jinzd-ai-cli 0.4.204 → 0.4.206

package/README.md

@@ -100,7 +100,7 @@ Use `@filepath` to reference files or images directly in your prompt.
 ### Web UI
 
 ```bash
-aicli web                    # Start on localhost:3456
+aicli web                    # Start on localhost:3000
 aicli web --port 8080        # Custom port
 aicli web --host 0.0.0.0    # LAN access (shows QR-friendly URL)
 ```

package/dist/{batch-ZP52GVVD.js → batch-6PORMJWT.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   ConfigManager
-} from "./chunk-BENRC3OO.js";
+} from "./chunk-TW47X5AO.js";
 import "./chunk-TZQHYZKT.js";
-import "./chunk-SCQOEDVL.js";
+import "./chunk-QNUVZO5X.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-JLZ5QA2I.js → chunk-2WV6AGHM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CONFIG_DIR_NAME
-} from "./chunk-SCQOEDVL.js";
+} from "./chunk-QNUVZO5X.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-26YWVRLT.js → chunk-BQIV4ZQT.js}

@@ -6,7 +6,7 @@ import { platform } from "os";
 import chalk from "chalk";
 
 // src/core/constants.ts
-var VERSION = "0.4.204";
+var VERSION = "0.4.206";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-T5RTPF2Q.js → chunk-KJHMRAJU.js}

@@ -2,7 +2,7 @@
 import {
   CONFIG_DIR_NAME,
   VERSION
-} from "./chunk-SCQOEDVL.js";
+} from "./chunk-QNUVZO5X.js";
 
 // src/diagnostics/crash-log.ts
 import {

package/dist/{chunk-PIZWD5JN.js → chunk-KOU4KX7J.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   truncateForPersist
-} from "./chunk-B75A6AG4.js";
+} from "./chunk-QQYSZMET.js";
 import {
   APP_NAME,
   CONFIG_DIR_NAME,
@@ -11,7 +11,7 @@ import {
   MCP_PROTOCOL_VERSION,
   MCP_TOOL_PREFIX,
   VERSION
-} from "./chunk-SCQOEDVL.js";
+} from "./chunk-QNUVZO5X.js";
 
 // src/mcp/client.ts
 import { spawn } from "child_process";

package/dist/{chunk-UZISJ3KZ.js → chunk-QMXC327F.js}

@@ -3,7 +3,7 @@ import {
   detectsHallucinatedFileOp,
   repairToolCallArguments,
   schemaToJsonSchema
-} from "./chunk-SMFRJCXB.js";
+} from "./chunk-XPBEJB27.js";
 import {
   AuthError,
   ProviderError,
@@ -31,8 +31,8 @@ var BaseProvider = class {
    * 将 Message[] 转换为 OpenAI API 格式的消息数组。
    * content 为 string 时直接传递；为 MessageContentPart[] 时保留数组格式（vision 请求）。
    *
-   * 自动跳过 role='tool' 和带 toolCalls 的 assistant 消息——
-   * 这些是 v0.4.60+ 持久化的工具历史，由 _extraMessages 机制单独注入。
+   * 基类只提供降级格式：跳过 role='tool' 和带 toolCalls 的 assistant 消息。
+   * 需要完整工具历史 roundtrip 的 provider 应覆盖消息构造逻辑，例如 OpenAI-compatible provider。
    */
   normalizeMessages(messages) {
     return messages.filter((m) => m.role !== "tool" && !m.toolCalls).map((m) => ({ role: m.role, content: m.content }));

package/dist/{chunk-SCQOEDVL.js → chunk-QNUVZO5X.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/core/constants.ts
-var VERSION = "0.4.204";
+var VERSION = "0.4.206";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-B75A6AG4.js → chunk-QQYSZMET.js}

@@ -5,15 +5,15 @@ import {
 } from "./chunk-T2NL5ZIA.js";
 import {
   runTestsTool
-} from "./chunk-GYN2PTY2.js";
+} from "./chunk-SFCNFX42.js";
 import {
   runTool
-} from "./chunk-JLZ5QA2I.js";
+} from "./chunk-2WV6AGHM.js";
 import {
   getDangerLevel,
   isFileWriteTool,
   runLeanAgentLoop
-} from "./chunk-SMFRJCXB.js";
+} from "./chunk-XPBEJB27.js";
 import {
   EnvLoader,
   NetworkError,
@@ -26,7 +26,7 @@ import {
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-SCQOEDVL.js";
+} from "./chunk-QNUVZO5X.js";
 import {
   fileCheckpoints
 } from "./chunk-4BKXL7SM.js";
@@ -40,11 +40,14 @@ import {
 import {
   loadIndex
 } from "./chunk-CKH4KQ4E.js";
+import {
+  atomicWriteFileSync
+} from "./chunk-IW3Q7AE5.js";
 
