jinzd-ai-cli 0.4.108 → 0.4.110

package/README.md

@@ -422,6 +422,12 @@ npm run test:watch    # Watch mode
 
 ## Documentation
 
+- [`docs/USAGE.md`](docs/USAGE.md) — Complete reference manual (commands, tools, config)
+- [`docs/TUTORIAL.md`](docs/TUTORIAL.md) — Hands-on tutorial, zero to fluent in an hour
+- [`docs/ADVANCED.md`](docs/ADVANCED.md) — Architecture and internals (for developers)
+- [`docs/RECIPES.md`](docs/RECIPES.md) — Practical recipes by scenario
+- [`docs/SECURITY.md`](docs/SECURITY.md) — **Security model, deployment checklist, audit history.** Read before exposing `aicli web` to a network.
+- [`CHANGELOG.md`](CHANGELOG.md) — Per-version change log
 - [Chinese README](README.zh-CN.md) — 中文说明文档
 
 ## License

package/README.zh-CN.md

@@ -184,6 +184,8 @@ AI 在对话中可自主调用 28 个工具：
 - [`docs/USAGE.zh-CN.md`](docs/USAGE.zh-CN.md) — 完整参考手册（所有命令、工具、配置）
 - [`docs/ADVANCED.zh-CN.md`](docs/ADVANCED.zh-CN.md) — 架构与内部原理（开发者向）
 - [`docs/RECIPES.zh-CN.md`](docs/RECIPES.zh-CN.md) — 实战配方（按场景查）
+- [`docs/SECURITY.zh-CN.md`](docs/SECURITY.zh-CN.md) — **安全模型、部署清单、审计历史。** 把 `aicli web` 暴露到网络前请先读。
+- [`CHANGELOG.md`](CHANGELOG.md) — 每个版本的更新记录
 
 ## 主要 REPL 命令
 

package/dist/{batch-A6F3UA3N.js → batch-V255CIMB.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   ConfigManager
-} from "./chunk-A26EOV2J.js";
+} from "./chunk-BLJIPN2F.js";
 import "./chunk-2ZD3YTVM.js";
-import "./chunk-DNKI3JIL.js";
+import "./chunk-SQPICAHN.js";
 import "./chunk-PDX44BCA.js";
 
 // src/cli/batch.ts

package/dist/{chunk-A26EOV2J.js → chunk-BLJIPN2F.js}

@@ -8,7 +8,7 @@ import {
   CONFIG_FILE_NAME,
   HISTORY_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-DNKI3JIL.js";
+} from "./chunk-SQPICAHN.js";
 
 // src/config/config-manager.ts
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";

package/dist/{chunk-XWJTZWS7.js → chunk-GFDEAYPM.js}

@@ -6,7 +6,7 @@ import { platform } from "os";
 import chalk from "chalk";
 
 // src/core/constants.ts
-var VERSION = "0.4.108";
+var VERSION = "0.4.110";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-A3HZY7DA.js → chunk-LKWFPJIP.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-3BICTI5M.js";
 import {
   runTestsTool
-} from "./chunk-NN2B3UBA.js";
+} from "./chunk-M77QS5QW.js";
 import {
   EnvLoader,
   NetworkError,
@@ -18,7 +18,7 @@ import {
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-DNKI3JIL.js";
+} from "./chunk-SQPICAHN.js";
 import {
   fileCheckpoints
 } from "./chunk-4BKXL7SM.js";

package/dist/{chunk-NN2B3UBA.js → chunk-M77QS5QW.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   TEST_TIMEOUT
-} from "./chunk-DNKI3JIL.js";
+} from "./chunk-SQPICAHN.js";
 
 // src/tools/builtin/run-tests.ts
 import { execSync, spawnSync } from "child_process";

package/dist/{chunk-DNKI3JIL.js → chunk-SQPICAHN.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/core/constants.ts
-var VERSION = "0.4.108";
+var VERSION = "0.4.110";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-IKX4D6C7.js → chunk-YIHYQVV7.js}

