wechatbridge-cli 1.6.2__tar.gz → 1.7.1__tar.gz

{wechatbridge_cli-1.6.2 → wechatbridge_cli-1.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wechatbridge-cli
-Version: 1.6.2
+Version: 1.7.1
 Summary: Bridge WeChat messages to agy, Grok Build, or Codex CLIs — text/image/file/voice in, CLI replies and generated files back.
 Author: WeChatBridge contributors
 License: MIT

{wechatbridge_cli-1.6.2 → wechatbridge_cli-1.7.1}/tests/test_dsh.py

@@ -514,7 +514,7 @@ class TestRunDshIntegration(unittest.IsolatedAsyncioTestCase, _DshIntegrationBas
 
     async def test_empty_reply(self):
         display, artifacts = await self._run("hi", mode="empty")
-        self.assertEqual(display, "（这次没有文字回复）")
+        self.assertEqual(display, "🔔 对话额度已用尽\n\n后端没有返回任何内容，通常是本账号的对话额度/用量已耗尽。请稍后再试或联系管理员确认额度。")
         self.assertEqual(artifacts, [])
 
     async def test_nonzero_exit_maps_to_error_bubble(self):
@@ -1210,7 +1210,7 @@ class TestRunDshMemoryIntegration(unittest.IsolatedAsyncioTestCase, _DshIntegrat
         display, artifacts = await self._run("继续", user_id=user_id, mode="empty")
         self.assertIn("上下文安全提示", display)
         self.assertIn("历史对话记录触发安全策略", display)
-        self.assertIn("（这次没有文字回复）", display)
+        self.assertIn("对话额度已用尽", display)
 
     async def test_run_dsh_shows_notice_on_error_reply_when_context_dropped(self):
         """When context was dropped and command exits nonzero / fails, safety notice is preserved separately from error bubble."""

{wechatbridge_cli-1.6.2 → wechatbridge_cli-1.7.1}/tests/test_hardening.py

@@ -2983,5 +2983,261 @@ class TestAgyStreamRetry(unittest.IsolatedAsyncioTestCase):
         mock_sleep.assert_not_awaited()
 
