common import (
 
 logger = logging.getLogger("agy_runner")
 
+# execve 单参数上限（Linux MAX_ARG_STRLEN = 128KB），留安全余量
+_MAX_ARG_BYTES = 120 * 1024
+
 
 def extract_artifacts(text: str) -> list[tuple[str, str]]:
     """Extract (name, absolute_path) tuples from markdown file:/// links.
@@ -109,6 +112,14 @@ async def run_agy(prompt: str, user_id: str, timeout: int = None) -> tuple[str,
     if timeout is None:
         timeout = config.agy_timeout
 
+    # argv 单参数上限约 128KB（MAX_ARG_STRLEN），超长 prompt 直接拒绝，避免 E2BIG
+    if len(prompt.encode("utf-8", errors="replace")) > _MAX_ARG_BYTES:
+        logger.warning("Prompt too large for argv from user %s", user_id)
+        return format_error(
+            "消息过长",
+            f"单条消息超过 {_MAX_ARG_BYTES // 1024}KB 无法传给 CLI，请精简或分段发送。",
+        ), []
+
     t0 = time.time()
     session_dir = ensure_user_gemini(user_id)
 
@@ -228,10 +239,25 @@ async def run_agy(prompt: str, user_id: str, timeout: int = None) -> tuple[str,
                         env=env,
                         preexec_fn=os.setsid if hasattr(os, "setsid") else None,
                     )
-                    r_stdout, r_stderr = await asyncio.wait_for(
-                        retry_process.communicate(),
-                        timeout=float(timeout),
-                    )
+                    try:
+                        r_stdout, r_stderr = await asyncio.wait_for(
+                            retry_process.communicate(),
+                            timeout=float(timeout),
+                        )
+                    except asyncio.TimeoutError:
+                        # 重试进程也必须回收，否则超时后成为孤儿进程
+                        logger.warning(
+                            "agy retry timed out after %ss for user %s, terminating retry process",
+                            timeout, user_id,
+                        )
+                        await terminate_process(retry_process, graceful=True)
+                        return format_error(
+                            "级联超时",
+                            "模型 API 级联推理超时，自动重试仍超时。请稍后重试或简化指令。",
+                        ), []
+                    except (asyncio.CancelledError, Exception):
+                        await terminate_process(retry_process, graceful=False)
+                        raise
                     r_stdout_text = r_stdout.decode("utf-8", errors="replace").strip()
                     r_stderr_text = r_stderr.decode("utf-8", errors="replace").strip()
                     # Any useful stdout after retry counts as recovered (agy may exit non-zero)
@@ -271,10 +297,15 @@ async def run_agy(prompt: str, user_id: str, timeout: int = None) -> tuple[str,
         await terminate_process(process, graceful=True)
         return format_error("处理超时", f"超过 {timeout} 秒未完成，已终止本次任务。"), []
 
+    except asyncio.CancelledError:
+        # 任务被取消（如重登录前排空）：必须杀掉子进程再传递取消
+        await terminate_process(process, graceful=False)
+        raise
+
     except Exception as e:
         logger.exception("Unexpected error running agy: %s", e)
         await terminate_process(process, graceful=False)
-        return format_error("执行出错", str(e)), []
+        return format_error("执行出错", "内部错误，详情见服务端日志。"), []
 
 
 # ---------------------------------------------------------------------------
@@ -290,6 +321,7 @@ async def _run_agy_subcommand(subcmd_args: list, user_id: str) -> str:
     """
     session_dir = ensure_user_gemini(user_id)
     cmd = [config.agy_binary_path] + subcmd_args
+    process = None
     try:
         env = sanitize_env(session_dir)
         process = await asyncio.create_subprocess_exec(
@@ -320,10 +352,16 @@ async def _run_agy_subcommand(subcmd_args: list, user_id: str) -> str:
         return clean_output(stdout_text) or EMPTY_REPLY
 
     except asyncio.TimeoutError:
+        # 超时必须回收子进程，否则挂死的子命令成为孤儿进程
+        await terminate_process(process, graceful=True)
         return format_error("指令超时", "子命令 30 秒内未完成。")
+    except asyncio.CancelledError:
+        await terminate_process(process, graceful=False)
+        raise
     except Exception as e:
         logger.exception("Subcommand error: %s", e)
-        return format_error("执行出错", str(e))
+        await terminate_process(process, graceful=False)
+        return format_error("执行出错", "内部错误，详情见服务端日志。")
 
 
 def _cmd_help() -> str:
@@ -612,19 +650,7 @@ async def handle_slash_command(text: str, user_id: str) -> str | None:
             "> 用 codegraph 的 search 工具搜 ctxmode"
         )
 