@@ -2,7 +2,7 @@
 import {
   schemaToJsonSchema,
   truncateForPersist
-} from "./chunk-A3HZY7DA.js";
+} from "./chunk-LKWFPJIP.js";
 import {
   AuthError,
   ProviderError,
@@ -18,7 +18,7 @@ import {
   MCP_PROTOCOL_VERSION,
   MCP_TOOL_PREFIX,
   VERSION
-} from "./chunk-DNKI3JIL.js";
+} from "./chunk-SQPICAHN.js";
 import {
   redactJson
 } from "./chunk-7ZJN4KLV.js";
@@ -1772,6 +1772,39 @@ function buildPhantomCorrectionMessage(phantoms) {
   const list = phantoms.map((p) => `  - ${p}`).join("\n");
   return "You claimed to have written the following file(s), but no matching write_file tool call was actually made in this turn:\n" + list + '\n\nEach of these files does NOT exist on disk. You MUST now invoke write_file (via the function calling API) for every missing file listed above. Do NOT output another "completion summary" until the tool calls have actually been made.';
 }
+var PSEUDO_TOOL_CALL_PATTERNS = [
+  // <tool_call name="..."> ... </tool_call>  (DeepSeek V4 thinking, GLM)
+  /<tool_call\s+name\s*=\s*["'][\w._-]+["']/,
+  // <function_calls> ... </function_calls>  (Anthropic-style as text)
+  /<\/?function_calls\s*>/,
+  // <invoke name="..." />  (Anthropic XML tool-call, which is real for
+  // Claude API but is text/garbage for any other provider's plain stream)
+  /<invoke\s+name\s*=\s*["'][\w._-]+["']/,
+  // <tool_use> ... <tool_use_id>  (Claude flavor leaked into text)
+  /<tool_use(?:_id)?\b/,
+  // ```tool_call\n...\n``` markdown fences (Kimi/Zhipu fallback)
+  /```\s*tool_call\b/i,
+  // Bare JSON tool-call block: lines starting with `{"name":"...","arguments":`
+  /^\s*\{\s*"name"\s*:\s*"[\w._-]+"\s*,\s*"arguments"\s*:/m
+];
+function detectPseudoToolCalls(content) {
+  if (!content || content.length === 0) return null;
+  for (const re of PSEUDO_TOOL_CALL_PATTERNS) {
+    if (re.test(content)) return re.source;
+  }
+  return null;
+}
+var CONTENT_ONLY_STREAM_REMINDER = `
+
+[\u26A0\uFE0F CONTENT GENERATION MODE]
+You are now in a CONTENT-ONLY streaming pass. The file at the configured path will receive every token of THIS response.
+- Do NOT emit <tool_call>, </tool_call>, <function_calls>, <invoke>, <tool_use>, or any tool-call XML/JSON markup.
+- Do NOT print "I will now call ...", "let me read ...", "<think>" reasoning blocks (the surrounding REPL handles those separately \u2014 they should not enter the saved file).
+- Do NOT pretend to call tools. There are NO tools available in this stream \u2014 only your text output is captured.
+- Produce ONLY the requested document body. Markdown is fine. Code blocks are fine. Tool-call markup is NOT.
+- If you accidentally start a <tool_call>, STOP and produce the document body instead.
+
+The file is closed and named when this stream ends. If your output contains pseudo-tool-call markup, the save will be REJECTED and you will be asked to retry.`;
 
 // src/providers/kimi.ts
 var KIMI_XML_REMINDER = `
@@ -4047,6 +4080,8 @@ export {
   extractWrittenFilePaths,
   findPhantomClaims,
   buildPhantomCorrectionMessage,
+  detectPseudoToolCalls,
+  CONTENT_ONLY_STREAM_REMINDER,
   ProviderRegistry,
   getContentText,
   SessionManager,

package/dist/{constants-QZWMYEMB.js → constants-EVSUKVTR.js}

@@ -36,7 +36,7 @@ import {
   TEST_TIMEOUT,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-DNKI3JIL.js";
+} from "./chunk-SQPICAHN.js";
 import "./chunk-PDX44BCA.js";
 export {
   AGENTIC_BEHAVIOR_GUIDELINE,

