jinzd-ai-cli 0.4.150 → 0.4.151

package/dist/electron-server.js

@@ -36,20 +36,20 @@ import {
   VERSION,
   buildUserIdentityPrompt,
   runTestsTool
-} from "./chunk-TUGKYLIV.js";
+} from "./chunk-WCBVNY6D.js";
 import {
   hasSemanticIndex,
   semanticSearch
-} from "./chunk-NKR53CPL.js";
+} from "./chunk-YKVFZLSI.js";
 import {
   loadIndex
 } from "./chunk-DQ2OHJNF.js";
-import "./chunk-PASCDYMH.js";
+import "./chunk-D6U75FHP.js";
 import {
   loadChatIndex,
   redactJson,
   searchChatMemory
-} from "./chunk-WJ32NAW3.js";
+} from "./chunk-T5VKNPLD.js";
 import "./chunk-JV5N65KN.js";
 import "./chunk-3RG5ZIWI.js";
 
@@ -638,6 +638,7 @@ function getDangerLevel(toolName, args) {
     if (/\btee\b|\bcp\b|\bmv\b|\bln\s+-s/.test(cmd)) return "write";
     if (/\bchmod\b|\bchown\b/.test(cmd)) return "write";
     if (/\bSet-Content\b|\bOut-File\b|\bAdd-Content\b|\bCopy-Item\b|\bMove-Item\b|\bSet-ItemProperty\b|\bNew-ItemProperty\b/i.test(cmd)) return "write";
+    if (/\b(python3?|node|deno|bun|perl|ruby|php)\b[^\n]*?\s-(?:c|e|p|r)\b/i.test(cmd)) return "write";
     return "safe";
   }
   if (toolName === "write_file") return "write";
@@ -710,10 +711,10 @@ var ClaudeProvider = class extends BaseProvider {
     };
     const proxyUrl = options?.proxy;
     try {
-      const { Agent, ProxyAgent, fetch: undiciFetch } = await import("undici");
+      const { Agent: Agent2, ProxyAgent, fetch: undiciFetch } = await import("undici");
       const STREAM_BODY_TIMEOUT = 30 * 60 * 1e3;
       const STREAM_HEADERS_TIMEOUT = 5 * 60 * 1e3;
-      const dispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, bodyTimeout: STREAM_BODY_TIMEOUT, headersTimeout: STREAM_HEADERS_TIMEOUT }) : new Agent({ bodyTimeout: STREAM_BODY_TIMEOUT, headersTimeout: STREAM_HEADERS_TIMEOUT });
+      const dispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, bodyTimeout: STREAM_BODY_TIMEOUT, headersTimeout: STREAM_HEADERS_TIMEOUT }) : new Agent2({ bodyTimeout: STREAM_BODY_TIMEOUT, headersTimeout: STREAM_HEADERS_TIMEOUT });
       clientOptions.fetch = ((url, init) => undiciFetch(url, { ...init, dispatcher }));
     } catch {
     }
@@ -1575,14 +1576,14 @@ var OpenAICompatibleProvider = class extends BaseProvider {
     };
     const proxyUrl = options?.proxy;
     try {
-      const { Agent, ProxyAgent, fetch: undiciFetch } = await import("undici");
+      const { Agent: Agent2, ProxyAgent, fetch: undiciFetch } = await import("undici");
       const STREAM_BODY_TIMEOUT = 30 * 60 * 1e3;
       const STREAM_HEADERS_TIMEOUT = 5 * 60 * 1e3;
       const dispatcher = proxyUrl ? new ProxyAgent({
         uri: proxyUrl,
         bodyTimeout: STREAM_BODY_TIMEOUT,
         headersTimeout: STREAM_HEADERS_TIMEOUT
-      }) : new Agent({
+      }) : new Agent2({
         bodyTimeout: STREAM_BODY_TIMEOUT,
         headersTimeout: STREAM_HEADERS_TIMEOUT
       });
@@ -4987,7 +4988,7 @@ function checkPermission(toolName, args, dangerLevel, rules, defaultAction = "co
       if (rule.when.pathPattern) {
         if (toolName === "bash" && rule.action === "auto-approve") {
           const cmd = String(args["command"] ?? "").trim();
-          if (/[;&|`$<>]/.test(cmd) || /\$\(/.test(cmd)) continue;
+          if (/[;&|`$<>\n\r]/.test(cmd) || /\$\(/.test(cmd)) continue;
           if (!cmd.startsWith(rule.when.pathPattern)) continue;
         } else {
           const path3 = String(args["path"] ?? args["command"] ?? "");
@@ -7015,6 +7016,8 @@ ${stderr}`);
 
