jinzd-ai-cli 0.4.205 → 0.4.207

package/dist/{server-RKP7JRRE.js → server-37EXC4EB.js}

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
 import {
   ToolRegistry
-} from "./chunk-43MWRT2C.js";
+} from "./chunk-QQYSZMET.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-VOV2PWZU.js";
+import "./chunk-SFCNFX42.js";
 import {
   runTool
-} from "./chunk-XIYSFN4U.js";
+} from "./chunk-2WV6AGHM.js";
 import {
   getDangerLevel,
   schemaToJsonSchema
-} from "./chunk-SMFRJCXB.js";
+} from "./chunk-XPBEJB27.js";
 import "./chunk-TZQHYZKT.js";
 import {
   VERSION
-} from "./chunk-3RET7PL7.js";
+} from "./chunk-QNUVZO5X.js";
 import "./chunk-4BKXL7SM.js";
 import "./chunk-TB4W4Y4T.js";
 import "./chunk-KHYD3WXE.js";

package/dist/{server-ML6ZL3J5.js → server-L2MXWYF7.js}

@@ -19,7 +19,7 @@ import {
   loadDevState,
   persistToolRound,
   setupProxy
-} from "./chunk-ZSC4YLEJ.js";
+} from "./chunk-KOU4KX7J.js";
 import {
   ToolExecutor,
   ToolRegistry,
@@ -38,10 +38,10 @@ import {
   spawnAgentContext,
   truncateOutput,
   undoStack
-} from "./chunk-43MWRT2C.js";
+} from "./chunk-QQYSZMET.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-VOV2PWZU.js";
+import "./chunk-SFCNFX42.js";
 import {
   SessionManager,
   getContentText
@@ -52,10 +52,10 @@ import {
 } from "./chunk-E44DTERW.js";
 import {
   ProviderRegistry
-} from "./chunk-UZISJ3KZ.js";
+} from "./chunk-QMXC327F.js";
 import {
   runTool
-} from "./chunk-XIYSFN4U.js";
+} from "./chunk-2WV6AGHM.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   TEE_FINAL_USER_NUDGE,
@@ -71,10 +71,10 @@ import {
   stripOuterCodeFence,
   stripToolCallReminder,
   teeStreamErrorSummary
-} from "./chunk-SMFRJCXB.js";
+} from "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-TZ7SNVSG.js";
+} from "./chunk-TW47X5AO.js";
 import "./chunk-TZQHYZKT.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
@@ -94,7 +94,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-3RET7PL7.js";
+} from "./chunk-QNUVZO5X.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
@@ -106,7 +106,9 @@ import "./chunk-KHYD3WXE.js";
 import "./chunk-SLSWPBK3.js";
 import "./chunk-O6UFCEUZ.js";
 import "./chunk-CKH4KQ4E.js";
-import "./chunk-IW3Q7AE5.js";
+import {
+  atomicWriteFileSync
+} from "./chunk-IW3Q7AE5.js";
 
