jinzd-ai-cli 0.4.204 → 0.4.206

package/dist/index.js

@@ -15,7 +15,7 @@ import {
   saveDevState,
   sessionHasMeaningfulContent,
   setupProxy
-} from "./chunk-PIZWD5JN.js";
+} from "./chunk-KOU4KX7J.js";
 import {
   ToolExecutor,
   ToolRegistry,
@@ -35,10 +35,10 @@ import {
   spawnAgentContext,
   theme,
   undoStack
-} from "./chunk-B75A6AG4.js";
+} from "./chunk-QQYSZMET.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-GYN2PTY2.js";
+import "./chunk-SFCNFX42.js";
 import {
   SessionManager,
   getContentText
@@ -55,16 +55,16 @@ import {
   getConfigDirUsage,
   listRecentCrashes,
   writeCrashLog
-} from "./chunk-T5RTPF2Q.js";
+} from "./chunk-KJHMRAJU.js";
 import {
   ProviderRegistry
-} from "./chunk-UZISJ3KZ.js";
+} from "./chunk-QMXC327F.js";
 import {
   getStatsSnapshot,
   getTopFailingTools,
   getTopUsedTools,
   installFlushOnExit
-} from "./chunk-JLZ5QA2I.js";
+} from "./chunk-2WV6AGHM.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   TEE_FINAL_USER_NUDGE,
@@ -83,10 +83,10 @@ import {
   stripOuterCodeFence,
   stripToolCallReminder,
   teeStreamErrorSummary
-} from "./chunk-SMFRJCXB.js";
+} from "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-BENRC3OO.js";
+} from "./chunk-TW47X5AO.js";
 import {
   AuthError,
   ProviderError,
@@ -113,7 +113,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-SCQOEDVL.js";
+} from "./chunk-QNUVZO5X.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
@@ -135,14 +135,16 @@ import {
 } from "./chunk-SLSWPBK3.js";
 import "./chunk-O6UFCEUZ.js";
 import "./chunk-CKH4KQ4E.js";
-import "./chunk-IW3Q7AE5.js";
+import {
+  atomicWriteFileSync
+} from "./chunk-IW3Q7AE5.js";
 
 // src/index.ts
 import { program } from "commander";
 
 // src/repl/repl.ts
 import * as readline from "readline";
-import { existsSync as existsSync4, readFileSync as readFileSync3, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync4 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync3, readdirSync as readdirSync3, statSync as statSync3, mkdirSync as mkdirSync4 } from "fs";
 import { join as join4, resolve as resolve2, extname as extname2, dirname as dirname3, basename as basename2 } from "path";
 import chalk4 from "chalk";
 
