jinzd-ai-cli 0.4.150 → 0.4.153

package/dist/electron-server.js

@@ -36,20 +36,20 @@ import {
   VERSION,
   buildUserIdentityPrompt,
   runTestsTool
-} from "./chunk-TUGKYLIV.js";
+} from "./chunk-LJPB4ZER.js";
 import {
   hasSemanticIndex,
   semanticSearch
-} from "./chunk-NKR53CPL.js";
+} from "./chunk-YKVFZLSI.js";
 import {
   loadIndex
 } from "./chunk-DQ2OHJNF.js";
-import "./chunk-PASCDYMH.js";
+import "./chunk-D6U75FHP.js";
 import {
   loadChatIndex,
   redactJson,
   searchChatMemory
-} from "./chunk-WJ32NAW3.js";
+} from "./chunk-T5VKNPLD.js";
 import "./chunk-JV5N65KN.js";
 import "./chunk-3RG5ZIWI.js";
 
@@ -638,6 +638,7 @@ function getDangerLevel(toolName, args) {
     if (/\btee\b|\bcp\b|\bmv\b|\bln\s+-s/.test(cmd)) return "write";
     if (/\bchmod\b|\bchown\b/.test(cmd)) return "write";
     if (/\bSet-Content\b|\bOut-File\b|\bAdd-Content\b|\bCopy-Item\b|\bMove-Item\b|\bSet-ItemProperty\b|\bNew-ItemProperty\b/i.test(cmd)) return "write";
+    if (/\b(python3?|node|deno|bun|perl|ruby|php)\b[^\n]*?\s-(?:c|e|p|r)\b/i.test(cmd)) return "write";
     return "safe";
   }
   if (toolName === "write_file") return "write";
@@ -710,10 +711,10 @@ var ClaudeProvider = class extends BaseProvider {
     };
     const proxyUrl = options?.proxy;
     try {
-      const { Agent, ProxyAgent, fetch: undiciFetch } = await import("undici");
+      const { Agent: Agent2, ProxyAgent, fetch: undiciFetch } = await import("undici");
       const STREAM_BODY_TIMEOUT = 30 * 60 * 1e3;
       const STREAM_HEADERS_TIMEOUT = 5 * 60 * 1e3;
-      const dispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, bodyTimeout: STREAM_BODY_TIMEOUT, headersTimeout: STREAM_HEADERS_TIMEOUT }) : new Agent({ bodyTimeout: STREAM_BODY_TIMEOUT, headersTimeout: STREAM_HEADERS_TIMEOUT });
+      const dispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, bodyTimeout: STREAM_BODY_TIMEOUT, headersTimeout: STREAM_HEADERS_TIMEOUT }) : new Agent2({ bodyTimeout: STREAM_BODY_TIMEOUT, headersTimeout: STREAM_HEADERS_TIMEOUT });
       clientOptions.fetch = ((url, init) => undiciFetch(url, { ...init, dispatcher }));
     } catch {
     }
@@ -1575,14 +1576,14 @@ var OpenAICompatibleProvider = class extends BaseProvider {
     };
     const proxyUrl = options?.proxy;
     try {
-      const { Agent, ProxyAgent, fetch: undiciFetch } = await import("undici");
+      const { Agent: Agent2, ProxyAgent, fetch: undiciFetch } = await import("undici");
       const STREAM_BODY_TIMEOUT = 30 * 60 * 1e3;
       const STREAM_HEADERS_TIMEOUT = 5 * 60 * 1e3;
       const dispatcher = proxyUrl ? new ProxyAgent({
         uri: proxyUrl,
         bodyTimeout: STREAM_BODY_TIMEOUT,
         headersTimeout: STREAM_HEADERS_TIMEOUT
-      }) : new Agent({
+      }) : new Agent2({
         bodyTimeout: STREAM_BODY_TIMEOUT,
         headersTimeout: STREAM_HEADERS_TIMEOUT
       });
@@ -4987,7 +4988,7 @@ function checkPermission(toolName, args, dangerLevel, rules, defaultAction = "co
       if (rule.when.pathPattern) {
         if (toolName === "bash" && rule.action === "auto-approve") {
           const cmd = String(args["command"] ?? "").trim();
-          if (/[;&|`$<>]/.test(cmd) || /\$\(/.test(cmd)) continue;
+          if (/[;&|`$<>\n\r]/.test(cmd) || /\$\(/.test(cmd)) continue;
           if (!cmd.startsWith(rule.when.pathPattern)) continue;
         } else {
           const path3 = String(args["path"] ?? args["command"] ?? "");
@@ -7015,6 +7016,8 @@ ${stderr}`);
 