 // src/web/server.ts
 import express from "express";
@@ -346,7 +348,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       }
     }
     this.sendToolCallStart(call);
-    if (this.sessionAutoApprove && (dangerLevel === "write" || dangerLevel === "destructive")) {
+    if (this.sessionAutoApprove && dangerLevel === "write") {
       try {
         const rawContent = await runTool(tool, call.arguments, call.name);
         const content = truncateOutput(rawContent, call.name);
@@ -1176,7 +1178,7 @@ Try: /compact to reduce context, /clear to reset, or switch to a larger-context
             try {
               mkdirSync(dirname(pendingTeeSave), { recursive: true });
               const bodyToSave = stripOuterCodeFence(content);
-              writeFileSync(pendingTeeSave, bodyToSave, "utf-8");
+              atomicWriteFileSync(pendingTeeSave, bodyToSave);
               undoStack.push(pendingTeeSave, `save_last_response (deferred): ${pendingTeeSave}`);
               const lines = bodyToSave.split("\n").length;
               this.send({ type: "info", message: `\u2705 Saved (from reply): ${pendingTeeSave} (${lines} lines, ${bodyToSave.length} chars)` });
@@ -1351,7 +1353,7 @@ ${summaryContent}`,
     let summary;
     try {
       mkdirSync(dirname(saveToFile), { recursive: true });
-      fileStream = createWriteStream(saveToFile, { encoding: "utf-8" });
+      fileStream = createWriteStream(saveToFile);
       const teeSystemPrompt = stripToolCallReminder(systemPrompt ?? "") + CONTENT_ONLY_STREAM_REMINDER;
       const teeExtraMessages = extraMessages.length > 0 ? [...extraMessages, { role: "user", content: TEE_FINAL_USER_NUDGE }] : [{ role: "user", content: TEE_FINAL_USER_NUDGE }];
       const chatRequest = {
@@ -1391,7 +1393,7 @@ ${summaryContent}`,
         fullContent = "";
       } else {
         if (verdict.kind === "salvaged" || verdict.kind === "fallback") {
-          writeFileSync(saveToFile, verdict.content, "utf-8");
+          atomicWriteFileSync(saveToFile, verdict.content);
           fullContent = verdict.content;
         }
         summary = verdict.summary;
@@ -1843,7 +1845,7 @@ ${activated.meta.description || ""}` });
           this.send({ type: "info", message: "\u{1F512} Auto-approve disabled \u2014 confirmations restored for this session." });
         } else {
           this.toolExecutor.sessionAutoApprove = true;
-          this.send({ type: "info", message: "\u26A1 YOLO mode ON \u2014 all write/destructive tools auto-approved for this session.\nUse /yolo off to re-enable confirmations." });
+          this.send({ type: "info", message: "\u26A1 YOLO mode ON \u2014 write tools auto-approved; destructive tools still require confirmation.\nUse /yolo off to re-enable write confirmations." });
         }
         break;
       }
@@ -2456,7 +2458,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-ZFAEFEYK.js");
+          const { executeTests } = await import("./run-tests-5F2OBWIK.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -3526,12 +3528,9 @@ async function startWebServer(options = {}) {
       "Content-Security-Policy",
       [
         "default-src 'self'",
-        // v0.4.162: the client UI is driven by inline onclick= handlers and
-        // inline <script> blocks (SW registration, theme init). 'self' alone
-        // silently blocked EVERY button (click → nothing, no JS error, just a
-        // CSP violation in the console). localhost dev/admin tool — the
-        // unsafe-inline XSS surface is acceptable under that threat model.
-        "script-src 'self' 'unsafe-inline'",
+        // Inline event handlers and startup scripts live in app.js, so script
+        // execution stays locked to same-origin files only.
+        "script-src 'self'",
         "style-src 'self' 'unsafe-inline'",
         "img-src 'self' data: blob:",
         "font-src 'self' data:",
@@ -3891,7 +3890,7 @@ async function startWebServer(options = {}) {
             handlers.set(tabId, handler);
             clearPreAuthTimer();
             console.log(`   \u2713 User registered & connected: ${username} (tab: ${tabId.slice(0, 12)})`);
-            ws.send(JSON.stringify({ type: "auth_result", success: true, token: newToken, username }));
+            ws.send(JSON.stringify({ type: "auth_result", success: true, username }));
             return;
           }
           if (action === "token") {
@@ -3907,7 +3906,7 @@ async function startWebServer(options = {}) {
             handlers.set(tabId, handler);
             clearPreAuthTimer();
             console.log(`   \u2713 Token auth: ${verifiedUser} (tab: ${tabId.slice(0, 12)})`);
-            ws.send(JSON.stringify({ type: "auth_result", success: true, token: clientToken, username: verifiedUser }));
+            ws.send(JSON.stringify({ type: "auth_result", success: true, username: verifiedUser }));
             return;
           }
           if (action === "login") {
@@ -3922,7 +3921,7 @@ async function startWebServer(options = {}) {
             handlers.set(tabId, handler);
             clearPreAuthTimer();
             console.log(`   \u2713 User logged in: ${username} (tab: ${tabId.slice(0, 12)})`);
-            ws.send(JSON.stringify({ type: "auth_result", success: true, token: loginToken, username }));
+            ws.send(JSON.stringify({ type: "auth_result", success: true, username }));
             return;
           }
           ws.send(JSON.stringify({ type: "auth_result", success: false, error: "Unknown auth action" }));
@@ -3948,9 +3947,10 @@ async function startWebServer(options = {}) {
     });
     ws.on("close", () => {
       clearPreAuthTimer();
-      console.log(`   \u2717 Tab disconnected: ${tabId.slice(0, 12)} (total: ${handlers.size - 1})`);
+      const wasTracked = handlers.has(tabId);
       if (handler) handler.onDisconnect();
-      handlers.delete(tabId);
+      if (wasTracked) handlers.delete(tabId);
+      console.log(`   \u2717 Tab disconnected: ${tabId.slice(0, 12)} (total: ${handlers.size})`);
     });
     ws.on("error", (err) => {
       console.error(`   WebSocket error: ${err.message}`);