-    if cmd == "/agent":
-        if not config.enable_subagent:
-            return "ℹ️ **该功能已禁用** ℹ️"
-        if not args:
-            return "❌ **缺少参数** ❌\n\n`/agent <名称> <任务>`"
-        # Construct prompt and run through agy
-        agent_parts = args.split(maxsplit=1)
-        agent_name = agent_parts[0]
-        agent_task = agent_parts[1] if len(agent_parts) > 1 else ""
-        crafted = f"请用 invoke_subagent 调用 agent {agent_name} 执行任务：{agent_task}"
-        logger.info("Agent subcmd: user=%s agent=%s task=%.100s", user_id, agent_name, agent_task)
-        result_text, _ = await run_agy(crafted, user_id)
-        return result_text
+    # /agent 已上移到 main.py 统一处理（必须经过危险确认门，不能再绕过）
 
     # --- D class: passthrough to agy (return None so caller runs run_agy) ---
     return None

{wechatbridge_cli-1.3.0 → wechatbridge_cli-1.3.2}/wechatbridge/grok.py

@@ -23,6 +23,9 @@ from .runner_common import (
 
 logger = logging.getLogger("grok_runner")
 
+# execve 单参数上限（Linux MAX_ARG_STRLEN = 128KB），留安全余量
+_MAX_ARG_BYTES = 120 * 1024
+
 
 # ---------------------------------------------------------------------------
 # Per-user .grok directory setup
@@ -250,13 +253,16 @@ def _build_grok_command(prompt: str, prefs: dict, first: bool, persona_content:
 # Artifact extraction from chat_history.jsonl
 # ---------------------------------------------------------------------------
 
-def _extract_grok_artifacts(session_dir: str, session_id: str) -> list:
+def _extract_grok_artifacts(session_dir: str, session_id: str, since: float = 0.0) -> list:
     """Extract (name, abs_path) tuples from grok session chat_history.jsonl.
 
     grok stores sessions under $HOME/.grok/sessions/<url-encoded-cwd>/<session-id>/.
     The chat_history.jsonl contains structured tool_calls with file_path arguments
     from write/edit operations.
 
+    ``since``: 只收录 mtime >= since 的文件——chat_history.jsonl 跨轮累积，
+    不过滤的话 --continue 会话每轮都会把历史文件重发一遍。
+
     Falls back to empty list on any error (never blocks text reply).
     """
     grok_sessions = os.path.join(session_dir, ".grok", "sessions")
@@ -292,6 +298,12 @@ def _extract_grok_artifacts(session_dir: str, session_id: str) -> list:
                         if name in ("write", "edit", "str_replace") and isinstance(args, dict):
                             fp = args.get("file_path", "")
                             if fp and os.path.isabs(fp):
+                                # 只收录本轮运行期间新写/修改的文件
+                                try:
+                                    if since and os.path.getmtime(fp) < since - 2.0:
+                                        continue
+                                except OSError:
+                                    continue  # 文件已不存在，无需回传
                                 art_name = os.path.basename(fp)
                                 key = (art_name, fp)
                                 if key not in seen:
@@ -305,7 +317,7 @@ def _extract_grok_artifacts(session_dir: str, session_id: str) -> list:
     return artifacts
 
 
-def _parse_grok_output(stdout_text: str, session_dir: str) -> tuple:
+def _parse_grok_output(stdout_text: str, session_dir: str, since: float = 0.0) -> tuple:
     """Parse grok JSON output into (display_text, artifacts).
 
     Handles both success JSON ({text, sessionId, ...}) and error JSON
@@ -330,7 +342,7 @@ def _parse_grok_output(stdout_text: str, session_dir: str) -> tuple:
 
     artifacts = []
     if session_id:
-        artifacts = _extract_grok_artifacts(session_dir, session_id)
+        artifacts = _extract_grok_artifacts(session_dir, session_id, since=since)
 
     # Strip file:/// links from display (in case grok emits them)
     display = re.sub(
@@ -355,6 +367,14 @@ async def run_grok(prompt: str, user_id: str, timeout: int = None) -> tuple:
     if timeout is None:
         timeout = config.agy_timeout
 
+    # argv 单参数上限约 128KB（MAX_ARG_STRLEN），超长 prompt 直接拒绝，避免 E2BIG
+    if len(prompt.encode("utf-8", errors="replace")) > _MAX_ARG_BYTES:
+        logger.warning("Prompt too large for argv from user %s", user_id)
+        return format_error(
+            "消息过长",
+            f"单条消息超过 {_MAX_ARG_BYTES // 1024}KB 无法传给 CLI，请精简或分段发送。",
+        ), []
+
     t0 = time.time()
     session_dir = ensure_user_grok(user_id)
 