 // src/tools/builtin/bash.ts
 import { spawn } from "child_process";
 import { existsSync as existsSync2, readdirSync, statSync } from "fs";
-import { platform } from "os";
+import { platform as platform2 } from "os";
 import { resolve } from "path";
 
 // src/tools/undo-stack.ts
@@ -196,9 +199,32 @@ function runWithSessionKey(sessionKey, fn) {
   return als.run({ sessionKey: key }, fn);
 }
 
-// src/tools/builtin/bash.ts
+// src/tools/win-shell.ts
+import { platform } from "os";
 var IS_WINDOWS = platform() === "win32";
-var SHELL = IS_WINDOWS ? "powershell.exe" : process.env["SHELL"] ?? "/bin/bash";
+var WIN_UTF8_PREAMBLE = "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; $OutputEncoding = [System.Text.Encoding]::UTF8; ";
+function shellInvocation(command) {
+  if (IS_WINDOWS) {
+    return {
+      shell: "powershell.exe",
+      args: ["-NoProfile", "-NonInteractive", "-Command", WIN_UTF8_PREAMBLE + command]
+    };
+  }
+  return { shell: process.env["SHELL"] ?? "/bin/bash", args: ["-c", command] };
+}
+function decodeWindowsBuffer(buf) {
+  const utf8 = buf.toString("utf-8");
+  if (!utf8.includes("\uFFFD")) return utf8;
+  try {
+    return new TextDecoder("gbk").decode(buf);
+  } catch {
+    return utf8;
+  }
+}
+
+// src/tools/builtin/bash.ts
+var IS_WINDOWS2 = platform2() === "win32";
+var SHELL = IS_WINDOWS2 ? "powershell.exe" : process.env["SHELL"] ?? "/bin/bash";
 var cwdBySession = /* @__PURE__ */ new Map();
 function getCwd() {
   const key = getCurrentSessionKey();
@@ -215,7 +241,7 @@ function setCwd(next) {
 var bashTool = {
   definition: {
     name: "bash",
-    description: IS_WINDOWS ? `Execute commands in PowerShell. Supports mkdir, ls, cat, python, etc.
+    description: IS_WINDOWS2 ? `Execute commands in PowerShell. Supports mkdir, ls, cat, python, etc.
 Important rules:
 1. Each bash call runs in an independent subprocess; cd commands do not persist. To run in a specific directory, use the cwd parameter, or combine commands: e.g. "cd mydir; ls" or "mkdir mydir; cd mydir; New-Item file.txt".
 2. If a command fails (returns an error or non-zero exit code), stop immediately, report the error to the user, and do not retry the same or similar commands.
@@ -231,7 +257,7 @@ Important rules:
     parameters: {
       command: {
         type: "string",
-        description: IS_WINDOWS ? `PowerShell command to execute. Combine multiple commands with semicolons, e.g.: "mkdir mydir; Set-Content mydir/file.txt 'content'"` : `${SHELL} command to execute. Combine multiple commands with &&, e.g.: "mkdir -p mydir && echo 'content' > mydir/file.txt"`,
+        description: IS_WINDOWS2 ? `PowerShell command to execute. Combine multiple commands with semicolons, e.g.: "mkdir mydir; Set-Content mydir/file.txt 'content'"` : `${SHELL} command to execute. Combine multiple commands with &&, e.g.: "mkdir -p mydir && echo 'content' > mydir/file.txt"`,
         required: true
       },
       cwd: {
@@ -283,9 +309,9 @@ Important rules:
       setCwd(resolved);
     }
     let actualCommand;
-    if (IS_WINDOWS) {
+    if (IS_WINDOWS2) {
       const fixedCommand = fixWindowsDeleteCommand(command);
-      actualCommand = `[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; $OutputEncoding = [System.Text.Encoding]::UTF8; ${fixedCommand}`;
+      actualCommand = WIN_UTF8_PREAMBLE + fixedCommand;
     } else {
       actualCommand = command;
     }
@@ -329,7 +355,7 @@ Important rules:
       }
       updateCwdFromCommand(command, effectiveCwd);
       pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
-      const result = Buffer.isBuffer(stdout) ? IS_WINDOWS ? decodeWindowsBuffer(stdout) : stdout.toString("utf-8") : String(stdout ?? "");
+      const result = Buffer.isBuffer(stdout) ? IS_WINDOWS2 ? decodeWindowsBuffer(stdout) : stdout.toString("utf-8") : String(stdout ?? "");
       return result || "(command completed with no output)";
     } catch (err) {
       pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
@@ -354,8 +380,8 @@ How to recover (pick ONE \u2014 do NOT retry the same command):
           );
         }
         if ("status" in execErr && execErr.status !== void 0) {
