wechatbridge-cli 1.3.1__tar.gz → 1.3.3__tar.gz

{wechatbridge_cli-1.3.1/wechatbridge_cli.egg-info → wechatbridge_cli-1.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wechatbridge-cli
-Version: 1.3.1
+Version: 1.3.3
 Summary: Bridge WeChat messages to agy or Grok Build CLIs — text/image/file/voice in, CLI replies and generated files back.
 Author: WeChatBridge contributors
 License: MIT

wechatbridge_cli-1.3.3/tests/test_hardening.py

@@ -0,0 +1,314 @@
+"""Hardening / cleanup / message-safety probes (stdlib unittest only).
+
+Exercises real production helpers and async methods with mocks — not
+string-copied stand-ins of the user-facing copy.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import os
+import tempfile
+import time
+import unittest
+from unittest import mock
+from unittest.mock import AsyncMock, MagicMock
+
+
+class TestSplitMessageChunks(unittest.TestCase):
+    def test_join_equals_original_fixed(self):
+        from wechatbridge.runner_common import split_message_chunks
+
+        samples = [
+            "",
+            "short",
+            "a" * 50,
+            "line1\nline2\nline3",
+            "word " * 400,
+            "x" * 10 + "\n" + "y" * 10,
+            "  keep  spaces  at  edges  ",
+            "\n\n\n",
+            "中文" * 300,
+        ]
+        for text in samples:
+            for limit in (5, 20, 80, 2000):
+                chunks = split_message_chunks(text, limit)
+                self.assertEqual("".join(chunks), text, msg=repr(text[:40]))
+                for c in chunks:
+                    self.assertLessEqual(len(c), limit if limit > 0 else len(c))
+
+    def test_random_join_equals_original(self):
+        import random
+        from wechatbridge.runner_common import split_message_chunks
+
+        rng = random.Random(42)
+        alphabet = "abc \n中文，。"
+        for _ in range(30):
+            text = "".join(rng.choice(alphabet) for _ in range(rng.randint(0, 500)))
+            limit = rng.randint(1, 120)
+            chunks = split_message_chunks(text, limit)
+            self.assertEqual("".join(chunks), text)
+
+
+class TestPathIsUnder(unittest.TestCase):
+    def test_child_and_escape(self):
+        from wechatbridge.runner_common import path_is_under
+
+        with tempfile.TemporaryDirectory() as td:
+            child = os.path.join(td, "a", "b")
+            os.makedirs(child)
+            self.assertTrue(path_is_under(child, td))
+            self.assertTrue(path_is_under(td, td))
+            outside = os.path.join(
+                tempfile.gettempdir(), "not-under-" + os.path.basename(td)
+            )
+            self.assertFalse(path_is_under(outside, td))
+
+    def test_symlink_escape_blocked(self):
+        from wechatbridge.runner_common import path_is_under
+
+        with tempfile.TemporaryDirectory() as td:
+            allowed = os.path.join(td, "allowed")
+            secret = os.path.join(td, "secret")
+            os.makedirs(allowed)
+            os.makedirs(secret)
+            leak = os.path.join(allowed, "leak")
+            os.symlink(secret, leak)
+            self.assertFalse(path_is_under(leak, allowed))
+
+
+class TestRemoveOldFilesDangling(unittest.TestCase):
+    def test_dangling_file_and_dir_links_removed_immediately(self):
+        from wechatbridge.runner_common import _remove_old_files_under
+
+        with tempfile.TemporaryDirectory() as td:
+            bad_file = os.path.join(td, "python")
+            os.symlink("/no/such/target/python-xyz", bad_file)
+            bad_dir = os.path.join(td, "lib64")
+            os.symlink("/no/such/lib", bad_dir)
+            keep = os.path.join(td, "keep.txt")
+            with open(keep, "w", encoding="utf-8") as f:
+                f.write("ok")
+            old = os.path.join(td, "old.txt")
+            with open(old, "w", encoding="utf-8") as f:
+                f.write("bye")
+            old_mtime = time.time() - 10 * 86400
+            os.utime(old, (old_mtime, old_mtime))
+
+            cutoff = time.time() - 7 * 86400
+            removed = _remove_old_files_under(td, cutoff)
+
+            self.assertGreaterEqual(removed, 3)
+            self.assertFalse(os.path.lexists(bad_file))
+            self.assertFalse(os.path.lexists(bad_dir))
+            self.assertFalse(os.path.exists(old))
+            self.assertTrue(os.path.exists(keep))
+
+    def test_intact_young_symlink_kept(self):
+        from wechatbridge.runner_common import _remove_old_files_under
+
+        with tempfile.TemporaryDirectory() as td:
+            target = os.path.join(td, "real.txt")
+            with open(target, "w", encoding="utf-8") as f:
+                f.write("data")
+            link = os.path.join(td, "alias")
+            os.symlink(target, link)
+            cutoff = time.time() - 7 * 86400
+            _remove_old_files_under(td, cutoff)
+            self.assertTrue(os.path.lexists(link))
+            self.assertTrue(os.path.exists(target))
+
+    def test_does_not_follow_symlink_into_outside_tree(self):
+        """followlinks=False: must not age-delete files outside root via symlink."""
+        from wechatbridge.runner_common import _remove_old_files_under
+
+        with tempfile.TemporaryDirectory() as outer:
+            with tempfile.TemporaryDirectory() as root:
+                victim = os.path.join(outer, "outside-old.txt")
+                with open(victim, "w", encoding="utf-8") as f:
+                    f.write("keep-me")
+                old_mtime = time.time() - 10 * 86400
+                os.utime(victim, (old_mtime, old_mtime))
+                os.symlink(outer, os.path.join(root, "escape"))
+                cutoff = time.time() - 7 * 86400
+                _remove_old_files_under(root, cutoff)
+                self.assertTrue(os.path.exists(victim), "must not delete outside tree")
+
+
+class TestOversizedArtifactNotice(unittest.TestCase):
+    def test_helper_never_embeds_absolute_path(self):
+        from wechatbridge.runner_common import format_oversized_artifact_notice
+
+        art_path = "/root/.local/share/wechatbridge/default/sessions/u1/scratch/report.pdf"
+        text = format_oversized_artifact_notice("report.pdf", 120.5)
+        self.assertNotIn(art_path, text)
+        self.assertNotIn("/root/", text)
+        self.assertNotIn("sessions/", text)
+        self.assertIn("report.pdf", text)
+        self.assertIn("未回传", text)
+
+    def test_send_artifacts_back_uses_safe_notice(self):