@@ -1828,7 +1830,7 @@ No tools match "${filter}".
           const { join: join5 } = await import("path");
           const { existsSync: existsSync5 } = await import("fs");
           const { getGitRoot: getGitRoot2 } = await import("./git-context-EXOEHQSF.js");
-          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-JRY7PDEY.js");
+          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-NHGTSHKT.js");
           const { approveProject, hashMcpFile } = await import("./project-trust-NKYHL3VZ.js");
           const cwd = process.cwd();
           const projectRoot = getGitRoot2(cwd) ?? cwd;
@@ -2889,7 +2891,7 @@ ${hint}` : "")
       usage: "/test [command|filter]",
       async execute(args, ctx) {
         try {
-          const { executeTests } = await import("./run-tests-RQWSG25U.js");
+          const { executeTests } = await import("./run-tests-5F2OBWIK.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -3567,7 +3569,7 @@ Summary: ${fileMap.size} file(s) \u2014 ${newFiles} new, ${modifiedFiles} modifi
           console.log(theme.info("  \u{1F512} Auto-approve disabled \u2014 confirmations restored for this session."));
         } else {
           executor.sessionAutoApprove = true;
-          console.log(theme.warning("  \u26A1 YOLO mode ON \u2014 all write/destructive tools auto-approved for this session."));
+          console.log(theme.warning("  \u26A1 YOLO mode ON \u2014 write tools auto-approved; destructive tools still require confirmation."));
           console.log(theme.dim("  Use /yolo off to re-enable confirmations."));
         }
         console.log();
@@ -4047,11 +4049,11 @@ Managing ${displayName} API Key`);
     console.log("  alwaysYolo: " + (current ? theme.warning("ON") : theme.dim("off")));
     console.log(
       theme.dim(
-        "  When ON, REPL starts with sessionAutoApprove enabled \u2014 all write/destructive\n  tools (edit_file, bash, etc.) run without confirmation prompts. Only enable this\n  if you fully trust the working directory you run aicli in.\n"
+        "  When ON, REPL starts with sessionAutoApprove enabled \u2014 write\n  tools (write_file/edit_file, etc.) run without confirmation prompts. Destructive tools still require confirmation. Only enable this\n  if you fully trust the working directory you run aicli in.\n"
       )
     );
     const next = await confirm({
-      message: current ? "Keep alwaysYolo enabled?" : "Enable alwaysYolo (skip ALL write/destructive confirmations)?",
+      message: current ? "Keep alwaysYolo enabled?" : "Enable alwaysYolo (skip write confirmations; destructive still confirms)?",
       default: current
     });
     if (next === current) {
@@ -5391,7 +5393,7 @@ Session '${this.resumeSessionId}' not found.
     this.renderer.printWelcome(this.currentProvider, this.currentModel, welcomeModelInfo?.contextWindow, profileNickname);
     if (this.toolExecutor.sessionAutoApprove && this.config.get("alwaysYolo") === true) {
       process.stdout.write(
-        theme.warning("  \u26A1 YOLO mode ON (alwaysYolo=true in config) \u2014 all write/destructive tools auto-approved.\n")
+        theme.warning("  \u26A1 YOLO mode ON (alwaysYolo=true in config) \u2014 write tools auto-approved; destructive tools still require confirmation.\n")
       );
     }
     const cfgOutputCap = this.config.get("maxToolOutputChars");
@@ -6642,7 +6644,7 @@ ${decision.displayMessage}
             try {
               mkdirSync4(dirname3(pendingTeeSave), { recursive: true });
               const bodyToSave = stripOuterCodeFence(content);
-              writeFileSync2(pendingTeeSave, bodyToSave, "utf-8");
+              atomicWriteFileSync(pendingTeeSave, bodyToSave);
               undoStack.push(pendingTeeSave, `save_last_response (deferred): ${pendingTeeSave}`);
               const lines = bodyToSave.split("\n").length;
               process.stdout.write(theme.success(
@@ -6911,7 +6913,7 @@ Tip: You can continue the conversation by asking the AI to proceed.`
             }
             if (verdict.kind === "salvaged" || verdict.kind === "fallback") {
               try {
-                writeFileSync2(saveToFile, verdict.content, "utf-8");
+                atomicWriteFileSync(saveToFile, verdict.content);
                 const banner = verdict.kind === "fallback" ? `
   \u26A0 Fallback save: fresh stream had no usable body (matched: ${verdict.matched})
   ${saveToFile} now holds the response you previously saw (${verdict.content.length} chars).
@@ -7267,7 +7269,7 @@ program.command("web").description("Start Web UI server with browser-based chat
     console.error("Error: Invalid port number. Must be between 1 and 65535.");
     process.exit(1);
   }
-  const { startWebServer } = await import("./server-MF6UDMBZ.js");
+  const { startWebServer } = await import("./server-LDPQ3DLK.js");
   await startWebServer({ port, host: options.host });
 });
 program.command("user [action] [username]").description("Manage Web UI users (list | create <name> | delete <name> | reset-password <name> | logout-all <name> | migrate <name>)").action(async (action, username) => {