 
+class TestAuditHardeningFixes(unittest.IsolatedAsyncioTestCase):
+    """Regression tests for deep-audit security and correctness fixes."""
+
+    def setUp(self):
+        from wechatbridge.config import config as cfg
+        self._cfg = cfg
+        self._tmp = tempfile.TemporaryDirectory()
+        self.session_base = self._tmp.name
+        self._orig_base = cfg.session_base_dir
+        self._orig_backend = cfg.backend
+        cfg.session_base_dir = self.session_base
+
+    def tearDown(self):
+        self._cfg.session_base_dir = self._orig_base
+        self._cfg.backend = self._orig_backend
+        self._tmp.cleanup()
+
+    async def test_agy_send_artifacts_allows_session_dir_and_blocks_sensitive_or_hardlink(self):
+        from wechatbridge import main as main_mod
+        from wechatbridge.runner_common import ensure_session_dir
+
+        self._cfg.backend = "agy"
+        uid = "u-agy-sec"
+        sdir = ensure_session_dir(uid)
+
+        # Normal artifact directly in session_dir (should be allowed)
+        good_file = os.path.join(sdir, "report.pdf")
+        with open(good_file, "wb") as f:
+            f.write(b"%PDF-1.4 ok")
+
+        # Normal artifact in .gemini/antigravity-cli/scratch (should be allowed)
+        scratch_dir = os.path.join(sdir, ".gemini", "antigravity-cli", "scratch")
+        os.makedirs(scratch_dir, exist_ok=True)
+        scratch_file = os.path.join(scratch_dir, "chart.png")
+        with open(scratch_file, "wb") as f:
+            f.write(b"PNGDATA")
+
+        # Sensitive files inside session_dir (must be blocked)
+        prefs_file = os.path.join(sdir, "prefs.json")
+        with open(prefs_file, "w") as f:
+            f.write('{"model": "gemini-4-argon"}')
+        gemini_dir = os.path.join(sdir, ".gemini")
+        os.makedirs(gemini_dir, exist_ok=True)
+        token_file = os.path.join(gemini_dir, "antigravity-oauth-token")
+        with open(token_file, "w") as f:
+            f.write("secret-oauth-token")
+
+        # Hardlink inside session_dir pointing to external file (must be blocked)
+        ext_file = os.path.join(self.session_base, "external_secret.txt")
+        with open(ext_file, "w") as f:
+            f.write("top-secret")
+        hardlink_file = os.path.join(sdir, "linked.txt")
+        os.link(ext_file, hardlink_file)
+
+        client = mock.MagicMock()
+        client.state.baseurl = "https://ilink"
+        client.state.bot_token = "tok"
+        client.send_media = AsyncMock(return_value=True)
+        client.send_message = AsyncMock(return_value=True)
+
+        await main_mod.send_artifacts_back(
+            artifacts=[
+                ("report.pdf", good_file),
+                ("chart.png", scratch_file),
+                ("prefs.json", prefs_file),
+                ("antigravity-oauth-token", token_file),
+                ("linked.txt", hardlink_file),
+            ],
+            client=client,
+            from_user=uid,
+            context_token="ctx",
+        )
+
+        sent_paths = [c.kwargs["path"] for c in client.send_media.await_args_list]
+        self.assertEqual(
+            sent_paths,
+            [os.path.realpath(good_file), os.path.realpath(scratch_file)],
+        )
+
+    def test_agy_extract_artifacts_balanced_parens_and_model_tsv_parsing(self):
+        from wechatbridge import agy as agy_mod
+
+        text = (
+            "已生成 [report (1).pdf](file:///tmp/sess/report%20(1).pdf) "
+            "和 [v2 [final].docx](file:///tmp/sess/v2%20[final].docx)。"
+        )
+        arts = agy_mod.extract_artifacts(text)
+        self.assertEqual(
+            arts,
+            [
+                ("report (1).pdf", "/tmp/sess/report (1).pdf"),
+                ("v2 [final].docx", "/tmp/sess/v2 [final].docx"),
+            ],
+        )
+
+        tsv_models = (
+            "gemini-4-argon\tGemini 3.1 Pro (High)\n"
+            "claude-opus-4-6-thinking\tClaude Opus 4.6 (Thinking)\n"
+        )
+        self.assertEqual(
+            agy_mod._parse_agy_model_ids(tsv_models),
+            ["gemini-4-argon", "claude-opus-4-6-thinking"],
+        )
+
+    async def test_planning_and_fast_toggle_and_clear_resets_mode(self):
+        from wechatbridge import agy as agy_mod
+        from wechatbridge.runner_common import load_prefs
+
+        uid = "u-toggle"
+        r1 = await agy_mod.handle_slash_command("/planning", uid)
+        self.assertIn("已开启规划模式", r1)
+        self.assertEqual(load_prefs(uid).get("mode"), "plan")
+
+        # Calling /planning again toggles it off
+        r2 = await agy_mod.handle_slash_command("/planning", uid)
+        self.assertIn("已关闭规划模式", r2)
+        self.assertEqual(load_prefs(uid).get("mode"), "")
+
+        # Enable again and verify /clear resets sticky mode
+        await agy_mod.handle_slash_command("/planning", uid)
+        self.assertEqual(load_prefs(uid).get("mode"), "plan")
+        await agy_mod.handle_slash_command("/clear", uid)
+        self.assertEqual(load_prefs(uid).get("mode"), "")
+
+        # /fast off
+        await agy_mod.handle_slash_command("/fast", uid)
+        self.assertEqual(load_prefs(uid).get("effort"), "low")
+        r_fast_off = await agy_mod.handle_slash_command("/fast off", uid)
+        self.assertIn("已关闭快速模式", r_fast_off)
+        self.assertEqual(load_prefs(uid).get("effort"), "")
+
+    def test_sanitize_prompt_at_paths_allows_session_and_add_dirs_blocks_external(self):
+        from wechatbridge.runner_common import _sanitize_prompt_at_paths, ensure_session_dir
+
+        sdir = ensure_session_dir("u-at")
+        extra_dir = os.path.join(self.session_base, "allowed_extra")