+        """Call the real async helper; assert user text has no server path."""
+        from wechatbridge.main import send_artifacts_back
+
+        async def _run():
+            with tempfile.TemporaryDirectory() as td:
+                scratch = os.path.join(td, ".gemini", "antigravity-cli", "scratch")
+                os.makedirs(scratch)
+                big_path = os.path.join(scratch, "huge.bin")
+                with open(big_path, "wb") as f:
+                    f.write(b"x" * 64)
+
+                client = MagicMock()
+                client.state.baseurl = "https://example.test"
+                client.state.bot_token = "tok"
+                client.send_message = AsyncMock(return_value=True)
+                client.send_media = AsyncMock(return_value=True)
+
+                with mock.patch(
+                    "wechatbridge.main.get_session_dir", return_value=td
+                ), mock.patch(
+                    "wechatbridge.main._get_backend", return_value="agy"
+                ), mock.patch(
+                    "wechatbridge.main.config"
+                ) as cfg:
+                    cfg.max_outbound_file_bytes = 8  # force oversized
+                    await send_artifacts_back(
+                        client,
+                        "user-1",
+                        "ctx-token",
+                        [("huge.bin", big_path)],
+                    )
+
+                client.send_media.assert_not_awaited()
+                client.send_message.assert_awaited()
+                kwargs = client.send_message.await_args.kwargs
+                text = kwargs["text"]
+                self.assertNotIn(big_path, text)
+                self.assertNotIn(td, text)
+                self.assertIn("huge.bin", text)
+                self.assertIn("未回传", text)
+
+        asyncio.run(_run())
+
+
+class TestILinkDeliveryAccepted(unittest.TestCase):
+    def test_predicate(self):
+        from wechatbridge.ilink import ilink_delivery_accepted
+
+        self.assertTrue(ilink_delivery_accepted(0, ""))
+        self.assertTrue(ilink_delivery_accepted(0, None))
+        self.assertTrue(ilink_delivery_accepted(-1, "7487118974343175304"))
+        self.assertTrue(ilink_delivery_accepted(1, "abc"))
+        self.assertTrue(ilink_delivery_accepted(-1, 42))  # non-empty non-str id
+        self.assertFalse(ilink_delivery_accepted(-1, ""))
+        self.assertFalse(ilink_delivery_accepted(-1, "   "))
+        self.assertFalse(ilink_delivery_accepted(1, None))
+        self.assertFalse(ilink_delivery_accepted(1, 0))
+
+
+class TestILinkPostSendmessageRetry(unittest.IsolatedAsyncioTestCase):
+    async def asyncSetUp(self):
+        from wechatbridge.ilink import ILinkClient
+
+        self.client = ILinkClient()
+
+    async def asyncTearDown(self):
+        await self.client.http_client.aclose()
+
+    async def test_ret_minus_one_with_message_id_is_success(self):
+        mock_resp = MagicMock()
+        mock_resp.raise_for_status = MagicMock()
+        mock_resp.json.return_value = {"ret": -1, "message_id": "mid-ok-1"}
+        self.client.http_client.post = AsyncMock(return_value=mock_resp)
+
+        ok = await self.client._post_sendmessage_with_retry(
+            url="https://example.test/send",
+            headers={},
+            body={},
+            to_user_id="u1",
+            max_attempts=1,
+        )
+        self.assertTrue(ok)
+        self.client.http_client.post.assert_awaited_once()
+
+    async def test_ret_nonzero_without_message_id_fails_fast(self):
+        mock_resp = MagicMock()
+        mock_resp.raise_for_status = MagicMock()
+        mock_resp.json.return_value = {"ret": -1, "message_id": ""}
+        self.client.http_client.post = AsyncMock(return_value=mock_resp)
+
+        with mock.patch("wechatbridge.ilink.asyncio.sleep", new_callable=AsyncMock):
+            ok = await self.client._post_sendmessage_with_retry(
+                url="https://example.test/send",
+                headers={},
+                body={},
+                to_user_id="u1",
+                max_attempts=2,
+            )
+        self.assertFalse(ok)
+        self.assertEqual(self.client.http_client.post.await_count, 2)
+
+    async def test_ret_zero_succeeds(self):
+        mock_resp = MagicMock()
+        mock_resp.raise_for_status = MagicMock()
+        mock_resp.json.return_value = {"ret": 0, "message_id": "m0"}
+        self.client.http_client.post = AsyncMock(return_value=mock_resp)
+        ok = await self.client._post_sendmessage_with_retry(
+            url="https://example.test/send",
+            headers={},
+            body={},
+            to_user_id="u1",
+            max_attempts=1,
+        )
+        self.assertTrue(ok)
+
+
+class TestInboundStreamCapLogic(unittest.TestCase):
+    def test_content_length_and_stream_abort_rules(self):
+        max_in = 100
+
+        def reject_cl(declared: int | None) -> bool:
+            return declared is not None and declared > max_in
+
+        def reject_buf(buf_len: int, piece_len: int) -> bool:
+            return buf_len + piece_len > max_in
+
+        self.assertTrue(reject_cl(101))
+        self.assertFalse(reject_cl(100))
+        self.assertFalse(reject_cl(None))
+        self.assertTrue(reject_buf(90, 20))
+        self.assertFalse(reject_buf(90, 10))
+
+
+class TestSensitiveEnv(unittest.TestCase):
+    def test_strips_api_keys_keeps_harmless(self):
+        from wechatbridge.runner_common import _is_sensitive_env_name, sanitize_env
+
+        self.assertTrue(_is_sensitive_env_name("XAI_API_KEY"))
+        self.assertTrue(_is_sensitive_env_name("OPENAI_API_KEY"))
+        self.assertTrue(_is_sensitive_env_name("BOT_TOKEN"))
+        self.assertFalse(_is_sensitive_env_name("HOME"))
+        self.assertFalse(_is_sensitive_env_name("PATH"))
+        self.assertFalse(_is_sensitive_env_name("LANG"))
+
+        with tempfile.TemporaryDirectory() as td:
+            with mock.patch.dict(
+                os.environ,
+                {
+                    "PATH": "/usr/bin",
+                    "XAI_API_KEY": "secret",
+                    "LANG": "C",
+                    "HOME": "/tmp/other",
+                },
+                clear=False,
+            ):
+                env = sanitize_env(td)
+            self.assertEqual(env["HOME"], td)
+            self.assertNotIn("XAI_API_KEY", env)
+            self.assertIn("LANG", env)
+            self.assertEqual(env["LANG"], "C")
+
+
+if __name__ == "__main__":
+    unittest.main()