 // src/tools/builtin/web-fetch.ts
 import { promises as dnsPromises } from "dns";
+import net from "net";
+import { Agent } from "undici";
 function htmlToText(html) {
   let text = html.replace(/<script[\s\S]*?<\/script>/gi, "").replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<noscript[\s\S]*?<\/noscript>/gi, "").replace(/<svg[\s\S]*?<\/svg>/gi, "");
   const HTML_REGEX_LIMIT = 2e5;
@@ -7058,34 +7061,100 @@ function extractDescription(html) {
   return m ? m[1].trim() : "";
 }
 var MAX_OUTPUT = 16e3;
+function parseIpPart(s) {
+  if (/^0x[0-9a-f]+$/i.test(s)) return parseInt(s, 16);
+  if (/^0[0-7]+$/.test(s)) return parseInt(s, 8);
+  if (/^[1-9]\d*$/.test(s) || s === "0") return parseInt(s, 10);
+  return null;
+}
+function normalizeIpv4(h) {
+  const parts = h.split(".");
+  if (parts.length === 1) {
+    const n = parseIpPart(parts[0]);
+    if (n === null || n < 0 || n > 4294967295) return null;
+    return [n >>> 24 & 255, n >>> 16 & 255, n >>> 8 & 255, n & 255].join(".");
+  }
+  if (parts.length === 4) {
+    const nums = parts.map(parseIpPart);
+    if (nums.some((n) => n === null || n < 0 || n > 255)) return null;
+    return nums.join(".");
+  }
+  return null;
+}
+function isPrivateIpv4(ip) {
+  const m = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!m) return false;
+  const [o1, o2] = [Number(m[1]), Number(m[2])];
+  if (o1 === 127) return true;
+  if (o1 === 10) return true;
+  if (o1 === 172 && o2 >= 16 && o2 <= 31) return true;
+  if (o1 === 192 && o2 === 168) return true;
+  if (o1 === 169 && o2 === 254) return true;
+  if (o1 === 0) return true;
+  if (o1 >= 224) return true;
+  return false;
+}
+function isPrivateIpv6(ip) {
+  const h = ip.toLowerCase().replace(/%.*$/, "");
+  if (h === "::1" || h === "::") return true;
+  const first = h.split(":")[0] ?? "";
+  if (/^f[cd]/.test(first)) return true;
+  if (/^fe[89ab]/.test(first)) return true;
+  const mapped = h.match(/::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (mapped) return isPrivateIpv4(mapped[1]);
+  const mappedHex = h.match(/::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (mappedHex) {
+    const hi = parseInt(mappedHex[1], 16), lo = parseInt(mappedHex[2], 16);
+    const v4 = [hi >> 8 & 255, hi & 255, lo >> 8 & 255, lo & 255].join(".");
+    return isPrivateIpv4(v4);
+  }
+  return false;
+}
+function isPrivateAddr(ip) {
+  if (net.isIPv4(ip)) return isPrivateIpv4(ip);
+  if (net.isIPv6(ip)) return isPrivateIpv6(ip);
+  return false;
+}
 function isPrivateHost(hostname) {
   const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (h === "localhost" || h === "0.0.0.0" || h === "::1") return true;
-  if (h.startsWith("fe80:")) return true;
-  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (m) {
-    const [o1, o2] = [Number(m[1]), Number(m[2])];
-    if (o1 === 127) return true;
-    if (o1 === 10) return true;
-    if (o1 === 172 && o2 >= 16 && o2 <= 31) return true;
-    if (o1 === 192 && o2 === 168) return true;
-    if (o1 === 169 && o2 === 254) return true;
-    if (o1 === 0) return true;
-  }
+  if (h === "localhost" || h === "") return true;
+  const v4 = normalizeIpv4(h);
+  if (v4) return isPrivateIpv4(v4);
+  if (net.isIPv6(h)) return isPrivateIpv6(h);
   return false;
 }
 async function resolveAndCheck(hostname) {
   const h = hostname.replace(/^\[|\]$/g, "");