 // src/tools/builtin/web-fetch.ts
 import { promises as dnsPromises } from "dns";
+import net from "net";
+import { Agent } from "undici";
 function htmlToText(html) {
   let text = html.replace(/<script[\s\S]*?<\/script>/gi, "").replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<noscript[\s\S]*?<\/noscript>/gi, "").replace(/<svg[\s\S]*?<\/svg>/gi, "");
   const HTML_REGEX_LIMIT = 2e5;
@@ -7058,34 +7061,100 @@ function extractDescription(html) {
   return m ? m[1].trim() : "";
 }
 var MAX_OUTPUT = 16e3;
+function parseIpPart(s) {
+  if (/^0x[0-9a-f]+$/i.test(s)) return parseInt(s, 16);
+  if (/^0[0-7]+$/.test(s)) return parseInt(s, 8);
+  if (/^[1-9]\d*$/.test(s) || s === "0") return parseInt(s, 10);
+  return null;
+}
+function normalizeIpv4(h) {
+  const parts = h.split(".");
+  if (parts.length === 1) {
+    const n = parseIpPart(parts[0]);
+    if (n === null || n < 0 || n > 4294967295) return null;
+    return [n >>> 24 & 255, n >>> 16 & 255, n >>> 8 & 255, n & 255].join(".");
+  }
+  if (parts.length === 4) {
+    const nums = parts.map(parseIpPart);
+    if (nums.some((n) => n === null || n < 0 || n > 255)) return null;
+    return nums.join(".");
+  }
+  return null;
+}
+function isPrivateIpv4(ip) {
+  const m = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!m) return false;
+  const [o1, o2] = [Number(m[1]), Number(m[2])];
+  if (o1 === 127) return true;
+  if (o1 === 10) return true;
+  if (o1 === 172 && o2 >= 16 && o2 <= 31) return true;
+  if (o1 === 192 && o2 === 168) return true;
+  if (o1 === 169 && o2 === 254) return true;
+  if (o1 === 0) return true;
+  if (o1 >= 224) return true;
+  return false;
+}
+function isPrivateIpv6(ip) {
+  const h = ip.toLowerCase().replace(/%.*$/, "");
+  if (h === "::1" || h === "::") return true;
+  const first = h.split(":")[0] ?? "";
+  if (/^f[cd]/.test(first)) return true;
+  if (/^fe[89ab]/.test(first)) return true;
+  const mapped = h.match(/::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (mapped) return isPrivateIpv4(mapped[1]);
+  const mappedHex = h.match(/::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (mappedHex) {
+    const hi = parseInt(mappedHex[1], 16), lo = parseInt(mappedHex[2], 16);
+    const v4 = [hi >> 8 & 255, hi & 255, lo >> 8 & 255, lo & 255].join(".");
+    return isPrivateIpv4(v4);
+  }
+  return false;
+}
+function isPrivateAddr(ip) {
+  if (net.isIPv4(ip)) return isPrivateIpv4(ip);
+  if (net.isIPv6(ip)) return isPrivateIpv6(ip);
+  return false;
+}
 function isPrivateHost(hostname) {
   const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (h === "localhost" || h === "0.0.0.0" || h === "::1") return true;
-  if (h.startsWith("fe80:")) return true;
-  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (m) {
-    const [o1, o2] = [Number(m[1]), Number(m[2])];
-    if (o1 === 127) return true;
-    if (o1 === 10) return true;
-    if (o1 === 172 && o2 >= 16 && o2 <= 31) return true;
-    if (o1 === 192 && o2 === 168) return true;
-    if (o1 === 169 && o2 === 254) return true;
-    if (o1 === 0) return true;
-  }
+  if (h === "localhost" || h === "") return true;
+  const v4 = normalizeIpv4(h);
+  if (v4) return isPrivateIpv4(v4);
+  if (net.isIPv6(h)) return isPrivateIpv6(h);
   return false;
 }
 async function resolveAndCheck(hostname) {
   const h = hostname.replace(/^\[|\]$/g, "");
-  if (/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h) || h.includes(":")) return;
+  if (net.isIP(h) !== 0 || normalizeIpv4(h)) return;
   try {
-    const { address } = await dnsPromises.lookup(h);
-    if (isPrivateHost(address)) {
-      throw new NetworkError(`Blocked: "${hostname}" resolves to private address ${address}. web_fetch is restricted to public URLs.`);