+        os.makedirs(extra_dir, exist_ok=True)
+        prompt = (
+            f"请看 @{sdir}/img.png 和 @{extra_dir}/doc.md "
+            "不要读 @/etc/passwd 或 @../../etc/shadow"
+        )
+        sanitized = _sanitize_prompt_at_paths(prompt, sdir, extra_roots=[extra_dir])
+        self.assertIn(f"@{sdir}/img.png", sanitized)
+        self.assertIn(f"@{extra_dir}/doc.md", sanitized)
+        self.assertNotIn("/etc/passwd", sanitized)
+        self.assertNotIn("/etc/shadow", sanitized)
+        self.assertEqual(sanitized.count("[blocked-path]"), 2)
+
+    async def test_ilink_get_updates_raises_on_5xx_and_encrypt_roundtrip(self):
+        import httpx
+        from wechatbridge.ilink import ILinkClient, _encrypt_aes_ecb, _decrypt_aes_ecb
+
+        key = os.urandom(16)
+        for length in (0, 1, 15, 16, 17, 32, 100):
+            raw = os.urandom(length)
+            enc = _encrypt_aes_ecb(raw, key)
+            self.assertEqual(_decrypt_aes_ecb(enc, key), raw)
+
+        client = ILinkClient()
+        try:
+            req = httpx.Request("POST", "https://ilink/ilink/bot/getupdates")
+            resp_502 = httpx.Response(502, request=req)
+            client.http_client.post = AsyncMock(
+                side_effect=httpx.HTTPStatusError("502 Bad Gateway", request=req, response=resp_502)
+            )
+            client.state.clear = mock.MagicMock()
+            with self.assertRaises(httpx.HTTPStatusError):
+                await client.get_updates("buf1", "https://ilink", "tok")
+            client.state.clear.assert_not_called()
+        finally:
+            await client.close()
+
+    async def test_price_http_error_does_not_leak_url_or_appkey(self):
+        import httpx
+        from wechatbridge import price as price_mod
+
+        req = httpx.Request(
+            "GET",
+            "https://openapi.dataoke.com/api/goods/get-goods-details?appKey=SECRET_DT_KEY_123&id=1",
+        )
+        err = httpx.ConnectError(
+            "Connection failed for https://openapi.dataoke.com/api?appKey=SECRET_DT_KEY_123",
+            request=req,
+        )
+        with mock.patch.object(price_mod, "dt_configured", return_value=True), \
+             mock.patch.object(price_mod, "query_tb_item", side_effect=err):
+            reply = await price_mod.handle_price_query({"kind": "tb_item", "item_id": "1"})
+        self.assertNotIn("SECRET_DT_KEY_123", reply)
+        self.assertIn("比价接口请求失败", reply)
+
+        with self.assertRaises(ValueError):
+            price_mod._resolve_short_link("http://127.0.0.1:8080/admin")
+        self.assertFalse(price_mod._is_allowed_short_url("https://evil.u.jd.com/abc"))
+        self.assertFalse(price_mod._is_allowed_short_url("https://a.3.cn/xyz"))
+        self.assertTrue(price_mod._is_allowed_short_url("https://u.jd.com/abc"))
+
+    def test_ensure_user_gemini_refreshes_stale_oauth_token_and_blocks_copied_secrets(self):
+        from wechatbridge import agy as agy_mod
+        from wechatbridge.runner_common import is_sensitive_artifact_path, _sanitize_prompt_at_paths
+
+        fake_host_home = os.path.join(self.session_base, "host_home")
+        host_agy = os.path.join(fake_host_home, ".gemini", "antigravity-cli")
+        os.makedirs(host_agy, exist_ok=True)
+        src_token = os.path.join(host_agy, "antigravity-oauth-token")
+        with open(src_token, "w") as f:
+            f.write("old-token-value-111111")
+
+        def _fake_expanduser(p: str) -> str:
+            if p.startswith("~/"):
+                return os.path.join(fake_host_home, p[2:])
+            return p
+
+        with mock.patch("os.path.expanduser", side_effect=_fake_expanduser):
+            sdir = agy_mod.ensure_user_gemini("u-tok-refresh")
+            dst_token = os.path.join(sdir, ".gemini", "antigravity-cli", "antigravity-oauth-token")
+            with open(dst_token) as f:
+                self.assertEqual(f.read(), "old-token-value-111111")
+
+            # Make dst older and update src token
+            os.utime(dst_token, (1000.0, 1000.0))
+            with open(src_token, "w") as f:
+                f.write("refreshed-token-value-222222")
+            os.utime(src_token, (2000.0, 2000.0))
+
+            agy_mod.ensure_user_gemini("u-tok-refresh")
+            with open(dst_token) as f:
+                self.assertEqual(f.read(), "refreshed-token-value-222222")
+
+        # Renamed / copied credentials must still be blocked by is_sensitive_artifact_path
+        copied_secret = os.path.join(sdir, "token.copy")
+        with open(copied_secret, "w") as f:
+            f.write("refreshed-token-value-222222")
+        self.assertTrue(is_sensitive_artifact_path(copied_secret, sdir))
+
+        auth_bak = os.path.join(sdir, "auth.json.bak")
+        with open(auth_bak, "w") as f:
+            f.write("{}")
+        self.assertTrue(is_sensitive_artifact_path(auth_bak, sdir))
+
+        scratch_settings = os.path.join(sdir, ".gemini", "antigravity-cli", "scratch", "settings.json")
+        os.makedirs(os.path.dirname(scratch_settings), exist_ok=True)
+        with open(scratch_settings, "w") as f:
+            f.write("{}")
+        self.assertTrue(is_sensitive_artifact_path(scratch_settings, sdir))
+
+        # @<path> sanitization for bare sensitive names, URL-encoded traversal, and URLs
+        p_out = _sanitize_prompt_at_paths(
+            "read @prefs.json @auth.json.bak @..%2f..%2fetc%2fpasswd @https://evil.com/a",
+            sdir,
+        )
+        self.assertEqual(
+            p_out,
+            "read [blocked-path] [blocked-path] [blocked-path] [blocked-path]",
+        )
+
+
 if __name__ == "__main__":
     unittest.main()