-  if (/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h) || h.includes(":")) return;
+  if (net.isIP(h) !== 0 || normalizeIpv4(h)) return;
   try {
-    const { address } = await dnsPromises.lookup(h);
-    if (isPrivateHost(address)) {
-      throw new NetworkError(`Blocked: "${hostname}" resolves to private address ${address}. web_fetch is restricted to public URLs.`);
+    const addrs = await dnsPromises.lookup(h, { all: true, verbatim: true });
+    for (const { address } of addrs) {
+      if (isPrivateAddr(address)) {
+        throw new NetworkError(`Blocked: "${hostname}" resolves to private address ${address}. web_fetch is restricted to public URLs.`);
+      }
     }
   } catch (e) {
     if (e.message.startsWith("Blocked:")) throw e;
   }
 }
+function ssrfSafeDispatcher() {
+  return new Agent({
+    connect: {
+      lookup: (hostname, options, cb) => {
+        dnsPromises.lookup(hostname, { all: true, verbatim: true }).then((addrs) => {
+          for (const a of addrs) {
+            if (isPrivateAddr(a.address)) {
+              cb(new NetworkError(`Blocked: "${hostname}" resolves to private address ${a.address}.`), null);
+              return;
+            }
+          }
+          if (options && options.all) cb(null, addrs);
+          else cb(null, addrs[0].address, addrs[0].family);
+        }).catch((err) => cb(err, null));
+      }
+    }
+  });
+}
 var webFetchTool = {
   definition: {
     name: "web_fetch",
@@ -7130,6 +7199,7 @@ var webFetchTool = {
       Accept: "text/html,application/xhtml+xml,text/plain,*/*",
       "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8"
     };
+    const dispatcher = ssrfSafeDispatcher();
     try {
       let currentUrl = url;
       let resp = null;
@@ -7142,8 +7212,9 @@ var webFetchTool = {
         const r = await fetch(currentUrl, {
           signal: controller2.signal,
           headers: FETCH_HEADERS,
-          redirect: "manual"
+          redirect: "manual",
           // 手动控制重定向
+          dispatcher
         });
         if (r.status >= 300 && r.status < 400) {
           if (hop >= MAX_REDIRECTS) {
@@ -7174,7 +7245,12 @@ var webFetchTool = {
       if (err.name === "AbortError") {
         throw new NetworkError(`Request timed out after 20s: ${url}`, void 0, err);
       }
+      const cause = err.cause;
+      if (cause?.message?.startsWith("Blocked:")) throw new NetworkError(cause.message);
       throw err;
+    } finally {
+      void dispatcher.close().catch(() => {
+      });
     }
     let text;
     if (contentType.includes("text/plain") || contentType.includes("application/json")) {
@@ -12403,7 +12479,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
         const root = process.cwd();
         const { loadIndex: loadIndex2, clearIndex } = await import("./store-A3TZM6PS.js");
         const { indexProject: indexProject2 } = await import("./indexer-ISSNIFQY.js");
-        const { loadVectorStore, clearVectorStore } = await import("./vector-store-AK6J3RIA.js");
+        const { loadVectorStore, clearVectorStore } = await import("./vector-store-PLDSXF3V.js");
         if (sub === "status") {
           const idx = loadIndex2(root);
           const vec = loadVectorStore(root);
@@ -12452,7 +12528,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             message: `Building semantic index for ${idx.symbolCount} symbols\u2026 (first run downloads ~117 MB model)`