{wechatbridge_cli-1.3.1 → wechatbridge_cli-1.3.3}/wechatbridge/__init__.py

@@ -1,2 +1,2 @@
 """WeChatBridge — bridge WeChat messages to agy or Grok Build CLIs."""
-__version__ = "1.3.1"
+__version__ = "1.3.3"

{wechatbridge_cli-1.3.1 → wechatbridge_cli-1.3.3}/wechatbridge/agy.py

@@ -23,6 +23,9 @@ from .runner_common import (
 
 logger = logging.getLogger("agy_runner")
 
+# execve 单参数上限（Linux MAX_ARG_STRLEN = 128KB），留安全余量
+_MAX_ARG_BYTES = 120 * 1024
+
 
 def extract_artifacts(text: str) -> list[tuple[str, str]]:
     """Extract (name, absolute_path) tuples from markdown file:/// links.
@@ -109,6 +112,14 @@ async def run_agy(prompt: str, user_id: str, timeout: int = None) -> tuple[str,
     if timeout is None:
         timeout = config.agy_timeout
 
+    # argv 单参数上限约 128KB（MAX_ARG_STRLEN），超长 prompt 直接拒绝，避免 E2BIG
+    if len(prompt.encode("utf-8", errors="replace")) > _MAX_ARG_BYTES:
+        logger.warning("Prompt too large for argv from user %s", user_id)
+        return format_error(
+            "消息过长",
+            f"单条消息超过 {_MAX_ARG_BYTES // 1024}KB 无法传给 CLI，请精简或分段发送。",
+        ), []
+
     t0 = time.time()
     session_dir = ensure_user_gemini(user_id)
 
@@ -228,10 +239,25 @@ async def run_agy(prompt: str, user_id: str, timeout: int = None) -> tuple[str,
                         env=env,
                         preexec_fn=os.setsid if hasattr(os, "setsid") else None,
                     )
-                    r_stdout, r_stderr = await asyncio.wait_for(
-                        retry_process.communicate(),
-                        timeout=float(timeout),
-                    )
+                    try:
+                        r_stdout, r_stderr = await asyncio.wait_for(
+                            retry_process.communicate(),
+                            timeout=float(timeout),
+                        )
+                    except asyncio.TimeoutError:
+                        # 重试进程也必须回收，否则超时后成为孤儿进程
+                        logger.warning(
+                            "agy retry timed out after %ss for user %s, terminating retry process",
+                            timeout, user_id,
+                        )
+                        await terminate_process(retry_process, graceful=True)
+                        return format_error(
+                            "级联超时",
+                            "模型 API 级联推理超时，自动重试仍超时。请稍后重试或简化指令。",
+                        ), []
+                    except (asyncio.CancelledError, Exception):
+                        await terminate_process(retry_process, graceful=False)
+                        raise
                     r_stdout_text = r_stdout.decode("utf-8", errors="replace").strip()
                     r_stderr_text = r_stderr.decode("utf-8", errors="replace").strip()
                     # Any useful stdout after retry counts as recovered (agy may exit non-zero)
@@ -271,10 +297,15 @@ async def run_agy(prompt: str, user_id: str, timeout: int = None) -> tuple[str,
         await terminate_process(process, graceful=True)
         return format_error("处理超时", f"超过 {timeout} 秒未完成，已终止本次任务。"), []
 
+    except asyncio.CancelledError:
+        # 任务被取消（如重登录前排空）：必须杀掉子进程再传递取消
+        await terminate_process(process, graceful=False)
+        raise
+
     except Exception as e:
         logger.exception("Unexpected error running agy: %s", e)
         await terminate_process(process, graceful=False)
-        return format_error("执行出错", str(e)), []
+        return format_error("执行出错", "内部错误，详情见服务端日志。"), []
 
 
 # ---------------------------------------------------------------------------
@@ -290,6 +321,7 @@ async def _run_agy_subcommand(subcmd_args: list, user_id: str) -> str:
     """
     session_dir = ensure_user_gemini(user_id)
     cmd = [config.agy_binary_path] + subcmd_args
+    process = None
     try:
         env = sanitize_env(session_dir)
         process = await asyncio.create_subprocess_exec(
@@ -320,10 +352,16 @@ async def _run_agy_subcommand(subcmd_args: list, user_id: str) -> str:
         return clean_output(stdout_text) or EMPTY_REPLY
 
     except asyncio.TimeoutError:
+        # 超时必须回收子进程，否则挂死的子命令成为孤儿进程
+        await terminate_process(process, graceful=True)
         return format_error("指令超时", "子命令 30 秒内未完成。")
+    except asyncio.CancelledError:
+        await terminate_process(process, graceful=False)
+        raise
     except Exception as e:
         logger.exception("Subcommand error: %s", e)
-        return format_error("执行出错", str(e))
+        await terminate_process(process, graceful=False)
+        return format_error("执行出错", "内部错误，详情见服务端日志。")
 
 
 def _cmd_help() -> str:
@@ -612,19 +650,7 @@ async def handle_slash_command(text: str, user_id: str) -> str | None:
             "> 用 codegraph 的 search 工具搜 ctxmode"
         )
 
-    if cmd == "/agent":
-        if not config.enable_subagent:
-            return "ℹ️ **该功能已禁用** ℹ️"
-        if not args:
-            return "❌ **缺少参数** ❌\n\n`/agent <名称> <任务>`"
-        # Construct prompt and run through agy
-        agent_parts = args.split(maxsplit=1)
-        agent_name = agent_parts[0]
-        agent_task = agent_parts[1] if len(agent_parts) > 1 else ""
-        crafted = f"请用 invoke_subagent 调用 agent {agent_name} 执行任务：{agent_task}"
-        logger.info("Agent subcmd: user=%s agent=%s task=%.100s", user_id, agent_name, agent_task)
-        result_text, _ = await run_agy(crafted, user_id)
-        return result_text
+    # /agent 已上移到 main.py 统一处理（必须经过危险确认门，不能再绕过）
 
     # --- D class: passthrough to agy (return None so caller runs run_agy) ---
     return None

{wechatbridge_cli-1.3.1 → wechatbridge_cli-1.3.3}/wechatbridge/grok.py

@@ -23,6 +23,9 @@ from .runner_common import (
 
 logger = logging.getLogger("grok_runner")
 
+# execve 单参数上限（Linux MAX_ARG_STRLEN = 128KB），留安全余量
+_MAX_ARG_BYTES = 120 * 1024
+
 
 # ---------------------------------------------------------------------------
 # Per-user .grok directory setup
@@ -250,13 +253,16 @@ def _build_grok_command(prompt: str, prefs: dict, first: bool, persona_content:
 # Artifact extraction from chat_history.jsonl
 # ---------------------------------------------------------------------------
 
-def _extract_grok_artifacts(session_dir: str, session_id: str) -> list:
+def _extract_grok_artifacts(session_dir: str, session_id: str, since: float = 0.0) -> list:
     """Extract (name, abs_path) tuples from grok session chat_history.jsonl.
 
     grok stores sessions under $HOME/.grok/sessions/<url-encoded-cwd>/<session-id>/.
     The chat_history.jsonl contains structured tool_calls with file_path arguments
     from write/edit operations.
 
+    ``since``: 只收录 mtime >= since 的文件——chat_history.jsonl 跨轮累积，
+    不过滤的话 --continue 会话每轮都会把历史文件重发一遍。
+
     Falls back to empty list on any error (never blocks text reply).
     """
     grok_sessions = os.path.join(session_dir, ".grok", "sessions")
@@ -292,6 +298,12 @@ def _extract_grok_artifacts(session_dir: str, session_id: str) -> list:
                         if name in ("write", "edit", "str_replace") and isinstance(args, dict):
                             fp = args.get("file_path", "")
                             if fp and os.path.isabs(fp):
+                                # 只收录本轮运行期间新写/修改的文件
+                                try:
+                                    if since and os.path.getmtime(fp) < since - 2.0:
+                                        continue
+                                except OSError:
+                                    continue  # 文件已不存在，无需回传
                                 art_name = os.path.basename(fp)
                                 key = (art_name, fp)
                                 if key not in seen:
@@ -305,7 +317,7 @@ def _extract_grok_artifacts(session_dir: str, session_id: str) -> list:
     return artifacts
 
 
-def _parse_grok_output(stdout_text: str, session_dir: str) -> tuple:
+def _parse_grok_output(stdout_text: str, session_dir: str, since: float = 0.0) -> tuple:
     """Parse grok JSON output into (display_text, artifacts).
 