-          const stderr = IS_WINDOWS && Buffer.isBuffer(execErr.stderr) ? decodeWindowsBuffer(execErr.stderr).trim() : execErr.stderr?.toString().trim() ?? "";
-          const stdout = IS_WINDOWS && Buffer.isBuffer(execErr.stdout) ? decodeWindowsBuffer(execErr.stdout).trim() : execErr.stdout?.toString().trim() ?? "";
+          const stderr = IS_WINDOWS2 && Buffer.isBuffer(execErr.stderr) ? decodeWindowsBuffer(execErr.stderr).trim() : execErr.stderr?.toString().trim() ?? "";
+          const stdout = IS_WINDOWS2 && Buffer.isBuffer(execErr.stdout) ? decodeWindowsBuffer(execErr.stdout).trim() : execErr.stdout?.toString().trim() ?? "";
           const combined = [stdout, stderr].filter(Boolean).join("\n");
           const hint = buildErrorHint(command, combined);
           throw new ToolError(
@@ -389,23 +415,14 @@ function fixWindowsDeleteCommand(command) {
     }
   );
 }
-function decodeWindowsBuffer(buf) {
-  const utf8 = buf.toString("utf-8");
-  if (!utf8.includes("\uFFFD")) return utf8;
-  try {
-    return new TextDecoder("gbk").decode(buf);
-  } catch {
-    return utf8;
-  }
-}
 function buildErrorHint(command, stderr) {
   const hints = [];
-  if (IS_WINDOWS && /\|\|/.test(command) && /(\|\||is not a valid argument|不是此版本中的有效|ParserError|Unexpected token)/i.test(stderr)) {
+  if (IS_WINDOWS2 && /\|\|/.test(command) && /(\|\||is not a valid argument|不是此版本中的有效|ParserError|Unexpected token)/i.test(stderr)) {
     hints.push(
       `Hint: PowerShell parses '||' as a pipeline operator (PS 5.x) or logical-or (PS 7+), it CANNOT be passed inline as SQL string concatenation. Workaround: write the SQL to a local .sql file with write_file, then 'scp' it to the remote host and run 'psql -f /tmp/x.sql'. Do NOT try to escape || or wrap the command differently \u2014 it will not work.`
     );
   }
-  if (IS_WINDOWS && /\bpython3\b/.test(command)) {
+  if (IS_WINDOWS2 && /\bpython3\b/.test(command)) {
     const trivialStderr = stderr.trim().length === 0 || /^[·\s]*exit 1\b/i.test(stderr.trim());
     if (/(not recognized|is not recognized|无法将.*识别)/i.test(stderr) || trivialStderr) {
       hints.push(
@@ -413,27 +430,27 @@ function buildErrorHint(command, stderr) {
       );
     }
   }
-  if (IS_WINDOWS && /^\s*ssh\b/.test(command) && /\\"/.test(command) && /(syntax error|ERROR:|ParserError|unexpected|parser|意外的|语法|不是此版本|所在位置\s+行)/i.test(stderr)) {
+  if (IS_WINDOWS2 && /^\s*ssh\b/.test(command) && /\\"/.test(command) && /(syntax error|ERROR:|ParserError|unexpected|parser|意外的|语法|不是此版本|所在位置\s+行)/i.test(stderr)) {
     hints.push(
       `Hint: SSH + nested quotes ("...\\"...\\"") is fragile across PS \u2192 ssh \u2192 remote-shell \u2192 psql layers. Use the file-based flow: (1) write_file locally to a .sql file, (2) 'scp x.sql root@host:/tmp/', (3) 'ssh root@host "sudo -u postgres psql -d <db> -f /tmp/x.sql"'. Or for remote-only SQL: 'ssh host "cat > /tmp/x.sql << \\'SQLEOF\\'\\n...\\nSQLEOF"' then run psql -f. Avoid inline psql -c with embedded quotes.`
     );
   }
-  if (IS_WINDOWS && /\bmkdir\b/.test(command) && /\s-p\b/.test(command) && /(已存在|already exists|ItemExistsUnauthorizedAccessError|exists)/i.test(stderr)) {
+  if (IS_WINDOWS2 && /\bmkdir\b/.test(command) && /\s-p\b/.test(command) && /(已存在|already exists|ItemExistsUnauthorizedAccessError|exists)/i.test(stderr)) {
     hints.push(
       `Hint: PowerShell's mkdir does not support the '-p' flag. When the directory already exists it exits with code 1. Use instead: New-Item -ItemType Directory -Force -Path <dir> ('-Force' silently succeeds even if the directory already exists, mimicking 'mkdir -p').`
     );
   }
-  if (IS_WINDOWS && /Remove-Item/i.test(command) && /cannot find path|no such file|exit 1/i.test(stderr || command)) {
+  if (IS_WINDOWS2 && /Remove-Item/i.test(command) && /cannot find path|no such file|exit 1/i.test(stderr || command)) {
     hints.push(
       `Hint: On Windows, "Remove-Item ... -ErrorAction SilentlyContinue" still makes the powershell process exit 1 when no files match (even though the error is silenced). Use Test-Path as a guard: @('tmp_a.sql','tmp_b.sql','tmp_c.csv') | Where-Object { Test-Path $_ } | Remove-Item -Force \u2014 Test-Path returns a bool without raising, so missing paths are filtered out and exit code is 0.`