@@ -7434,16 +7436,16 @@ program.command("sessions").description("List recent conversation sessions").opt
   console.log(footer + "\n");
 });
 program.command("usage").description("Show token + cost usage grouped by provider/model (cross-session)").option("--days <n>", "Only the last N days (inclusive of today)").option("--month <ym>", "Only a specific month, format YYYY-MM (e.g. 2026-06)").option("--json", "Output as JSON (for scripting)").action(async (options) => {
-  const { runUsageCli } = await import("./usage-Z64KJASD.js");
+  const { runUsageCli } = await import("./usage-SZWZFX3T.js");
   await runUsageCli(options);
 });
 program.command("doctor").description("Health check: API keys, config, MCP, recent crashes, tool usage, disk usage").option("--json", "Output as JSON (for scripting)").option("--reset-stats", "Reset accumulated tool usage statistics").action(async (options) => {
-  const { runDoctorCli } = await import("./doctor-cli-KPUULUPS.js");
+  const { runDoctorCli } = await import("./doctor-cli-WKH7T4AW.js");
   await runDoctorCli({ json: !!options.json, resetStats: !!options.resetStats });
 });
 program.command("batch <action> [arg] [arg2]").description("Anthropic Message Batches: submit | list | status <id> | results <id> [out] | cancel <id>").option("--dry-run", "Parse and validate input without submitting (submit only)").action(async (action, arg, arg2, options) => {
   try {
-    const batch = await import("./batch-ZP52GVVD.js");
+    const batch = await import("./batch-6PORMJWT.js");
     switch (action) {
       case "submit":
         if (!arg) {
@@ -7486,7 +7488,7 @@ program.command("batch <action> [arg] [arg2]").description("Anthropic Message Ba
   }
 });
 program.command("mcp-serve").description("Start an MCP server over STDIO, exposing aicli's built-in tools to Claude Desktop / Cursor / other MCP clients").option("--allow-destructive", "Allow bash / run_interactive / task_create (always destructive in MCP mode)").option("--allow-outside-cwd", "Allow tool path arguments to escape the sandbox root \u2014 disabled by default").option("--tools <list>", "Comma-separated whitelist of tools to expose (default: all eligible tools)").option("--cwd <path>", "Working directory AND sandbox root (default: current directory)").action(async (options) => {
-  const { startMcpServer } = await import("./server-XNB76DRR.js");
+  const { startMcpServer } = await import("./server-37EXC4EB.js");
   await startMcpServer({
     allowDestructive: !!options.allowDestructive,
     allowOutsideCwd: !!options.allowOutsideCwd,
@@ -7495,7 +7497,7 @@ program.command("mcp-serve").description("Start an MCP server over STDIO, exposi
   });
 });
 program.command("ci").description("Headless PR review (code + security) \u2014 reads git/gh diff, optionally posts to PR. Designed for GitHub Actions.").option("--pr <num>", "PR number; diff fetched via `gh pr diff <num>`", (v) => parseInt(v, 10)).option("--base <ref>", "Base ref for `git diff <ref>...HEAD` (ignored when --pr set)").option("--post", "Post review as a PR comment (requires gh CLI + GH_TOKEN, needs --pr)").option("--no-update", "Always create a new comment instead of updating the previous aicli review").option("--skip-code", "Skip the code review section").option("--skip-security", "Skip the security review section").option("--detailed", "Use the detailed code-review prompt").option("--max-diff <n>", "Max diff chars sent to the model (default 30000)", (v) => parseInt(v, 10)).option("--provider <id>", "Override provider (default: config.defaultProvider)").option("--model <id>", "Override model").option("--dry-run", "Print result to stdout instead of posting (overrides --post)").action(async (options) => {
-  const { runCi } = await import("./ci-LWE2I5QW.js");
+  const { runCi } = await import("./ci-AYMV66P3.js");
   const result = await runCi({
     pr: options.pr,
     base: options.base,
@@ -7593,7 +7595,7 @@ program.command("help").description("Show a comprehensive guide to all aicli fea
     `    ${M}/checkpoint${R} ${M}/fork${R}               Save/restore/fork session state`,
     `    ${M}/branch${R}                        List/create/switch/delete conversation branches (B2)`,
     `    ${M}/undo${R}                          Undo file operations`,
-    `    ${M}/yolo${R}                          Skip all tool confirmations`,
+    `    ${M}/yolo${R}                          Skip write confirmations`,
     `    ${M}/mcp${R}                           Manage MCP server connections`,
     `    ${M}/skill${R}                         Manage agent skills`,
     `    ${M}/memory${R}                        View/edit persistent memory`,
@@ -7641,7 +7643,7 @@ program.command("hub [topic]").description("Start multi-agent hub (discuss / bra
     }),
     config.get("customProviders")
   );
-  const { startHub } = await import("./hub-4CDJPNIM.js");
+  const { startHub } = await import("./hub-6R3M3NTC.js");
   await startHub(
     {
       topic: topic ?? "",

