@rdmind/rdmind 0.0.28-alpha.1 → 0.0.28-alpha.2

package/cli.js

@@ -43517,14 +43517,14 @@ var require_connect = __commonJS({
       const sessionCache = new SessionCache(maxCachedSessions == null ? 100 : maxCachedSessions);
       timeout2 = timeout2 == null ? 1e4 : timeout2;
       allowH2 = allowH2 != null ? allowH2 : false;
-      return /* @__PURE__ */ __name(function connect({ hostname: hostname5, host, protocol, port, servername, localAddress, httpSocket }, callback) {
+      return /* @__PURE__ */ __name(function connect({ hostname: hostname4, host, protocol, port, servername, localAddress, httpSocket }, callback) {
         let socket;
         if (protocol === "https:") {
           if (!tls) {
             tls = __require("node:tls");
           }
           servername = servername || options2.servername || util4.getServerName(host) || null;
-          const sessionKey = servername || hostname5;
+          const sessionKey = servername || hostname4;
           assert3(sessionKey);
           const session = customSession || sessionCache.get(sessionKey) || null;
           port = port || 443;
@@ -43539,7 +43539,7 @@ var require_connect = __commonJS({
             socket: httpSocket,
             // upgrade socket connection
             port,
-            host: hostname5
+            host: hostname4
           });
           socket.on("session", function(session2) {
             sessionCache.set(sessionKey, session2);
@@ -43553,14 +43553,14 @@ var require_connect = __commonJS({
             ...options2,
             localAddress,
             port,
-            host: hostname5
+            host: hostname4
           });
         }
         if (options2.keepAlive == null || options2.keepAlive) {
           const keepAliveInitialDelay = options2.keepAliveInitialDelay === void 0 ? 6e4 : options2.keepAliveInitialDelay;
           socket.setKeepAlive(true, keepAliveInitialDelay);
         }
-        const clearConnectTimeout = util4.setupConnectTimeout(new WeakRef(socket), { timeout: timeout2, hostname: hostname5, port });
+        const clearConnectTimeout = util4.setupConnectTimeout(new WeakRef(socket), { timeout: timeout2, hostname: hostname4, port });
         socket.setNoDelay(true).once(protocol === "https:" ? "secureConnect" : "connect", function() {
           queueMicrotask(clearConnectTimeout);
           if (callback) {
@@ -48536,8 +48536,8 @@ var require_client_h2 = __commonJS({
         }
       }
       let stream2 = null;
-      const { hostname: hostname5, port } = client[kUrl];
-      headers[HTTP2_HEADER_AUTHORITY] = host || `${hostname5}${port ? `:${port}` : ""}`;
+      const { hostname: hostname4, port } = client[kUrl];
+      headers[HTTP2_HEADER_AUTHORITY] = host || `${hostname4}${port ? `:${port}` : ""}`;
       headers[HTTP2_HEADER_METHOD] = method;
       const abort = /* @__PURE__ */ __name((err) => {
         if (request4.aborted || request4.completed) {
@@ -49204,20 +49204,20 @@ var require_client = __commonJS({
     function connect(client) {
       assert3(!client[kConnecting]);
       assert3(!client[kHTTPContext]);
-      let { host, hostname: hostname5, protocol, port } = client[kUrl];
-      if (hostname5[0] === "[") {
-        const idx = hostname5.indexOf("]");
+      let { host, hostname: hostname4, protocol, port } = client[kUrl];
+      if (hostname4[0] === "[") {
+        const idx = hostname4.indexOf("]");
         assert3(idx !== -1);
-        const ip = hostname5.substring(1, idx);
+        const ip = hostname4.substring(1, idx);
         assert3(net2.isIPv6(ip));
-        hostname5 = ip;
+        hostname4 = ip;
       }
       client[kConnecting] = true;
       if (channels.beforeConnect.hasSubscribers) {
         channels.beforeConnect.publish({
           connectParams: {
             host,
-            hostname: hostname5,
+            hostname: hostname4,
             protocol,
             port,
             version: client[kHTTPContext]?.version,
@@ -49229,14 +49229,14 @@ var require_client = __commonJS({
       }
       client[kConnector]({
         host,
-        hostname: hostname5,
+        hostname: hostname4,
         protocol,
         port,
         servername: client[kServerName],
         localAddress: client[kLocalAddress]
       }, (err, socket) => {
         if (err) {
-          handleConnectError(client, err, { host, hostname: hostname5, protocol, port });
+          handleConnectError(client, err, { host, hostname: hostname4, protocol, port });
           client[kResume]();
           return;
         }
@@ -49250,7 +49250,7 @@ var require_client = __commonJS({
           client[kHTTPContext] = socket.alpnProtocol === "h2" ? connectH2(client, socket) : connectH1(client, socket);
         } catch (err2) {
           socket.destroy().on("error", noop6);
-          handleConnectError(client, err2, { host, hostname: hostname5, protocol, port });
+          handleConnectError(client, err2, { host, hostname: hostname4, protocol, port });
           client[kResume]();
           return;
         }
@@ -49263,7 +49263,7 @@ var require_client = __commonJS({
           channels.connected.publish({
             connectParams: {
               host,
-              hostname: hostname5,
+              hostname: hostname4,
               protocol,
               port,
               version: client[kHTTPContext]?.version,
@@ -49279,7 +49279,7 @@ var require_client = __commonJS({
       });
     }
     __name(connect, "connect");
-    function handleConnectError(client, err, { host, hostname: hostname5, protocol, port }) {
+    function handleConnectError(client, err, { host, hostname: hostname4, protocol, port }) {
       if (client.destroyed) {
         return;
       }
@@ -49288,7 +49288,7 @@ var require_client = __commonJS({
         channels.connectError.publish({
           connectParams: {
             host,
-            hostname: hostname5,
+            hostname: hostname4,
             protocol,
             port,
             version: client[kHTTPContext]?.version,
@@ -50338,10 +50338,10 @@ var require_env_http_proxy_agent = __commonJS({
         ]);
       }
       #getProxyAgentForUrl(url2) {
-        let { protocol, host: hostname5, port } = url2;
-        hostname5 = hostname5.replace(/:\d*$/, "").toLowerCase();
+        let { protocol, host: hostname4, port } = url2;
+        hostname4 = hostname4.replace(/:\d*$/, "").toLowerCase();
         port = Number.parseInt(port, 10) || DEFAULT_PORTS[protocol] || 0;
-        if (!this.#shouldProxy(hostname5, port)) {
+        if (!this.#shouldProxy(hostname4, port)) {
           return this[kNoProxyAgent];
         }
         if (protocol === "https:") {
@@ -50349,7 +50349,7 @@ var require_env_http_proxy_agent = __commonJS({
         }
         return this[kHttpProxyAgent];
       }
-      #shouldProxy(hostname5, port) {
+      #shouldProxy(hostname4, port) {
         if (this.#noProxyChanged) {
           this.#parseNoProxy();
         }
@@ -50365,11 +50365,11 @@ var require_env_http_proxy_agent = __commonJS({
             continue;
           }
           if (!/^[.*]/.test(entry.hostname)) {
-            if (hostname5 === entry.hostname) {
+            if (hostname4 === entry.hostname) {
               return false;
             }
           } else {
-            if (hostname5.endsWith(entry.hostname.replace(/^\*/, ""))) {
+            if (hostname4.endsWith(entry.hostname.replace(/^\*/, ""))) {
               return false;
             }
           }
@@ -50815,10 +50815,10 @@ var require_h2c_client = __commonJS({
       #buildConnector(connectOpts) {
         return (opts, callback) => {
           const timeout2 = connectOpts?.connectOpts ?? 1e4;
-          const { hostname: hostname5, port, pathname } = opts;
+          const { hostname: hostname4, port, pathname } = opts;
           const socket = connect({
             ...opts,
-            host: hostname5,
+            host: hostname4,
             port,
             pathname
           });
@@ -50829,7 +50829,7 @@ var require_h2c_client = __commonJS({
           socket.alpnProtocol = "h2";
           const clearConnectTimeout = util4.setupConnectTimeout(
             new WeakRef(socket),
-            { timeout: timeout2, hostname: hostname5, port }
+            { timeout: timeout2, hostname: hostname4, port }
           );
           socket.setNoDelay(true).once("connect", function() {
             queueMicrotask(clearConnectTimeout);
@@ -77806,7 +77806,7 @@ var require_googleauth = __commonJS({
     var child_process_1 = __require("child_process");
     var fs103 = __require("fs");
     var gcpMetadata = require_src4();
-    var os49 = __require("os");
+    var os48 = __require("os");
     var path115 = __require("path");
     var crypto_1 = require_crypto3();
     var transporters_1 = require_transporters();
@@ -78250,7 +78250,7 @@ var require_googleauth = __commonJS({
        * @api private
        */
       _isWindows() {
-        const sys = os49.platform();
+        const sys = os48.platform();
         if (sys && sys.length >= 3) {
           if (sys.substring(0, 3).toLowerCase() === "win") {
             return true;
@@ -124811,7 +124811,7 @@ var require_service_config = __commonJS({
     exports2.validateRetryThrottling = validateRetryThrottling;
     exports2.validateServiceConfig = validateServiceConfig;
     exports2.extractAndSelectServiceConfig = extractAndSelectServiceConfig;
-    var os49 = __require("os");
+    var os48 = __require("os");
     var constants_1 = require_constants9();
     var DURATION_REGEX = /^\d+(\.\d{1,9})?s$/;
     var CLIENT_LANGUAGE_STRING = "node";
@@ -125117,8 +125117,8 @@ var require_service_config = __commonJS({
         }
         if (Array.isArray(validatedConfig.clientHostname)) {
           let hostnameMatched = false;
-          for (const hostname5 of validatedConfig.clientHostname) {
-            if (hostname5 === os49.hostname()) {
+          for (const hostname4 of validatedConfig.clientHostname) {
+            if (hostname4 === os48.hostname()) {
               hostnameMatched = true;
             }
           }
@@ -138607,8 +138607,8 @@ var require_resolver_dns = __commonJS({
           }
           trace2("Looking up DNS hostname " + this.dnsHostname);
           this.latestLookupResult = null;
-          const hostname5 = this.dnsHostname;
-          this.pendingLookupPromise = this.lookup(hostname5);
+          const hostname4 = this.dnsHostname;
+          this.pendingLookupPromise = this.lookup(hostname4);
           this.pendingLookupPromise.then((addressList) => {
             if (this.pendingLookupPromise === null) {
               return;
@@ -138636,7 +138636,7 @@ var require_resolver_dns = __commonJS({
             this.listener.onError(this.defaultResolutionError);
           });
           if (this.isServiceConfigEnabled && this.pendingTxtPromise === null) {
-            this.pendingTxtPromise = this.resolveTxt(hostname5);
+            this.pendingTxtPromise = this.resolveTxt(hostname4);
             this.pendingTxtPromise.then((txtRecord) => {
               if (this.pendingTxtPromise === null) {
                 return;
@@ -138659,12 +138659,12 @@ var require_resolver_dns = __commonJS({
           }
         }
       }
-      async lookup(hostname5) {
+      async lookup(hostname4) {
         if (environment_1.GRPC_NODE_USE_ALTERNATIVE_RESOLVER) {
           trace2("Using alternative DNS resolver.");
           const records = await Promise.allSettled([
-            this.alternativeResolver.resolve4(hostname5),
-            this.alternativeResolver.resolve6(hostname5)
+            this.alternativeResolver.resolve4(hostname4),
+            this.alternativeResolver.resolve6(hostname4)
           ]);
           if (records.every((result) => result.status === "rejected")) {
             throw new Error(records[0].reason);
@@ -138676,15 +138676,15 @@ var require_resolver_dns = __commonJS({
             port: +this.port
           }));
         }
-        const addressList = await dns_1.promises.lookup(hostname5, { all: true });
+        const addressList = await dns_1.promises.lookup(hostname4, { all: true });
         return addressList.map((addr) => ({ host: addr.address, port: +this.port }));
       }
-      async resolveTxt(hostname5) {
+      async resolveTxt(hostname4) {
         if (environment_1.GRPC_NODE_USE_ALTERNATIVE_RESOLVER) {
           trace2("Using alternative DNS resolver.");
-          return this.alternativeResolver.resolveTxt(hostname5);
+          return this.alternativeResolver.resolveTxt(hostname4);
         }
-        return dns_1.promises.resolveTxt(hostname5);
+        return dns_1.promises.resolveTxt(hostname4);
       }
       startNextResolutionTimer() {
         var _a6, _b2;
@@ -138816,13 +138816,13 @@ var require_http_proxy = __commonJS({
           userCred = proxyUrl.username;
         }
       }
-      const hostname5 = proxyUrl.hostname;
+      const hostname4 = proxyUrl.hostname;
       let port = proxyUrl.port;
       if (port === "") {
         port = "80";
       }
       const result = {
-        address: `${hostname5}:${port}`
+        address: `${hostname4}:${port}`
       };
       if (userCred) {
         result.creds = userCred;
@@ -139084,7 +139084,7 @@ var require_subchannel_call = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.Http2SubchannelCall = void 0;
     var http22 = __require("http2");
-    var os49 = __require("os");
+    var os48 = __require("os");
     var constants_1 = require_constants9();
     var metadata_1 = require_metadata3();
     var stream_decoder_1 = require_stream_decoder();
@@ -139092,7 +139092,7 @@ var require_subchannel_call = __commonJS({
     var constants_2 = require_constants9();
     var TRACER_NAME = "subchannel_call";
     function getSystemErrorName(errno) {
-      for (const [name3, num] of Object.entries(os49.constants.errno)) {
+      for (const [name3, num] of Object.entries(os48.constants.errno)) {
         if (num === errno) {
           return name3;
         }
@@ -140666,8 +140666,8 @@ var require_load_balancing_call = __commonJS({
         if (splitPath.length >= 2) {
           serviceName = splitPath[1];
         }
-        const hostname5 = (_b2 = (_a6 = (0, uri_parser_1.splitHostPort)(this.host)) === null || _a6 === void 0 ? void 0 : _a6.host) !== null && _b2 !== void 0 ? _b2 : "localhost";
-        this.serviceUrl = `https://${hostname5}/${serviceName}`;
+        const hostname4 = (_b2 = (_a6 = (0, uri_parser_1.splitHostPort)(this.host)) === null || _a6 === void 0 ? void 0 : _a6.host) !== null && _b2 !== void 0 ? _b2 : "localhost";