     );
   }
-  if (IS_WINDOWS && /-(?:EA|ErrorAction)\s+(?:SilentlyContinue|Ignore)\b/i.test(command) && /\b(Get-ChildItem|Get-Item|Get-Content|gci|gi|gc|dir|ls)\b/i.test(command) && !/Remove-Item/i.test(command) && !/Test-Path/i.test(command) && /cannot find path|no such file|does not exist|exit 1|不存在|找不到/i.test(stderr || command)) {
+  if (IS_WINDOWS2 && /-(?:EA|ErrorAction)\s+(?:SilentlyContinue|Ignore)\b/i.test(command) && /\b(Get-ChildItem|Get-Item|Get-Content|gci|gi|gc|dir|ls)\b/i.test(command) && !/Remove-Item/i.test(command) && !/Test-Path/i.test(command) && /cannot find path|no such file|does not exist|exit 1|不存在|找不到/i.test(stderr || command)) {
     hints.push(
       `Hint: On Windows, "-ErrorAction SilentlyContinue" silences the error MESSAGE but does NOT change the exit code \u2014 the process still exits 1 when the path doesn't exist (because powershell.exe -NonInteractive flips the exit code on any non-terminating error, silenced or not). If you're just probing for existence, use Test-Path instead \u2014 it returns $true/$false without raising: \`if (Test-Path ./mydir) { Get-ChildItem ./mydir }\` or unconditionally use \`New-Item -ItemType Directory -Force -Path ./mydir\` which is idempotent. Don't retry the same -ErrorAction SilentlyContinue probe expecting a different result.`
     );
   }
-  if (IS_WINDOWS && /\bWrite-(?:Content|File)\b/i.test(command) && /(not recognized|无法将.*识别|不是.*cmdlet|CommandNotFoundException)/i.test(stderr)) {
+  if (IS_WINDOWS2 && /\bWrite-(?:Content|File)\b/i.test(command) && /(not recognized|无法将.*识别|不是.*cmdlet|CommandNotFoundException)/i.test(stderr)) {
     hints.push(
       `Hint: 'Write-Content' / 'Write-File' are NOT PowerShell cmdlets (common LLM hallucination). To write a file, prefer the built-in 'write_file' tool \u2014 it handles encoding/escaping cleanly and supports diff preview. If you must stay in bash: use 'Set-Content -Path <file> -Value <string> -Encoding utf8' (overwrites) or 'Add-Content' (appends) or 'Out-File -FilePath <file> -Encoding utf8'.`
     );
@@ -454,6 +471,18 @@ function detectBlockingCommand(command) {
   if (logcat && !/(?:^|\s)-(?:d|t|c|g)\b/.test(logcat[1] ?? "")) {
     return blockingMessage("adb logcat", "stream device logs");
   }
+  if (/\bStart-Process\b/i.test(command) && /\b(?:emulator|qemu[\w-]*)(?:\.exe)?\b/i.test(command)) {
+    return `This launches a long-running emulator/qemu process via Start-Process, which DETACHES a GUI child that aicli cannot track or stop with task_stop \u2014 and in practice that child often dies together with this bash call, leaving nothing running.
+
+Use the 'task_create' tool instead so the process is tracked and stoppable:
+  task_create(command: "<sdk>\\emulator\\emulator.exe -avd <name> -no-boot-anim", description: "launch emulator")
+
+Then poll readiness with SHORT bash calls (these DO exit):
+  adb devices                              # is the device listed?
+  adb shell getprop sys.boot_completed     # prints "1" once fully booted
+
+[Do NOT launch long-running GUI processes via Start-Process in bash \u2014 use task_create.]`;
+  }
   return null;
 }
 function blockingMessage(example, what) {
@@ -533,7 +562,7 @@ function pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, cwd) {
 }
 function runShell(command, opts) {
   return new Promise((resolvePromise) => {
-    const shellArgs = IS_WINDOWS ? ["-NoProfile", "-NonInteractive", "-Command", command] : ["-c", command];
+    const shellArgs = IS_WINDOWS2 ? ["-NoProfile", "-NonInteractive", "-Command", command] : ["-c", command];
     const child = spawn(SHELL, shellArgs, {
       cwd: opts.cwd,
       env: opts.env,
@@ -596,7 +625,7 @@ function runShell(command, opts) {
 }
 function killChild(child) {
   if (child.killed || child.exitCode !== null) return;
-  if (IS_WINDOWS && child.pid) {
+  if (IS_WINDOWS2 && child.pid) {
     try {
       spawn("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
         windowsHide: true,
@@ -1021,7 +1050,7 @@ ${content}`;
 };
 