package/dist/electron-server.js

@@ -36,7 +36,7 @@ import {
   VERSION,
   buildUserIdentityPrompt,
   runTestsTool
-} from "./chunk-XWJTZWS7.js";
+} from "./chunk-GFDEAYPM.js";
 import {
   hasSemanticIndex,
   semanticSearch
@@ -2186,6 +2186,39 @@ CRITICAL \u2014 Batch file generation rules:
 4. Only produce a text summary AFTER all write_file calls have been made and returned success.
 5. The system compares every "file saved" claim against actual tool calls. Phantom claims trigger an automatic retry \u2014 do not waste rounds.`;
 var HALLUCINATION_CORRECTION_MESSAGE = "You did NOT actually call the write_file tool \u2014 the file was NOT created! Please immediately use the write_file tool via the function calling API to perform the actual file write. Do NOT describe file content in text \u2014 you MUST invoke write_file through the tool_calls mechanism.";
+var PSEUDO_TOOL_CALL_PATTERNS = [
+  // <tool_call name="..."> ... </tool_call>  (DeepSeek V4 thinking, GLM)
+  /<tool_call\s+name\s*=\s*["'][\w._-]+["']/,
+  // <function_calls> ... </function_calls>  (Anthropic-style as text)
+  /<\/?function_calls\s*>/,
+  // <invoke name="..." />  (Anthropic XML tool-call, which is real for
+  // Claude API but is text/garbage for any other provider's plain stream)
+  /<invoke\s+name\s*=\s*["'][\w._-]+["']/,
+  // <tool_use> ... <tool_use_id>  (Claude flavor leaked into text)
+  /<tool_use(?:_id)?\b/,
+  // ```tool_call\n...\n``` markdown fences (Kimi/Zhipu fallback)
+  /```\s*tool_call\b/i,
+  // Bare JSON tool-call block: lines starting with `{"name":"...","arguments":`
+  /^\s*\{\s*"name"\s*:\s*"[\w._-]+"\s*,\s*"arguments"\s*:/m
+];
+function detectPseudoToolCalls(content) {
+  if (!content || content.length === 0) return null;
+  for (const re of PSEUDO_TOOL_CALL_PATTERNS) {
+    if (re.test(content)) return re.source;
+  }
+  return null;
+}
+var CONTENT_ONLY_STREAM_REMINDER = `
+
+[\u26A0\uFE0F CONTENT GENERATION MODE]
+You are now in a CONTENT-ONLY streaming pass. The file at the configured path will receive every token of THIS response.
+- Do NOT emit <tool_call>, </tool_call>, <function_calls>, <invoke>, <tool_use>, or any tool-call XML/JSON markup.
+- Do NOT print "I will now call ...", "let me read ...", "<think>" reasoning blocks (the surrounding REPL handles those separately \u2014 they should not enter the saved file).
+- Do NOT pretend to call tools. There are NO tools available in this stream \u2014 only your text output is captured.
+- Produce ONLY the requested document body. Markdown is fine. Code blocks are fine. Tool-call markup is NOT.
+- If you accidentally start a <tool_call>, STOP and produce the document body instead.
+
+The file is closed and named when this stream ends. If your output contains pseudo-tool-call markup, the save will be REJECTED and you will be asked to retry.`;
 
 // src/providers/kimi.ts
 var KIMI_XML_REMINDER = `
@@ -9787,7 +9820,7 @@ function autoTrimSessionIfNeeded(session, sizeLimit = SESSION_SIZE_LIMIT) {
 }
 
 // src/web/session-handler.ts
-import { existsSync as existsSync20, readFileSync as readFileSync13, appendFileSync as appendFileSync3, writeFileSync as writeFileSync8, mkdirSync as mkdirSync9, readdirSync as readdirSync9, statSync as statSync8, createWriteStream } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync13, appendFileSync as appendFileSync3, writeFileSync as writeFileSync8, mkdirSync as mkdirSync9, readdirSync as readdirSync9, statSync as statSync8, createWriteStream, unlinkSync as unlinkSync4 } from "fs";
 import { join as join13, resolve as resolve5, dirname as dirname4 } from "path";
 import { execSync as execSync3 } from "child_process";
 