package/dist/{run-tests-RQWSG25U.js → run-tests-5F2OBWIK.js}

@@ -2,8 +2,8 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-GYN2PTY2.js";
-import "./chunk-SCQOEDVL.js";
+} from "./chunk-SFCNFX42.js";
+import "./chunk-QNUVZO5X.js";
 export {
   executeTests,
   runTestsTool

package/dist/{run-tests-6G2F7OSC.js → run-tests-NBCA4KEG.js}

@@ -1,7 +1,7 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-26YWVRLT.js";
+} from "./chunk-BQIV4ZQT.js";
 export {
   executeTests,
   runTestsTool

package/dist/{server-XNB76DRR.js → server-37EXC4EB.js}

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
 import {
   ToolRegistry
-} from "./chunk-B75A6AG4.js";
+} from "./chunk-QQYSZMET.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-GYN2PTY2.js";
+import "./chunk-SFCNFX42.js";
 import {
   runTool
-} from "./chunk-JLZ5QA2I.js";
+} from "./chunk-2WV6AGHM.js";
 import {
   getDangerLevel,
   schemaToJsonSchema
-} from "./chunk-SMFRJCXB.js";
+} from "./chunk-XPBEJB27.js";
 import "./chunk-TZQHYZKT.js";
 import {
   VERSION
-} from "./chunk-SCQOEDVL.js";
+} from "./chunk-QNUVZO5X.js";
 import "./chunk-4BKXL7SM.js";
 import "./chunk-TB4W4Y4T.js";
 import "./chunk-KHYD3WXE.js";

package/dist/{server-MF6UDMBZ.js → server-LDPQ3DLK.js}

@@ -19,7 +19,7 @@ import {
   loadDevState,
   persistToolRound,
   setupProxy
-} from "./chunk-PIZWD5JN.js";
+} from "./chunk-KOU4KX7J.js";
 import {
   ToolExecutor,
   ToolRegistry,
@@ -38,10 +38,10 @@ import {
   spawnAgentContext,
   truncateOutput,
   undoStack
-} from "./chunk-B75A6AG4.js";
+} from "./chunk-QQYSZMET.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-GYN2PTY2.js";
+import "./chunk-SFCNFX42.js";
 import {
   SessionManager,
   getContentText
@@ -52,10 +52,10 @@ import {
 } from "./chunk-E44DTERW.js";
 import {
   ProviderRegistry
-} from "./chunk-UZISJ3KZ.js";
+} from "./chunk-QMXC327F.js";
 import {
   runTool
-} from "./chunk-JLZ5QA2I.js";
+} from "./chunk-2WV6AGHM.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   TEE_FINAL_USER_NUDGE,
@@ -71,10 +71,10 @@ import {
   stripOuterCodeFence,
   stripToolCallReminder,
   teeStreamErrorSummary
-} from "./chunk-SMFRJCXB.js";
+} from "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-BENRC3OO.js";
+} from "./chunk-TW47X5AO.js";
 import "./chunk-TZQHYZKT.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
@@ -94,7 +94,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-SCQOEDVL.js";
+} from "./chunk-QNUVZO5X.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
@@ -106,7 +106,9 @@ import "./chunk-KHYD3WXE.js";
 import "./chunk-SLSWPBK3.js";
 import "./chunk-O6UFCEUZ.js";
 import "./chunk-CKH4KQ4E.js";
-import "./chunk-IW3Q7AE5.js";
+import {
+  atomicWriteFileSync
+} from "./chunk-IW3Q7AE5.js";
 