+        this.serviceUrl = `https://${hostname4}/${serviceName}`;
         this.startTime = /* @__PURE__ */ new Date();
       }
       getDeadlineInfo() {
@@ -159060,7 +159060,7 @@ var require_ProcessDetector = __commonJS({
     exports2.processDetector = void 0;
     var api_1 = (init_esm2(), __toCommonJS(esm_exports2));
     var semconv_1 = require_semconv2();
-    var os49 = __require("os");
+    var os48 = __require("os");
     var ProcessDetector = class {
       static {
         __name(this, "ProcessDetector");
@@ -159083,7 +159083,7 @@ var require_ProcessDetector = __commonJS({
           attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
         }
         try {
-          const userInfo2 = os49.userInfo();
+          const userInfo2 = os48.userInfo();
           attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo2.username;
         } catch (e2) {
           api_1.diag.debug(`error obtaining process owner: ${e2}`);
@@ -165433,8 +165433,8 @@ var require_homedir = __commonJS({
   "node_modules/resolve/lib/homedir.js"(exports2, module2) {
     "use strict";
     init_esbuild_shims();
-    var os49 = __require("os");
-    module2.exports = os49.homedir || /* @__PURE__ */ __name(function homedir24() {
+    var os48 = __require("os");
+    module2.exports = os48.homedir || /* @__PURE__ */ __name(function homedir24() {
       var home = process.env.HOME;
       var user = process.env.LOGNAME || process.env.USER || process.env.LNAME || process.env.USERNAME;
       if (process.platform === "win32") {
@@ -170008,10 +170008,10 @@ var require_utils12 = __commonJS({
     }, "isCompressed");
     exports2.isCompressed = isCompressed;
     function stringUrlToHttpOptions(stringUrl) {
-      const { hostname: hostname5, pathname, port, username, password, search, protocol, hash, href, origin, host } = new URL(stringUrl);
+      const { hostname: hostname4, pathname, port, username, password, search, protocol, hash, href, origin, host } = new URL(stringUrl);
       const options2 = {
         protocol,
-        hostname: hostname5 && hostname5[0] === "[" ? hostname5.slice(1, -1) : hostname5,
+        hostname: hostname4 && hostname4[0] === "[" ? hostname4.slice(1, -1) : hostname4,
         hash,
         search,
         pathname,
@@ -170070,8 +170070,8 @@ var require_utils12 = __commonJS({
         }
       } else {
         optionsParsed = Object.assign({ protocol: options2.host ? "http:" : void 0 }, options2);
-        const hostname5 = optionsParsed.host || (optionsParsed.port != null ? `${optionsParsed.hostname}${optionsParsed.port}` : optionsParsed.hostname);
-        origin = `${optionsParsed.protocol || "http:"}//${hostname5}`;
+        const hostname4 = optionsParsed.host || (optionsParsed.port != null ? `${optionsParsed.hostname}${optionsParsed.port}` : optionsParsed.hostname);
+        origin = `${optionsParsed.protocol || "http:"}//${hostname4}`;
         pathname = options2.pathname;
         if (!pathname && optionsParsed.path) {
           try {
@@ -170099,7 +170099,7 @@ var require_utils12 = __commonJS({
         return { hostname: requestOptions.hostname, port: requestOptions.port };
       }
       const matches = requestOptions.host?.match(/^([^:/ ]+)(:\d{1,5})?/) || null;
-      const hostname5 = requestOptions.hostname || (matches === null ? "localhost" : matches[1]);
+      const hostname4 = requestOptions.hostname || (matches === null ? "localhost" : matches[1]);
       let port = requestOptions.port;
       if (!port) {
         if (matches && matches[2]) {
@@ -170108,11 +170108,11 @@ var require_utils12 = __commonJS({
           port = requestOptions.protocol === "https:" ? "443" : "80";
         }
       }
-      return { hostname: hostname5, port };
+      return { hostname: hostname4, port };
     }, "extractHostnameAndPort");
     exports2.extractHostnameAndPort = extractHostnameAndPort;
     var getOutgoingRequestAttributes = /* @__PURE__ */ __name((requestOptions, options2, semconvStability, enableSyntheticSourceDetection) => {
-      const hostname5 = options2.hostname;
+      const hostname4 = options2.hostname;
       const port = options2.port;
       const method = requestOptions.method ?? "GET";
       const normalizedMethod = normalizeMethod(method);
@@ -170123,13 +170123,13 @@ var require_utils12 = __commonJS({
         [semconv_1.ATTR_HTTP_URL]: urlFull,
         [semconv_1.ATTR_HTTP_METHOD]: method,
         [semconv_1.ATTR_HTTP_TARGET]: requestOptions.path || "/",
-        [semconv_1.ATTR_NET_PEER_NAME]: hostname5,
-        [semconv_1.ATTR_HTTP_HOST]: headers.host ?? `${hostname5}:${port}`
+        [semconv_1.ATTR_NET_PEER_NAME]: hostname4,
+        [semconv_1.ATTR_HTTP_HOST]: headers.host ?? `${hostname4}:${port}`
       };
       const newAttributes = {
         // Required attributes
         [semantic_conventions_1.ATTR_HTTP_REQUEST_METHOD]: normalizedMethod,
-        [semantic_conventions_1.ATTR_SERVER_ADDRESS]: hostname5,
+        [semantic_conventions_1.ATTR_SERVER_ADDRESS]: hostname4,
         [semantic_conventions_1.ATTR_SERVER_PORT]: Number(port),
         [semantic_conventions_1.ATTR_URL_FULL]: urlFull,
         [semantic_conventions_1.ATTR_USER_AGENT_ORIGINAL]: userAgent2
@@ -170359,7 +170359,7 @@ var require_utils12 = __commonJS({
       const ips = headers["x-forwarded-for"];
       const httpVersion = request4.httpVersion;
       const host = headers.host;
-      const hostname5 = host?.replace(/^(.*)(:[0-9]{1,5})/, "$1") || "localhost";
+      const hostname4 = host?.replace(/^(.*)(:[0-9]{1,5})/, "$1") || "localhost";
       const method = request4.method;
       const normalizedMethod = normalizeMethod(method);
       const serverAddress = getServerAddress(request4, options2.component);
@@ -170396,7 +170396,7 @@ var require_utils12 = __commonJS({
       const oldAttributes = {
         [semconv_1.ATTR_HTTP_URL]: parsedUrl.toString(),
         [semconv_1.ATTR_HTTP_HOST]: host,
-        [semconv_1.ATTR_NET_HOST_NAME]: hostname5,
+        [semconv_1.ATTR_NET_HOST_NAME]: hostname4,
         [semconv_1.ATTR_HTTP_METHOD]: method,
         [semconv_1.ATTR_HTTP_SCHEME]: options2.component
       };
@@ -170938,11 +170938,11 @@ var require_http = __commonJS({
           }, true)) {
             return original.apply(this, [optionsParsed, ...args]);
           }
-          const { hostname: hostname5, port } = (0, utils_1.extractHostnameAndPort)(optionsParsed);
+          const { hostname: hostname4, port } = (0, utils_1.extractHostnameAndPort)(optionsParsed);
           const attributes = (0, utils_1.getOutgoingRequestAttributes)(optionsParsed, {
             component,
             port,
-            hostname: hostname5,
+            hostname: hostname4,
             hookAttributes: instrumentation._callStartSpanHook(optionsParsed, instrumentation.getConfig().startOutgoingSpanHook)
           }, instrumentation._semconvStability, instrumentation.getConfig().enableSyntheticSourceDetection || false);
           const startTime = (0, core_1.hrTime)();
@@ -183115,19 +183115,7 @@ var init_pipeline = __esm({
             isStreaming
           );
           if (this.config.cliConfig.getDebugMode()) {
-            const cleanParams2 = {
-              model: openaiRequest.model,
-              messages: openaiRequest.messages,
-              temperature: openaiRequest.temperature,
-              top_p: openaiRequest.top_p,
-              top_k: openaiRequest["top_k"],
-              repetition_penalty: openaiRequest["repetition_penalty"],
-              max_tokens: openaiRequest["max_tokens"],
-              tools: openaiRequest.tools,
-              stream: openaiRequest.stream,
-              stream_options: openaiRequest.stream_options
-            };
-            console.log(JSON.stringify(cleanParams2, null, 2));
+            console.log(`[OpenAI-Pipeline] API Request: model=${openaiRequest.model}, messages=${openaiRequest.messages?.length || 0}, stream=${openaiRequest.stream || false}`);
           }
           const result = await executor(openaiRequest, context2);
           context2.duration = Date.now() - context2.startTime;
@@ -184659,7 +184647,7 @@ function createContentGeneratorConfig(config, authType, generationConfig) {
   };
 }
 async function createContentGenerator(config, gcConfig, sessionId2, isInitialAuth) {
-  const version2 = "0.0.28-alpha.1";
+  const version2 = "0.0.28-alpha.2";
   const userAgent2 = `QwenCode/${version2} (${process.platform}; ${process.arch})`;
   const baseHeaders = {
     "User-Agent": userAgent2
@@ -238276,10 +238264,10 @@ var init_google_auth_provider = __esm({
             "URL must be provided in the config for Google Credentials provider"
           );
         }
-        const hostname5 = new URL(url2).hostname;
-        if (!ALLOWED_HOSTS.some((pattern) => pattern.test(hostname5))) {
+        const hostname4 = new URL(url2).hostname;
+        if (!ALLOWED_HOSTS.some((pattern) => pattern.test(hostname4))) {
           throw new Error(
-            `Host "${hostname5}" is not an allowed host for Google Credential provider.`
+            `Host "${hostname4}" is not an allowed host for Google Credential provider.`
           );
         }
         const scopes = this.config?.oauth?.scopes;
@@ -246662,8 +246650,8 @@ var init_html_to_text = __esm({
 import { URL as URL5 } from "node:url";
 function isPrivateIp(url2) {
   try {
-    const hostname5 = new URL5(url2).hostname;
-    return PRIVATE_IP_RANGES.some((range) => range.test(hostname5));
+    const hostname4 = new URL5(url2).hostname;
+    return PRIVATE_IP_RANGES.some((range) => range.test(hostname4));
   } catch (_e) {
     return false;
   }
@@ -250909,7 +250897,6 @@ __export(apiKeyEncryption_exports, {
   isEncrypted: () => isEncrypted
 });
 import * as crypto15 from "node:crypto";
-import * as os25 from "node:os";
 function encryptApiKey(plaintext2) {
   if (!plaintext2 || plaintext2.trim() === "") {
     return plaintext2;
@@ -250918,9 +250905,8 @@ function encryptApiKey(plaintext2) {
     return plaintext2;
   }
   try {
-    const key = deriveKey();
     const iv = crypto15.randomBytes(16);
-    const cipher = crypto15.createCipheriv("aes-256-gcm", key, iv);
+    const cipher = crypto15.createCipheriv("aes-256-gcm", FIXED_KEY, iv);
     let encrypted = cipher.update(plaintext2, "utf8");
     encrypted = Buffer.concat([encrypted, cipher.final()]);
     const authTag = cipher.getAuthTag();
@@ -250935,47 +250921,55 @@ function encryptApiKey(plaintext2) {
 }
 function decryptApiKey(ciphertext) {
   if (!ciphertext || ciphertext.trim() === "") {
+    console.log("[ApiKeyEncryption] decryptApiKey: \u7A7A\u5B57\u7B26\u4E32\uFF0C\u76F4\u63A5\u8FD4\u56DE");
     return ciphertext;
   }
   if (!ciphertext.startsWith("xhs_enc:")) {
+    console.log("[ApiKeyEncryption] decryptApiKey: \u4E0D\u662F\u52A0\u5BC6\u683C\u5F0F\uFF0C\u76F4\u63A5\u8FD4\u56DE\u660E\u6587");
     return ciphertext;
   }
+  console.log("[ApiKeyEncryption] decryptApiKey: \u68C0\u6D4B\u5230\u52A0\u5BC6\u683C\u5F0F\uFF0C\u5F00\u59CB\u89E3\u5BC6...");
   try {
     const parts = ciphertext.substring(8).split(":");
     if (parts.length !== 3) {
-      throw new Error("\u65E0\u6548\u7684\u52A0\u5BC6\u683C\u5F0F");
+      throw new Error(`\u65E0\u6548\u7684\u52A0\u5BC6\u683C\u5F0F: \u671F\u671B3\u90E8\u5206\uFF0C\u5B9E\u9645${parts.length}\u90E8\u5206`);
     }
     const [ivBase64, authTagBase64, encryptedBase64] = parts;
     const iv = Buffer.from(ivBase64, "base64");
     const authTag = Buffer.from(authTagBase64, "base64");
     const encrypted = Buffer.from(encryptedBase64, "base64");
-    const key = deriveKey();
-    const decipher = crypto15.createDecipheriv("aes-256-gcm", key, iv);
+    console.log("[ApiKeyEncryption] decryptApiKey: Base64 \u89E3\u7801\u6210\u529F");
+    const decipher = crypto15.createDecipheriv("aes-256-gcm", FIXED_KEY, iv);
     decipher.setAuthTag(authTag);
     let decrypted = decipher.update(encrypted);
     decrypted = Buffer.concat([decrypted, decipher.final()]);
-    return decrypted.toString("utf8");
+    const plaintext2 = decrypted.toString("utf8");
+    console.log(`[ApiKeyEncryption] decryptApiKey: \u2705 \u89E3\u5BC6\u6210\u529F: ${plaintext2.substring(0, 8)}...${plaintext2.slice(-8)}`);
+    return plaintext2;
   } catch (error) {
-    console.warn("[ApiKeyEncryption] \u89E3\u5BC6\u5931\u8D25\uFF0C\u8FD4\u56DE\u539F\u59CB\u503C:", error);
-    return ciphertext;
+    console.error("[ApiKeyEncryption] decryptApiKey: \u274C \u89E3\u5BC6\u5931\u8D25:", error);
+    throw new Error(
+      `API Key \u89E3\u5BC6\u5931\u8D25: ${error instanceof Error ? error.message : String(error)}\u3002\u8BF7\u91CD\u65B0\u8FDB\u884C SSO \u8BA4\u8BC1\u3002`
+    );
   }
 }
-function deriveKey() {
-  const hostname5 = os25.hostname();
-  const salt = "rdmind-xhs-sso-api-key-salt-v1";
-  const iterations = 1e5;
-  return crypto15.pbkdf2Sync(hostname5, salt, iterations, 32, "sha256");
-}
 function isEncrypted(value) {
   return value.startsWith("xhs_enc:");
 }
+var FIXED_KEY;
 var init_apiKeyEncryption = __esm({
   "packages/core/src/utils/apiKeyEncryption.ts"() {
     "use strict";
     init_esbuild_shims();
+    FIXED_KEY = crypto15.pbkdf2Sync(
+      "rdmind-xhs-sso-fixed-key-v1",
+      "rdmind-xhs-sso-salt-v1",
+      1e5,
+      32,
+      "sha256"
+    );
     __name(encryptApiKey, "encryptApiKey");
     __name(decryptApiKey, "decryptApiKey");
-    __name(deriveKey, "deriveKey");
     __name(isEncrypted, "isEncrypted");
   }
 });
@@ -258451,7 +258445,7 @@ import * as child_process from "node:child_process";
 import * as process24 from "node:process";
 import * as path61 from "node:path";
 import * as fs54 from "node:fs";
-import * as os26 from "node:os";
+import * as os25 from "node:os";
 function getVsCodeCommand(platform15 = process24.platform) {
   return platform15 === "win32" ? "code.cmd" : "code";
 }
@@ -258473,7 +258467,7 @@ async function findVsCodeCommand(platform15 = process24.platform) {
   } catch {
   }
   const locations = [];
-  const homeDir = os26.homedir();
+  const homeDir = os25.homedir();
   if (platform15 === "darwin") {
     locations.push(
       "/Applications/Visual Studio Code.app/Contents/Resources/app/bin/code",
@@ -258986,8 +258980,8 @@ var init_git_commit = __esm({
   "packages/core/src/generated/git-commit.ts"() {
     "use strict";
     init_esbuild_shims();
-    GIT_COMMIT_INFO = "97c8a98";
-    CLI_VERSION = "0.0.28-alpha.1";
+    GIT_COMMIT_INFO = "6f6a45e";
+    CLI_VERSION = "0.0.28-alpha.2";
   }
 });
 