           });
           try {
-            const { rebuildSemanticIndex } = await import("./semantic-IJKF5ZZC.js");
+            const { rebuildSemanticIndex } = await import("./semantic-GJJWTI3A.js");
             const stats = await rebuildSemanticIndex(root);
             const first = stats.modelFirstLoadMs ? ` (model load+first batch ${stats.modelFirstLoadMs}ms)` : "";
             this.send({
@@ -12639,7 +12715,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-YSHH37SS.js");
+          const { executeTests } = await import("./run-tests-XWEHN7DF.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -13163,7 +13239,7 @@ Add .md files to create commands.` });
       return;
     }
     try {
-      const { searchChatMemory: searchChatMemory2, loadChatIndex: loadChatIndex2 } = await import("./chat-index-MY3DJTV3.js");
+      const { searchChatMemory: searchChatMemory2, loadChatIndex: loadChatIndex2 } = await import("./chat-index-BE4TPLFH.js");
       const loaded = loadChatIndex2();
       if (!loaded || loaded.idx.chunks.length === 0) {
         this.send({ type: "memory_hits", query: q, hits: [], indexMissing: true });
@@ -13199,7 +13275,7 @@ Add .md files to create commands.` });
   }
   async handleMemoryStatus() {
     try {
-      const { getChatIndexStatus } = await import("./chat-index-MY3DJTV3.js");
+      const { getChatIndexStatus } = await import("./chat-index-BE4TPLFH.js");
       const s = getChatIndexStatus();
       this.send({
         type: "memory_status",
@@ -13224,7 +13300,7 @@ Add .md files to create commands.` });
         type: "info",
         message: full ? "\u{1F9E0} Rebuilding chat memory index (this may take a while on first run \u2014 ~117 MB embedder)." : "\u{1F9E0} Refreshing chat memory index (incremental)\u2026"
       });
-      const { buildChatIndex } = await import("./chat-index-MY3DJTV3.js");
+      const { buildChatIndex } = await import("./chat-index-BE4TPLFH.js");
       const stats = await buildChatIndex({
         full,
         onProgress: (p) => {
@@ -13751,7 +13827,9 @@ var AuthManager = class {
       if (parts.length !== 2) return null;
       const [payloadB64, signature] = parts;
       const expectedSig = this.sign(payloadB64);
-      if (signature !== expectedSig) return null;
+      const sigBuf = Buffer.from(signature ?? "", "utf-8");
+      const expBuf = Buffer.from(expectedSig, "utf-8");
+      if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) return null;
       const payload = JSON.parse(
         Buffer.from(payloadB64, "base64url").toString("utf-8")
       );
@@ -14448,9 +14526,9 @@ async function startWebServer(options = {}) {
           try {
             const nets = networkInterfaces();
             for (const name of Object.keys(nets)) {
-              for (const net of nets[name] ?? []) {
-                if (net.family === "IPv4" && !net.internal) {
-                  console.log(`   \u{1F4F1} LAN access: http://${net.address}:${actualPort}`);
+              for (const net2 of nets[name] ?? []) {
+                if (net2.family === "IPv4" && !net2.internal) {
+                  console.log(`   \u{1F4F1} LAN access: http://${net2.address}:${actualPort}`);
                 }
               }
             }