@@ -10663,10 +10696,11 @@ ${summaryResult.content}`,
     try {
       mkdirSync9(dirname4(saveToFile), { recursive: true });
       fileStream = createWriteStream(saveToFile, { encoding: "utf-8" });
+      const teeSystemPrompt = (systemPrompt ?? "") + CONTENT_ONLY_STREAM_REMINDER;
       const chatRequest = {
         messages: apiMessages,
         model: this.currentModel,
-        systemPrompt,
+        systemPrompt: teeSystemPrompt,
         systemPromptVolatile,
         stream: true,
         temperature: modelParams.temperature,
@@ -10691,10 +10725,20 @@ ${summaryResult.content}`,
       await new Promise((resolve7, reject) => {
         fileStream.end((err) => err ? reject(err) : resolve7());
       });
-      const lines = fullContent.split("\n").length;
-      const bytes = Buffer.byteLength(fullContent, "utf-8");
-      summary = `File saved: ${saveToFile} (${lines} lines, ${bytes} bytes)`;
-      undoStack.push(saveToFile, `save_last_response: ${saveToFile}`);
+      const pseudoMatch = detectPseudoToolCalls(fullContent);
+      if (pseudoMatch) {
+        try {
+          unlinkSync4(saveToFile);
+        } catch {
+        }
+        isError = true;
+        summary = `[save_last_response REJECTED] Your fresh streaming output contained pseudo-tool-call markup (matched: ${pseudoMatch}). The file at "${saveToFile}" was NOT saved (deleted). This fresh stream has NO tools attached \u2014 output is captured verbatim. Do NOT print <tool_call>, <function_calls>, <invoke>, or {"name":"...","arguments":...} JSON. Try again: produce ONLY the document body.`;
+      } else {
+        const lines = fullContent.split("\n").length;
+        const bytes = Buffer.byteLength(fullContent, "utf-8");
+        summary = `File saved: ${saveToFile} (${lines} lines, ${bytes} bytes)`;
+        undoStack.push(saveToFile, `save_last_response: ${saveToFile}`);
+      }
       if (teeUsage) {
         roundUsage.inputTokens += teeUsage.inputTokens;
         roundUsage.outputTokens += teeUsage.outputTokens;
@@ -11789,7 +11833,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-VBJ5H3XR.js");
+          const { executeTests } = await import("./run-tests-XVK66TGP.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {

package/dist/{hub-3HEMIJTM.js → hub-O3EQ2LDY.js}

@@ -386,7 +386,7 @@ ${content}`);
   }
 }
 async function runTaskMode(config, providers, configManager, topic) {
-  const { TaskOrchestrator } = await import("./task-orchestrator-6WIYZPDB.js");
+  const { TaskOrchestrator } = await import("./task-orchestrator-2TGWMUUT.js");
   const orchestrator = new TaskOrchestrator(config, providers, configManager);
   let interrupted = false;
   const onSigint = () => {

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import {
+  CONTENT_ONLY_STREAM_REMINDER,
   HALLUCINATION_CORRECTION_MESSAGE,
   McpManager,
   ProviderRegistry,
@@ -12,6 +13,7 @@ import {
   buildWriteRoundReminder,
   clearDevState,
   computeCost,
+  detectPseudoToolCalls,
   detectsHallucinatedFileOp,
   extractWrittenFilePaths,
   findPhantomClaims,
@@ -25,10 +27,10 @@ import {
   saveDevState,
   sessionHasMeaningfulContent,
   setupProxy
-} from "./chunk-IKX4D6C7.js";
+} from "./chunk-YIHYQVV7.js";
 import {
   ConfigManager
-} from "./chunk-A26EOV2J.js";
+} from "./chunk-BLJIPN2F.js";
 import {
   ToolExecutor,
   ToolRegistry,
@@ -47,10 +49,10 @@ import {
   spawnAgentContext,
   theme,
   undoStack
-} from "./chunk-A3HZY7DA.js";
+} from "./chunk-LKWFPJIP.js";
 import "./chunk-3BICTI5M.js";
 import "./chunk-2DXY7UGF.js";
-import "./chunk-NN2B3UBA.js";
+import "./chunk-M77QS5QW.js";
 import "./chunk-2ZD3YTVM.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
@@ -73,7 +75,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-DNKI3JIL.js";
+} from "./chunk-SQPICAHN.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
@@ -100,7 +102,7 @@ import { program } from "commander";
 
 // src/repl/repl.ts
 import * as readline from "readline";
-import { existsSync as existsSync5, readFileSync as readFileSync4, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync4, readdirSync as readdirSync3, statSync as statSync3, unlinkSync as unlinkSync2 } from "fs";
 import { join as join5, resolve as resolve2, extname as extname2, dirname as dirname3, basename as basename2 } from "path";
 import chalk4 from "chalk";
 