+    const addrs = await dnsPromises.lookup(h, { all: true, verbatim: true });
+    for (const { address } of addrs) {
+      if (isPrivateAddr(address)) {
+        throw new NetworkError(`Blocked: "${hostname}" resolves to private address ${address}. web_fetch is restricted to public URLs.`);
+      }
     }
   } catch (e) {
     if (e.message.startsWith("Blocked:")) throw e;
   }
 }
+function ssrfSafeDispatcher() {
+  return new Agent({
+    connect: {
+      lookup: (hostname, options, cb) => {
+        dnsPromises.lookup(hostname, { all: true, verbatim: true }).then((addrs) => {
+          for (const a of addrs) {
+            if (isPrivateAddr(a.address)) {
+              cb(new NetworkError(`Blocked: "${hostname}" resolves to private address ${a.address}.`), null);
+              return;
+            }
+          }
+          if (options && options.all) cb(null, addrs);
+          else cb(null, addrs[0].address, addrs[0].family);
+        }).catch((err) => cb(err, null));
+      }
+    }
+  });
+}
 var webFetchTool = {
   definition: {
     name: "web_fetch",
@@ -7130,6 +7199,7 @@ var webFetchTool = {
       Accept: "text/html,application/xhtml+xml,text/plain,*/*",
       "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8"
     };
+    const dispatcher = ssrfSafeDispatcher();
     try {
       let currentUrl = url;
       let resp = null;
@@ -7142,8 +7212,9 @@ var webFetchTool = {
         const r = await fetch(currentUrl, {
           signal: controller2.signal,
           headers: FETCH_HEADERS,
-          redirect: "manual"
+          redirect: "manual",
           // 手动控制重定向
+          dispatcher
         });
         if (r.status >= 300 && r.status < 400) {
           if (hop >= MAX_REDIRECTS) {
@@ -7174,7 +7245,12 @@ var webFetchTool = {
       if (err.name === "AbortError") {
         throw new NetworkError(`Request timed out after 20s: ${url}`, void 0, err);
       }
+      const cause = err.cause;
+      if (cause?.message?.startsWith("Blocked:")) throw new NetworkError(cause.message);
       throw err;
+    } finally {
+      void dispatcher.close().catch(() => {
+      });
     }
     let text;
     if (contentType.includes("text/plain") || contentType.includes("application/json")) {
@@ -12403,7 +12479,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
         const root = process.cwd();
         const { loadIndex: loadIndex2, clearIndex } = await import("./store-A3TZM6PS.js");
         const { indexProject: indexProject2 } = await import("./indexer-ISSNIFQY.js");
-        const { loadVectorStore, clearVectorStore } = await import("./vector-store-AK6J3RIA.js");
+        const { loadVectorStore, clearVectorStore } = await import("./vector-store-PLDSXF3V.js");
         if (sub === "status") {
           const idx = loadIndex2(root);
           const vec = loadVectorStore(root);
@@ -12452,7 +12528,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             message: `Building semantic index for ${idx.symbolCount} symbols\u2026 (first run downloads ~117 MB model)`
           });
           try {
-            const { rebuildSemanticIndex } = await import("./semantic-IJKF5ZZC.js");
+            const { rebuildSemanticIndex } = await import("./semantic-GJJWTI3A.js");
             const stats = await rebuildSemanticIndex(root);
             const first = stats.modelFirstLoadMs ? ` (model load+first batch ${stats.modelFirstLoadMs}ms)` : "";
             this.send({
@@ -12639,7 +12715,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-YSHH37SS.js");
+          const { executeTests } = await import("./run-tests-DCT5LWBB.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -13163,7 +13239,7 @@ Add .md files to create commands.` });