package/dist/{hub-OGEDS4X7.js → hub-3MKH3BMA.js}

@@ -386,7 +386,7 @@ ${content}`);
   }
 }
 async function runTaskMode(config, providers, configManager, topic) {
-  const { TaskOrchestrator } = await import("./task-orchestrator-XBPAOLYD.js");
+  const { TaskOrchestrator } = await import("./task-orchestrator-EVJVR3HL.js");
   const orchestrator = new TaskOrchestrator(config, providers, configManager);
   let interrupted = false;
   const onSigint = () => {

package/dist/index.js

@@ -20,12 +20,12 @@ import {
   saveDevState,
   sessionHasMeaningfulContent,
   setupProxy
-} from "./chunk-D5KUERWQ.js";
+} from "./chunk-MPMEYE43.js";
 import {
   getConfigDirUsage,
   listRecentCrashes,
   writeCrashLog
-} from "./chunk-G6LBSAVY.js";
+} from "./chunk-75YT3SZI.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   HALLUCINATION_CORRECTION_MESSAGE,
@@ -43,10 +43,10 @@ import {
   looksLikeDocumentBody,
   stripPseudoToolCalls,
   stripToolCallReminder
-} from "./chunk-ONOVJIL2.js";
+} from "./chunk-AIZOARZY.js";
 import {
   ConfigManager
-} from "./chunk-RCDS54ZC.js";
+} from "./chunk-MEM43AE7.js";
 import {
   ToolExecutor,
   ToolRegistry,
@@ -65,17 +65,17 @@ import {
   spawnAgentContext,
   theme,
   undoStack
-} from "./chunk-PCDBAZJK.js";
-import "./chunk-UQQJWHRV.js";
-import "./chunk-2DXY7UGF.js";
-import "./chunk-XYM3PCVR.js";
+} from "./chunk-WXVG56NI.js";
+import "./chunk-HDSKW7Q3.js";
+import "./chunk-ZWVIDFGY.js";
+import "./chunk-K76YV4EL.js";
 import {
   getStatsSnapshot,
   getTopFailingTools,
   getTopUsedTools,
   installFlushOnExit
-} from "./chunk-V6L44Y3F.js";
-import "./chunk-OWPFDHKC.js";
+} from "./chunk-YCF6S3P3.js";
+import "./chunk-NXXNLLSG.js";
 import {
   AuthError,
   ProviderError,
@@ -102,7 +102,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-QXRDETAI.js";
+} from "./chunk-ZQX2NCQK.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
@@ -118,7 +118,7 @@ import {
   getChatIndexStatus,
   scanString,
   searchChatMemory
-} from "./chunk-7ZJN4KLV.js";
+} from "./chunk-RXM76HB7.js";
 import "./chunk-KHYD3WXE.js";
 import "./chunk-VNNYHW6N.js";
 import "./chunk-OVWE4E46.js";
@@ -1769,7 +1769,7 @@ No tools match "${filter}".
           const { join: join6 } = await import("path");
           const { existsSync: existsSync6 } = await import("fs");
           const { getGitRoot: getGitRoot2 } = await import("./git-context-7KIP4X2V.js");
-          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-U2QQSUYK.js");
+          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-GRKJCSZF.js");
           const { approveProject, hashMcpFile } = await import("./project-trust-IFM7FXEV.js");
           const cwd = process.cwd();
           const projectRoot = getGitRoot2(cwd) ?? cwd;
@@ -2705,7 +2705,7 @@ ${hint}` : "")
         const root = process.cwd();
         const { loadIndex, clearIndex } = await import("./store-VMK543OQ.js");
         const { indexProject } = await import("./indexer-S6UMGQKA.js");
-        const { loadVectorStore, clearVectorStore } = await import("./vector-store-MCQ77OOJ.js");
+        const { loadVectorStore, clearVectorStore } = await import("./vector-store-Z5OF4WWJ.js");
         if (sub === "status") {
           const idx = loadIndex(root);
           const vec = loadVectorStore(root);
@@ -2764,7 +2764,7 @@ ${hint}` : "")
           }
           console.log(theme.dim(`  Building semantic index for ${idx.symbolCount} symbols\u2026`));
           console.log(theme.dim("  (First run downloads ~117 MB embedding model to ~/.aicli/models/)"));
-          const { rebuildSemanticIndex } = await import("./semantic-V37U4MCW.js");
+          const { rebuildSemanticIndex } = await import("./semantic-FKOEXY75.js");
           try {
             const stats = await rebuildSemanticIndex(root, {
               onProgress: (done, total) => {
@@ -2830,7 +2830,7 @@ ${hint}` : "")
       usage: "/test [command|filter]",
       async execute(args, ctx) {
         try {
-          const { executeTests } = await import("./run-tests-Q7COBDVK.js");
+          const { executeTests } = await import("./run-tests-HYELAYSL.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -5560,7 +5560,7 @@ Session '${this.resumeSessionId}' not found.
     })();
     void (async () => {
       try {
-        const { getChatIndexStatus: getChatIndexStatus2, buildChatIndex: buildChatIndex2 } = await import("./chat-index-JBF4ZIQI.js");
+        const { getChatIndexStatus: getChatIndexStatus2, buildChatIndex: buildChatIndex2 } = await import("./chat-index-LUQWWLKO.js");
         const initial = getChatIndexStatus2();
         this.chatMemoryStatus = {