@@ -1594,7 +1596,7 @@ ${text}
           const { join: join6 } = await import("path");
           const { existsSync: existsSync6 } = await import("fs");
           const { getGitRoot: getGitRoot2 } = await import("./git-context-7KIP4X2V.js");
-          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-QZWMYEMB.js");
+          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-EVSUKVTR.js");
           const { approveProject, hashMcpFile } = await import("./project-trust-IFM7FXEV.js");
           const cwd = process.cwd();
           const projectRoot = getGitRoot2(cwd) ?? cwd;
@@ -2644,7 +2646,7 @@ ${hint}` : "")
       usage: "/test [command|filter]",
       async execute(args, ctx) {
         try {
-          const { executeTests } = await import("./run-tests-LWSTPCZY.js");
+          const { executeTests } = await import("./run-tests-M73756VV.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -6237,10 +6239,11 @@ ${mcpBudgetNote}` : "");
           } else {
             const teeAc = this.setupStreamInterrupt();
             try {
+              const teeSystemPrompt = (systemPrompt ?? "") + CONTENT_ONLY_STREAM_REMINDER;
               const genStream = provider.chatStream({
                 messages: apiMessages,
                 model: effectiveModel,
-                systemPrompt,
+                systemPrompt: teeSystemPrompt,
                 systemPromptVolatile,
                 stream: true,
                 temperature: modelParams.temperature,
@@ -6256,6 +6259,37 @@ ${mcpBudgetNote}` : "");
                 genStream,
                 { saveToFile, showTokens: teeShowTokens, sessionTotal: teeShowTokens ? { ...this.sessionTokenUsage } : void 0, signal: teeAc.signal }
               );
+              const pseudoMatch = detectPseudoToolCalls(genContent);
+              if (pseudoMatch) {
+                try {
+                  unlinkSync2(saveToFile);
+                } catch {
+                }
+                process.stdout.write(theme.error(
+                  `
+  \u2717 Rejected save: response contained pseudo-tool-call markup (matched: ${pseudoMatch})
+  ${saveToFile} was deleted; the model will be asked to regenerate without tool markup.
+
+`
+                ));
+                const errorResults = result.toolCalls.map((tc) => ({
+                  callId: tc.id,
+                  content: tc.name === "save_last_response" ? `[save_last_response REJECTED] Your fresh streaming output contained pseudo-tool-call markup (e.g. <tool_call>, <function_calls>, or {"name":"...","arguments":...}). The file at "${saveToFile}" was NOT saved (it was deleted to prevent garbage on disk).
+
+This fresh stream has NO tools attached \u2014 your output is captured verbatim. Do NOT print tool-call XML/JSON. Try again: produce ONLY the document body (markdown is fine; tool markup is NOT).` : `[skipped: save_last_response was rejected and other parallel calls are abandoned]`,
+                  isError: tc.name === "save_last_response"
+                }));
+                const reasoningContent3 = "reasoningContent" in result ? result.reasoningContent : void 0;
+                const newMsgs3 = provider.buildToolResultMessages(result.toolCalls, errorResults, reasoningContent3);
+                extraMessages.push(...newMsgs3);
+                if (genUsage) {
+                  roundUsage.inputTokens += genUsage.inputTokens;
+                  roundUsage.outputTokens += genUsage.outputTokens;
+                  roundUsage.cacheCreationTokens += genUsage.cacheCreationTokens ?? 0;
+                  roundUsage.cacheReadTokens += genUsage.cacheReadTokens ?? 0;
+                }
+                continue;
+              }
               lastResponseStore.content = genContent;
               if (genUsage) {
                 roundUsage.inputTokens += genUsage.inputTokens;
@@ -6800,7 +6834,7 @@ program.command("web").description("Start Web UI server with browser-based chat
     console.error("Error: Invalid port number. Must be between 1 and 65535.");
     process.exit(1);
   }
-  const { startWebServer } = await import("./server-6F2JF2JK.js");
+  const { startWebServer } = await import("./server-YRX5VO5N.js");
   await startWebServer({ port, host: options.host });
 });
 program.command("user [action] [username]").description("Manage Web UI users (list | create <name> | delete <name> | reset-password <name> | migrate <name>)").action(async (action, username) => {
@@ -6923,7 +6957,7 @@ program.command("sessions").description("List recent conversation sessions").act
 });
 program.command("batch <action> [arg] [arg2]").description("Anthropic Message Batches: submit | list | status <id> | results <id> [out] | cancel <id>").option("--dry-run", "Parse and validate input without submitting (submit only)").action(async (action, arg, arg2, options) => {
   try {
-    const batch = await import("./batch-A6F3UA3N.js");
+    const batch = await import("./batch-V255CIMB.js");
     switch (action) {
       case "submit":
         if (!arg) {
@@ -6966,7 +7000,7 @@ program.command("batch <action> [arg] [arg2]").description("Anthropic Message Ba
   }
 });
 program.command("mcp-serve").description("Start an MCP server over STDIO, exposing aicli's built-in tools to Claude Desktop / Cursor / other MCP clients").option("--allow-destructive", "Allow bash / run_interactive / task_create (always destructive in MCP mode)").option("--allow-outside-cwd", "Allow tool path arguments to escape the sandbox root \u2014 disabled by default").option("--tools <list>", "Comma-separated whitelist of tools to expose (default: all eligible tools)").option("--cwd <path>", "Working directory AND sandbox root (default: current directory)").action(async (options) => {
-  const { startMcpServer } = await import("./server-DSG3EYRA.js");
+  const { startMcpServer } = await import("./server-54OXGXJ6.js");
   await startMcpServer({
     allowDestructive: !!options.allowDestructive,
     allowOutsideCwd: !!options.allowOutsideCwd,
@@ -7093,7 +7127,7 @@ program.command("hub [topic]").description("Start multi-agent hub (discuss / bra
     }),
     config.get("customProviders")
   );
-  const { startHub } = await import("./hub-3HEMIJTM.js");
+  const { startHub } = await import("./hub-O3EQ2LDY.js");
   await startHub(
     {
       topic: topic ?? "",