 // src/tools/builtin/write-file.ts
-import { writeFileSync as writeFileSync2, appendFileSync, mkdirSync } from "fs";
+import { appendFileSync, mkdirSync } from "fs";
 import { dirname as dirname2 } from "path";
 
 // src/tools/executor.ts
@@ -1496,8 +1525,8 @@ var ToolExecutor = class {
   /** confirm() 的取消回调，由 SIGINT handler 调用 */
   cancelConfirmFn = null;
   /**
-   * 会话级 auto-approve：跳过所有 write/destructive 确认（仅当前会话有效）。
-   * 通过 /yolo 命令切换。destructive 操作仍会显示警告但不阻塞。
+   * 会话级 auto-approve：跳过 write 确认（仅当前会话有效）。
+   * destructive 操作仍然必须逐次确认。
    */
   sessionAutoApprove = false;
   /**
@@ -1581,7 +1610,7 @@ var ToolExecutor = class {
         }
       }
     }
-    if (this.sessionAutoApprove && dangerLevel !== "safe") {
+    if (this.sessionAutoApprove && dangerLevel === "write") {
       this.printToolCall(call);
       if (dangerLevel === "write") this.printDiffPreview(call);
       console.log(theme.warning("  \u26A1 Auto-approved (session /yolo mode)"));
@@ -2110,7 +2139,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
     if (appendMode) {
       appendFileSync(filePath, content, encoding);
     } else {
-      writeFileSync2(filePath, content, encoding);
+      atomicWriteFileSync(filePath, content);
     }
     const lines = content.split("\n").length;
     const mode = appendMode ? "appended" : "written";
@@ -2126,7 +2155,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
 };
 
 // src/tools/builtin/edit-file.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync4, existsSync as existsSync5 } from "fs";
 