package/dist/{task-orchestrator-LJP5XZSC.js → task-orchestrator-2DTDVCMR.js}

@@ -3,21 +3,21 @@ import {
   ToolRegistry,
   googleSearchContext,
   truncateOutput
-} from "./chunk-43MWRT2C.js";
+} from "./chunk-QQYSZMET.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-VOV2PWZU.js";
+import "./chunk-SFCNFX42.js";
 import {
   runTool
-} from "./chunk-XIYSFN4U.js";
+} from "./chunk-2WV6AGHM.js";
 import {
   getDangerLevel,
   runLeanAgentLoop
-} from "./chunk-SMFRJCXB.js";
+} from "./chunk-XPBEJB27.js";
 import "./chunk-TZQHYZKT.js";
 import {
   SUBAGENT_ALLOWED_TOOLS
-} from "./chunk-3RET7PL7.js";
+} from "./chunk-QNUVZO5X.js";
 import "./chunk-4BKXL7SM.js";
 import "./chunk-TB4W4Y4T.js";
 import "./chunk-KHYD3WXE.js";

package/dist/{usage-YX2235W5.js → usage-SZWZFX3T.js}

@@ -8,9 +8,9 @@ import {
 } from "./chunk-E44DTERW.js";
 import {
   ConfigManager
-} from "./chunk-TZ7SNVSG.js";
+} from "./chunk-TW47X5AO.js";
 import "./chunk-TZQHYZKT.js";
-import "./chunk-3RET7PL7.js";
+import "./chunk-QNUVZO5X.js";
 import "./chunk-IW3Q7AE5.js";
 
 // src/cli/usage.ts

package/dist/web/client/actions.js

@@ -0,0 +1,84 @@
+/**
+ * Declarative Web UI actions and startup hooks.
+ * Kept separate from app.js so static and dynamic UI markup can avoid inline handlers.
+ */
+
+function handleDeclarativeAction(action, el) {
+  switch (action) {
+    case 'toggle-auth-mode': toggleAuthMode(); break;
+    case 'show-enable-auth': showEnableAuthDialog(); break;
+    case 'logout': handleLogout(); break;
+    case 'toggle-batch-select': toggleBatchSelect(); break;
+    case 'select-all-sessions': selectAllSessions(); break;
+    case 'batch-delete-selected': batchDeleteSelected(); break;
+    case 'start-hub': window.startHub(); break;
+    case 'abort-hub': window.abortHub(); break;
+    case 'close-sidebar': closeSidebar(); break;
+    case 'import-templates': importTemplates(); break;
+    case 'export-templates': exportTemplates(); break;
+    case 'show-add-template': showAddTemplate(); break;
+    case 'cancel-template-form': cancelTemplateForm(); break;
+    case 'save-template-form': saveTemplateForm(); break;
+    case 'confirm-response': window.respondConfirm(el.dataset.requestId, el.dataset.approved === 'true'); break;
+    case 'batch-confirm-response': window.respondBatchConfirm(el.dataset.requestId, el); break;
+    case 'batch-deny-response': window.respondBatchDeny(el.dataset.requestId, el); break;
+    case 'ask-user-response': window.respondAskUser(el.dataset.requestId); break;
+    case 'auto-pause-response': window.respondAutoPause(el.dataset.requestId, el.dataset.pauseAction); break;
+    case 'use-template': useTemplate(el.closest('[data-tpl-id]')?.dataset.tplId); break;
+    case 'edit-template': editTemplate(el.closest('[data-tpl-id]')?.dataset.tplId); break;
+    case 'delete-template': deleteTemplate(el.closest('[data-tpl-id]')?.dataset.tplId); break;
+    case 'insert-file-ref': insertFileRef(el.dataset.filePath || ''); break;
+    case 'show-full-preview':
+      if (el.previousElementSibling) el.previousElementSibling.style.maxHeight = 'none';
+      el.remove();
+      break;
+    case 'load-session': send({ type: 'command', name: 'session', args: ['load', el.dataset.sessionId] }); break;
+  }
+}
+
+document.addEventListener('click', (event) => {
+  const themeEl = event.target.closest('[data-theme-choice]');
+  if (themeEl) {
+    event.preventDefault();
+    window.setTheme(themeEl.dataset.themeChoice);
+    return;
+  }
+
+  const actionEl = event.target.closest('[data-action]');
+  if (!actionEl) return;
+  event.preventDefault();
+  handleDeclarativeAction(actionEl.dataset.action, actionEl);
+});
+
+document.addEventListener('keydown', (event) => {
+  if (event.key !== 'Enter') return;
+  const actionEl = event.target.closest('[data-enter-action]');
+  if (!actionEl) return;
+  event.preventDefault();
+  handleDeclarativeAction(actionEl.dataset.enterAction, actionEl);
+});
+
+document.getElementById('auth-form')?.addEventListener('submit', handleAuth);
+
+function registerServiceWorker() {
+  // Self-updating service worker (v0.4.159). A new SW postMessages
+  // 'sw-updated' (and triggers controllerchange) when it takes over; reload
+  // once so users do not stay on stale index.html/app.js after an upgrade.
+  if (!('serviceWorker' in navigator)) return;
+  let swReloaded = false;
+  const reloadOnce = () => {
+    if (!swReloaded) {
+      swReloaded = true;
+      location.reload();
+    }
+  };
+  navigator.serviceWorker.addEventListener('message', (e) => {
+    if (e.data && e.data.type === 'sw-updated') reloadOnce();
+  });
+  navigator.serviceWorker.addEventListener('controllerchange', reloadOnce);
+  navigator.serviceWorker.register('sw.js').then((reg) => {
+    reg.update();
+  }).catch(() => {});
+}
+
+registerServiceWorker();