@@ -266121,7 +266115,7 @@ var require_supports_color = __commonJS({
   "node_modules/chalk/node_modules/supports-color/index.js"(exports2, module2) {
     "use strict";
     init_esbuild_shims();
-    var os49 = __require("os");
+    var os48 = __require("os");
     var tty3 = __require("tty");
     var hasFlag3 = require_has_flag();
     var { env: env7 } = process;
@@ -266170,7 +266164,7 @@ var require_supports_color = __commonJS({
         return min;
       }
       if (process.platform === "win32") {
-        const osRelease = os49.release().split(".");
+        const osRelease = os48.release().split(".");
         if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
           return Number(osRelease[2]) >= 14931 ? 3 : 2;
         }
@@ -269059,7 +269053,7 @@ var require_supports_color2 = __commonJS({
   "node_modules/supports-hyperlinks/node_modules/supports-color/index.js"(exports2, module2) {
     "use strict";
     init_esbuild_shims();
-    var os49 = __require("os");
+    var os48 = __require("os");
     var tty3 = __require("tty");
     var hasFlag3 = require_has_flag();
     var { env: env7 } = process;
@@ -269108,7 +269102,7 @@ var require_supports_color2 = __commonJS({
         return min;
       }
       if (process.platform === "win32") {
-        const osRelease = os49.release().split(".");
+        const osRelease = os48.release().split(".");
         if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
           return Number(osRelease[2]) >= 14931 ? 3 : 2;
         }
@@ -269319,7 +269313,7 @@ var require_main = __commonJS({
     init_esbuild_shims();
     var fs103 = __require("fs");
     var path115 = __require("path");
-    var os49 = __require("os");
+    var os48 = __require("os");
     var crypto19 = __require("crypto");
     var packageJson4 = require_package5();
     var version2 = packageJson4.version;
@@ -269474,7 +269468,7 @@ var require_main = __commonJS({
     }
     __name(_vaultPath, "_vaultPath");
     function _resolveHome(envPath) {
-      return envPath[0] === "~" ? path115.join(os49.homedir(), envPath.slice(1)) : envPath;
+      return envPath[0] === "~" ? path115.join(os48.homedir(), envPath.slice(1)) : envPath;
     }
     __name(_resolveHome, "_resolveHome");
     function _configVault(options2) {
@@ -286154,7 +286148,7 @@ var require_extract_zip = __commonJS({
 });
 