{wechatbridge_cli-1.6.2 → wechatbridge_cli-1.7.1}/wechatbridge/__init__.py

@@ -1,2 +1,2 @@
 """WeChatBridge — bridge WeChat messages to agy, Grok Build, or Codex CLIs."""
-__version__ = "1.6.2"
+__version__ = "1.7.1"

{wechatbridge_cli-1.6.2 → wechatbridge_cli-1.7.1}/wechatbridge/agy.py

@@ -10,13 +10,16 @@ import re
 import shutil
 import signal
 import sys
+import tempfile
 import time
 from urllib.parse import unquote
 
 from .config import config
 from .runner_common import (
+    MAX_ADD_DIRS,
+    _sanitize_prompt_at_paths,
     sanitize_user_id, get_session_dir, ensure_session_dir, is_first_message, mark_initialized, clear_initialized,
-    clean_output, load_prefs, save_prefs, is_dangerous, parse_model_effort,
+    clean_output, load_prefs, save_prefs, is_dangerous, is_sensitive_artifact_path, parse_model_effort,
     sanitize_env, terminate_process, update_active_prefs,
     format_error, format_cli_error, _classify_cli_error, is_bridge_formatted_reply, EMPTY_REPLY,
     ANSI_RE, HTML_TAG_RE, validate_add_dir,
@@ -27,22 +30,26 @@ logger = logging.getLogger("agy_runner")
 # execve 单参数上限（Linux MAX_ARG_STRLEN = 128KB），留安全余量
 _MAX_ARG_BYTES = 120 * 1024
 
+# Matches markdown [name](file:///path) while supporting one level of balanced
+# brackets in display name and one level of balanced parentheses in path (e.g.
+# "report (1).pdf"), without greedily spanning across multiple links on a line.
+_FILE_LINK_RE = re.compile(
+    r"\[((?:[^\[\]]+|\[[^\[\]]*\])+)\]\(file:///((?:[^()\s]+|\([^()\s]*\))+)\)"
+)
+
 
 def extract_artifacts(text: str) -> list[tuple[str, str]]:
     """Extract (name, absolute_path) tuples from markdown file:/// links.
 