package/dist/web/client/app.js

@@ -336,8 +336,8 @@ function handleConfirmRequest(msg) {
     </div>
     ${msg.diff ? `<div class="confirm-diff w-full">${renderDiffHtml(msg.diff)}</div>` : ''}
     <div class="flex gap-2 mt-2">
-      <button class="btn btn-success btn-sm btn-outline" onclick="respondConfirm('${msg.requestId}', true)">✓ Approve</button>
-      <button class="btn btn-error btn-sm btn-outline" onclick="respondConfirm('${msg.requestId}', false)">✗ Deny</button>
+      <button class="btn btn-success btn-sm btn-outline" data-action="confirm-response" data-request-id="${msg.requestId}" data-approved="true">✓ Approve</button>
+      <button class="btn btn-error btn-sm btn-outline" data-action="confirm-response" data-request-id="${msg.requestId}" data-approved="false">✗ Deny</button>
     </div>
   `;
   messagesEl.appendChild(el);
@@ -363,8 +363,8 @@ function handleBatchConfirmRequest(msg) {
     </div>
     <div class="w-full my-1">${fileListHtml}</div>
     <div class="flex gap-2 mt-2">
-      <button class="btn btn-success btn-sm btn-outline" onclick="respondBatchConfirm('${msg.requestId}', this)">✓ Approve Selected</button>
-      <button class="btn btn-error btn-sm btn-outline" onclick="respondBatchDeny('${msg.requestId}', this)">✗ Reject All</button>
+      <button class="btn btn-success btn-sm btn-outline" data-action="batch-confirm-response" data-request-id="${msg.requestId}">✓ Approve Selected</button>
+      <button class="btn btn-error btn-sm btn-outline" data-action="batch-deny-response" data-request-id="${msg.requestId}">✗ Reject All</button>
     </div>
   `;
   messagesEl.appendChild(el);
@@ -383,8 +383,8 @@ function handleAskUserRequest(msg) {
       <input type="text" id="ask-input-${msg.requestId}"
         class="input input-sm input-bordered flex-1"
         placeholder="Your answer..."
-        onkeydown="if(event.key==='Enter')respondAskUser('${msg.requestId}')">
-      <button class="btn btn-primary btn-sm" onclick="respondAskUser('${msg.requestId}')">Send</button>
+        data-enter-action="ask-user-response" data-request-id="${msg.requestId}">
+      <button class="btn btn-primary btn-sm" data-action="ask-user-response" data-request-id="${msg.requestId}">Send</button>
     </div>
   `;
   messagesEl.appendChild(el);
@@ -407,12 +407,12 @@ function handleAutoPauseRequest(msg) {
       <input type="text" id="pause-input-${msg.requestId}"
         class="input input-sm input-bordered flex-1"
         placeholder="Optional: redirect AI with a new instruction..."
-        onkeydown="if(event.key==='Enter')respondAutoPause('${msg.requestId}','redirect')">
+        data-enter-action="auto-pause-response" data-request-id="${msg.requestId}" data-pause-action="redirect">
     </div>
     <div class="flex gap-2">
-      <button class="btn btn-success btn-sm flex-1" onclick="respondAutoPause('${msg.requestId}','continue')">▶ Continue</button>
-      <button class="btn btn-primary btn-sm flex-1" onclick="respondAutoPause('${msg.requestId}','redirect')">↪ Redirect</button>
-      <button class="btn btn-error btn-sm flex-1" onclick="respondAutoPause('${msg.requestId}','stop')">⏹ Stop</button>
+      <button class="btn btn-success btn-sm flex-1" data-action="auto-pause-response" data-request-id="${msg.requestId}" data-pause-action="continue">▶ Continue</button>
+      <button class="btn btn-primary btn-sm flex-1" data-action="auto-pause-response" data-request-id="${msg.requestId}" data-pause-action="redirect">↪ Redirect</button>
+      <button class="btn btn-error btn-sm flex-1" data-action="auto-pause-response" data-request-id="${msg.requestId}" data-pause-action="stop">⏹ Stop</button>
     </div>
   `;
   messagesEl.appendChild(el);
@@ -666,6 +666,7 @@ window.setTheme = function(theme) {
 