 // packages/cli/src/config/extensions/github.ts
-import * as os29 from "node:os";
+import * as os28 from "node:os";
 import * as https3 from "node:https";
 import * as fs71 from "node:fs";
 import * as path73 from "node:path";
@@ -286382,8 +286376,8 @@ async function downloadFromGitHubRelease(installMetadata, destination) {
   }
 }
 function findReleaseAsset(assets) {
-  const platform15 = os29.platform();
-  const arch3 = os29.arch();
+  const platform15 = os28.platform();
+  const arch3 = os28.arch();
   const platformArchPrefix = `${platform15}.${arch3}.`;
   const platformPrefix = `${platform15}.`;
   const platformArchAsset = assets.find(
@@ -286665,10 +286659,10 @@ var init_extensionEnablement = __esm({
 // packages/cli/src/config/extension.ts
 import * as fs73 from "node:fs";
 import * as path75 from "node:path";
-import * as os30 from "node:os";
+import * as os29 from "node:os";
 import { randomUUID as randomUUID7 } from "node:crypto";
 function getWorkspaceExtensions(workspaceDir) {
-  if (path75.resolve(workspaceDir) === path75.resolve(os30.homedir())) {
+  if (path75.resolve(workspaceDir) === path75.resolve(os29.homedir())) {
     return [];
   }
   return loadExtensionsFromDir(workspaceDir);
@@ -286720,7 +286714,7 @@ function loadExtensions(extensionEnablementManager, workspaceDir = process.cwd()
   return Array.from(uniqueExtensions.values());
 }
 function loadUserExtensions() {
-  const userExtensions = loadExtensionsFromDir(os30.homedir());
+  const userExtensions = loadExtensionsFromDir(os29.homedir());
   const uniqueExtensions = /* @__PURE__ */ new Map();
   for (const extension of userExtensions) {
     if (!uniqueExtensions.has(extension.config.name)) {
@@ -287082,7 +287076,7 @@ function toOutputString(extension, workspaceDir) {
   const manager = new ExtensionEnablementManager(
     ExtensionStorage.getUserExtensionsDir()
   );
-  const userEnabled = manager.isEnabled(extension.config.name, os30.homedir());
+  const userEnabled = manager.isEnabled(extension.config.name, os29.homedir());
   const workspaceEnabled = manager.isEnabled(
     extension.config.name,
     workspaceDir
@@ -287146,7 +287140,7 @@ function disableExtension(name3, scope, cwd7 = process.cwd()) {
     ExtensionStorage.getUserExtensionsDir(),
     [name3]
   );
-  const scopePath = scope === "Workspace" /* Workspace */ ? cwd7 : os30.homedir();
+  const scopePath = scope === "Workspace" /* Workspace */ ? cwd7 : os29.homedir();
   manager.disable(name3, true, scopePath);
   logExtensionDisable(config, new ExtensionDisableEvent(name3, scope));
 }
@@ -287161,7 +287155,7 @@ function enableExtension(name3, scope, cwd7 = process.cwd()) {
   const manager = new ExtensionEnablementManager(
     ExtensionStorage.getUserExtensionsDir()
   );
-  const scopePath = scope === "Workspace" /* Workspace */ ? cwd7 : os30.homedir();
+  const scopePath = scope === "Workspace" /* Workspace */ ? cwd7 : os29.homedir();
   manager.enable(name3, true, scopePath);
   const config = getTelemetryConfig(cwd7);
   logExtensionEnable(config, new ExtensionEnableEvent(name3, scope));
@@ -287201,12 +287195,12 @@ var init_extension = __esm({
         return path75.join(this.getExtensionDir(), EXTENSIONS_CONFIG_FILENAME);
       }
       static getUserExtensionsDir() {
-        const storage = new Storage(os30.homedir());
+        const storage = new Storage(os29.homedir());
         return storage.getExtensionsDir();
       }
       static async createTmpDir() {
         return await fs73.promises.mkdtemp(
-          path75.join(os30.tmpdir(), "rdmind-extension")
+          path75.join(os29.tmpdir(), "rdmind-extension")
         );
       }
     };
@@ -294052,7 +294046,9 @@ async function resolveXhsSsoRuntimeConfig(config, settings) {
       );
     }
   }
+  console.log(`[XhsSsoConfig] resolveXhsSsoRuntimeConfig: apiKey=${apiKey ? apiKey.startsWith("xhs_enc:") ? "xhs_enc:..." : `${apiKey.substring(0, 8)}...` : "empty"}`);
   const decryptedApiKey = decryptApiKey(apiKey);
+  console.log(`[XhsSsoConfig] resolveXhsSsoRuntimeConfig: \u89E3\u5BC6\u540E=${decryptedApiKey.startsWith("xhs_enc:") ? "\u274C \u4ECD\u662F\u52A0\u5BC6\u683C\u5F0F" : "\u2705 \u89E3\u5BC6\u6210\u529F"}`);
   return {
     apiKey: decryptedApiKey,
     baseUrl,
@@ -294067,7 +294063,9 @@ async function applyXhsSsoConfig(config, settings, options2 = {}) {
   if (!apiKey || apiKey.trim() === "") {
     throw new Error("\u7F3A\u5C11\u5C0F\u7EA2\u4E66 SSO API Key\uFF0C\u8BF7\u5148\u5B8C\u6210 SSO \u8BA4\u8BC1\u3002");
   }
+  console.log(`[XhsSsoConfig] applyXhsSsoConfig: apiKey=${apiKey ? apiKey.startsWith("xhs_enc:") ? "xhs_enc:..." : `${apiKey.substring(0, 8)}...` : "empty"}`);
   const decryptedApiKey = decryptApiKey(apiKey);
+  console.log(`[XhsSsoConfig] applyXhsSsoConfig: \u89E3\u5BC6\u540E=${decryptedApiKey.startsWith("xhs_enc:") ? "\u274C \u4ECD\u662F\u52A0\u5BC6\u683C\u5F0F" : "\u2705 \u89E3\u5BC6\u6210\u529F"}`);
   const encryptedApiKey = encryptApiKey(decryptedApiKey);
   settings.setValue(scope, "security.auth.selectedType", "xhs-sso" /* XHS_SSO */);
   settings.setValue(scope, "security.auth.baseUrl", baseUrl);
@@ -299654,9 +299652,9 @@ var require_defaults3 = __commonJS({
   "node_modules/@pnpm/npm-conf/lib/defaults.js"(exports2) {
     "use strict";
     init_esbuild_shims();
-    var os49 = __require("os");
+    var os48 = __require("os");
     var path115 = __require("path");
-    var temp = os49.tmpdir();
+    var temp = os48.tmpdir();
     var uidOrPid = process.getuid ? process.getuid() : process.pid;
     var hasUnicode = /* @__PURE__ */ __name(() => true, "hasUnicode");
     var isWindows8 = process.platform === "win32";
@@ -299667,7 +299665,7 @@ var require_defaults3 = __commonJS({
     var umask = {
       fromString: /* @__PURE__ */ __name(() => process.umask(), "fromString")
     };
-    var home = os49.homedir();
+    var home = os48.homedir();
     if (home) {
       process.env.HOME = home;
     } else {
@@ -301789,6 +301787,21 @@ var require_ansi_align = __commonJS({
   }
 });
 