-    Uses regex ``\\[([^\\]]+)\\](file:///([^)]+))`` to find agy-generated
-    artifact references in stdout. Returns deduplicated, order-preserved list.
-
-    Paths and display names are URL-decoded (``urllib.parse.unquote``) so
-    percent-encoded spaces / CJK (e.g. ``my%20report.pdf``, ``%E6%8A%A5%E5%91%8A.pdf``)
-    resolve to real filesystem paths.
+    Supports balanced parentheses in filenames (e.g. ``report (1).pdf``) and
+    URL-decodes (``urllib.parse.unquote``) percent-encoded spaces / CJK.
+    Returns a deduplicated, order-preserved list.
     """
     if not text:
         return []
     seen = set()
     result = []
-    for match in re.finditer(r"\[([^\]]+)\]\(file:///([^)]+)\)", text):
+    for match in _FILE_LINK_RE.finditer(text):
         name = unquote(match.group(1).split("#")[0])
         path_part = unquote(match.group(2).split("#")[0])
         abs_path = path_part if path_part.startswith("/") else "/" + path_part
@@ -88,14 +95,38 @@ def ensure_user_gemini(user_id: str) -> str:
     except OSError:
         pass
 
-    # Copy global auth token if not yet present
+    # Copy or refresh global auth token when missing or older than host token
     # agy standard auth token path, managed by agy CLI
     token_src = os.path.expanduser("~/.gemini/antigravity-cli/antigravity-oauth-token")
     token_dst = os.path.join(antigravity_dir, "antigravity-oauth-token")
-    if not os.path.exists(token_dst) and os.path.exists(token_src):
+    if os.path.exists(token_src):
         try:
-            shutil.copy(token_src, token_dst)
-            os.chmod(token_dst, 0o600)
+            src_stat = os.stat(token_src)
+            need_copy = not os.path.exists(token_dst)
+            if not need_copy and src_stat.st_size > 0:
+                try:
+                    dst_stat = os.stat(token_dst)
+                    if src_stat.st_mtime > dst_stat.st_mtime or dst_stat.st_size == 0:
+                        need_copy = True
+                except OSError:
+                    need_copy = True
+            if need_copy and src_stat.st_size > 0:
+                fd, tmp_token = tempfile.mkstemp(
+                    dir=antigravity_dir, prefix=".oauth-token.", suffix=".tmp"
+                )
+                try:
+                    with os.fdopen(fd, "wb") as fout:
+                        with open(token_src, "rb") as fin:
+                            shutil.copyfileobj(fin, fout)
+                    os.chmod(tmp_token, 0o600)
+                    os.replace(tmp_token, token_dst)
+                except OSError:
+                    if os.path.exists(tmp_token):
+                        try:
+                            os.unlink(tmp_token)
+                        except OSError:
+                            pass
+                    raise
         except OSError as e:
             logger.warning("Failed to copy auth token for %s: %s", user_id, e)
 
@@ -178,15 +209,21 @@ async def run_agy(prompt: str, user_id: str, timeout: int = None) -> tuple[str,
         cmd += ["--effort", effort]
     if prefs.get("mode"):
         cmd += ["--mode", prefs["mode"]]
-    for d in prefs.get("add_dirs", []):
+    valid_add_dirs = []
+    for d in (prefs.get("add_dirs", []) or [])[:MAX_ADD_DIRS]:
         if not d:
             continue
         ok, resolved = validate_add_dir(d, user_id)
         if ok:
+            valid_add_dirs.append(resolved)
             cmd += ["--add-dir", resolved]
         else:
             logger.warning("Skipping disallowed add_dir for %s: %s (%s)", user_id, d, resolved)
 