           exists: initial.exists,
@@ -7530,11 +7530,11 @@ program.command("web").description("Start Web UI server with browser-based chat
     console.error("Error: Invalid port number. Must be between 1 and 65535.");
     process.exit(1);
   }
-  const { startWebServer } = await import("./server-5HDA5MNI.js");
+  const { startWebServer } = await import("./server-32HM2KMX.js");
   await startWebServer({ port, host: options.host });
 });
 program.command("user [action] [username]").description("Manage Web UI users (list | create <name> | delete <name> | reset-password <name> | logout-all <name> | migrate <name>)").action(async (action, username) => {
-  const { AuthManager } = await import("./auth-7KK5BOCA.js");
+  const { AuthManager } = await import("./auth-OI4YRVRG.js");
   const config = new ConfigManager();
   const auth = new AuthManager(config.getConfigDir());
   if (!action || action === "list") {
@@ -7697,12 +7697,12 @@ program.command("sessions").description("List recent conversation sessions").opt
   console.log(footer + "\n");
 });
 program.command("doctor").description("Health check: API keys, config, MCP, recent crashes, tool usage, disk usage").option("--json", "Output as JSON (for scripting)").option("--reset-stats", "Reset accumulated tool usage statistics").action(async (options) => {
-  const { runDoctorCli } = await import("./doctor-cli-5LFGU2TS.js");
+  const { runDoctorCli } = await import("./doctor-cli-R6ODVYFR.js");
   await runDoctorCli({ json: !!options.json, resetStats: !!options.resetStats });
 });
 program.command("batch <action> [arg] [arg2]").description("Anthropic Message Batches: submit | list | status <id> | results <id> [out] | cancel <id>").option("--dry-run", "Parse and validate input without submitting (submit only)").action(async (action, arg, arg2, options) => {
   try {
-    const batch = await import("./batch-KGBSTQU3.js");
+    const batch = await import("./batch-IPWV3DNK.js");
     switch (action) {
       case "submit":
         if (!arg) {
@@ -7745,7 +7745,7 @@ program.command("batch <action> [arg] [arg2]").description("Anthropic Message Ba
   }
 });
 program.command("mcp-serve").description("Start an MCP server over STDIO, exposing aicli's built-in tools to Claude Desktop / Cursor / other MCP clients").option("--allow-destructive", "Allow bash / run_interactive / task_create (always destructive in MCP mode)").option("--allow-outside-cwd", "Allow tool path arguments to escape the sandbox root \u2014 disabled by default").option("--tools <list>", "Comma-separated whitelist of tools to expose (default: all eligible tools)").option("--cwd <path>", "Working directory AND sandbox root (default: current directory)").action(async (options) => {
-  const { startMcpServer } = await import("./server-J2GQRZP3.js");
+  const { startMcpServer } = await import("./server-P7WY7VEX.js");
   await startMcpServer({
     allowDestructive: !!options.allowDestructive,
     allowOutsideCwd: !!options.allowOutsideCwd,
@@ -7754,7 +7754,7 @@ program.command("mcp-serve").description("Start an MCP server over STDIO, exposi
   });
 });
 program.command("ci").description("Headless PR review (code + security) \u2014 reads git/gh diff, optionally posts to PR. Designed for GitHub Actions.").option("--pr <num>", "PR number; diff fetched via `gh pr diff <num>`", (v) => parseInt(v, 10)).option("--base <ref>", "Base ref for `git diff <ref>...HEAD` (ignored when --pr set)").option("--post", "Post review as a PR comment (requires gh CLI + GH_TOKEN, needs --pr)").option("--no-update", "Always create a new comment instead of updating the previous aicli review").option("--skip-code", "Skip the code review section").option("--skip-security", "Skip the security review section").option("--detailed", "Use the detailed code-review prompt").option("--max-diff <n>", "Max diff chars sent to the model (default 30000)", (v) => parseInt(v, 10)).option("--provider <id>", "Override provider (default: config.defaultProvider)").option("--model <id>", "Override model").option("--dry-run", "Print result to stdout instead of posting (overrides --post)").action(async (options) => {
-  const { runCi } = await import("./ci-XHNSTENI.js");
+  const { runCi } = await import("./ci-YDMKYUQC.js");
   const result = await runCi({
     pr: options.pr,
     base: options.base,
@@ -7895,7 +7895,7 @@ program.command("hub [topic]").description("Start multi-agent hub (discuss / bra
     }),
     config.get("customProviders")
   );
-  const { startHub } = await import("./hub-OGEDS4X7.js");
+  const { startHub } = await import("./hub-3MKH3BMA.js");
   await startHub(
     {
       topic: topic ?? "",