       return;
     }
     try {
-      const { searchChatMemory: searchChatMemory2, loadChatIndex: loadChatIndex2 } = await import("./chat-index-MY3DJTV3.js");
+      const { searchChatMemory: searchChatMemory2, loadChatIndex: loadChatIndex2 } = await import("./chat-index-BE4TPLFH.js");
       const loaded = loadChatIndex2();
       if (!loaded || loaded.idx.chunks.length === 0) {
         this.send({ type: "memory_hits", query: q, hits: [], indexMissing: true });
@@ -13199,7 +13275,7 @@ Add .md files to create commands.` });
   }
   async handleMemoryStatus() {
     try {
-      const { getChatIndexStatus } = await import("./chat-index-MY3DJTV3.js");
+      const { getChatIndexStatus } = await import("./chat-index-BE4TPLFH.js");
       const s = getChatIndexStatus();
       this.send({
         type: "memory_status",
@@ -13224,7 +13300,7 @@ Add .md files to create commands.` });
         type: "info",
         message: full ? "\u{1F9E0} Rebuilding chat memory index (this may take a while on first run \u2014 ~117 MB embedder)." : "\u{1F9E0} Refreshing chat memory index (incremental)\u2026"
       });
-      const { buildChatIndex } = await import("./chat-index-MY3DJTV3.js");
+      const { buildChatIndex } = await import("./chat-index-BE4TPLFH.js");
       const stats = await buildChatIndex({
         full,
         onProgress: (p) => {
@@ -13751,7 +13827,9 @@ var AuthManager = class {
       if (parts.length !== 2) return null;
       const [payloadB64, signature] = parts;
       const expectedSig = this.sign(payloadB64);
-      if (signature !== expectedSig) return null;
+      const sigBuf = Buffer.from(signature ?? "", "utf-8");
+      const expBuf = Buffer.from(expectedSig, "utf-8");
+      if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) return null;
       const payload = JSON.parse(
         Buffer.from(payloadB64, "base64url").toString("utf-8")
       );
@@ -13950,8 +14028,9 @@ async function startWebServer(options = {}) {
   }
   console.log(`   Providers: ${availableProviders.map((p) => p.info.id).join(", ")}`);
   let mcpManager = null;
-  const globalMcpServers = config.get("mcpServers") ?? {};
-  const projectMcpResolved = resolveProjectMcpPath();
+  const mcpEnabled = config.get("mcpEnabled") !== false;
+  const globalMcpServers = mcpEnabled ? config.get("mcpServers") ?? {} : {};
+  const projectMcpResolved = mcpEnabled ? resolveProjectMcpPath() : null;
   let projectMcpServers = {};
   if (projectMcpResolved) {
     const { checkTrust } = await import("./project-trust-EBGHD7LE.js");
@@ -13964,7 +14043,10 @@ async function startWebServer(options = {}) {
     }
   }
   const mergedMcpServers = { ...globalMcpServers, ...projectMcpServers };
-  if (Object.keys(mergedMcpServers).length > 0) {
+  if (!mcpEnabled) {
+    console.log("   \u{1F50C} MCP: disabled (config.mcpEnabled=false)");
+  }
+  if (mcpEnabled && Object.keys(mergedMcpServers).length > 0) {
     mcpManager = new McpManager();
     await mcpManager.connectAll(mergedMcpServers);
     const mcpTools = mcpManager.getAllTools();
@@ -14448,9 +14530,9 @@ async function startWebServer(options = {}) {
           try {
             const nets = networkInterfaces();
             for (const name of Object.keys(nets)) {
-              for (const net of nets[name] ?? []) {
-                if (net.family === "IPv4" && !net.internal) {
-                  console.log(`   \u{1F4F1} LAN access: http://${net.address}:${actualPort}`);
+              for (const net2 of nets[name] ?? []) {
+                if (net2.family === "IPv4" && !net2.internal) {
+                  console.log(`   \u{1F4F1} LAN access: http://${net2.address}:${actualPort}`);
                 }
               }
             }