 // src/tools/builtin/patch-apply.ts
 function parseUnifiedDiff(patch) {
@@ -2525,7 +2554,7 @@ Note: Path can be absolute or relative to cwd.`,
       if (res.ok && res.appliedCount > 0 && res.content !== void 0) {
         undoStack.push(filePath, `edit_file (patch ${res.appliedCount}/${hunks.length}): ${filePath}`);
         fileCheckpoints.snapshot(filePath, ToolExecutor.currentMessageIndex);
-        writeFileSync3(filePath, res.content, encoding);
+        atomicWriteFileSync(filePath, res.content);
       }
       return lines.join("\n");
     }
@@ -2559,7 +2588,7 @@ Note: Path can be absolute or relative to cwd.`,
       if (writeChanges) {
         undoStack.push(filePath, `edit_file (batch ${appliedCount}/${edits.length}): ${filePath}`);
         fileCheckpoints.snapshot(filePath, ToolExecutor.currentMessageIndex);
-        writeFileSync3(filePath, working, encoding);
+        atomicWriteFileSync(filePath, working);
       }
       const lines = [];
       if (anyFailed && stopOnError) {
@@ -2597,7 +2626,7 @@ Please read the file first and use exact text.`;
       const label = res.info?.mode === "ignore_whitespace" ? "edit_file (ws-replace)" : res.info?.mode === "replace_all" ? "edit_file (replace_all)" : "edit_file (replace)";
       undoStack.push(filePath, `${label}: ${filePath}`);
       fileCheckpoints.snapshot(filePath, ToolExecutor.currentMessageIndex);
-      writeFileSync3(filePath, res.content, encoding);
+      atomicWriteFileSync(filePath, res.content);
       if (res.info?.mode === "replace_all") {
         return `Successfully edited ${filePath}${modeLabel}
   Replaced: ${res.info.replacedCount} occurrence(s) of ${truncatePreview(oldStr)}
@@ -2621,7 +2650,7 @@ Please read the file first and use exact text.`;
       undoStack.push(filePath, `edit_file (insert): ${filePath}`);
       fileCheckpoints.snapshot(filePath, ToolExecutor.currentMessageIndex);
       lines.splice(afterLine, 0, content);
-      writeFileSync3(filePath, lines.join("\n"), encoding);
+      atomicWriteFileSync(filePath, lines.join("\n"));
       return `Successfully inserted ${content.split("\n").length} line(s) after line ${afterLine} in ${filePath}`;
     }
     if (args["delete_from_line"] !== void 0) {
@@ -2637,7 +2666,7 @@ Please read the file first and use exact text.`;
       undoStack.push(filePath, `edit_file (delete): ${filePath}`);
       fileCheckpoints.snapshot(filePath, ToolExecutor.currentMessageIndex);
       const deleted = lines.splice(fromLine - 1, toLine - fromLine + 1);
-      writeFileSync3(filePath, lines.join("\n"), encoding);
+      atomicWriteFileSync(filePath, lines.join("\n"));
       return `Successfully deleted lines ${fromLine}-${toLine} (${deleted.length} lines) from ${filePath}`;
     }
     throw new ToolError(
@@ -3122,8 +3151,8 @@ function collectMatchingFiles(dirPath, rootPath, regex, results, maxResults) {
 
 // src/tools/builtin/run-interactive.ts
 import { spawn as spawn2 } from "child_process";
-import { platform as platform2 } from "os";
-var IS_WINDOWS2 = platform2() === "win32";
+import { platform as platform3 } from "os";
+var IS_WINDOWS3 = platform3() === "win32";
 var runInteractiveTool = {
   definition: {
     name: "run_interactive",
@@ -3203,7 +3232,7 @@ var runInteractiveTool = {
       let lineIdx = 0;
       const writeNextLine = () => {
         if (lineIdx < stdinLines.length && !child.stdin.destroyed) {
-          const line = stdinLines[lineIdx++] + (IS_WINDOWS2 ? "\r\n" : "\n");
+          const line = stdinLines[lineIdx++] + (IS_WINDOWS3 ? "\r\n" : "\n");
           const canContinue = child.stdin.write(line);
           if (canContinue) {
             setTimeout(writeNextLine, 150);
@@ -3842,7 +3871,7 @@ ${preamble}`;
 }
 
