jinzd-ai-cli 0.4.12 → 0.4.13

package/dist/{chunk-JPCRXQ2E.js → chunk-52BIUGQ2.js}

@@ -2,7 +2,7 @@
 import {
   EnvLoader,
   schemaToJsonSchema
-} from "./chunk-A3S7PUMM.js";
+} from "./chunk-TXCLZ72H.js";
 import {
   APP_NAME,
   CONFIG_DIR_NAME,
@@ -15,7 +15,7 @@ import {
   MCP_TOOL_PREFIX,
   PLUGINS_DIR_NAME,
   VERSION
-} from "./chunk-Z5IRVRGL.js";
+} from "./chunk-DP3M26PP.js";
 
 // src/config/config-manager.ts
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
@@ -277,7 +277,8 @@ ${err}`
     if (rawValue === "true") value = true;
     else if (rawValue === "false") value = false;
     else if (rawValue !== "" && !isNaN(Number(rawValue))) value = Number(rawValue);
-    let current = this.config;
+    const draft = JSON.parse(JSON.stringify(this.config));
+    let current = draft;
     for (let i = 0; i < keys.length - 1; i++) {
       const key = keys[i];
       if (current[key] == null || typeof current[key] !== "object") {
@@ -286,6 +287,12 @@ ${err}`
       current = current[key];
     }
     current[keys[keys.length - 1]] = value;
+    const result = ConfigSchema.safeParse(draft);
+    if (!result.success) {
+      const firstErr = result.error.errors[0];
+      throw new ConfigError(`Invalid config value for "${path}": ${firstErr?.message ?? "validation failed"}`);
+    }
+    this.config = result.data;
     this.save();
   }
   /** 获取完整配置对象的格式化 JSON 字符串（用于 /config show 等展示） */
@@ -2535,6 +2542,7 @@ var McpClient = class {
   config;
   process = null;
   nextId = 1;
+  // M8: wraps at MAX_SAFE_INTEGER via getNextId()
   connected = false;
   serverInfo = null;
   /** stderr 收集（最多保留最后 2KB，用于错误报告） */
@@ -2667,6 +2675,7 @@ var McpClient = class {
         return reject(new Error(`MCP server [${this.serverId}] stdin not writable`));
       }
       const id = this.nextId++;
+      if (this.nextId > Number.MAX_SAFE_INTEGER - 1) this.nextId = 1;
       const request = {
         jsonrpc: "2.0",
         id,

package/dist/{chunk-Z5IRVRGL.js → chunk-DP3M26PP.js}

@@ -8,7 +8,7 @@ import { platform } from "os";
 import chalk from "chalk";
 
 // src/core/constants.ts
-var VERSION = "0.4.12";
+var VERSION = "0.4.13";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-3HJSWTKO.js → chunk-TLOCRYJC.js}

@@ -6,7 +6,7 @@ import { platform } from "os";
 import chalk from "chalk";
 
 // src/core/constants.ts
-var VERSION = "0.4.12";
+var VERSION = "0.4.13";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-A3S7PUMM.js → chunk-TXCLZ72H.js}

@@ -6,7 +6,7 @@ import {
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT,
   runTestsTool
-} from "./chunk-Z5IRVRGL.js";
+} from "./chunk-DP3M26PP.js";
 