package/dist/{hub-OGEDS4X7.js → hub-MDQNJOMV.js}

@@ -4,7 +4,7 @@ import {
   assignRoleColors,
   renderHubBanner,
   renderHubEvent
-} from "./chunk-YJ2CUK5O.js";
+} from "./chunk-M4GJOBWN.js";
 import "./chunk-PDX44BCA.js";
 
 // src/hub/discuss.ts
@@ -272,6 +272,49 @@ function listPresets() {
   return PRESETS;
 }
 
+// src/hub/resolve-providers.ts
+function resolveRoleProviders(roles, lookup, defaultProvider, defaultModel, available, mix) {
+  const warnings = [];
+  let pool = null;
+  if (mix !== void 0 && mix !== false) {
+    if (typeof mix === "string" && mix.trim().length > 0) {
+      const requested = mix.split(",").map((s) => s.trim()).filter(Boolean);
+      pool = [];
+      for (const id of requested) {
+        if (lookup.has(id)) pool.push(id);
+        else warnings.push(`--mix: provider "${id}" not configured \u2014 skipped.`);
+      }
+    } else {
+      pool = [...available];
+    }
+    if (pool.length === 0) {
+      warnings.push(`--mix: no usable providers \u2014 all roles fall back to "${defaultProvider}".`);
+      pool = [defaultProvider];
+    }
+  }
+  const providerDefaultModel = (pid) => pid === defaultProvider ? defaultModel : lookup.defaultModelFor(pid) ?? defaultModel;
+  const assignments = [];
+  const outRoles = roles.map((role, i) => {
+    const desired = pool ? pool[i % pool.length] : role.provider;
+    let providerId;
+    let fellBack = false;
+    if (desired && lookup.has(desired)) {
+      providerId = desired;
+    } else {
+      if (desired && !lookup.has(desired)) {
+        warnings.push(`role "${role.id}": provider "${desired}" not available \u2014 using "${defaultProvider}".`);
+        fellBack = true;
+      }
+      providerId = defaultProvider;
+    }
+    const explicitProvider = role.provider ?? defaultProvider;
+    const modelId = !pool && role.model && explicitProvider === providerId ? role.model : providerDefaultModel(providerId);
+    assignments.push({ roleId: role.id, roleName: role.name, providerId, modelId, fellBack });
+    return { ...role, provider: providerId, model: modelId };
+  });
+  return { roles: outRoles, assignments, warnings };
+}
+
 // src/hub/index.ts
 import { readFileSync, existsSync } from "fs";
 import chalk from "chalk";
@@ -363,6 +406,21 @@ ${content}`);
     }
     context = parts.join("\n\n---\n\n");
   }
+  {
+    const resolution = resolveRoleProviders(
+      roles,
+      {
+        has: (id) => providers.has(id),
+        defaultModelFor: (id) => providers.has(id) ? providers.get(id).info.defaultModel : void 0
+      },
+      defaultProvider,
+      defaultModel,
+      providers.listAvailable().map((p) => p.info.id),
+      options.mix
+    );
+    roles = resolution.roles;
+    for (const w of resolution.warnings) console.error(chalk.yellow(`  \u26A0 ${w}`));
+  }
   const mode = options.mode ?? "discuss";
   const config = {
     mode,
@@ -386,7 +444,7 @@ ${content}`);
   }
 }
 async function runTaskMode(config, providers, configManager, topic) {
-  const { TaskOrchestrator } = await import("./task-orchestrator-XBPAOLYD.js");
+  const { TaskOrchestrator } = await import("./task-orchestrator-BGQBNKAI.js");
   const orchestrator = new TaskOrchestrator(config, providers, configManager);
   let interrupted = false;
   const onSigint = () => {
@@ -422,7 +480,7 @@ async function runTaskMode(config, providers, configManager, topic) {
   }
 }
 async function runDistributedDiscussion(config, providers, topic, port) {
-  const { HubServer } = await import("./hub-server-AUMVPNU6.js");
+  const { HubServer } = await import("./hub-server-VPXCBWLA.js");
   const hub = new HubServer(config, providers, port);
   let interrupted = false;
   const onSigint = () => {

package/dist/{hub-server-AUMVPNU6.js → hub-server-VPXCBWLA.js}

@@ -11,7 +11,7 @@ import {
   renderRoundHeader,
   renderSummary,
   renderUserInterrupt
-} from "./chunk-YJ2CUK5O.js";
+} from "./chunk-M4GJOBWN.js";
 import "./chunk-PDX44BCA.js";
 