     Handles both success JSON ({text, sessionId, ...}) and error JSON
@@ -330,7 +342,7 @@ def _parse_grok_output(stdout_text: str, session_dir: str) -> tuple:
 
     artifacts = []
     if session_id:
-        artifacts = _extract_grok_artifacts(session_dir, session_id)
+        artifacts = _extract_grok_artifacts(session_dir, session_id, since=since)
 
     # Strip file:/// links from display (in case grok emits them)
     display = re.sub(
@@ -355,6 +367,14 @@ async def run_grok(prompt: str, user_id: str, timeout: int = None) -> tuple:
     if timeout is None:
         timeout = config.agy_timeout
 
+    # argv 单参数上限约 128KB（MAX_ARG_STRLEN），超长 prompt 直接拒绝，避免 E2BIG
+    if len(prompt.encode("utf-8", errors="replace")) > _MAX_ARG_BYTES:
+        logger.warning("Prompt too large for argv from user %s", user_id)
+        return format_error(
+            "消息过长",
+            f"单条消息超过 {_MAX_ARG_BYTES // 1024}KB 无法传给 CLI，请精简或分段发送。",
+        ), []
+
     t0 = time.time()
     session_dir = ensure_user_grok(user_id)
 
@@ -398,22 +418,22 @@ async def run_grok(prompt: str, user_id: str, timeout: int = None) -> tuple:
         stdout_text = stdout_bytes.decode("utf-8", errors="replace").strip()
         stderr_text = stderr_bytes.decode("utf-8", errors="replace").strip()
 
-        display, artifacts = _parse_grok_output(stdout_text, session_dir)
+        display, artifacts = _parse_grok_output(stdout_text, session_dir, since=t0)
 
-        # Failure detection: non-zero exit, or structured error already formatted
+        # Failure detection: 非零退出一律视为失败（与 agy 行为对齐），
+        # 零退出但 stdout 是结构化错误（已格式化为 ❌ 前缀）也算失败
         failed = process.returncode != 0 or (
             isinstance(display, str) and display.startswith("❌")
         )
-        if process.returncode != 0 and (not display or display == EMPTY_REPLY):
+        if process.returncode != 0:
             logger.warning(
                 "grok exited with code %s for user %s: %.200s",
                 process.returncode, user_id, stderr_text,
             )
-            display = format_cli_error(
-                stderr_text or "grok 进程异常退出", backend="grok"
-            )
             artifacts = []
-            failed = True
+            if not (isinstance(display, str) and display.startswith("❌")):
+                raw_err = stderr_text or ("" if display == EMPTY_REPLY else display) or "grok 进程异常退出"
+                display = format_cli_error(raw_err, backend="grok")
 
         # Only mark session initialized on a real successful reply
         if first and not failed:
@@ -431,10 +451,15 @@ async def run_grok(prompt: str, user_id: str, timeout: int = None) -> tuple:
         await terminate_process(process, graceful=True)
         return format_error("处理超时", f"超过 {timeout} 秒未完成，已终止本次任务。"), []
 
+    except asyncio.CancelledError:
+        # 任务被取消（如重登录前排空）：必须杀掉子进程再传递取消
+        await terminate_process(process, graceful=False)
+        raise
+
     except Exception as e:
         logger.exception("Unexpected error running grok: %s", e)
         await terminate_process(process, graceful=False)
-        return format_error("执行出错", str(e)), []
+        return format_error("执行出错", "内部错误，详情见服务端日志。"), []
 
 
 async def _run_grok_subcommand(subcmd_args: list, user_id: str) -> str:
@@ -445,6 +470,7 @@ async def _run_grok_subcommand(subcmd_args: list, user_id: str) -> str:
     """
     session_dir = ensure_user_grok(user_id)
     cmd = [config.grok_binary_path] + subcmd_args
+    process = None
     try:
         env = sanitize_env(session_dir)
         process = await asyncio.create_subprocess_exec(
@@ -476,10 +502,16 @@ async def _run_grok_subcommand(subcmd_args: list, user_id: str) -> str:
         return clean_output(stdout_text) or EMPTY_REPLY
 
     except asyncio.TimeoutError:
+        # 超时必须回收子进程，否则挂死的子命令成为孤儿进程
+        await terminate_process(process, graceful=True)
         return format_error("指令超时", "子命令 30 秒内未完成。")
+    except asyncio.CancelledError:
+        await terminate_process(process, graceful=False)
+        raise
     except Exception as e:
         logger.exception("Subcommand error: %s", e)
-        return format_error("执行出错", str(e))
+        await terminate_process(process, graceful=False)
+        return format_error("执行出错", "内部错误，详情见服务端日志。")
 
 
 # ---------------------------------------------------------------------------
@@ -665,18 +697,7 @@ async def handle_grok_slash_command(text: str, user_id: str) -> str | None:
             "> 用 codegraph 的 search 工具搜 ctxmode"
         )
 
-    if cmd == "/agent":
-        if not config.enable_subagent:
-            return "ℹ️ **该功能已禁用** ℹ️"
-        if not args:
-            return "❌ **缺少参数** ❌\n\n`/agent <名称> <任务>`"
-        agent_parts = args.split(maxsplit=1)
-        agent_name = agent_parts[0]
-        agent_task = agent_parts[1] if len(agent_parts) > 1 else ""
-        crafted = f"请用 invoke_subagent 调用 agent {agent_name} 执行任务：{agent_task}"
-        logger.info("Agent subcmd: user=%s agent=%s task=%.100s", user_id, agent_name, agent_task)
-        result_text, _ = await run_grok(crafted, user_id)
-        return result_text
+    # /agent 已上移到 main.py 统一处理（必须经过危险确认门，不能再绕过）
 
     # --- D class: passthrough to grok (return None so caller runs run_grok) ---
     return None

{wechatbridge_cli-1.3.1 → wechatbridge_cli-1.3.3}/wechatbridge/ilink.py

@@ -26,6 +26,22 @@ logger = logging.getLogger("ilink")
 ILINK_BASE = config.ilink_base_url.rstrip("/")
 