 // src/tools/builtin/save-last-response.ts
-import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2, rmdirSync as rmdirSync2 } from "fs";
+import { mkdirSync as mkdirSync2, unlinkSync as unlinkSync2, rmdirSync as rmdirSync2 } from "fs";
 import { dirname as dirname3 } from "path";
 var lastResponseStore = { content: "" };
 function cleanupRejectedTeeFile(filePath) {
@@ -3893,7 +3922,7 @@ Any of these triggers means use save_last_response, NOT write_file:
     }
     undoStack.push(filePath, `save_last_response: ${filePath}`);
     mkdirSync2(dirname3(filePath), { recursive: true });
-    writeFileSync4(filePath, content, "utf-8");
+    atomicWriteFileSync(filePath, content);
     const lines = content.split("\n").length;
     return `File saved: ${filePath} (${lines} lines, ${content.length} bytes)`;
   }
@@ -4516,16 +4545,29 @@ var spawnAgentTool = {
 // src/tools/builtin/task-manager.ts
 import { spawn as spawn3 } from "child_process";
 import { randomUUID } from "crypto";
-import { platform as platform3 } from "os";
+import { platform as platform4 } from "os";
 var MAX_OUTPUT_CHARS = 1e4;
+var MAX_OUTPUT_BYTES = 64 * 1024;
 var MAX_TASKS = 20;
 var tasks = /* @__PURE__ */ new Map();
-function appendOutput(task, field, chunk) {
-  task[field] += chunk;
-  if (task[field].length > MAX_OUTPUT_CHARS) {
-    task[field] = "... [truncated] ...\n" + task[field].slice(-MAX_OUTPUT_CHARS);
+function capChunks(chunks) {
+  let total = 0;
+  for (const c of chunks) total += c.length;
+  while (total > MAX_OUTPUT_BYTES && chunks.length > 1) {
+    total -= chunks.shift().length;
   }
 }
+function decodeField(chunks) {
+  const buf = Buffer.concat(chunks);
+  const text = IS_WINDOWS ? decodeWindowsBuffer(buf) : buf.toString("utf-8");
+  return text.length > MAX_OUTPUT_CHARS ? "... [truncated] ...\n" + text.slice(-MAX_OUTPUT_CHARS) : text;
+}
+function appendOutput(task, field, chunk) {
+  const chunks = field === "stdout" ? task._stdoutChunks : task._stderrChunks;
+  chunks.push(chunk);
+  capChunks(chunks);
+  task[field] = decodeField(chunks);
+}
 function createTask(command, description) {
   if (tasks.size >= MAX_TASKS) {
     for (const [id2, t] of tasks) {
@@ -4536,13 +4578,11 @@ function createTask(command, description) {
     }
   }
   const id = randomUUID().slice(0, 8);
-  const isWin = platform3() === "win32";
-  const shell = isWin ? "cmd" : "sh";
-  const shellFlag = isWin ? "/c" : "-c";
-  const proc = spawn3(shell, [shellFlag, command], {
+  const { shell, args } = shellInvocation(command);
+  const proc = spawn3(shell, args, {
     stdio: ["ignore", "pipe", "pipe"],
     detached: false,
-    env: { ...process.env, PYTHONUTF8: "1" }
+    env: { ...process.env, PYTHONUTF8: "1", PYTHONIOENCODING: "utf-8" }
   });
   const task = {
     id,
@@ -4554,10 +4594,12 @@ function createTask(command, description) {
     status: "running",
     exitCode: null,
     stdout: "",
-    stderr: ""
+    stderr: "",
+    _stdoutChunks: [],
+    _stderrChunks: []
   };
-  proc.stdout?.on("data", (chunk) => appendOutput(task, "stdout", chunk.toString("utf-8")));
-  proc.stderr?.on("data", (chunk) => appendOutput(task, "stderr", chunk.toString("utf-8")));
+  proc.stdout?.on("data", (chunk) => appendOutput(task, "stdout", chunk));
+  proc.stderr?.on("data", (chunk) => appendOutput(task, "stderr", chunk));
   proc.on("close", (code) => {
     task.endTime = Date.now();
     task.exitCode = code;
@@ -4573,7 +4615,9 @@ Process error: ${err.message}`;
   return task;
 }
 function listTasks() {
-  return [...tasks.values()].map(({ process: _p, ...rest }) => rest);
+  return [...tasks.values()].map(
+    ({ process: _p, _stdoutChunks: _o, _stderrChunks: _e, ...rest }) => rest
+  );
 }
 function getTaskOutput(id) {
   const task = tasks.get(id);
@@ -4585,7 +4629,7 @@ function stopTask(id) {
   if (!task || task.status !== "running") return false;
   try {
     const proc = task.process;
-    if (platform3() === "win32" && proc.pid) {
+    if (platform4() === "win32" && proc.pid) {
       try {
         spawn3("taskkill", ["/PID", String(proc.pid), "/T", "/F"], {
           windowsHide: true,
@@ -4620,7 +4664,7 @@ function stopTask(id) {
 var taskCreateTool = {
   definition: {
     name: "task_create",
-    description: `Start a command running in the background and return immediately with a task ID (monitor via task_list, stop via task_stop). Use this for ANY long-running or never-exiting command, including: dev servers (npm run dev, metro / react-native start), Android emulator launch (emulator -avd X), device log streaming (adb logcat), file watchers, and builds you want to monitor while continuing other work. Running such commands via 'bash' instead would block until timeout.`,
+    description: `Start a command running in the background and return immediately with a task ID (monitor via task_list, stop via task_stop). Use this for ANY long-running or never-exiting command, including: dev servers (npm run dev, metro / react-native start), Android emulator launch (emulator -avd X), device log streaming (adb logcat), file watchers, and builds you want to monitor while continuing other work. Running such commands via 'bash' instead would block until timeout. The command runs in the SAME shell as the 'bash' tool (PowerShell on Windows, $SHELL on Unix), so a command you verified with 'bash' can be moved here verbatim \u2014 write it in PowerShell syntax on Windows (e.g. & "C:\\path\\app.exe" -flag), NOT cmd.exe syntax.`,
     parameters: {
       command: {
         type: "string",

package/dist/{chunk-GYN2PTY2.js → chunk-SFCNFX42.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   TEST_TIMEOUT
-} from "./chunk-SCQOEDVL.js";
+} from "./chunk-QNUVZO5X.js";
 