 // src/hub/hub-server.ts

package/dist/index.js

@@ -20,12 +20,12 @@ import {
   saveDevState,
   sessionHasMeaningfulContent,
   setupProxy
-} from "./chunk-D5KUERWQ.js";
+} from "./chunk-EIIMBVXN.js";
 import {
   getConfigDirUsage,
   listRecentCrashes,
   writeCrashLog
-} from "./chunk-G6LBSAVY.js";
+} from "./chunk-TURORFH2.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   HALLUCINATION_CORRECTION_MESSAGE,
@@ -43,10 +43,10 @@ import {
   looksLikeDocumentBody,
   stripPseudoToolCalls,
   stripToolCallReminder
-} from "./chunk-ONOVJIL2.js";
+} from "./chunk-AIZOARZY.js";
 import {
   ConfigManager
-} from "./chunk-RCDS54ZC.js";
+} from "./chunk-UWW3EWER.js";
 import {
   ToolExecutor,
   ToolRegistry,
@@ -65,17 +65,17 @@ import {
   spawnAgentContext,
   theme,
   undoStack
-} from "./chunk-PCDBAZJK.js";
-import "./chunk-UQQJWHRV.js";
-import "./chunk-2DXY7UGF.js";
-import "./chunk-XYM3PCVR.js";
+} from "./chunk-OP3I24WL.js";
+import "./chunk-HDSKW7Q3.js";
+import "./chunk-ZWVIDFGY.js";
+import "./chunk-OT2HLGSO.js";
 import {
   getStatsSnapshot,
   getTopFailingTools,
   getTopUsedTools,
   installFlushOnExit
-} from "./chunk-V6L44Y3F.js";
-import "./chunk-OWPFDHKC.js";
+} from "./chunk-EYJQJZJ6.js";
+import "./chunk-NXXNLLSG.js";
 import {
   AuthError,
   ProviderError,
@@ -102,7 +102,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-QXRDETAI.js";
+} from "./chunk-D62BVFP7.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
@@ -118,7 +118,7 @@ import {
   getChatIndexStatus,
   scanString,
   searchChatMemory
-} from "./chunk-7ZJN4KLV.js";
+} from "./chunk-RXM76HB7.js";
 import "./chunk-KHYD3WXE.js";
 import "./chunk-VNNYHW6N.js";
 import "./chunk-OVWE4E46.js";
@@ -1769,7 +1769,7 @@ No tools match "${filter}".
           const { join: join6 } = await import("path");
           const { existsSync: existsSync6 } = await import("fs");
           const { getGitRoot: getGitRoot2 } = await import("./git-context-7KIP4X2V.js");
-          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-U2QQSUYK.js");
+          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-43EVHE2E.js");
           const { approveProject, hashMcpFile } = await import("./project-trust-IFM7FXEV.js");
           const cwd = process.cwd();
           const projectRoot = getGitRoot2(cwd) ?? cwd;
@@ -2705,7 +2705,7 @@ ${hint}` : "")
         const root = process.cwd();
         const { loadIndex, clearIndex } = await import("./store-VMK543OQ.js");
         const { indexProject } = await import("./indexer-S6UMGQKA.js");
-        const { loadVectorStore, clearVectorStore } = await import("./vector-store-MCQ77OOJ.js");
+        const { loadVectorStore, clearVectorStore } = await import("./vector-store-Z5OF4WWJ.js");
         if (sub === "status") {
           const idx = loadIndex(root);
           const vec = loadVectorStore(root);
@@ -2764,7 +2764,7 @@ ${hint}` : "")
           }
           console.log(theme.dim(`  Building semantic index for ${idx.symbolCount} symbols\u2026`));
           console.log(theme.dim("  (First run downloads ~117 MB embedding model to ~/.aicli/models/)"));
-          const { rebuildSemanticIndex } = await import("./semantic-V37U4MCW.js");
+          const { rebuildSemanticIndex } = await import("./semantic-FKOEXY75.js");
           try {
             const stats = await rebuildSemanticIndex(root, {
               onProgress: (done, total) => {
@@ -2830,7 +2830,7 @@ ${hint}` : "")
       usage: "/test [command|filter]",
       async execute(args, ctx) {
         try {
-          const { executeTests } = await import("./run-tests-Q7COBDVK.js");
+          const { executeTests } = await import("./run-tests-EYZ2JZ4X.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -5560,7 +5560,7 @@ Session '${this.resumeSessionId}' not found.
     })();
     void (async () => {
       try {
-        const { getChatIndexStatus: getChatIndexStatus2, buildChatIndex: buildChatIndex2 } = await import("./chat-index-JBF4ZIQI.js");
+        const { getChatIndexStatus: getChatIndexStatus2, buildChatIndex: buildChatIndex2 } = await import("./chat-index-LUQWWLKO.js");
         const initial = getChatIndexStatus2();
         this.chatMemoryStatus = {
           exists: initial.exists,
@@ -7530,11 +7530,11 @@ program.command("web").description("Start Web UI server with browser-based chat
     console.error("Error: Invalid port number. Must be between 1 and 65535.");
     process.exit(1);
   }
-  const { startWebServer } = await import("./server-5HDA5MNI.js");
+  const { startWebServer } = await import("./server-OIYBFKS2.js");