package/dist/{run-tests-Q7COBDVK.js → run-tests-HYELAYSL.js}

@@ -2,8 +2,8 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-XYM3PCVR.js";
-import "./chunk-QXRDETAI.js";
+} from "./chunk-K76YV4EL.js";
+import "./chunk-ZQX2NCQK.js";
 import "./chunk-PDX44BCA.js";
 export {
   executeTests,

package/dist/{run-tests-YSHH37SS.js → run-tests-XWEHN7DF.js}

@@ -1,7 +1,7 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-TUGKYLIV.js";
+} from "./chunk-WCBVNY6D.js";
 import "./chunk-3RG5ZIWI.js";
 export {
   executeTests,

package/dist/{semantic-V37U4MCW.js → semantic-FKOEXY75.js}

@@ -5,8 +5,8 @@ import {
   pathTokens,
   rebuildSemanticIndex,
   semanticSearch
-} from "./chunk-UQQJWHRV.js";
-import "./chunk-2DXY7UGF.js";
+} from "./chunk-HDSKW7Q3.js";
+import "./chunk-ZWVIDFGY.js";
 import "./chunk-KHYD3WXE.js";
 import "./chunk-OVWE4E46.js";
 import "./chunk-PDX44BCA.js";

package/dist/{semantic-IJKF5ZZC.js → semantic-GJJWTI3A.js}

@@ -4,9 +4,9 @@ import {
   pathTokens,
   rebuildSemanticIndex,
   semanticSearch
-} from "./chunk-NKR53CPL.js";
+} from "./chunk-YKVFZLSI.js";
 import "./chunk-DQ2OHJNF.js";
-import "./chunk-PASCDYMH.js";
+import "./chunk-D6U75FHP.js";
 import "./chunk-JV5N65KN.js";
 import "./chunk-3RG5ZIWI.js";
 export {