 
+def ilink_delivery_accepted(ret, message_id) -> bool:
+    """Whether an iLink sendmessage JSON body means the message was accepted.
+
+    The server often returns ``ret != 0`` (commonly ``-1``) **together with** a
+    non-empty ``message_id`` when delivery succeeded. Treat as failure only when
+    there is no message id to prove acceptance. ``ret == 0`` always accepts.
+    """
+    if ret == 0:
+        return True
+    if message_id is None:
+        return False
+    if isinstance(message_id, str):
+        return bool(message_id.strip())
+    return bool(message_id)
+
+
 def _is_allowed_media_url(url: str) -> bool:
     """Only allow downloads from WeChat CDN hosts or the configured CDN base host."""
     try:
@@ -209,9 +225,12 @@ class ILinkState:
                     os.chmod(parent, 0o700)
                 except OSError:
                     pass
-            with open(self.path, "w") as f:
+            # tmp + os.replace 原子写，避免崩溃留下半截 state 文件
+            tmp_path = self.path + ".tmp"
+            with open(tmp_path, "w") as f:
                 json.dump(data, f)
-            os.chmod(self.path, 0o600)
+            os.chmod(tmp_path, 0o600)
+            os.replace(tmp_path, self.path)
         except OSError as e:
             logger.error("Failed to save iLink state: %s", e)
 
@@ -270,7 +289,7 @@ class ILinkClient:
         return qrcode_str, qrcode_img_content
 
     async def poll_qrcode_status(
-        self, qrcode_str: str, timeout: int = 180, interval: float = 1.5
+        self, qrcode_str: str, timeout: int = 180
     ) -> Tuple[str, str]:
         """
         Poll QR code status until confirmed or timeout.
@@ -369,11 +388,12 @@ class ILinkClient:
             logger.warning("HTTP error in get_updates: %s", e)
             return [], buf
         except httpx.RequestError as e:
+            # 网络层错误上抛，由主循环做指数退避（避免原地满速重试+日志洪泛）
             logger.warning("Network error in get_updates: %s", e)
-            return [], buf
+            raise
         except Exception as e:
             logger.exception("Unexpected error in get_updates: %s", e)
-            return [], buf
+            raise
 
     # ---- Media upload and sending ----
 
@@ -457,8 +477,8 @@ class ILinkClient:
                 )
             elapsed = time.time() - t0
             logger.info(
-                "CDN upload done: %d bytes in %.3fs x-encrypted-param=%.80s",
-                len(ciphertext), elapsed, encrypted_param,
+                "CDN upload done: %d bytes in %.3fs x-encrypted-param(len=%d)",
+                len(ciphertext), elapsed, len(encrypted_param),
             )
             return encrypted_param
         except httpx.TimeoutException:
@@ -629,7 +649,7 @@ class ILinkClient:
 
                 ret = data.get("ret", -1)
                 message_id = data.get("message_id", "")
-                if ret != 0 and not message_id:
+                if not ilink_delivery_accepted(ret, message_id):
                     logger.warning(
                         "%s failed ret=%s for %s (attempt %d/%d): %s",
                         log_label, ret, to_user_id, attempt, max_attempts, data,
@@ -640,14 +660,16 @@ class ILinkClient:
                         continue
                     return False
 
-                if ret != 0 and message_id:
-                    logger.warning(
-                        "%s ret=%s but has message_id=%s, treating as success",
+                if ret != 0:
+                    # Documented API quirk — delivered despite non-zero ret
+                    logger.debug(
+                        "%s ret=%s with message_id=%s (iLink quirk, delivered)",
                         log_label, ret, message_id,
                     )
                 logger.info(
-                    "%s sent to %s (attempt %d/%d): msg_id=%s",
-                    log_label, to_user_id, attempt, max_attempts, data.get("message_id"),
+                    "%s sent to %s (attempt %d/%d): msg_id=%s ret=%s",
+                    log_label, to_user_id, attempt, max_attempts,
+                    message_id, ret,
                 )
                 return True
 
@@ -826,13 +848,13 @@ class ILinkClient:
             cl = resp.headers.get("content-length")
             if cl is not None:
                 try:
-                    if int(cl) > max_in:
-                        raise ValueError(
-                            f"入站文件过大（Content-Length {cl} > {max_in} 字节）"
-                        )
-                except ValueError as e:
-                    if "入站文件过大" in str(e):
-                        raise
+                    declared = int(cl)
+                except ValueError:
+                    declared = None  # 非法 Content-Length 头忽略，由流式上限兜底
+                if declared is not None and declared > max_in:
+                    raise ValueError(
+                        f"入站文件过大（Content-Length {cl} > {max_in} 字节）"
+                    )
             async for piece in resp.aiter_bytes():
                 if not piece:
                     continue

{wechatbridge_cli-1.3.1 → wechatbridge_cli-1.3.3}/wechatbridge/main.py

@@ -12,6 +12,7 @@ import os
 import sys
 import time
 import uuid
+from collections import OrderedDict
 from io import StringIO
 
 from . import __version__
@@ -21,6 +22,7 @@ from .runner_common import (
     clean_session_media,
     format_error,
     format_model_label,
+    format_oversized_artifact_notice,
     get_session_dir,
     is_dangerous,
     load_prefs,
@@ -44,6 +46,71 @@ logging.getLogger("httpx").setLevel(logging.WARNING)
 pending_confirms: dict = {}
 
 
+# Slash 处理器内部信号：该指令已完整处理（如 /agent 进入确认流程），调用方直接 return
+_HANDLED = object()
+
+# 重登录/关闭前等待在途消息任务的最长时间
+_DRAIN_TIMEOUT_S = 90.0
+
+# 后台任务强引用集合（事件循环只持弱引用，防止任务被 GC 提前回收）
+_background_tasks: set = set()
+
+
+def _spawn_bg(coro) -> asyncio.Task:
+    """create_task + 强引用跟踪，任务结束自动移除。"""
+    t = asyncio.create_task(coro)
+    _background_tasks.add(t)
+    t.add_done_callback(_background_tasks.discard)
+    return t
+
+
+# 已见消息 ID（LRU，上限 1000）——服务端重投/重启重放时跳过重复处理
+_seen_msg_ids: "OrderedDict[str, None]" = OrderedDict()
+_SEEN_MSG_IDS_CAP = 1000
+
+
+# 去重键字段优先级，对齐官方 WeixinMessage schema（Tencent/openclaw-weixin types.ts）：
+#   message_id(数值) > client_id > item_list[0].msg_id > seq
+def _msg_dedup_key(msg: dict) -> str | None:
+    """从入站消息提取去重键；服务端不下发任何 id 字段时返回 None（无法安全去重）。"""
+    for field in ("message_id", "client_id"):
+        v = msg.get(field)
+        if v:
+            return f"{field}:{v}"
+    items = msg.get("item_list")
+    if isinstance(items, list) and items and isinstance(items[0], dict):
+        v = items[0].get("msg_id")
+        if v:
+            return f"item_msg_id:{v}"
+    v = msg.get("seq")
+    if v:
+        return f"seq:{v}"
+    return None
+
+
+_dedup_field_announced = False
+
+
+def _is_duplicate_msg(msg: dict) -> bool:
+    global _dedup_field_announced
+    key = _msg_dedup_key(msg)
+    if not _dedup_field_announced:
+        _dedup_field_announced = True
+        if key:
+            logger.info("消息去重已启用，使用字段: %s", key.split(":", 1)[0])
+        else:
+            logger.info("服务端未下发消息 id 字段，去重停用（依赖服务端游标）")
+    if key is None:
+        return False
+    if key in _seen_msg_ids:
+        return True
+    _seen_msg_ids[key] = None
+    _seen_msg_ids.move_to_end(key)
+    while len(_seen_msg_ids) > _SEEN_MSG_IDS_CAP:
+        _seen_msg_ids.popitem(last=False)
+    return False
+
+
 # ---------------------------------------------------------------------------
 # Backend dispatcher — routes to agy or grok based on per-user preference
 # ---------------------------------------------------------------------------
@@ -65,10 +132,16 @@ async def _run_llm(prompt: str, user_id: str) -> tuple[str, list]:
         return await run_agy(prompt, user_id)
 