   await startWebServer({ port, host: options.host });
 });
 program.command("user [action] [username]").description("Manage Web UI users (list | create <name> | delete <name> | reset-password <name> | logout-all <name> | migrate <name>)").action(async (action, username) => {
-  const { AuthManager } = await import("./auth-7KK5BOCA.js");
+  const { AuthManager } = await import("./auth-OI4YRVRG.js");
   const config = new ConfigManager();
   const auth = new AuthManager(config.getConfigDir());
   if (!action || action === "list") {
@@ -7697,12 +7697,12 @@ program.command("sessions").description("List recent conversation sessions").opt
   console.log(footer + "\n");
 });
 program.command("doctor").description("Health check: API keys, config, MCP, recent crashes, tool usage, disk usage").option("--json", "Output as JSON (for scripting)").option("--reset-stats", "Reset accumulated tool usage statistics").action(async (options) => {
-  const { runDoctorCli } = await import("./doctor-cli-5LFGU2TS.js");
+  const { runDoctorCli } = await import("./doctor-cli-ZT674MCQ.js");
   await runDoctorCli({ json: !!options.json, resetStats: !!options.resetStats });
 });
 program.command("batch <action> [arg] [arg2]").description("Anthropic Message Batches: submit | list | status <id> | results <id> [out] | cancel <id>").option("--dry-run", "Parse and validate input without submitting (submit only)").action(async (action, arg, arg2, options) => {
   try {
-    const batch = await import("./batch-KGBSTQU3.js");
+    const batch = await import("./batch-DBRN4MCC.js");
     switch (action) {
       case "submit":
         if (!arg) {
@@ -7745,7 +7745,7 @@ program.command("batch <action> [arg] [arg2]").description("Anthropic Message Ba
   }
 });
 program.command("mcp-serve").description("Start an MCP server over STDIO, exposing aicli's built-in tools to Claude Desktop / Cursor / other MCP clients").option("--allow-destructive", "Allow bash / run_interactive / task_create (always destructive in MCP mode)").option("--allow-outside-cwd", "Allow tool path arguments to escape the sandbox root \u2014 disabled by default").option("--tools <list>", "Comma-separated whitelist of tools to expose (default: all eligible tools)").option("--cwd <path>", "Working directory AND sandbox root (default: current directory)").action(async (options) => {
-  const { startMcpServer } = await import("./server-J2GQRZP3.js");
+  const { startMcpServer } = await import("./server-MQWFO2GJ.js");
   await startMcpServer({
     allowDestructive: !!options.allowDestructive,
     allowOutsideCwd: !!options.allowOutsideCwd,
@@ -7754,7 +7754,7 @@ program.command("mcp-serve").description("Start an MCP server over STDIO, exposi
   });
 });
 program.command("ci").description("Headless PR review (code + security) \u2014 reads git/gh diff, optionally posts to PR. Designed for GitHub Actions.").option("--pr <num>", "PR number; diff fetched via `gh pr diff <num>`", (v) => parseInt(v, 10)).option("--base <ref>", "Base ref for `git diff <ref>...HEAD` (ignored when --pr set)").option("--post", "Post review as a PR comment (requires gh CLI + GH_TOKEN, needs --pr)").option("--no-update", "Always create a new comment instead of updating the previous aicli review").option("--skip-code", "Skip the code review section").option("--skip-security", "Skip the security review section").option("--detailed", "Use the detailed code-review prompt").option("--max-diff <n>", "Max diff chars sent to the model (default 30000)", (v) => parseInt(v, 10)).option("--provider <id>", "Override provider (default: config.defaultProvider)").option("--model <id>", "Override model").option("--dry-run", "Print result to stdout instead of posting (overrides --post)").action(async (options) => {
-  const { runCi } = await import("./ci-XHNSTENI.js");
+  const { runCi } = await import("./ci-UEEUSELV.js");
   const result = await runCi({
     pr: options.pr,
     base: options.base,
@@ -7827,6 +7827,7 @@ program.command("help").description("Show a comprehensive guide to all aicli fea
     `${B}${C}  \u25A0 MULTI-AGENT HUB${R}`,
     `    ${Y}--preset <name>${R}                Role preset (tech-review/brainstorm/code-review/debate)`,
     `    ${Y}--roles <file>${R}                 Custom roles JSON file`,
+    `    ${Y}--mix [providers]${R}              Mixed multi-model: spread providers across roles (e.g. claude,openai,deepseek)`,
     `    ${Y}-c, --context <file>${R}           Inject context doc (repeatable: -c a.md -c b.md)`,
     `    ${Y}--task${R}                         Task mode: agents plan & write code with tools`,