 // ── UI helpers ─────────────────────────────────────────────────────
 
+
 function createAssistantMessage() {
   const el = document.createElement('div');
   el.className = 'msg-assistant';
@@ -714,11 +715,11 @@ function renderMarkdown(el, text) {
         const btn = document.createElement('button');
         btn.className = 'copy-code-btn btn btn-ghost btn-xs';
         btn.textContent = '📋 Copy';
-        btn.onclick = () => {
-          navigator.clipboard.writeText(block.textContent || '');
-          btn.textContent = '✓ Copied';
-          setTimeout(() => btn.textContent = '📋 Copy', 1500);
-        };
+        btn.addEventListener('click', () => {
+          navigator.clipboard.writeText(block.textContent || '');
+          btn.textContent = 'Copied';
+          setTimeout(() => btn.textContent = 'Copy', 1500);
+        });
         pre.style.position = 'relative';
         pre.appendChild(btn);
       }
@@ -1920,12 +1921,12 @@ function addImageToPreview(file) {
       <img src="${reader.result}" class="rounded max-h-16 max-w-[100px] object-contain border border-base-content/20" alt="${escapeHtml(file.name)}">
       <button class="btn btn-xs btn-circle btn-error absolute -top-1 -right-1 opacity-80" title="Remove">✕</button>
     `;
-    thumb.querySelector('button').onclick = () => {
+    thumb.querySelector('button').addEventListener('click', () => {
       const idx = pendingImages.findIndex(img => img.name === file.name && img.data === base64);
       if (idx >= 0) pendingImages.splice(idx, 1);
       thumb.remove();
       if (pendingImages.length === 0) imagePreviewArea.classList.add('hidden');
-    };
+    });
     imagePreviewArea.appendChild(thumb);
     imagePreviewArea.classList.remove('hidden');
   };
@@ -1991,189 +1992,6 @@ function handleMemoryContent(msg) {
 