 // src/web/server.ts
 import express from "express";
@@ -346,7 +348,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       }
     }
     this.sendToolCallStart(call);
-    if (this.sessionAutoApprove && (dangerLevel === "write" || dangerLevel === "destructive")) {
+    if (this.sessionAutoApprove && dangerLevel === "write") {
       try {
         const rawContent = await runTool(tool, call.arguments, call.name);
         const content = truncateOutput(rawContent, call.name);
@@ -1176,7 +1178,7 @@ Try: /compact to reduce context, /clear to reset, or switch to a larger-context
             try {
               mkdirSync(dirname(pendingTeeSave), { recursive: true });
               const bodyToSave = stripOuterCodeFence(content);
-              writeFileSync(pendingTeeSave, bodyToSave, "utf-8");
+              atomicWriteFileSync(pendingTeeSave, bodyToSave);
               undoStack.push(pendingTeeSave, `save_last_response (deferred): ${pendingTeeSave}`);
               const lines = bodyToSave.split("\n").length;
               this.send({ type: "info", message: `\u2705 Saved (from reply): ${pendingTeeSave} (${lines} lines, ${bodyToSave.length} chars)` });
@@ -1351,7 +1353,7 @@ ${summaryContent}`,
     let summary;
     try {
       mkdirSync(dirname(saveToFile), { recursive: true });
-      fileStream = createWriteStream(saveToFile, { encoding: "utf-8" });
+      fileStream = createWriteStream(saveToFile);
       const teeSystemPrompt = stripToolCallReminder(systemPrompt ?? "") + CONTENT_ONLY_STREAM_REMINDER;
       const teeExtraMessages = extraMessages.length > 0 ? [...extraMessages, { role: "user", content: TEE_FINAL_USER_NUDGE }] : [{ role: "user", content: TEE_FINAL_USER_NUDGE }];
       const chatRequest = {
@@ -1391,7 +1393,7 @@ ${summaryContent}`,
         fullContent = "";
       } else {
         if (verdict.kind === "salvaged" || verdict.kind === "fallback") {
-          writeFileSync(saveToFile, verdict.content, "utf-8");
+          atomicWriteFileSync(saveToFile, verdict.content);
           fullContent = verdict.content;
         }
         summary = verdict.summary;
@@ -1843,7 +1845,7 @@ ${activated.meta.description || ""}` });
           this.send({ type: "info", message: "\u{1F512} Auto-approve disabled \u2014 confirmations restored for this session." });
         } else {
           this.toolExecutor.sessionAutoApprove = true;
-          this.send({ type: "info", message: "\u26A1 YOLO mode ON \u2014 all write/destructive tools auto-approved for this session.\nUse /yolo off to re-enable confirmations." });
+          this.send({ type: "info", message: "\u26A1 YOLO mode ON \u2014 write tools auto-approved; destructive tools still require confirmation.\nUse /yolo off to re-enable write confirmations." });
         }
         break;
       }
@@ -2456,7 +2458,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-RQWSG25U.js");
+          const { executeTests } = await import("./run-tests-5F2OBWIK.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -3891,7 +3893,7 @@ async function startWebServer(options = {}) {
             handlers.set(tabId, handler);
             clearPreAuthTimer();
             console.log(`   \u2713 User registered & connected: ${username} (tab: ${tabId.slice(0, 12)})`);
-            ws.send(JSON.stringify({ type: "auth_result", success: true, token: newToken, username }));
+            ws.send(JSON.stringify({ type: "auth_result", success: true, username }));
             return;
           }
           if (action === "token") {
@@ -3907,7 +3909,7 @@ async function startWebServer(options = {}) {
             handlers.set(tabId, handler);
             clearPreAuthTimer();
             console.log(`   \u2713 Token auth: ${verifiedUser} (tab: ${tabId.slice(0, 12)})`);
-            ws.send(JSON.stringify({ type: "auth_result", success: true, token: clientToken, username: verifiedUser }));
+            ws.send(JSON.stringify({ type: "auth_result", success: true, username: verifiedUser }));
             return;
           }
           if (action === "login") {
@@ -3922,7 +3924,7 @@ async function startWebServer(options = {}) {
             handlers.set(tabId, handler);
             clearPreAuthTimer();
             console.log(`   \u2713 User logged in: ${username} (tab: ${tabId.slice(0, 12)})`);
-            ws.send(JSON.stringify({ type: "auth_result", success: true, token: loginToken, username }));
+            ws.send(JSON.stringify({ type: "auth_result", success: true, username }));
             return;
           }
           ws.send(JSON.stringify({ type: "auth_result", success: false, error: "Unknown auth action" }));
@@ -3948,9 +3950,10 @@ async function startWebServer(options = {}) {
     });
     ws.on("close", () => {
       clearPreAuthTimer();
-      console.log(`   \u2717 Tab disconnected: ${tabId.slice(0, 12)} (total: ${handlers.size - 1})`);
+      const wasTracked = handlers.has(tabId);
       if (handler) handler.onDisconnect();
-      handlers.delete(tabId);
+      if (wasTracked) handlers.delete(tabId);
+      console.log(`   \u2717 Tab disconnected: ${tabId.slice(0, 12)} (total: ${handlers.size})`);
     });
     ws.on("error", (err) => {
       console.error(`   WebSocket error: ${err.message}`);