+// packages/cli/src/utils/l4SensitiveRepositories.ts
+var L4_SENSITIVE_REPOSITORIES;
+var init_l4SensitiveRepositories = __esm({
+  "packages/cli/src/utils/l4SensitiveRepositories.ts"() {
+    "use strict";
+    init_esbuild_shims();
+    L4_SENSITIVE_REPOSITORIES = [
+      // 可以在这里添加敏感仓库地址
+      // 例如：
+      // 'git@code.devops.xiaohongshu.com:sns/rdmind.git',
+      // 'git@code.devops.xiaohongshu.com:aikit/rdmind.git',
+    ];
+  }
+});
+
 // packages/cli/src/utils/l4RepositoryAutoSwitch.ts
 var l4RepositoryAutoSwitch_exports = {};
 __export(l4RepositoryAutoSwitch_exports, {
@@ -301804,7 +301817,7 @@ function isL4Repository(workspaceRoot) {
     if (!remoteUrl) {
       return false;
     }
-    const isMatch = L4_SENSITIVE_REPOSITORIES2.some(
+    const isMatch = L4_SENSITIVE_REPOSITORIES.some(
       (repo) => remoteUrl.includes(repo) || repo.includes(remoteUrl)
     );
     if (process.env["DEBUG"] || process.env["RDMIND_DEBUG"]) {
@@ -301853,7 +301866,6 @@ async function autoSwitchToQSModel(config, settings) {
     });
   }
 }
-var L4_SENSITIVE_REPOSITORIES2;
 var init_l4RepositoryAutoSwitch = __esm({
   "packages/cli/src/utils/l4RepositoryAutoSwitch.ts"() {
     "use strict";
@@ -301861,10 +301873,7 @@ var init_l4RepositoryAutoSwitch = __esm({
     init_core2();
     init_core2();
     init_xhsSsoConfig();
-    L4_SENSITIVE_REPOSITORIES2 = [
-      "git@code.devops.xiaohongshu.com:aikit/rdmind.git"
-      // 可以在这里添加更多敏感仓库地址
-    ];
+    init_l4SensitiveRepositories();
     __name(isL4Repository, "isL4Repository");
     __name(autoSwitchToQSModel, "autoSwitchToQSModel");
   }
@@ -310544,7 +310553,7 @@ var QwenDark = new Theme(
 init_theme();
 import * as fs57 from "node:fs";
 import * as path64 from "node:path";
-import * as os27 from "node:os";
+import * as os26 from "node:os";
 