 // src/tools/builtin/bash.ts
 import { execSync } from "child_process";
@@ -534,6 +534,13 @@ Suggestion: read existing text versions (.md / .txt) in the project, or install
     if (BINARY_EXTENSIONS.has(ext)) {
       return `[Binary file: ${filePath} (${ext})]
 This is a binary file and cannot be read as text. If there is a text version (.md / .txt) in the project, please read that instead.`;
+    }
+    try {
+      const fstat = statSync2(normalizedPath);
+      if (fstat.size > MAX_FILE_BYTES) {
+        return `[File too large: ${filePath} | ${(fstat.size / 1024 / 1024).toFixed(1)} MB exceeds ${MAX_FILE_BYTES / 1024 / 1024} MB limit]`;
+      }
+    } catch {
     }
     const buf = readFileSync2(normalizedPath);
     if (encoding === "base64") {
@@ -1003,6 +1010,10 @@ Supports regex. Automatically skips node_modules, dist, .git directories.`,
     const maxResults = Math.max(1, Number(args["max_results"] ?? 50));
     if (!pattern) throw new Error("pattern is required");
     if (!existsSync6(rootPath)) throw new Error(`Path not found: ${rootPath}`);
+    const MAX_PATTERN_LENGTH = 1e3;
+    if (pattern.length > MAX_PATTERN_LENGTH) {
+      throw new Error(`Pattern too long (${pattern.length} chars, max ${MAX_PATTERN_LENGTH}). Use a shorter pattern.`);
+    }
     let regex;
     try {
       regex = new RegExp(pattern, ignoreCase ? "gi" : "g");
@@ -1386,11 +1397,11 @@ ${stderr}`);
 // src/tools/builtin/web-fetch.ts
 import { promises as dnsPromises } from "dns";
 function htmlToText(html) {
+  let text = html.replace(/<script[\s\S]*?<\/script>/gi, "").replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<noscript[\s\S]*?<\/noscript>/gi, "").replace(/<svg[\s\S]*?<\/svg>/gi, "");
   const HTML_REGEX_LIMIT = 2e5;
-  if (html.length > HTML_REGEX_LIMIT) {
-    html = html.slice(0, HTML_REGEX_LIMIT);
+  if (text.length > HTML_REGEX_LIMIT) {
+    text = text.slice(0, HTML_REGEX_LIMIT);
   }
-  let text = html.replace(/<script[\s\S]*?<\/script>/gi, "").replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<noscript[\s\S]*?<\/noscript>/gi, "").replace(/<svg[\s\S]*?<\/svg>/gi, "");
   text = text.replace(/<h([1-6])[^>]*>([\s\S]*?)<\/h\1>/gi, (_m, lvl, content) => {
     const prefix = "#".repeat(Number(lvl));
     return `
@@ -1848,6 +1859,14 @@ var EnvLoader = class {
       if (val) return val;
     }
     const dynamicEnvVar = `AICLI_API_KEY_${providerId.toUpperCase().replace(/-/g, "_")}`;
+    if (fixedEnvVar && fixedEnvVar !== dynamicEnvVar) {
+      const fixedVal = process.env[fixedEnvVar];
+      const dynVal = process.env[dynamicEnvVar];
+      if (fixedVal && dynVal && fixedVal !== dynVal) {
+        process.stderr.write(`[warn] env var collision: ${fixedEnvVar} and ${dynamicEnvVar} have different values for provider "${providerId}". Using ${fixedEnvVar}.
+`);
+      }
+    }
     return process.env[dynamicEnvVar] || void 0;
   }
   static getDefaultProvider() {

package/dist/{hub-J5ZOVM4Q.js → hub-LURPCJ4Z.js}

@@ -381,7 +381,7 @@ ${content}`);
   }
 }
 async function runTaskMode(config, providers, configManager, topic) {
-  const { TaskOrchestrator } = await import("./task-orchestrator-A5X2GUSH.js");
+  const { TaskOrchestrator } = await import("./task-orchestrator-XXOS7WHR.js");
   const orchestrator = new TaskOrchestrator(config, providers, configManager);
   let interrupted = false;
   const onSigint = () => {

package/dist/index.js

@@ -23,7 +23,7 @@ import {
   saveDevState,
   sessionHasMeaningfulContent,
   setupProxy
-} from "./chunk-JPCRXQ2E.js";
+} from "./chunk-52BIUGQ2.js";
 import {
   ToolRegistry,
   askUserContext,
@@ -38,7 +38,7 @@ import {
   theme,
   truncateOutput,
   undoStack
-} from "./chunk-A3S7PUMM.js";
+} from "./chunk-TXCLZ72H.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
   AUTHOR,
@@ -58,7 +58,7 @@ import {
   REPO_URL,
   SKILLS_DIR_NAME,
   VERSION
-} from "./chunk-Z5IRVRGL.js";
+} from "./chunk-DP3M26PP.js";
 
 // src/index.ts
 import { program } from "commander";
@@ -1914,7 +1914,7 @@ ${hint}` : "")
       description: "Run project tests and show structured report",
       usage: "/test [command|filter]",
       async execute(args, _ctx) {
-        const { executeTests } = await import("./run-tests-EUOAU3RZ.js");
+        const { executeTests } = await import("./run-tests-PVVT37LK.js");
         const argStr = args.join(" ").trim();
         let testArgs = {};
         if (argStr) {
@@ -5528,7 +5528,7 @@ program.command("web").description("Start Web UI server with browser-based chat
     console.error("Error: Invalid port number. Must be between 1 and 65535.");
     process.exit(1);
   }
-  const { startWebServer } = await import("./server-PWWT4P52.js");
+  const { startWebServer } = await import("./server-KPNMFMDU.js");
   await startWebServer({ port, host: options.host });
 });
 program.command("user [action] [username]").description("Manage Web UI users (list | create <name> | delete <name> | reset-password <name> | migrate <name>)").action(async (action, username) => {
@@ -5761,7 +5761,7 @@ program.command("hub [topic]").description("Start multi-agent hub (discuss / bra
     }),
     config.get("customProviders")
   );
-  const { startHub } = await import("./hub-J5ZOVM4Q.js");
+  const { startHub } = await import("./hub-LURPCJ4Z.js");
   await startHub(
     {
       topic: topic ?? "",