 // ── Prompt Templates ───────────────────────────────────────────────
 
-const TEMPLATES_KEY = 'aicli-templates';
-
-function loadTemplates() {
-  try {
-    return JSON.parse(localStorage.getItem(TEMPLATES_KEY) || '[]');
-  } catch { return []; }
-}
-
-function saveTemplatesToStorage(templates) {
-  localStorage.setItem(TEMPLATES_KEY, JSON.stringify(templates));
-}
-
-function openTemplatesModal() {
-  const modal = document.getElementById('templates-modal');
-  if (!modal) return;
-  cancelTemplateForm();
-  renderTemplateList();
-  document.getElementById('template-search').value = '';
-  modal.showModal();
-}
-
-function renderTemplateList(filter) {
-  const listEl = document.getElementById('template-list');
-  if (!listEl) return;
-  const templates = loadTemplates();
-  const q = (filter || '').toLowerCase();
-  const filtered = q
-    ? templates.filter(t => t.name.toLowerCase().includes(q) || (t.tags || []).some(tag => tag.toLowerCase().includes(q)) || t.content.toLowerCase().includes(q))
-    : templates;
-
-  if (filtered.length === 0) {
-    listEl.innerHTML = `<div class="template-empty">${q ? 'No matching templates' : 'No templates yet. Click ＋ New to create one.'}</div>`;
-    return;
-  }
-
-  listEl.innerHTML = filtered.map(t => {
-    const preview = t.content.length > 80 ? t.content.slice(0, 80) + '...' : t.content;
-    const tagsHtml = (t.tags || []).map(tag => `<span class="template-item-tag">${escapeHtml(tag)}</span>`).join('');
-    return `
-      <div class="template-item" data-tpl-id="${t.id}" onclick="useTemplate('${t.id}')">
-        <div class="template-item-body">
-          <div class="template-item-name">${escapeHtml(t.name)}</div>
-          <div class="template-item-preview">${escapeHtml(preview)}</div>
-          ${tagsHtml ? `<div class="template-item-tags">${tagsHtml}</div>` : ''}
-        </div>
-        <div class="template-item-actions">
-          <button class="btn btn-xs btn-ghost" onclick="event.stopPropagation(); editTemplate('${t.id}')" title="Edit">✏️</button>
-          <button class="btn btn-xs btn-ghost" onclick="event.stopPropagation(); deleteTemplate('${t.id}')" title="Delete">🗑️</button>
-        </div>
-      </div>`;
-  }).join('');
-}
-
-function useTemplate(id) {
-  const templates = loadTemplates();
-  const tpl = templates.find(t => t.id === id);
-  if (!tpl) return;
-  userInput.value = tpl.content;
-  userInput.focus();
-  userInput.style.height = 'auto';
-  userInput.style.height = Math.min(userInput.scrollHeight, 200) + 'px';
-  document.getElementById('templates-modal')?.close();
-}
-
-function showAddTemplate() {
-  const form = document.getElementById('template-form');
-  form.classList.remove('hidden');
-  document.getElementById('tpl-edit-id').value = '';
-  document.getElementById('tpl-name').value = '';
-  document.getElementById('tpl-content').value = '';
-  document.getElementById('tpl-tags').value = '';
-  document.getElementById('tpl-name').focus();
-}
-
-function editTemplate(id) {
-  const templates = loadTemplates();
-  const tpl = templates.find(t => t.id === id);
-  if (!tpl) return;
-  const form = document.getElementById('template-form');
-  form.classList.remove('hidden');
-  document.getElementById('tpl-edit-id').value = tpl.id;
-  document.getElementById('tpl-name').value = tpl.name;
-  document.getElementById('tpl-content').value = tpl.content;
-  document.getElementById('tpl-tags').value = (tpl.tags || []).join(', ');
-  document.getElementById('tpl-name').focus();
-}
-
-function cancelTemplateForm() {
-  document.getElementById('template-form')?.classList.add('hidden');
-}
-
-function saveTemplateForm() {
-  const name = document.getElementById('tpl-name').value.trim();
-  const content = document.getElementById('tpl-content').value.trim();
-  const tagsRaw = document.getElementById('tpl-tags').value.trim();
-  const editId = document.getElementById('tpl-edit-id').value;
-
-  if (!name || !content) return;
-
-  const tags = tagsRaw ? tagsRaw.split(',').map(s => s.trim()).filter(Boolean) : [];
-  const templates = loadTemplates();
-
-  if (editId) {
-    const idx = templates.findIndex(t => t.id === editId);
-    if (idx >= 0) {
-      templates[idx].name = name;
-      templates[idx].content = content;
-      templates[idx].tags = tags;
-    }
-  } else {
-    templates.unshift({
-      id: 'tpl-' + Date.now().toString(36) + Math.random().toString(36).slice(2, 6),
-      name,
-      content,
-      tags,
-      createdAt: new Date().toISOString(),
-    });
-  }
-
-  saveTemplatesToStorage(templates);