 // packages/cli/src/ui/themes/ansi.ts
 init_esbuild_shims();
@@ -311189,7 +311198,7 @@ var ThemeManager = class {
       if (this.customThemes.has(canonicalPath)) {
         return this.customThemes.get(canonicalPath);
       }
-      const homeDir = path64.resolve(os27.homedir());
+      const homeDir = path64.resolve(os26.homedir());
       if (!canonicalPath.startsWith(homeDir)) {
         console.warn(
           `Theme file at "${themePath}" is outside your home directory. Only load themes from trusted sources.`
@@ -328134,7 +328143,7 @@ var import_react45 = __toESM(require_react(), 1);
 init_core2();
 import { spawnSync as spawnSync3 } from "node:child_process";
 import fs58 from "node:fs";
-import os28 from "node:os";
+import os27 from "node:os";
 import pathMod from "node:path";
 
 // packages/cli/src/ui/components/shared/vim-buffer-actions.ts
@@ -329967,7 +329976,7 @@ function useTextBuffer({
   const openInExternalEditor = (0, import_react45.useCallback)(
     async (opts = {}) => {
       const editor = opts.editor ?? process.env["VISUAL"] ?? process.env["EDITOR"] ?? (process.platform === "win32" ? "notepad" : "vi");
-      const tmpDir = fs58.mkdtempSync(pathMod.join(os28.tmpdir(), "gemini-edit-"));
+      const tmpDir = fs58.mkdtempSync(pathMod.join(os27.tmpdir(), "gemini-edit-"));
       const filePath = pathMod.join(tmpDir, "buffer.txt");
       fs58.writeFileSync(filePath, text, "utf8");
       dispatch({ type: "create_undo_snapshot" });
@@ -347319,7 +347328,7 @@ import { homedir as homedir19 } from "node:os";
 
 // packages/cli/src/utils/resolvePath.ts
 init_esbuild_shims();
-import * as os31 from "node:os";
+import * as os30 from "node:os";
 import * as path80 from "node:path";
 function resolvePath2(p) {
   if (!p) {
@@ -347327,9 +347336,9 @@ function resolvePath2(p) {
   }
   let expandedPath = p;
   if (p.toLowerCase().startsWith("%userprofile%")) {
-    expandedPath = os31.homedir() + p.substring("%userprofile%".length);
+    expandedPath = os30.homedir() + p.substring("%userprofile%".length);
   } else if (p === "~" || p.startsWith("~/")) {
-    expandedPath = os31.homedir() + p.substring(1);
+    expandedPath = os30.homedir() + p.substring(1);
   }
   return path80.normalize(expandedPath);
 }
@@ -347569,7 +347578,7 @@ __name(getPackageJson, "getPackageJson");
 // packages/cli/src/utils/version.ts
 async function getCliVersion() {
   const pkgJson = await getPackageJson();
-  return "0.0.28-alpha.1";
+  return "0.0.28-alpha.2";
 }
 __name(getCliVersion, "getCliVersion");
 
@@ -347580,7 +347589,7 @@ init_extension();
 init_esbuild_shims();
 init_core2();
 var import_command_exists = __toESM(require_command_exists2(), 1);
-import * as os32 from "node:os";
+import * as os31 from "node:os";
 var VALID_SANDBOX_COMMANDS = [
   "docker",
   "podman",
@@ -347616,7 +347625,7 @@ function getSandboxCommand(sandbox) {
       `Missing sandbox command '${sandbox}' (from GEMINI_SANDBOX)`
     );
   }
-  if (os32.platform() === "darwin" && import_command_exists.default.sync("sandbox-exec")) {
+  if (os31.platform() === "darwin" && import_command_exists.default.sync("sandbox-exec")) {
     return "sandbox-exec";
   } else if (import_command_exists.default.sync("docker") && sandbox === true) {
     return "docker";
@@ -348528,7 +348537,7 @@ async function loadCliConfig(settings, extensions, extensionEnablementManager, s
       model: resolvedModel,
       apiKey: (() => {
         const rawApiKey = argv.openaiApiKey || (isXhsSso ? settings.security?.auth?.apiKey || process.env["OPENAI_API_KEY"] : process.env["OPENAI_API_KEY"] || settings.security?.auth?.apiKey);
-        if (rawApiKey && isXhsSso && !argv.openaiApiKey && !process.env["OPENAI_API_KEY"]) {
+        if (rawApiKey && rawApiKey.startsWith("xhs_enc:")) {
           return decryptApiKey(rawApiKey);
         }
         return rawApiKey;
@@ -349876,13 +349885,13 @@ init_esbuild_shims();
 // packages/cli/src/utils/systemInfo.ts
 init_esbuild_shims();
 import process35 from "node:process";
-import os33 from "node:os";
+import os32 from "node:os";
 import { execSync as execSync5 } from "node:child_process";
 init_core2();
 
 // packages/cli/src/generated/git-commit.ts
 init_esbuild_shims();
-var GIT_COMMIT_INFO2 = "97c8a98";
+var GIT_COMMIT_INFO2 = "6f6a45e";
 