@@ -398,22 +418,22 @@ async def run_grok(prompt: str, user_id: str, timeout: int = None) -> tuple:
         stdout_text = stdout_bytes.decode("utf-8", errors="replace").strip()
         stderr_text = stderr_bytes.decode("utf-8", errors="replace").strip()
 
-        display, artifacts = _parse_grok_output(stdout_text, session_dir)
+        display, artifacts = _parse_grok_output(stdout_text, session_dir, since=t0)
 
-        # Failure detection: non-zero exit, or structured error already formatted
+        # Failure detection: 非零退出一律视为失败（与 agy 行为对齐），
+        # 零退出但 stdout 是结构化错误（已格式化为 ❌ 前缀）也算失败
         failed = process.returncode != 0 or (
             isinstance(display, str) and display.startswith("❌")
         )
-        if process.returncode != 0 and (not display or display == EMPTY_REPLY):
+        if process.returncode != 0:
             logger.warning(
                 "grok exited with code %s for user %s: %.200s",
                 process.returncode, user_id, stderr_text,
             )
-            display = format_cli_error(
-                stderr_text or "grok 进程异常退出", backend="grok"
-            )
             artifacts = []
-            failed = True
+            if not (isinstance(display, str) and display.startswith("❌")):
+                raw_err = stderr_text or ("" if display == EMPTY_REPLY else display) or "grok 进程异常退出"
+                display = format_cli_error(raw_err, backend="grok")
 
         # Only mark session initialized on a real successful reply
         if first and not failed:
@@ -431,10 +451,15 @@ async def run_grok(prompt: str, user_id: str, timeout: int = None) -> tuple:
         await terminate_process(process, graceful=True)
         return format_error("处理超时", f"超过 {timeout} 秒未完成，已终止本次任务。"), []
 
+    except asyncio.CancelledError:
+        # 任务被取消（如重登录前排空）：必须杀掉子进程再传递取消
+        await terminate_process(process, graceful=False)
+        raise
+
     except Exception as e:
         logger.exception("Unexpected error running grok: %s", e)
         await terminate_process(process, graceful=False)
-        return format_error("执行出错", str(e)), []
+        return format_error("执行出错", "内部错误，详情见服务端日志。"), []
 
 
 async def _run_grok_subcommand(subcmd_args: list, user_id: str) -> str:
@@ -445,6 +470,7 @@ async def _run_grok_subcommand(subcmd_args: list, user_id: str) -> str:
     """
     session_dir = ensure_user_grok(user_id)
     cmd = [config.grok_binary_path] + subcmd_args
+    process = None
     try:
         env = sanitize_env(session_dir)
         process = await asyncio.create_subprocess_exec(
@@ -476,10 +502,16 @@ async def _run_grok_subcommand(subcmd_args: list, user_id: str) -> str:
         return clean_output(stdout_text) or EMPTY_REPLY
 
     except asyncio.TimeoutError:
+        # 超时必须回收子进程，否则挂死的子命令成为孤儿进程
+        await terminate_process(process, graceful=True)
         return format_error("指令超时", "子命令 30 秒内未完成。")
+    except asyncio.CancelledError:
+        await terminate_process(process, graceful=False)
+        raise
     except Exception as e:
         logger.exception("Subcommand error: %s", e)
-        return format_error("执行出错", str(e))
+        await terminate_process(process, graceful=False)
+        return format_error("执行出错", "内部错误，详情见服务端日志。")
 
 
 # ---------------------------------------------------------------------------
@@ -665,18 +697,7 @@ async def handle_grok_slash_command(text: str, user_id: str) -> str | None:
             "> 用 codegraph 的 search 工具搜 ctxmode"
         )
 
-    if cmd == "/agent":
-        if not config.enable_subagent:
-            return "ℹ️ **该功能已禁用** ℹ️"
-        if not args:
-            return "❌ **缺少参数** ❌\n\n`/agent <名称> <任务>`"
-        agent_parts = args.split(maxsplit=1)
-        agent_name = agent_parts[0]
-        agent_task = agent_parts[1] if len(agent_parts) > 1 else ""
-        crafted = f"请用 invoke_subagent 调用 agent {agent_name} 执行任务：{agent_task}"
-        logger.info("Agent subcmd: user=%s agent=%s task=%.100s", user_id, agent_name, agent_task)
-        result_text, _ = await run_grok(crafted, user_id)
-        return result_text
+    # /agent 已上移到 main.py 统一处理（必须经过危险确认门，不能再绕过）
 
     # --- D class: passthrough to grok (return None so caller runs run_grok) ---
     return None