package/dist/{run-tests-EUOAU3RZ.js → run-tests-PVVT37LK.js}

@@ -2,7 +2,7 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-Z5IRVRGL.js";
+} from "./chunk-DP3M26PP.js";
 export {
   executeTests,
   runTestsTool

package/dist/{run-tests-4WPBBNWG.js → run-tests-UPW6W4QE.js}

@@ -1,7 +1,7 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-3HJSWTKO.js";
+} from "./chunk-TLOCRYJC.js";
 export {
   executeTests,
   runTestsTool

package/dist/{server-PWWT4P52.js → server-KPNMFMDU.js}

@@ -18,7 +18,7 @@ import {
   renderDiff,
   runHook,
   setupProxy
-} from "./chunk-JPCRXQ2E.js";
+} from "./chunk-52BIUGQ2.js";
 import {
   AuthManager
 } from "./chunk-BYNY5JPB.js";
@@ -32,7 +32,7 @@ import {
   spawnAgentContext,
   truncateOutput,
   undoStack
-} from "./chunk-A3S7PUMM.js";
+} from "./chunk-TXCLZ72H.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
   CONTEXT_FILE_CANDIDATES,
@@ -44,7 +44,7 @@ import {
   PLAN_MODE_SYSTEM_ADDON,
   SKILLS_DIR_NAME,
   VERSION
-} from "./chunk-Z5IRVRGL.js";
+} from "./chunk-DP3M26PP.js";
 
 // src/web/server.ts
 import express from "express";
@@ -57,7 +57,7 @@ import { networkInterfaces } from "os";
 // src/web/tool-executor-web.ts
 import { randomUUID } from "crypto";
 import { existsSync, readFileSync } from "fs";
-var ToolExecutorWeb = class {
+var ToolExecutorWeb = class _ToolExecutorWeb {
   constructor(registry, ws) {
     this.registry = registry;
     this.ws = ws;
@@ -71,6 +71,10 @@ var ToolExecutorWeb = class {
   pendingConfirms = /* @__PURE__ */ new Map();
   /** Pending batch confirm promises */
   pendingBatchConfirms = /* @__PURE__ */ new Map();
+  /** M7 fix: timers for confirm cleanup if client crashes */
+  pendingTimers = /* @__PURE__ */ new Map();
+  static CONFIRM_TIMEOUT_MS = 5 * 60 * 1e3;
+  // 5 minutes
   /** Publicly readable by SessionHandler to check if confirm is active */
   confirming = false;
   /** Session-level auto-approve toggle (/yolo command) */
@@ -86,10 +90,19 @@ var ToolExecutorWeb = class {
     if (opts.permissionRules) this.permissionRules = opts.permissionRules;
     if (opts.defaultPermission) this.defaultPermission = opts.defaultPermission;
   }
+  /** Clear M7 timeout timer for a requestId */
+  clearPendingTimer(requestId) {
+    const timer = this.pendingTimers.get(requestId);
+    if (timer) {
+      clearTimeout(timer);
+      this.pendingTimers.delete(requestId);
+    }
+  }
   /** Resolve a pending confirm from client response */
   resolveConfirm(requestId, approved) {
     const resolve3 = this.pendingConfirms.get(requestId);
     if (resolve3) {
+      this.clearPendingTimer(requestId);
       this.pendingConfirms.delete(requestId);
       this.confirming = false;
       resolve3(approved);
@@ -99,6 +112,7 @@ var ToolExecutorWeb = class {
   resolveBatchConfirm(requestId, decision) {
     const resolve3 = this.pendingBatchConfirms.get(requestId);
     if (resolve3) {
+      this.clearPendingTimer(requestId);
       this.pendingBatchConfirms.delete(requestId);
       this.confirming = false;
       if (decision === "all" || decision === "none") {
@@ -190,6 +204,11 @@ var ToolExecutorWeb = class {
     this.send(msg);
     return new Promise((resolve3) => {
       this.pendingConfirms.set(requestId, resolve3);
+      this.pendingTimers.set(requestId, setTimeout(() => {
+        if (this.pendingConfirms.has(requestId)) {
+          this.resolveConfirm(requestId, false);
+        }
+      }, _ToolExecutorWeb.CONFIRM_TIMEOUT_MS));
     });
   }
   /** WebSocket-based batch confirm */
@@ -210,6 +229,11 @@ var ToolExecutorWeb = class {
     this.send(msg);
     return new Promise((resolve3) => {
       this.pendingBatchConfirms.set(requestId, resolve3);
+      this.pendingTimers.set(requestId, setTimeout(() => {
+        if (this.pendingBatchConfirms.has(requestId)) {
+          this.resolveBatchConfirm(requestId, "none");
+        }
+      }, _ToolExecutorWeb.CONFIRM_TIMEOUT_MS));
     });
   }
   async execute(call) {
@@ -1448,7 +1472,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-EUOAU3RZ.js");
+          const { executeTests } = await import("./run-tests-PVVT37LK.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {

package/dist/{task-orchestrator-A5X2GUSH.js → task-orchestrator-XXOS7WHR.js}

@@ -4,14 +4,14 @@ import {
   getDangerLevel,
   googleSearchContext,
   truncateOutput
-} from "./chunk-A3S7PUMM.js";
+} from "./chunk-TXCLZ72H.js";
 import {
   SUBAGENT_ALLOWED_TOOLS
-} from "./chunk-Z5IRVRGL.js";
+} from "./chunk-DP3M26PP.js";
 
 // src/hub/task-orchestrator.ts
 import { createInterface } from "readline";
-import { existsSync, readFileSync, writeFileSync, unlinkSync } from "fs";
+import { existsSync, readFileSync, writeFileSync, unlinkSync, renameSync } from "fs";
 import { join } from "path";
 import chalk from "chalk";
 
@@ -266,7 +266,9 @@ var TaskOrchestrator = class {
   }
   saveState(plan) {
     try {
-      writeFileSync(this.stateFilePath, JSON.stringify(plan, null, 2), "utf-8");
+      const tmpPath = this.stateFilePath + ".tmp";
+      writeFileSync(tmpPath, JSON.stringify(plan, null, 2), "utf-8");
+      renameSync(tmpPath, this.stateFilePath);
     } catch {
     }
   }
@@ -357,13 +359,29 @@ Example:
       if (!Array.isArray(parsed) || parsed.length === 0) {
         throw new Error("Empty task list");
       }
+      const validRoleIds = new Set(roles.map((r) => r.id));
+      for (let i = 0; i < parsed.length; i++) {
+        const t = parsed[i];
+        if (typeof t !== "object" || t === null) {
+          throw new Error(`Task #${i + 1}: not an object`);
+        }
+        if (typeof t.description !== "string" || !t.description.trim()) {
+          throw new Error(`Task #${i + 1}: missing or empty "description"`);
+        }
+        if (typeof t.assignee !== "string" || !t.assignee.trim()) {
+          throw new Error(`Task #${i + 1}: missing or empty "assignee"`);
+        }
+        if (t.dependencies != null && !Array.isArray(t.dependencies)) {
+          throw new Error(`Task #${i + 1}: "dependencies" must be an array`);
+        }
+      }
       const roleMap = new Map(roles.map((r) => [r.id, r.name]));
       const tasks = parsed.map((t, i) => ({
-        id: t.id ?? i + 1,
+        id: typeof t.id === "number" ? t.id : i + 1,
         description: t.description,
         assignee: t.assignee,
         assigneeName: roleMap.get(t.assignee) ?? t.assignee,
-        dependencies: t.dependencies ?? [],
+        dependencies: Array.isArray(t.dependencies) ? t.dependencies : [],
         status: "pending"
       }));
       return { goal, tasks };
@@ -428,7 +446,15 @@ Example:
       if (!nextTask) {
         const pending = plan.tasks.filter((t) => t.status === "pending");
         if (pending.length === 0) break;
-        console.log(chalk.red(`  \u2717 Cannot proceed: ${pending.length} task(s) have unmet dependencies.`));
+        const failedIds = new Set(plan.tasks.filter((t) => t.status === "failed").map((t) => t.id));
+        const hasCycle = pending.every(
+          (t) => t.dependencies.some((d) => !completedIds.has(d) && !failedIds.has(d) && pending.some((p) => p.id === d))
+        );
+        if (hasCycle) {
+          console.log(chalk.red(`  \u2717 Circular dependency detected among ${pending.length} task(s):`));
+        } else {
+          console.log(chalk.red(`  \u2717 Cannot proceed: ${pending.length} task(s) have unmet dependencies.`));
+        }
         for (const t of pending) {
           const unmet = t.dependencies.filter((d) => !completedIds.has(d));
           console.log(chalk.dim(`    Task #${t.id}: waiting on [${unmet.join(", ")}]`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jinzd-ai-cli",
-  "version": "0.4.12",
+  "version": "0.4.13",
   "description": "Cross-platform REPL-style AI CLI with multi-provider support",
   "type": "module",
   "main": "./dist/index.js",