+    safe_prompt = _sanitize_prompt_at_paths(
+        prompt, session_dir, extra_roots=valid_add_dirs
+    )
+
     if first:
         logger.info(
             "First message for user %s, running: agy -p ...", user_id
@@ -198,7 +235,7 @@ async def run_agy(prompt: str, user_id: str, timeout: int = None) -> tuple[str,
             user_id,
         )
 
-    cmd += ["-p", prompt]
+    cmd += ["-p", safe_prompt]
 
     process = None
     try:
@@ -226,7 +263,11 @@ async def run_agy(prompt: str, user_id: str, timeout: int = None) -> tuple[str,
         stderr_text = stderr_bytes.decode("utf-8", errors="replace").strip()
 
         # A: Extract artifacts from raw stdout (before clean_output!)
-        artifacts = extract_artifacts(stdout_text)
+        artifacts = [
+            (n, p)
+            for n, p in extract_artifacts(stdout_text)
+            if not is_sensitive_artifact_path(p, session_dir)
+        ]
 
         # B: (disabled) Scratch diff via before/after snapshots is removed because
         #   multi-user shared scratch causes cross-user artifact leakage.
@@ -237,6 +278,7 @@ async def run_agy(prompt: str, user_id: str, timeout: int = None) -> tuple[str,
         display = clean_output(stdout_text) or EMPTY_REPLY
 
         # Strip file:/// links from display to avoid leaking server paths
+        display = _FILE_LINK_RE.sub(r"[\1]", display)
         display = re.sub(
             r"\[([^\]]+)\]\(file:///[^)]+\)",
             r"[\1]",
@@ -293,8 +335,13 @@ async def run_agy(prompt: str, user_id: str, timeout: int = None) -> tuple[str,
                     r_stderr_text = r_stderr.decode("utf-8", errors="replace").strip()
                     # Any useful stdout after retry counts as recovered (agy may exit non-zero)
                     if r_stdout_text:
-                        r_artifacts = extract_artifacts(r_stdout_text)
+                        r_artifacts = [
+                            (n, p)
+                            for n, p in extract_artifacts(r_stdout_text)
+                            if not is_sensitive_artifact_path(p, session_dir)
+                        ]
                         r_display = clean_output(r_stdout_text) or EMPTY_REPLY
+                        r_display = _FILE_LINK_RE.sub(r"[\1]", r_display)
                         r_display = re.sub(r"\[([^\]]+)\]\(file:///[^)]+\)", r"[\1]", r_display)
                         if (
                             first
@@ -310,9 +357,10 @@ async def run_agy(prompt: str, user_id: str, timeout: int = None) -> tuple[str,
                         ), []
                     return format_cli_error(r_stderr_text or stderr_text, backend="agy"), []
                 return format_cli_error(stderr_text, backend="agy"), []
-            # Non-zero exit: never treat raw stdout as a normal success reply
+            # Non-zero exit: never treat raw stdout as a normal success reply,
+            # but preserve any valid non-sensitive artifacts already emitted.
             raw = stderr_text or stdout_text or display or "process exited abnormally"
-            return format_cli_error(raw, backend="agy"), []
+            return format_cli_error(raw, backend="agy"), artifacts
 
         # Success path only — never mark on ❌/🔔 error/throttle bubbles
         if first and display != EMPTY_REPLY and not is_bridge_formatted_reply(display):
@@ -524,26 +572,44 @@ def handle_persona(args: str, user_id: str) -> str:
 
 
 def _cmd_clear(user_id: str) -> str:
-    """Handle /clear or /new: delete .initialized flag to start fresh."""
+    """Handle /clear or /new: delete .initialized flag to start fresh and reset sticky plan mode."""
     session_dir = get_session_dir(user_id)
     clear_initialized(session_dir, backend="agy")
+    prefs_path = os.path.join(session_dir, "prefs.json")
+    if os.path.exists(prefs_path):
+        prefs = load_prefs(user_id)
+        if prefs.get("mode"):
+            update_active_prefs(user_id, mode="")
     return "✅ **对话已重置** ✅"
 