 // src/tools/builtin/run-tests.ts
 import { execSync, spawnSync } from "child_process";

package/dist/{chunk-BENRC3OO.js → chunk-TW47X5AO.js}

@@ -8,7 +8,7 @@ import {
   CONFIG_FILE_NAME,
   HISTORY_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-SCQOEDVL.js";
+} from "./chunk-QNUVZO5X.js";
 
 // src/config/config-manager.ts
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";

package/dist/{chunk-SMFRJCXB.js → chunk-XPBEJB27.js}

@@ -5,7 +5,14 @@ function isFileWriteTool(name) {
   return name === "write_file" || name === "edit_file" || name === "notebook_edit";
 }
 function getDangerLevel(toolName, args) {
-  if (toolName.startsWith("mcp__")) return "safe";
+  if (toolName.startsWith("mcp__")) {
+    const rawName = toolName.split("__").pop() ?? "";
+    const normalized = rawName.toLowerCase().replace(/[^a-z0-9]+/g, "_");
+    if (/^(read|get|list|search|find|query|fetch|status|describe|inspect|show|lookup)(?:_|$)/.test(normalized)) {
+      return "safe";
+    }
+    return "write";
+  }
   if (toolName === "bash") {
     const cmd = String(args["command"] ?? "");
     if (/\brm\s+[^\n]*(?:-\w*[rRfF]\w*|--recursive|--force)\b/.test(cmd)) return "destructive";

package/dist/{ci-LWE2I5QW.js → ci-AYMV66P3.js}

@@ -6,18 +6,18 @@ import {
 } from "./chunk-HLWUDRBO.js";
 import {
   ProviderRegistry
-} from "./chunk-UZISJ3KZ.js";
-import "./chunk-SMFRJCXB.js";
+} from "./chunk-QMXC327F.js";
+import "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-BENRC3OO.js";
+} from "./chunk-TW47X5AO.js";
 import "./chunk-TZQHYZKT.js";
 import {
   VERSION
-} from "./chunk-SCQOEDVL.js";
+} from "./chunk-QNUVZO5X.js";
 
 // src/cli/ci.ts
-import { execFileSync, execSync } from "child_process";
+import { execFileSync } from "child_process";
 var CI_COMMENT_MARKER = "<!-- aicli-ci-review -->";
 function fetchDiff(opts) {
   if (opts.diffOverride != null) return opts.diffOverride;
@@ -34,7 +34,8 @@ function fetchDiff(opts) {
   }
   if (opts.base) {
     try {
-      return execSync(`git diff ${shellQuote(opts.base)}...HEAD`, {
+      validateGitRef(opts.base);
+      return execFileSync("git", ["diff", `${opts.base}...HEAD`], {
         encoding: "utf-8",
         maxBuffer: 50 * 1024 * 1024,
         timeout: 3e4
@@ -45,18 +46,17 @@ function fetchDiff(opts) {
   }
   throw new Error("aicli ci: must supply --pr <num> or --base <ref> to determine the diff source");
 }
-function shellQuote(ref) {
+function validateGitRef(ref) {
   if (!/^[A-Za-z0-9._/\-]+$/.test(ref)) {
     throw new Error(`unsafe ref: ${ref}`);
   }
-  return ref;
 }
 function buildGitContextStr(opts) {
   const parts = [];
   if (opts.pr != null) parts.push(`PR: #${opts.pr}`);
   if (opts.base) parts.push(`Base: ${opts.base}`);
   try {
-    const branch = execSync("git rev-parse --abbrev-ref HEAD", { encoding: "utf-8", timeout: 5e3 }).trim();
+    const branch = execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], { encoding: "utf-8", timeout: 5e3 }).trim();
     if (branch) parts.push(`Branch: ${branch}`);
   } catch {
   }

package/dist/{constants-JRY7PDEY.js → constants-NHGTSHKT.js}

@@ -36,7 +36,7 @@ import {
   TEST_TIMEOUT,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-SCQOEDVL.js";
+} from "./chunk-QNUVZO5X.js";
 export {
   AGENTIC_BEHAVIOR_GUIDELINE,
   APP_NAME,