 
-async def _handle_slash(text: str, user_id: str) -> str | None:
+async def _handle_slash(client: ILinkClient, text: str, user_id: str, context_token: str):
     """Dispatch slash command to the active backend's handler.
 
-    /backend is a meta-command handled here, not delegated to backends.
+    /backend 和 /agent 是元指令，在这里处理，不下发给后端。
+
+    返回值约定：
+      str      — 直接作为回复文本
+      tuple    — (reply, artifacts)，经确认门后的执行结果
+      None     — D 类透传，调用方应把原文交给 gate_and_run
+      _HANDLED — 已完整处理（如 /agent 进入确认流程），调用方直接 return
     """
     parts = text.strip().split(maxsplit=1)
     cmd = parts[0].lower() if parts else ""
@@ -78,6 +151,10 @@ async def _handle_slash(text: str, user_id: str) -> str | None:
     if cmd == "/backend":
         return _cmd_backend(args, user_id)
 
+    # /agent 也在这里处理：统一走 gate_and_run 确认门，不能绕开 is_dangerous
+    if cmd == "/agent":
+        return await _cmd_agent(client, args, user_id, context_token)
+
     if cmd == "/version":
         return (
             f"📦 **版本信息** 📦\n\n当前版本: `{__version__}`\n"
@@ -134,6 +211,26 @@ def _cmd_backend(args: str, user_id: str) -> str:
     )
 
 
+async def _cmd_agent(client: ILinkClient, args: str, user_id: str, context_token: str):
+    """Handle /agent <名称> <任务> — 调用子代理执行任务。
+
+    必须经过 gate_and_run 的危险确认门（历史上后端各自实现时绕过了该检查）。
+    """
+    if not config.enable_subagent:
+        return "ℹ️ **该功能已禁用** ℹ️"
+    if not args.strip():
+        return "❌ **缺少参数** ❌\n\n`/agent <名称> <任务>`"
+    agent_parts = args.split(maxsplit=1)
+    agent_name = agent_parts[0]
+    agent_task = agent_parts[1] if len(agent_parts) > 1 else ""
+    crafted = f"请用 invoke_subagent 调用 agent {agent_name} 执行任务：{agent_task}"
+    logger.info("Agent subcmd: user=%s agent=%s task=%.100s", user_id, agent_name, agent_task)
+    result = await gate_and_run(client, user_id, context_token, crafted)
+    if result is None:
+        return _HANDLED  # 已进入危险确认流程
+    return result  # (reply, artifacts)
+
+
 # ---------------------------------------------------------------------------
 # Image file extension detection
 # ---------------------------------------------------------------------------
@@ -217,7 +314,6 @@ async def login_flow(client: ILinkClient) -> bool:
         bot_token, baseurl = await client.poll_qrcode_status(
             qrcode_str,
             timeout=config.qrcode_poll_timeout,
-            interval=config.qrcode_poll_interval,
         )
         client.state.bot_token = bot_token
         client.state.baseurl = baseurl
@@ -285,9 +381,14 @@ async def send_artifacts_back(client, from_user, context_token, artifacts) -> No
             file_size = os.path.getsize(art_path)
             if file_size > config.max_outbound_file_bytes:
                 size_mb = file_size / (1024 * 1024)
+                # Never echo server absolute paths to WeChat users
+                logger.info(
+                    "Artifact too large (%.1f MB), kept on server: %s",
+                    size_mb, art_path,
+                )
                 await client.send_message(
                     to_user_id=from_user,
-                    text=f"⚠️ **文件过大** ⚠️\n\n`{art_name}` {size_mb:.1f} MB\n已存：`{art_path}`",
+                    text=format_oversized_artifact_notice(art_name, size_mb),
                     context_token=context_token,
                     baseurl=client.state.baseurl,
                     bot_token=client.state.bot_token,
@@ -382,14 +483,20 @@ async def process_message(client: ILinkClient, msg: dict) -> None:
     await maybe_notify_admin(client, from_user, context_token)
 
     # ---- Pending dangerous prompt confirmation ----
+    # 确认匹配用文本或语音转写（语音消息也可以回确认口令）
+    reply_text = text.strip() or voice_text.strip()
+    cancelled_notice = ""
     pending = pending_confirms.get(from_user)
     if pending:
         expired = time.time() >= pending["expire_at"]
-        if not expired and text.strip().lower() == config.confirm_token.lower():
+        if not expired and reply_text.lower() == config.confirm_token.lower():
             # User confirmed → run pending prompt, send reply, return
             logger.info("[AUDIT] user=%s confirmed dangerous prompt", from_user)
-            reply, artifacts = await _run_llm(pending["prompt"], from_user)
+            # 先删再执行：执行异常也不能让陈旧 pending 被后续消息误触发
             del pending_confirms[from_user]
+            if image_media or file_media:
+                logger.info("确认回复携带媒体，媒体部分被忽略 from=%s", from_user)
+            reply, artifacts = await _run_llm(pending["prompt"], from_user)
             # Send reply
             success = await client.send_message(
                 to_user_id=from_user,
@@ -409,6 +516,10 @@ async def process_message(client: ILinkClient, msg: dict) -> None:
         if expired:
             # Expired: don't reply, continue normal flow
             logger.info("[AUDIT] user=%s pending expired, continue normal flow", from_user)
+        elif image_media or file_media:
+            # 用户发来新媒体内容：取消待确认并继续处理本条消息（不静默丢弃）
+            logger.info("[AUDIT] user=%s cancelled pending by sending new media", from_user)
+            cancelled_notice = "🚫 已取消待确认的危险操作。\n\n"
         else:
             # User explicitly cancelled: reply cancelled, return
             logger.info("[AUDIT] user=%s cancelled dangerous prompt", from_user)
@@ -462,7 +573,9 @@ async def process_message(client: ILinkClient, msg: dict) -> None:
 
             except Exception as e:
                 logger.exception("图片下载/解密失败: %s", e)
-                reply = format_error("图片下载或解密失败", str(e))
+                # ValueError 是自定义的中文可读原因；其他异常（httpx 等）含内部 URL，不外发
+                detail = str(e) if isinstance(e, ValueError) else "请重新发送图片。"
+                reply = format_error("图片下载或解密失败", detail)
 