package/dist/{run-tests-LWSTPCZY.js → run-tests-M73756VV.js}

@@ -2,8 +2,8 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-NN2B3UBA.js";
-import "./chunk-DNKI3JIL.js";
+} from "./chunk-M77QS5QW.js";
+import "./chunk-SQPICAHN.js";
 import "./chunk-PDX44BCA.js";
 export {
   executeTests,

package/dist/{run-tests-VBJ5H3XR.js → run-tests-XVK66TGP.js}

@@ -1,7 +1,7 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-XWJTZWS7.js";
+} from "./chunk-GFDEAYPM.js";
 import "./chunk-3RG5ZIWI.js";
 export {
   executeTests,

package/dist/{server-DSG3EYRA.js → server-54OXGXJ6.js}

@@ -3,14 +3,14 @@ import {
   ToolRegistry,
   getDangerLevel,
   schemaToJsonSchema
-} from "./chunk-A3HZY7DA.js";
+} from "./chunk-LKWFPJIP.js";
 import "./chunk-3BICTI5M.js";
 import "./chunk-2DXY7UGF.js";
-import "./chunk-NN2B3UBA.js";
+import "./chunk-M77QS5QW.js";
 import "./chunk-2ZD3YTVM.js";
 import {
   VERSION
-} from "./chunk-DNKI3JIL.js";
+} from "./chunk-SQPICAHN.js";
 import "./chunk-4BKXL7SM.js";
 import "./chunk-7ZJN4KLV.js";
 import "./chunk-KHYD3WXE.js";

package/dist/{server-6F2JF2JK.js → server-YRX5VO5N.js}

@@ -3,6 +3,7 @@ import {
   AuthManager
 } from "./chunk-BYNY5JPB.js";
 import {
+  CONTENT_ONLY_STREAM_REMINDER,
   HALLUCINATION_CORRECTION_MESSAGE,
   McpManager,
   ProviderRegistry,
@@ -11,6 +12,7 @@ import {
   TOOL_CALL_REMINDER,
   autoTrimSessionIfNeeded,
   computeCost,
+  detectPseudoToolCalls,
   detectsHallucinatedFileOp,
   formatCost,
   getContentText,
@@ -18,10 +20,10 @@ import {
   loadDevState,
   persistToolRound,
   setupProxy
-} from "./chunk-IKX4D6C7.js";
+} from "./chunk-YIHYQVV7.js";
 import {
   ConfigManager
-} from "./chunk-A26EOV2J.js";
+} from "./chunk-BLJIPN2F.js";
 import {
   ToolExecutor,
   ToolRegistry,
@@ -39,10 +41,10 @@ import {
   spawnAgentContext,
   truncateOutput,
   undoStack
-} from "./chunk-A3HZY7DA.js";
+} from "./chunk-LKWFPJIP.js";
 import "./chunk-3BICTI5M.js";
 import "./chunk-2DXY7UGF.js";
-import "./chunk-NN2B3UBA.js";
+import "./chunk-M77QS5QW.js";
 import "./chunk-2ZD3YTVM.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
@@ -62,7 +64,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-DNKI3JIL.js";
+} from "./chunk-SQPICAHN.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
@@ -473,7 +475,7 @@ function loadMemoryContent(configDir) {
 }
 