-  cancelTemplateForm();
-  renderTemplateList();
-}
-
-function deleteTemplate(id) {
-  const templates = loadTemplates().filter(t => t.id !== id);
-  saveTemplatesToStorage(templates);
-  renderTemplateList(document.getElementById('template-search')?.value);
-}
-
-function exportTemplates() {
-  const templates = loadTemplates();
-  if (templates.length === 0) return;
-  const blob = new Blob([JSON.stringify(templates, null, 2)], { type: 'application/json' });
-  const url = URL.createObjectURL(blob);
-  const a = document.createElement('a');
-  a.href = url;
-  a.download = `aicli-templates-${new Date().toISOString().slice(0, 10)}.json`;
-  a.click();
-  URL.revokeObjectURL(url);
-}
-
-function importTemplates() {
-  const input = document.createElement('input');
-  input.type = 'file';
-  input.accept = '.json';
-  input.onchange = () => {
-    const file = input.files[0];
-    if (!file) return;
-    const reader = new FileReader();
-    reader.onload = () => {
-      try {
-        const imported = JSON.parse(reader.result);
-        if (!Array.isArray(imported)) throw new Error('Not an array');
-        const existing = loadTemplates();
-        const existingIds = new Set(existing.map(t => t.id));
-        let added = 0;
-        for (const t of imported) {
-          if (t.id && t.name && t.content && !existingIds.has(t.id)) {
-            existing.push(t);
-            added++;
-          }
-        }
-        saveTemplatesToStorage(existing);
-        renderTemplateList();
-        addInfoMessage(`📥 Imported ${added} template(s).`);
-      } catch {
-        addErrorMessage('Failed to import templates: invalid JSON format.');
-      }
-    };
-    reader.readAsText(file);
-  };
-  input.click();
-}
-
-// Template button + search binding
-document.getElementById('btn-templates')?.addEventListener('click', openTemplatesModal);
-document.getElementById('template-search')?.addEventListener('input', (e) => {
-  renderTemplateList(e.target.value);
-});
-
-// ── File Tree ──────────────────────────────────────────────────────
-
 const fileTreeEl = document.getElementById('file-tree');
 const fileTreeCwdEl = document.getElementById('file-tree-cwd');
 const btnFileTreeRefresh = document.getElementById('btn-file-tree-refresh');
@@ -2324,10 +2142,10 @@ async function previewFileInChat(filePath) {
       <div class="flex items-center gap-2 mb-1">
         <span class="text-xs font-semibold opacity-70">📄 ${escapeHtml(filePath)}</span>
         <span class="badge badge-ghost badge-xs">${sizeKb} KB</span>
-        <button class="btn btn-xs btn-ghost ml-auto opacity-50" onclick="insertFileRef('${escapeHtml(filePath).replace(/'/g, "\\'")}')">Insert @ref</button>
+        <button class="btn btn-xs btn-ghost ml-auto opacity-50" data-action="insert-file-ref" data-file-path="${escapeHtml(filePath)}">Insert @ref</button>
       </div>
       <pre style="max-height:300px"><code class="language-${escapeHtml(ext)}">${escapeHtml(data.content)}</code></pre>
-      <button class="btn btn-xs btn-ghost mt-1 opacity-50 text-xs" onclick="this.previousElementSibling.style.maxHeight='none';this.remove()">▼ Show all</button>
+      <button class="btn btn-xs btn-ghost mt-1 opacity-50 text-xs" data-action="show-full-preview">▼ Show all</button>
     `;
     el.querySelectorAll('pre code').forEach(block => {
       try { hljs.highlightElement(block); } catch {}
@@ -2805,8 +2623,8 @@ async function handleAuth(event) {
   }
 }
 
-// Legacy WS auth_result handler — kept for backwards-compat with clients/
-// flows that still hit the WS auth path. Token field, if present, is ignored.
+// Legacy WS auth_result handler — kept for flows that still hit the WS auth path.
+// The server no longer echoes tokens; auth state is carried by httpOnly cookie.
 function handleAuthResult(msg) {
   const errorEl = document.getElementById('auth-error');
   const submitBtn = document.getElementById('auth-submit');
@@ -3308,7 +3126,7 @@ function hubDone(msg) {
   document.getElementById('hub-abort-btn').classList.add('hidden');
   const status = document.getElementById('hub-status');
   if (msg.saved && msg.sessionId) {
-    status.innerHTML = `Saved. <a class="link link-primary" onclick="send({type:'command',name:'session',args:['load','${msg.sessionId}']})">Open session</a>`;
+    status.innerHTML = `Saved. <a class="link link-primary" data-action="load-session" data-session-id="${msg.sessionId}">Open session</a>`;
   } else {
     status.textContent = msg.saved ? 'Saved to history.' : 'Done (not saved).';
   }