     # ---- Case 1.5: Message contains a file (non-image) ----
     elif file_media:
@@ -500,7 +613,9 @@ async def process_message(client: ILinkClient, msg: dict) -> None:
 
             except Exception as e:
                 logger.exception("文件下载/解密失败: %s", e)
-                reply = format_error("文件下载或解密失败", str(e))
+                # ValueError 是自定义的中文可读原因；其他异常（httpx 等）含内部 URL，不外发
+                detail = str(e) if isinstance(e, ValueError) else "请重新发送文件。"
+                reply = format_error("文件下载或解密失败", detail)
 
     # ---- Case 1.6: Voice message (text transcription passthrough) ----
     elif has_voice:
@@ -526,13 +641,20 @@ async def process_message(client: ILinkClient, msg: dict) -> None:
         # Slash command interception
         if text.startswith("/"):
             logger.info("Slash command from=%s: %.200s", from_user, text)
-            reply = await _handle_slash(text, from_user)
-            if reply is None:
+            handled = await _handle_slash(client, text, from_user, context_token)
+            if handled is _HANDLED:
+                return
+            if handled is None:
                 # D class: passthrough — run CLI normally
                 result = await gate_and_run(client, from_user, context_token, text)
                 if result is None:
                     return
                 reply, artifacts = result
+            elif isinstance(handled, tuple):
+                # /agent 等元指令经确认门后的执行结果
+                reply, artifacts = handled
+            else:
+                reply = handled
         else:
             result = await gate_and_run(client, from_user, context_token, text)
             if result is None:
@@ -542,7 +664,7 @@ async def process_message(client: ILinkClient, msg: dict) -> None:
     # ---- Send reply via iLink ----
     success = await client.send_message(
         to_user_id=from_user,
-        text=reply,
+        text=cancelled_notice + reply,
         context_token=context_token,
         baseurl=client.state.baseurl,
         bot_token=client.state.bot_token,
@@ -594,7 +716,8 @@ async def periodic_clean_scratch():
     while True:
         try:
             await asyncio.sleep(3600)
-            clean_scratch()
+            # 同步文件遍历放到线程池，避免阻塞事件循环卡死长轮询心跳
+            await asyncio.to_thread(clean_scratch)
         except Exception as e:
             logger.exception("periodic_clean_scratch error: %s", e)
 
@@ -602,17 +725,26 @@ async def periodic_clean_scratch():
 async def main_loop() -> None:
     """Main daemon loop: manages state, QR login, and message receiving."""
     ensure_runtime_dirs()
-    clean_scratch()
+    # 同步文件遍历放到线程池，避免阻塞事件循环
+    await asyncio.to_thread(clean_scratch)
     if config.update_check_enabled:
-        asyncio.create_task(update_check_loop())
-    asyncio.create_task(periodic_clean_scratch())
+        _spawn_bg(update_check_loop())
+    _spawn_bg(periodic_clean_scratch())
     while True:
         client = ILinkClient()
+        # 本轮 client 的在途消息任务（强引用持有，relogin 前排空，避免拿死连接发消息）
+        msg_tasks: set = set()
         try:
             state_loaded = client.state.load()
 
             if not state_loaded or not client.state.bot_token:
-                success = await login_flow(client)
+                try:
+                    success = await login_flow(client)
+                except Exception as e:
+                    # 网络抖动/服务端异常不应直接杀死 daemon
+                    logger.exception("登录流程异常，5 秒后重试: %s", e)
+                    await asyncio.sleep(5)
+                    continue
                 if not success:
                     logger.warning("扫码超时，3 秒后重新获取二维码等待扫码")
                     await asyncio.sleep(3)
@@ -624,19 +756,22 @@ async def main_loop() -> None:
 
             # Inner loop: long-poll for messages
             get_updates_buf = ""
+            fail_delay = 0.5  # 网络异常指数退避，封顶 30s
             while True:
                 try:
                     msgs, new_buf = await client.get_updates(
                         get_updates_buf, baseurl, bot_token
                     )
+                    fail_delay = 0.5  # 成功一次即重置退避
                 except Exception as e:
                     # Token invalidated (401/403) → break for re-login
                     logger.exception("长轮询异常: %s", e)
                     if not client.state.bot_token:
                         logger.warning("Bot token 已失效，准备重新登录")
                         break
-                    # Network hiccup → short delay and retry
-                    await asyncio.sleep(0.5)
+                    # Network hiccup → 指数退避后重试
+                    await asyncio.sleep(fail_delay)
+                    fail_delay = min(fail_delay * 2, 30.0)
                     continue
 
                 # Always update cursor with the server-returned value
@@ -645,8 +780,14 @@ async def main_loop() -> None:
                 for msg in msgs:
                     msg_type = msg.get("message_type", 0)
                     if msg_type == 1:  # User message
+                        if _is_duplicate_msg(msg):
+                            logger.info("跳过重复投递的消息: %s", _msg_dedup_key(msg))
+                            continue
+                        logger.debug("inbound msg keys: %s", sorted(msg.keys()))
                         # Non-blocking async task creation: process message in background
-                        asyncio.create_task(_safe_process_message(client, msg))
+                        t = asyncio.create_task(_safe_process_message(client, msg))
+                        msg_tasks.add(t)
+                        t.add_done_callback(msg_tasks.discard)
                     else:
                         logger.debug(
                             "跳过 message_type=%s", msg_type
@@ -659,6 +800,19 @@ async def main_loop() -> None:
             logger.info("收到退出信号")
             raise
         finally:
+            # 先排空/取消在途消息任务，再关连接，避免任务拿死 client 静默失败
+            if msg_tasks:
+                snapshot = set(msg_tasks)
+                logger.info(
+                    "等待 %d 个在途消息任务完成（最长 %.0fs）...",
+                    len(snapshot), _DRAIN_TIMEOUT_S,
+                )
+                _, still_pending = await asyncio.wait(snapshot, timeout=_DRAIN_TIMEOUT_S)
+                if still_pending:
+                    logger.warning("强制取消 %d 个未完成的在途任务", len(still_pending))
+                    for t in still_pending:
+                        t.cancel()
+                    await asyncio.gather(*still_pending, return_exceptions=True)
             await client.close()
 
         # Decide whether to re-login or exit

{wechatbridge_cli-1.3.1 → wechatbridge_cli-1.3.3}/wechatbridge/runner_common.py

@@ -13,6 +13,7 @@ import os
 import re
 import shutil
 import signal
+import stat
 import sys
 import time
 
@@ -22,8 +23,11 @@ logger = logging.getLogger("wechatbridge.runner")
 