package/dist/{server-5HDA5MNI.js → server-32HM2KMX.js}

@@ -2,7 +2,7 @@
 import {
   AuthManager,
   TOKEN_EXPIRY_MS
-} from "./chunk-O7NM4WTS.js";
+} from "./chunk-GXB7YKF2.js";
 import {
   McpManager,
   SessionManager,
@@ -14,7 +14,7 @@ import {
   loadDevState,
   persistToolRound,
   setupProxy
-} from "./chunk-D5KUERWQ.js";
+} from "./chunk-MPMEYE43.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   HALLUCINATION_CORRECTION_MESSAGE,
@@ -28,10 +28,10 @@ import {
   looksLikeDocumentBody,
   stripPseudoToolCalls,
   stripToolCallReminder
-} from "./chunk-ONOVJIL2.js";
+} from "./chunk-AIZOARZY.js";
 import {
   ConfigManager
-} from "./chunk-RCDS54ZC.js";
+} from "./chunk-MEM43AE7.js";
 import {
   ToolExecutor,
   ToolRegistry,
@@ -49,16 +49,16 @@ import {
   spawnAgentContext,
   truncateOutput,
   undoStack
-} from "./chunk-PCDBAZJK.js";
-import "./chunk-UQQJWHRV.js";
-import "./chunk-2DXY7UGF.js";
-import "./chunk-XYM3PCVR.js";
+} from "./chunk-WXVG56NI.js";
+import "./chunk-HDSKW7Q3.js";
+import "./chunk-ZWVIDFGY.js";
+import "./chunk-K76YV4EL.js";
 import {
   runTool
-} from "./chunk-V6L44Y3F.js";
+} from "./chunk-YCF6S3P3.js";
 import {
   getDangerLevel
-} from "./chunk-OWPFDHKC.js";
+} from "./chunk-NXXNLLSG.js";
 import "./chunk-2ZD3YTVM.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
@@ -78,14 +78,14 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-QXRDETAI.js";
+} from "./chunk-ZQX2NCQK.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
   getGitRoot
 } from "./chunk-HOSJZMQS.js";
 import "./chunk-4BKXL7SM.js";
-import "./chunk-7ZJN4KLV.js";
+import "./chunk-RXM76HB7.js";
 import "./chunk-KHYD3WXE.js";
 import "./chunk-VNNYHW6N.js";
 import "./chunk-OVWE4E46.js";
@@ -2226,7 +2226,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
         const root = process.cwd();
         const { loadIndex, clearIndex } = await import("./store-VMK543OQ.js");
         const { indexProject } = await import("./indexer-S6UMGQKA.js");
-        const { loadVectorStore, clearVectorStore } = await import("./vector-store-MCQ77OOJ.js");
+        const { loadVectorStore, clearVectorStore } = await import("./vector-store-Z5OF4WWJ.js");
         if (sub === "status") {
           const idx = loadIndex(root);
           const vec = loadVectorStore(root);
@@ -2275,7 +2275,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             message: `Building semantic index for ${idx.symbolCount} symbols\u2026 (first run downloads ~117 MB model)`
           });
           try {
-            const { rebuildSemanticIndex } = await import("./semantic-V37U4MCW.js");
+            const { rebuildSemanticIndex } = await import("./semantic-FKOEXY75.js");
             const stats = await rebuildSemanticIndex(root);
             const first = stats.modelFirstLoadMs ? ` (model load+first batch ${stats.modelFirstLoadMs}ms)` : "";
             this.send({
@@ -2462,7 +2462,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-Q7COBDVK.js");
+          const { executeTests } = await import("./run-tests-HYELAYSL.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -2986,7 +2986,7 @@ Add .md files to create commands.` });
       return;
     }
     try {
-      const { searchChatMemory, loadChatIndex } = await import("./chat-index-JBF4ZIQI.js");
+      const { searchChatMemory, loadChatIndex } = await import("./chat-index-LUQWWLKO.js");
       const loaded = loadChatIndex();
       if (!loaded || loaded.idx.chunks.length === 0) {
         this.send({ type: "memory_hits", query: q, hits: [], indexMissing: true });
@@ -3022,7 +3022,7 @@ Add .md files to create commands.` });
   }
   async handleMemoryStatus() {
     try {
-      const { getChatIndexStatus } = await import("./chat-index-JBF4ZIQI.js");
+      const { getChatIndexStatus } = await import("./chat-index-LUQWWLKO.js");
       const s = getChatIndexStatus();
       this.send({
         type: "memory_status",
@@ -3047,7 +3047,7 @@ Add .md files to create commands.` });
         type: "info",
         message: full ? "\u{1F9E0} Rebuilding chat memory index (this may take a while on first run \u2014 ~117 MB embedder)." : "\u{1F9E0} Refreshing chat memory index (incremental)\u2026"
       });
-      const { buildChatIndex } = await import("./chat-index-JBF4ZIQI.js");
+      const { buildChatIndex } = await import("./chat-index-LUQWWLKO.js");
       const stats = await buildChatIndex({
         full,
         onProgress: (p) => {