 // src/web/session-handler.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, appendFileSync, writeFileSync, mkdirSync, readdirSync, statSync, createWriteStream } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, appendFileSync, writeFileSync, mkdirSync, readdirSync, statSync, createWriteStream, unlinkSync } from "fs";
 import { join as join2, resolve, dirname } from "path";
 import { execSync } from "child_process";
 var FREE_ROUND_TOOLS = /* @__PURE__ */ new Set(["write_todos"]);
@@ -1257,10 +1259,11 @@ ${summaryResult.content}`,
     try {
       mkdirSync(dirname(saveToFile), { recursive: true });
       fileStream = createWriteStream(saveToFile, { encoding: "utf-8" });
+      const teeSystemPrompt = (systemPrompt ?? "") + CONTENT_ONLY_STREAM_REMINDER;
       const chatRequest = {
         messages: apiMessages,
         model: this.currentModel,
-        systemPrompt,
+        systemPrompt: teeSystemPrompt,
         systemPromptVolatile,
         stream: true,
         temperature: modelParams.temperature,
@@ -1285,10 +1288,20 @@ ${summaryResult.content}`,
       await new Promise((resolve3, reject) => {
         fileStream.end((err) => err ? reject(err) : resolve3());
       });
-      const lines = fullContent.split("\n").length;
-      const bytes = Buffer.byteLength(fullContent, "utf-8");
-      summary = `File saved: ${saveToFile} (${lines} lines, ${bytes} bytes)`;
-      undoStack.push(saveToFile, `save_last_response: ${saveToFile}`);
+      const pseudoMatch = detectPseudoToolCalls(fullContent);
+      if (pseudoMatch) {
+        try {
+          unlinkSync(saveToFile);
+        } catch {
+        }
+        isError = true;
+        summary = `[save_last_response REJECTED] Your fresh streaming output contained pseudo-tool-call markup (matched: ${pseudoMatch}). The file at "${saveToFile}" was NOT saved (deleted). This fresh stream has NO tools attached \u2014 output is captured verbatim. Do NOT print <tool_call>, <function_calls>, <invoke>, or {"name":"...","arguments":...} JSON. Try again: produce ONLY the document body.`;
+      } else {
+        const lines = fullContent.split("\n").length;
+        const bytes = Buffer.byteLength(fullContent, "utf-8");
+        summary = `File saved: ${saveToFile} (${lines} lines, ${bytes} bytes)`;
+        undoStack.push(saveToFile, `save_last_response: ${saveToFile}`);
+      }
       if (teeUsage) {
         roundUsage.inputTokens += teeUsage.inputTokens;
         roundUsage.outputTokens += teeUsage.outputTokens;
@@ -2383,7 +2396,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-LWSTPCZY.js");
+          const { executeTests } = await import("./run-tests-M73756VV.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {

package/dist/{task-orchestrator-6WIYZPDB.js → task-orchestrator-2TGWMUUT.js}

@@ -4,14 +4,14 @@ import {
   getDangerLevel,
   googleSearchContext,
   truncateOutput
-} from "./chunk-A3HZY7DA.js";
+} from "./chunk-LKWFPJIP.js";
 import "./chunk-3BICTI5M.js";
 import "./chunk-2DXY7UGF.js";
-import "./chunk-NN2B3UBA.js";
+import "./chunk-M77QS5QW.js";
 import "./chunk-2ZD3YTVM.js";
 import {
   SUBAGENT_ALLOWED_TOOLS
-} from "./chunk-DNKI3JIL.js";
+} from "./chunk-SQPICAHN.js";
 import "./chunk-4BKXL7SM.js";
 import "./chunk-7ZJN4KLV.js";
 import "./chunk-KHYD3WXE.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jinzd-ai-cli",
-  "version": "0.4.108",
+  "version": "0.4.110",
   "description": "Cross-platform REPL-style AI CLI with multi-provider support",
   "type": "module",
   "main": "./dist/index.js",