     `    ${Y}--distributed${R}                  Distributed mode (WebSocket, multi-process)`,
@@ -7872,7 +7873,7 @@ program.command("help").description("Show a comprehensive guide to all aicli fea
     `    ${G}aicli --provider claude -m claude-sonnet-4-20250514${R}  ${D}# specific model${R}`,
     `    ${G}aicli -p "explain this" < main.py${R}              ${D}# headless + file${R}`,
     `    ${G}aicli web --host 0.0.0.0${R}                       ${D}# Web UI on LAN${R}`,
-    `    ${G}aicli hub --preset brainstorm "idea"${R}            ${D}# multi-agent brainstorm${R}`,
+    `    ${G}aicli hub --preset brainstorm --mix "idea"${R}      ${D}# brainstorm across Claude/GPT/DeepSeek${R}`,
     `    ${G}aicli hub --task --roles team.json "build app"${R}  ${D}# task mode: agents write code${R}`,
     `    ${G}aicli hub -c spec.md -c api.md "build it"${R}       ${D}# hub + docs context${R}`,
     `    ${G}aicli batch submit prompts.jsonl${R}                ${D}# Anthropic batch: 50% off, 24h window${R}`,
@@ -7884,7 +7885,7 @@ program.command("help").description("Show a comprehensive guide to all aicli fea
   ];
   console.log(lines.join("\n"));
 });
-program.command("hub [topic]").description("Start multi-agent hub (discuss / brainstorm with multiple AI roles)").option("--preset <name>", "Use a built-in role preset (default: tech-review)").option("--roles <file>", "Load roles from a JSON file").option("--provider <name>", "Override default AI provider").option("-m, --model <name>", "Override default model").option("--max-rounds <n>", "Max discussion rounds (default: 10)").option("--presets", "List available role presets").option("--task", "Task mode: plan \u2192 approve \uFFFD\uFFFD execute with tools (agents write code)").option("--task-rounds <n>", "Max tool-call rounds per task (default: 30)").option("-c, --context <file>", "Inject context document (repeatable: -c a.md -c b.md)", (val, prev) => prev.concat(val), []).option("--distributed", "Start WebSocket server so remote aicli instances can join as agents").option("--port <n>", "WebSocket port for distributed mode (default: 9527)", "9527").action(async (topic, options) => {
+program.command("hub [topic]").description("Start multi-agent hub (discuss / brainstorm with multiple AI roles)").option("--preset <name>", "Use a built-in role preset (default: tech-review)").option("--roles <file>", "Load roles from a JSON file").option("--provider <name>", "Override default AI provider").option("-m, --model <name>", "Override default model").option("--mix [providers]", "Mixed multi-model: spread configured providers across roles (or --mix claude,openai,deepseek)").option("--max-rounds <n>", "Max discussion rounds (default: 10)").option("--presets", "List available role presets").option("--task", "Task mode: plan \u2192 approve \uFFFD\uFFFD execute with tools (agents write code)").option("--task-rounds <n>", "Max tool-call rounds per task (default: 30)").option("-c, --context <file>", "Inject context document (repeatable: -c a.md -c b.md)", (val, prev) => prev.concat(val), []).option("--distributed", "Start WebSocket server so remote aicli instances can join as agents").option("--port <n>", "WebSocket port for distributed mode (default: 9527)", "9527").action(async (topic, options) => {
   const config = new ConfigManager();
   const registry = new ProviderRegistry();
   await registry.initialize(
@@ -7895,7 +7896,7 @@ program.command("hub [topic]").description("Start multi-agent hub (discuss / bra
     }),
     config.get("customProviders")
   );
-  const { startHub } = await import("./hub-OGEDS4X7.js");
+  const { startHub } = await import("./hub-MDQNJOMV.js");
   await startHub(
     {
       topic: topic ?? "",
@@ -7903,6 +7904,7 @@ program.command("hub [topic]").description("Start multi-agent hub (discuss / bra
       rolesFile: options.roles,
       provider: options.provider,
       model: options.model,
+      mix: options.mix,
       mode: options.task === true ? "task" : void 0,
       maxRounds: options.maxRounds ? parseInt(options.maxRounds, 10) : void 0,
       listPresets: options.presets === true,

package/dist/{run-tests-YSHH37SS.js → run-tests-DCT5LWBB.js}

@@ -1,7 +1,7 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-TUGKYLIV.js";
+} from "./chunk-LJPB4ZER.js";
 import "./chunk-3RG5ZIWI.js";
 export {
   executeTests,

package/dist/{run-tests-Q7COBDVK.js → run-tests-EYZ2JZ4X.js}

@@ -2,8 +2,8 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-XYM3PCVR.js";
-import "./chunk-QXRDETAI.js";
+} from "./chunk-OT2HLGSO.js";
+import "./chunk-D62BVFP7.js";
 import "./chunk-PDX44BCA.js";
 export {
   executeTests,