package/dist/{task-orchestrator-PKZ2UTOK.js → task-orchestrator-2DTDVCMR.js}

@@ -3,21 +3,21 @@ import {
   ToolRegistry,
   googleSearchContext,
   truncateOutput
-} from "./chunk-B75A6AG4.js";
+} from "./chunk-QQYSZMET.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-GYN2PTY2.js";
+import "./chunk-SFCNFX42.js";
 import {
   runTool
-} from "./chunk-JLZ5QA2I.js";
+} from "./chunk-2WV6AGHM.js";
 import {
   getDangerLevel,
   runLeanAgentLoop
-} from "./chunk-SMFRJCXB.js";
+} from "./chunk-XPBEJB27.js";
 import "./chunk-TZQHYZKT.js";
 import {
   SUBAGENT_ALLOWED_TOOLS
-} from "./chunk-SCQOEDVL.js";
+} from "./chunk-QNUVZO5X.js";
 import "./chunk-4BKXL7SM.js";
 import "./chunk-TB4W4Y4T.js";
 import "./chunk-KHYD3WXE.js";

package/dist/{usage-Z64KJASD.js → usage-SZWZFX3T.js}

@@ -8,9 +8,9 @@ import {
 } from "./chunk-E44DTERW.js";
 import {
   ConfigManager
-} from "./chunk-BENRC3OO.js";
+} from "./chunk-TW47X5AO.js";
 import "./chunk-TZQHYZKT.js";
-import "./chunk-SCQOEDVL.js";
+import "./chunk-QNUVZO5X.js";
 import "./chunk-IW3Q7AE5.js";
 
 // src/cli/usage.ts

package/dist/web/client/app.js

@@ -2805,8 +2805,8 @@ async function handleAuth(event) {
   }
 }
 
-// Legacy WS auth_result handler — kept for backwards-compat with clients/
-// flows that still hit the WS auth path. Token field, if present, is ignored.
+// Legacy WS auth_result handler — kept for flows that still hit the WS auth path.
+// The server no longer echoes tokens; auth state is carried by httpOnly cookie.
 function handleAuthResult(msg) {
   const errorEl = document.getElementById('auth-error');
   const submitBtn = document.getElementById('auth-submit');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jinzd-ai-cli",
-  "version": "0.4.204",
+  "version": "0.4.206",
   "description": "Cross-platform REPL-style AI CLI with multi-provider support",
   "type": "module",
   "main": "./dist/index.js",