 # ANSI escape code pattern
 ANSI_RE = re.compile(r"\x1b\[[0-9;]*[a-zA-Z]")
-# HTML tag pattern
-HTML_TAG_RE = re.compile(r"<[^>]+>")
+# HTML tag pattern — 白名单制，避免把代码输出里的 <String>、<T> 等泛型当标签误删
+HTML_TAG_RE = re.compile(
+    r"</?(?:b|i|em|strong|code|pre|a|br|div|span|p|u|s|ul|ol|li|table|thead|tbody|tr|td|th|h[1-6]|blockquote|font|center|hr)(?:\s[^<>]*)?/?>",
+    re.IGNORECASE,
+)
 
 # Sensitive env var prefixes to strip from child process environments
 _SENSITIVE_PREFIXES = (
@@ -32,7 +36,8 @@ _SENSITIVE_PREFIXES = (
 )
 # Segment names that mark a var as secret when they appear as a path part
 _SENSITIVE_SEGMENTS = frozenset({
-    "TOKEN", "KEY", "SECRET", "PASSWORD", "PASSWD",
+    "TOKEN", "KEY", "SECRET", "PASSWORD", "PASSWD", "PASS", "PWD",
+    "AUTH", "CRED", "CREDS", "PRIVATE",
     "CREDENTIAL", "CREDENTIALS", "APIKEY", "API_KEY",
 })
 _SENSITIVE_SUFFIXES = (
@@ -165,6 +170,19 @@ def format_error(title: str, detail: str = "") -> str:
     return f"❌ **{title}** ❌"
 
 
+def format_oversized_artifact_notice(art_name: str, size_mb: float) -> str:
+    """User-facing text when an artifact is too large to send back to WeChat.
+
+    Must never include server absolute paths — only the display name and size.
+    """
+    name = (art_name or "file").replace("`", "'").strip() or "file"
+    return (
+        f"⚠️ **文件过大** ⚠️\n\n"
+        f"`{name}` {float(size_mb):.1f} MB\n"
+        f"已保存在服务器会话目录，未回传微信。"
+    )
+
+
 def format_cli_error(raw_message: str, *, backend: str = "") -> str:
     """Map CLI stderr/JSON error text into Chinese title + fixed header.
 
@@ -482,8 +500,11 @@ def save_prefs(user_id: str, prefs: dict) -> None:
                 payload["by_backend"].setdefault(b, _empty_backend_slot())
         # Current backend slot always mirrors active model/effort/mode
         sync_active_to_memory(payload)
-        with open(prefs_path, "w") as f:
+        # tmp + os.replace 原子写，避免崩溃留下半截 prefs.json
+        tmp_path = prefs_path + ".tmp"
+        with open(tmp_path, "w") as f:
             json.dump(payload, f, ensure_ascii=False, indent=2)
+        os.replace(tmp_path, prefs_path)
         # Keep caller's dict in sync with what was written
         prefs.update(payload)
     except OSError as e:
@@ -609,32 +630,91 @@ _SESSION_HISTORY_REL_DIRS = (
 _SQLITE_SIDECAR_TAILS = ("-wal", "-shm", "-journal")
 
 
+def _is_dangling_symlink(path: str) -> bool:
+    """True if path is a symlink whose target does not resolve.
+
+    Uses ``lstat`` first so we never mistake a plain missing path for a link.
+    ``os.path.exists`` follows the final hop — False means dangling. Unlink
+    still tolerates races (ENOENT) in the caller.
+    """
+    try:
+        st = os.lstat(path)
+    except OSError:
+        return False
+    if not stat.S_ISLNK(st.st_mode):
+        return False
+    try:
+        return not os.path.exists(path)
+    except OSError:
+        return True
+
+
+def _unlink_quiet(path: str) -> bool:
+    """Unlink path; True if removed. ENOENT (race) counts as already gone."""
+    try:
+        os.unlink(path)
+        return True
+    except FileNotFoundError:
+        return True
+    except OSError as e:
+        logger.warning("Session cleanup failed %s: %s", path, e)
+        return False
+
+
 def _remove_old_files_under(root: str, cutoff: float) -> int:
     """Delete files under root older than cutoff; prune empty subdirs.
 
     For independent temp files only (images/cache/scratch). Does not remove
     ``root`` itself. Returns number of files removed.
+
+    Dangling symlinks (file or dir links, e.g. stale venv ``bin/python`` /
+    ``lib64``) are removed immediately — they are never useful and previously
+    caused getmtime noise. Intact files/links still age out by ``lstat`` mtime.
     """
     if not os.path.isdir(root):
         return 0
     removed = 0
     try:
-        for dirpath, dirnames, filenames in os.walk(root, topdown=False):
+        # followlinks=False: never walk through session symlinks into host trees
+        for dirpath, dirnames, filenames in os.walk(
+            root, topdown=False, followlinks=False
+        ):
+            # Dir symlinks (and some platforms' file links) may appear in dirnames
+            for dn in list(dirnames):
+                dpath = os.path.join(dirpath, dn)
+                if _is_dangling_symlink(dpath):
+                    if _unlink_quiet(dpath):
+                        removed += 1
+                        logger.info(
+                            "Session cleanup: removed dangling dir link %s", dpath
+                        )
             for fn in filenames:
                 path = os.path.join(dirpath, fn)
                 try:
-                    if not os.path.isfile(path) and not os.path.islink(path):
+                    if os.path.islink(path):
+                        # 悬空链接立刻删；完好链接仍按自身 mtime 过期
+                        if _is_dangling_symlink(path) or os.lstat(path).st_mtime < cutoff:
+                            if _unlink_quiet(path):
+                                removed += 1
+                                logger.info("Session cleanup: removed %s", path)
+                        continue
+                    if not os.path.isfile(path):
                         continue
-                    if os.path.getmtime(path) < cutoff:
+                    if os.lstat(path).st_mtime < cutoff:
                         os.remove(path)
                         removed += 1
                         logger.info("Session cleanup: removed %s", path)
+                except FileNotFoundError:
+                    # raced with another cleaner / process
+                    continue
                 except OSError as e:
                     logger.warning("Session cleanup failed %s: %s", path, e)
             if dirpath == root:
                 continue
             try:
-                if not os.listdir(dirpath):
+                # With followlinks=False, dirpath is a real dir we entered — only
+                # prune when empty (never follow/remove host trees via symlinks).
+                if not os.path.islink(dirpath) and not os.listdir(dirpath):
                     os.rmdir(dirpath)
             except OSError:
                 pass

{wechatbridge_cli-1.3.1 → wechatbridge_cli-1.3.3/wechatbridge_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wechatbridge-cli
-Version: 1.3.1
+Version: 1.3.3
 Summary: Bridge WeChat messages to agy or Grok Build CLIs — text/image/file/voice in, CLI replies and generated files back.
 Author: WeChatBridge contributors
 License: MIT

{wechatbridge_cli-1.3.1 → wechatbridge_cli-1.3.3}/wechatbridge_cli.egg-info/SOURCES.txt

@@ -1,6 +1,7 @@
 LICENSE
 README.md
 pyproject.toml
+tests/test_hardening.py
 wechatbridge/__init__.py
 wechatbridge/__main__.py
 wechatbridge/agy.py