 // packages/cli/src/utils/systemInfo.ts
 async function getNpmVersion() {
@@ -349923,7 +349932,7 @@ __name(getSandboxEnv, "getSandboxEnv");
 async function getSystemInfo(context2) {
   const osPlatform = process35.platform;
   const osArch = process35.arch;
-  const osRelease = os33.release();
+  const osRelease = os32.release();
   const nodeVersion2 = process35.version;
   const npmVersion = await getNpmVersion();
   const sandboxEnv = getSandboxEnv();
@@ -351332,7 +351341,7 @@ ${docsUrl}`
 // packages/cli/src/ui/commands/directoryCommand.tsx
 init_esbuild_shims();
 init_core2();
-import * as os34 from "node:os";
+import * as os33 from "node:os";
 import * as path88 from "node:path";
 import * as fs80 from "node:fs/promises";
 function expandHomeDir(p) {
@@ -351341,9 +351350,9 @@ function expandHomeDir(p) {
   }
   let expandedPath = p;
   if (p.toLowerCase().startsWith("%userprofile%")) {
-    expandedPath = os34.homedir() + p.substring("%userprofile%".length);
+    expandedPath = os33.homedir() + p.substring("%userprofile%".length);
   } else if (p === "~" || p.startsWith("~/")) {
-    expandedPath = os34.homedir() + p.substring(1);
+    expandedPath = os33.homedir() + p.substring(1);
   }
   return path88.normalize(expandedPath);
 }
@@ -351604,7 +351613,7 @@ async function resolveCompletionPaths(partialPath, baseDir) {
     resolvedPath = baseDir;
     displayPrefix = "";
   } else if (partialPath.startsWith("~")) {
-    resolvedPath = path88.join(os34.homedir(), partialPath.slice(1));
+    resolvedPath = path88.join(os33.homedir(), partialPath.slice(1));
   } else {
     resolvedPath = path88.isAbsolute(partialPath) ? path88.resolve(partialPath || "/") : path88.resolve(baseDir, partialPath || ".");
   }
@@ -353170,7 +353179,7 @@ var mcpCommand2 = {
 init_esbuild_shims();
 init_core2();
 import path91 from "node:path";
-import os35 from "os";
+import os34 from "os";
 import fs82 from "fs/promises";
 var memoryCommand = {
   name: "memory",
@@ -353239,7 +353248,7 @@ ${memoryContent}
           action: /* @__PURE__ */ __name(async (context2) => {
             try {
               const globalMemoryPath = path91.join(
-                os35.homedir(),
+                os34.homedir(),
                 QWEN_DIR5,
                 "RDMind.md"
               );
@@ -355222,7 +355231,7 @@ init_esbuild_shims();
 // packages/cli/src/ui/utils/terminalSetup.ts
 init_esbuild_shims();
 import { promises as fs86 } from "node:fs";
-import * as os36 from "node:os";
+import * as os35 from "node:os";
 import * as path96 from "node:path";
 import { exec as exec3 } from "node:child_process";
 import { promisify as promisify7 } from "node:util";
@@ -355329,7 +355338,7 @@ async function detectTerminal() {
   if (termProgram === "vscode" || process.env["VSCODE_GIT_IPC_HANDLE"]) {
     return "vscode";
   }
-  if (os36.platform() !== "win32") {
+  if (os35.platform() !== "win32") {
     try {
       const { stdout } = await execAsync2("ps -o comm= -p $PPID");
       const parentName = stdout.trim();
@@ -355359,10 +355368,10 @@ async function backupFile(filePath) {
 }
 __name(backupFile, "backupFile");
 function getVSCodeStyleConfigDir(appName) {
-  const platform15 = os36.platform();
+  const platform15 = os35.platform();
   if (platform15 === "darwin") {
     return path96.join(
-      os36.homedir(),
+      os35.homedir(),
       "Library",
       "Application Support",
       appName,
@@ -355374,7 +355383,7 @@ function getVSCodeStyleConfigDir(appName) {
     }
     return path96.join(process.env["APPDATA"], appName, "User");
   } else {
-    return path96.join(os36.homedir(), ".config", appName, "User");
+    return path96.join(os35.homedir(), ".config", appName, "User");
   }
 }
 __name(getVSCodeStyleConfigDir, "getVSCodeStyleConfigDir");
@@ -357075,7 +357084,7 @@ var import_react113 = __toESM(require_react(), 1);
 init_core2();
 import crypto18 from "node:crypto";
 import path98 from "node:path";
-import os37 from "node:os";
+import os36 from "node:os";
 import fs88 from "node:fs";
 var OUTPUT_UPDATE_INTERVAL_MS2 = 1e3;
 var MAX_OUTPUT_LENGTH = 1e4;
@@ -357112,14 +357121,14 @@ var useShellCommandProcessor = /* @__PURE__ */ __name((addItemToHistory, setPend
         { type: "user_shell", text: rawQuery },
         userMessageTimestamp
       );
-      const isWindows8 = os37.platform() === "win32";
+      const isWindows8 = os36.platform() === "win32";
       const targetDir = config.getTargetDir();
       let commandToExecute = rawQuery;
       let pwdFilePath;
       if (!isWindows8) {
         let command2 = rawQuery.trim();
         const pwdFileName = `shell_pwd_${crypto18.randomBytes(6).toString("hex")}.tmp`;
-        pwdFilePath = path98.join(os37.tmpdir(), pwdFileName);
+        pwdFilePath = path98.join(os36.tmpdir(), pwdFileName);
         if (!command2.endsWith(";") && !command2.endsWith("&")) {
           command2 += ";";
         }
@@ -360041,13 +360050,13 @@ import { format as format3 } from "node:util";
 init_esbuild_shims();
 var import_graceful_fs = __toESM(require_graceful_fs(), 1);
 import path104 from "node:path";
-import os40 from "node:os";
+import os39 from "node:os";
 
 // node_modules/xdg-basedir/index.js
 init_esbuild_shims();
-import os38 from "os";
+import os37 from "os";
 import path101 from "path";
-var homeDirectory = os38.homedir();
+var homeDirectory = os37.homedir();
 var { env: env5 } = process;
 var xdgData = env5.XDG_DATA_HOME || (homeDirectory ? path101.join(homeDirectory, ".local", "share") : void 0);
 var xdgConfig = env5.XDG_CONFIG_HOME || (homeDirectory ? path101.join(homeDirectory, ".config") : void 0);
@@ -360282,14 +360291,14 @@ var dist_default6 = FS;
 
 // node_modules/atomically/dist/constants.js
 init_esbuild_shims();
-import os39 from "node:os";
+import os38 from "node:os";
 import process40 from "node:process";
 var DEFAULT_ENCODING2 = "utf8";
 var DEFAULT_FILE_MODE = 438;
 var DEFAULT_FOLDER_MODE = 511;
 var DEFAULT_WRITE_OPTIONS = {};
-var DEFAULT_USER_UID = os39.userInfo().uid;
-var DEFAULT_USER_GID = os39.userInfo().gid;
+var DEFAULT_USER_UID = os38.userInfo().uid;
+var DEFAULT_USER_GID = os38.userInfo().gid;
 var DEFAULT_TIMEOUT_SYNC = 1e3;
 var IS_POSIX = !!process40.getuid;
 var IS_USER_ROOT2 = process40.getuid ? !process40.getuid() : false;
@@ -360742,7 +360751,7 @@ __name(hasProperty, "hasProperty");
 // node_modules/configstore/index.js
 function getConfigDirectory(id, globalConfigPath) {
   const pathPrefix = globalConfigPath ? path104.join(id, "config.json") : path104.join("configstore", `${id}.json`);
-  const configDirectory = xdgConfig ?? import_graceful_fs.default.mkdtempSync(import_graceful_fs.default.realpathSync(os40.tmpdir()) + path104.sep);
+  const configDirectory = xdgConfig ?? import_graceful_fs.default.mkdtempSync(import_graceful_fs.default.realpathSync(os39.tmpdir()) + path104.sep);
   return path104.join(configDirectory, pathPrefix);
 }
 __name(getConfigDirectory, "getConfigDirectory");
@@ -361021,7 +361030,7 @@ var ansi_styles_default6 = ansiStyles6;
 // node_modules/update-notifier/node_modules/chalk/source/vendor/supports-color/index.js
 init_esbuild_shims();
 import process43 from "node:process";
-import os41 from "node:os";
+import os40 from "node:os";
 import tty2 from "node:tty";
 function hasFlag2(flag, argv = globalThis.Deno ? globalThis.Deno.args : process43.argv) {
   const prefix = flag.startsWith("-") ? "" : flag.length === 1 ? "-" : "--";
@@ -361089,7 +361098,7 @@ function _supportsColor2(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     return min;
   }
   if (process43.platform === "win32") {
-    const osRelease = os41.release().split(".");
+    const osRelease = os40.release().split(".");
     if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
       return Number(osRelease[2]) >= 14931 ? 3 : 2;
     }
@@ -362086,7 +362095,7 @@ init_esbuild_shims();
 var import_ini2 = __toESM(require_ini3(), 1);
 import process45 from "node:process";
 import path105 from "node:path";
-import os42 from "node:os";
+import os41 from "node:os";
 import fs93 from "node:fs";
 var isWindows7 = process45.platform === "win32";
 var readRc = /* @__PURE__ */ __name((filePath) => {
@@ -362121,7 +362130,7 @@ var getNpmPrefix = /* @__PURE__ */ __name(() => {
   if (envPrefix) {
     return envPrefix;
   }
-  const homePrefix = readRc(path105.join(os42.homedir(), ".npmrc"));
+  const homePrefix = readRc(path105.join(os41.homedir(), ".npmrc"));
   if (homePrefix) {
     return homePrefix;
   }
@@ -362152,11 +362161,11 @@ var getYarnPrefix = /* @__PURE__ */ __name(() => {
   if (windowsPrefix) {
     return windowsPrefix;
   }
-  const configPrefix = path105.join(os42.homedir(), ".config/yarn");
+  const configPrefix = path105.join(os41.homedir(), ".config/yarn");
   if (fs93.existsSync(configPrefix)) {
     return configPrefix;
   }
-  const homePrefix = path105.join(os42.homedir(), ".yarn-config");
+  const homePrefix = path105.join(os41.homedir(), ".yarn-config");
   if (fs93.existsSync(homePrefix)) {
     return homePrefix;
   }
@@ -363770,7 +363779,7 @@ init_esbuild_shims();
 init_wrapper();
 import * as fs97 from "node:fs";
 import * as path111 from "node:path";
-import * as os43 from "node:os";
+import * as os42 from "node:os";
 init_core2();
 var WebSocketClient = class {
   // 服务端下发的 socketId
@@ -363989,7 +363998,7 @@ var WebSocketClient = class {
     }
   }
   handleCreateFile(filename, content, subPath) {
-    const rdmindDir = path111.join(os43.homedir(), ".rdmind");
+    const rdmindDir = path111.join(os42.homedir(), ".rdmind");
     const targetDir = subPath ? path111.join(rdmindDir, subPath) : rdmindDir;
     const filePath = path111.join(targetDir, filename);
     try {
@@ -364004,7 +364013,7 @@ var WebSocketClient = class {
     }
   }
   handleDeleteFile(filename, subPath) {
-    const rdmindDir = path111.join(os43.homedir(), ".rdmind");
+    const rdmindDir = path111.join(os42.homedir(), ".rdmind");
     const targetDir = subPath ? path111.join(rdmindDir, subPath) : rdmindDir;
     const filePath = path111.join(targetDir, filename);
     try {
@@ -364114,7 +364123,7 @@ var WebSocketClient = class {
 