 
-def _cmd_fast(user_id: str) -> str:
-    """Handle /fast: set effort=low (scoped to current backend)."""
+_OFF_ARGS = frozenset({"off", "0", "false", "no", "normal", "default", "reset", "clear", "agent"})
+
+
+def _cmd_fast(user_id: str, args: str = "") -> str:
+    """Handle /fast [on|off]: set effort=low or toggle off (scoped to current backend)."""
+    sub = (args or "").strip().lower()
+    prefs = load_prefs(user_id)
+    if sub in _OFF_ARGS or (not sub and prefs.get("effort") == "low"):
+        update_active_prefs(user_id, effort="")
+        return "✅ **已关闭快速模式** ✅"
     update_active_prefs(user_id, effort="low")
     return "✅ **已开启快速模式** ✅"
 
 
-def _cmd_planning(user_id: str) -> str:
-    """Handle /planning: set mode=plan (scoped to current backend)."""
+def _cmd_planning(user_id: str, args: str = "") -> str:
+    """Handle /planning [on|off]: set mode=plan or toggle off (scoped to current backend)."""
+    sub = (args or "").strip().lower()
+    prefs = load_prefs(user_id)
+    if sub in _OFF_ARGS or (not sub and prefs.get("mode") == "plan"):
+        update_active_prefs(user_id, mode="")
+        return "✅ **已关闭规划模式** ✅"
     update_active_prefs(user_id, mode="plan")
     return "✅ **已开启规划模式** ✅"
 
 
 def _cmd_add_dir(args: str, user_id: str) -> str:
-    """Handle /add-dir <path>: add path to add_dirs list (dedup, validated)."""
+    """Handle /add-dir <path>: add path to add_dirs list (dedup, validated, capped)."""
     path = args.strip()
     if not path:
         return "❌ **缺少参数** ❌\n\n`/add-dir <路径>`"
@@ -554,12 +620,34 @@ def _cmd_add_dir(args: str, user_id: str) -> str:
     prefs = load_prefs(user_id)
     dirs = prefs.get("add_dirs", [])
     if resolved not in dirs:
+        if len(dirs) >= MAX_ADD_DIRS:
+            return f"❌ **工作目录数量已达上限 ({MAX_ADD_DIRS})** ❌"
         dirs.append(resolved)
         prefs["add_dirs"] = dirs
         save_prefs(user_id, prefs)
     return f"✅ **已添加工作目录** ✅\n\n```\n{resolved}\n```"
 
 
+def _parse_agy_model_ids(output: str) -> list[str]:
+    """Extract canonical model IDs from ``agy models`` output.
+
+    ``agy models`` outputs ``<model_id>\\t<Display Name>`` per line (e.g.
+    ``gemini-4-argon-high\\tGemini 4 Argon (High)``). Strip the display column
+    and any status/banner lines so only valid model slugs are returned.
+    """
+    models: list[str] = []
+    for raw_line in (output or "").split("\n"):
+        line = raw_line.strip()
+        if not line:
+            continue
+        if line.lower().startswith(("fetching available models", "available models", "error:")):
+            continue
+        model_id = line.split("\t", 1)[0].strip()
+        if model_id and " " not in model_id:
+            models.append(model_id)
+    return models
+
+
 async def _cmd_model(args: str, user_id: str) -> str:
     """Handle /model <name>: validate against agy models list, then save.
 
@@ -576,7 +664,7 @@ async def _cmd_model(args: str, user_id: str) -> str:
     if output.startswith("[error]") or is_bridge_formatted_reply(output):
         return "❌ **无法获取模型列表** ❌"
 
-    models = [line.strip() for line in output.split("\n") if line.strip()]
+    models = _parse_agy_model_ids(output)
 
     # Exact match
     if name in models:
@@ -652,10 +740,10 @@ async def handle_slash_command(text: str, user_id: str) -> str | None:
         return _cmd_clear(user_id)
 
     if cmd == "/fast":
-        return _cmd_fast(user_id)
+        return _cmd_fast(user_id, args)
 
     if cmd == "/planning":
-        return _cmd_planning(user_id)
+        return _cmd_planning(user_id, args)
 
     if cmd == "/model":
         return await _cmd_model(args, user_id)