 // packages/cli/src/ui/hooks/useWebSocket.ts
 init_core2();
-import * as os44 from "node:os";
+import * as os43 from "node:os";
 function getRdmindSsoId3() {
   try {
     const creds = readSSOCredentialsSync();
@@ -364145,7 +364154,7 @@ function useWebSocket({ onReloadCommands, debug: debug2 }) {
     const registrationPayload = {
       type: "auth",
       deviceId: sessionId,
-      deviceName: os44.hostname?.() || "unknown-host",
+      deviceName: os43.hostname?.() || "unknown-host",
       deviceType: "rdmind-cli"
     };
     if (rdmindSsoId) {
@@ -365509,7 +365518,7 @@ __name(readStdin, "readStdin");
 // packages/cli/src/gemini.tsx
 import { basename as basename16 } from "node:path";
 import v8 from "node:v8";
-import os48 from "node:os";
+import os47 from "node:os";
 import dns from "node:dns";
 import { randomUUID as randomUUID9 } from "node:crypto";
 
@@ -365519,7 +365528,7 @@ var import_shell_quote5 = __toESM(require_shell_quote(), 1);
 init_settings();
 init_core2();
 import { exec as exec4, execSync as execSync7, spawn as spawn11 } from "node:child_process";
-import os45 from "node:os";
+import os44 from "node:os";
 import path112 from "node:path";
 import fs99 from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
@@ -365528,7 +365537,7 @@ import { promisify as promisify9 } from "node:util";
 import { randomBytes as randomBytes6 } from "node:crypto";
 var execAsync3 = promisify9(exec4);
 function getContainerPath(hostPath) {
-  if (os45.platform() !== "win32") {
+  if (os44.platform() !== "win32") {
     return hostPath;
   }
   const withForwardSlashes = hostPath.replace(/\\/g, "/");
@@ -365558,7 +365567,7 @@ async function shouldUseCurrentUserInSandbox() {
   if (envVar === "0" || envVar === "false") {
     return false;
   }
-  if (os45.platform() === "linux") {
+  if (os44.platform() === "linux") {
     try {
       const osReleaseContent = await readFile11("/etc/os-release", "utf8");
       if (osReleaseContent.includes("ID=debian") || osReleaseContent.includes("ID=ubuntu") || osReleaseContent.match(/^ID_LIKE=.*debian.*/m) || // Covers derivatives
@@ -365588,7 +365597,7 @@ function ports() {
 }
 __name(ports, "ports");
 function entrypoint(workdir, cliArgs) {
-  const isWindows8 = os45.platform() === "win32";
+  const isWindows8 = os44.platform() === "win32";
   const containerWorkdir = getContainerPath(workdir);
   const shellCmds = [];
   const pathSeparator = isWindows8 ? ";" : ":";
@@ -365673,9 +365682,9 @@ async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs = []) {
         "-D",
         `TARGET_DIR=${fs99.realpathSync(process.cwd())}`,
         "-D",
-        `TMP_DIR=${fs99.realpathSync(os45.tmpdir())}`,
+        `TMP_DIR=${fs99.realpathSync(os44.tmpdir())}`,
         "-D",
-        `HOME_DIR=${fs99.realpathSync(os45.homedir())}`,
+        `HOME_DIR=${fs99.realpathSync(os44.homedir())}`,
         "-D",
         `CACHE_DIR=${fs99.realpathSync(execSync7(`getconf DARWIN_USER_CACHE_DIR`).toString().trim())}`
       ];
@@ -365843,8 +365852,8 @@ async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs = []) {
         `${userSettingsDirOnHost}:${getContainerPath(userSettingsDirOnHost)}`
       );
     }
-    args.push("--volume", `${os45.tmpdir()}:${getContainerPath(os45.tmpdir())}`);
-    const gcloudConfigDir = path112.join(os45.homedir(), ".config", "gcloud");
+    args.push("--volume", `${os44.tmpdir()}:${getContainerPath(os44.tmpdir())}`);
+    const gcloudConfigDir = path112.join(os44.homedir(), ".config", "gcloud");
     if (fs99.existsSync(gcloudConfigDir)) {
       args.push(
         "--volume",
@@ -366042,7 +366051,7 @@ async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs = []) {
     }
     args.push("--env", `SANDBOX=${containerName}`);
     if (config.command === "podman") {
-      const emptyAuthFilePath = path112.join(os45.tmpdir(), "empty_auth.json");
+      const emptyAuthFilePath = path112.join(os44.tmpdir(), "empty_auth.json");
       fs99.writeFileSync(emptyAuthFilePath, "{}", "utf-8");
       args.push("--authfile", emptyAuthFilePath);
     }
@@ -366056,7 +366065,7 @@ async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs = []) {
       const uid = execSync7("id -u").toString().trim();
       const gid = execSync7("id -g").toString().trim();
       const username = "gemini";
-      const homeDir = getContainerPath(os45.homedir());
+      const homeDir = getContainerPath(os44.homedir());
       const setupUserCommands = [
         // Use -f with groupadd to avoid errors if the group already exists.
         `groupadd -f -g ${gid} ${username}`,
@@ -366068,7 +366077,7 @@ async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs = []) {
       const suCommand = `su -p ${username} -c '${escapedOriginalCommand}'`;
       finalEntrypoint[2] = `${setupUserCommands} && ${suCommand}`;
       userFlag = `--user ${uid}:${gid}`;
-      args.push("--env", `HOME=${os45.homedir()}`);
+      args.push("--env", `HOME=${os44.homedir()}`);
     }
     args.push(image2);
     args.push(...finalEntrypoint);
@@ -366249,9 +366258,9 @@ init_settings();
 init_esbuild_shims();
 init_core2();
 import fs100 from "node:fs/promises";
-import os46 from "node:os";
+import os45 from "node:os";
 import { join as pathJoin } from "node:path";
-var warningsFilePath = pathJoin(os46.tmpdir(), "qwen-code-warnings.txt");
+var warningsFilePath = pathJoin(os45.tmpdir(), "qwen-code-warnings.txt");
 async function getStartupWarnings() {
   try {
     await fs100.access(warningsFilePath);
@@ -366275,8 +366284,9 @@ __name(getStartupWarnings, "getStartupWarnings");
 // packages/cli/src/utils/userStartupWarnings.ts
 init_esbuild_shims();
 init_core2();
+init_l4SensitiveRepositories();
 import fs101 from "node:fs/promises";
-import * as os47 from "node:os";
+import * as os46 from "node:os";
 import path113 from "node:path";
 var homeDirectoryCheck = {
   id: "home-directory",
@@ -366284,7 +366294,7 @@ var homeDirectoryCheck = {
     try {
       const [workspaceRealPath, homeRealPath] = await Promise.all([
         fs101.realpath(options2.workspaceRoot),
-        fs101.realpath(os47.homedir())
+        fs101.realpath(os46.homedir())
       ]);
       if (workspaceRealPath === homeRealPath) {
         return "\u5F53\u524D\u6B63\u5728 ~ \u76EE\u5F55\u4E0B\u8FD0\u884C RDMind\uFF0C\u5EFA\u8BAE\u8FDB\u5165\u9879\u76EE\u76EE\u5F55";
@@ -366323,11 +366333,6 @@ var ripgrepAvailabilityCheck = {
     return null;
   }, "check")
 };
-var L4_SENSITIVE_REPOSITORIES = [
-  "git@code.devops.xiaohongshu.com:sns/rdmind.git",
-  "git@code.devops.xiaohongshu.com:aikit/rdmind.git"
-  // 可以在这里添加更多敏感仓库地址
-];
 var l4RepositoryCheck = {
   id: "l4-repository",
   check: /* @__PURE__ */ __name(async (options2) => {
@@ -368418,7 +368423,7 @@ function validateDnsResolutionOrder(order) {
 }
 __name(validateDnsResolutionOrder, "validateDnsResolutionOrder");
 function getNodeMemoryArgs(isDebugMode2) {
-  const totalMemoryMB = os48.totalmem() / (1024 * 1024);
+  const totalMemoryMB = os47.totalmem() / (1024 * 1024);
   const heapStats = v8.getHeapStatistics();
   const currentMaxOldSpaceSizeMb = Math.floor(
     heapStats.heap_size_limit / 1024 / 1024