jinzd-ai-cli 0.4.206 → 0.4.207

package/dist/electron-server.js

@@ -15731,12 +15731,9 @@ async function startWebServer(options = {}) {
       "Content-Security-Policy",
       [
         "default-src 'self'",
-        // v0.4.162: the client UI is driven by inline onclick= handlers and
-        // inline <script> blocks (SW registration, theme init). 'self' alone
-        // silently blocked EVERY button (click → nothing, no JS error, just a
-        // CSP violation in the console). localhost dev/admin tool — the
-        // unsafe-inline XSS surface is acceptable under that threat model.
-        "script-src 'self' 'unsafe-inline'",
+        // Inline event handlers and startup scripts live in app.js, so script
+        // execution stays locked to same-origin files only.
+        "script-src 'self'",
         "style-src 'self' 'unsafe-inline'",
         "img-src 'self' data: blob:",
         "font-src 'self' data:",

package/dist/index.js

@@ -144,8 +144,8 @@ import { program } from "commander";
 
 // src/repl/repl.ts
 import * as readline from "readline";
-import { existsSync as existsSync4, readFileSync as readFileSync3, readdirSync as readdirSync3, statSync as statSync3, mkdirSync as mkdirSync4 } from "fs";
-import { join as join4, resolve as resolve2, extname as extname2, dirname as dirname3, basename as basename2 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync4, readdirSync as readdirSync3, statSync as statSync4, mkdirSync as mkdirSync4 } from "fs";
+import { join as join5, resolve as resolve2, extname as extname2, dirname as dirname3, basename as basename2 } from "path";
 import chalk4 from "chalk";
 
 // src/session/title-generator.ts
@@ -637,10 +637,10 @@ Error${typeName}: ${lines.join("\n")}
 };
 
 // src/repl/commands/index.ts
-import { writeFileSync, mkdirSync as mkdirSync2, existsSync as existsSync2, readFileSync, readdirSync, statSync as statSync2, appendFileSync } from "fs";
+import { writeFileSync, mkdirSync as mkdirSync2, existsSync as existsSync3, readFileSync as readFileSync2, statSync as statSync3, appendFileSync } from "fs";
 import { execSync as execSync2 } from "child_process";
 import { platform } from "os";
-import { resolve, dirname as dirname2, join as join2, basename } from "path";
+import { resolve, dirname as dirname2, join as join3, basename } from "path";
 import chalk2 from "chalk";
 
 // src/repl/clipboard.ts
@@ -730,12 +730,9 @@ function getClipboardHint() {
   return "";
 }
 
-// src/repl/commands/index.ts
-function fmtCtx(tokens) {
-  if (tokens >= 1e6) return `${Math.round(tokens / 1e5) / 10}M`;
-  if (tokens >= 1e3) return `${Math.round(tokens / 1024)}K`;
-  return `${tokens}`;
-}
+// src/repl/commands/project-init.ts
+import { existsSync as existsSync2, readFileSync, readdirSync, statSync as statSync2 } from "fs";
+import { join as join2 } from "path";
 var SCAN_SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -793,7 +790,7 @@ function scanDirTree(dir, maxDepth = 2, maxEntries = 80) {
       const name = sorted[i];
       const fullPath = join2(d, name);
       const isLast = i === sorted.length - 1;
-      const connector = isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 ";
+      const connector = isLast ? "+-- " : "|-- ";
       let isDir;
       try {
         isDir = statSync2(fullPath).isDirectory();
@@ -803,7 +800,7 @@ function scanDirTree(dir, maxDepth = 2, maxEntries = 80) {
       lines.push(prefix + connector + name + (isDir ? "/" : ""));
       count++;
       if (isDir) {
-        walk(fullPath, prefix + (isLast ? "    " : "\u2502   "), depth + 1);
+        walk(fullPath, prefix + (isLast ? "    " : "|   "), depth + 1);
       }
     }
   };
@@ -847,9 +844,9 @@ function scanProject(cwd) {
     try {
       const pkg = JSON.parse(readFileSync(join2(cwd, "package.json"), "utf-8"));
       const scripts = pkg.scripts ?? {};
-      info.buildCommand = scripts.build ? `npm run build` : void 0;
-      info.testCommand = scripts.test ? `npm test` : void 0;
-      info.devCommand = scripts.dev ? `npm run dev` : void 0;
+      info.buildCommand = scripts.build ? "npm run build" : void 0;
+      info.testCommand = scripts.test ? "npm test" : void 0;
+      info.devCommand = scripts.dev ? "npm run dev" : void 0;
       const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
       if (allDeps["react"]) info.framework = "React";
       else if (allDeps["vue"]) info.framework = "Vue";
@@ -891,10 +888,8 @@ function scanProject(cwd) {
 }
 function buildInitPrompt(info, cwd) {
   const parts = [
-    `Please generate an AICLI.md context file (Markdown format) for the following project. This file will be injected into the AI conversation's system prompt to help the AI understand the project structure and coding conventions.`,
-    `
-## Project Info
-`,
+    "Please generate an AICLI.md context file (Markdown format) for the following project. This file will be injected into the AI conversation system prompt to help the AI understand the project structure and coding conventions.",
+    "\n## Project Info\n",
     `- Working directory: ${cwd}`,
     `- Type: ${info.type}`,
     `- Language: ${info.language}`
@@ -923,6 +918,13 @@ Please generate a structured Markdown file containing:
 Output the Markdown content directly, do not wrap the entire file in a code block. Keep it concise, within 200 lines.`);
   return parts.join("\n");
 }
+
+// src/repl/commands/index.ts
+function fmtCtx(tokens) {
+  if (tokens >= 1e6) return `${Math.round(tokens / 1e5) / 10}M`;
+  if (tokens >= 1e3) return `${Math.round(tokens / 1024)}K`;
+  return `${tokens}`;
+}
 function copyToClipboard(text) {
   const plat = platform();
   if (plat === "win32") {
@@ -1827,16 +1829,16 @@ No tools match "${filter}".
       usage: "/mcp [reconnect [serverId] | trust-project]",
       async execute(args, ctx) {
         if (args[0] === "trust-project") {
-          const { join: join5 } = await import("path");
-          const { existsSync: existsSync5 } = await import("fs");
+          const { join: join6 } = await import("path");
+          const { existsSync: existsSync6 } = await import("fs");
           const { getGitRoot: getGitRoot2 } = await import("./git-context-EXOEHQSF.js");
           const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-NHGTSHKT.js");
           const { approveProject, hashMcpFile } = await import("./project-trust-NKYHL3VZ.js");
           const cwd = process.cwd();
           const projectRoot = getGitRoot2(cwd) ?? cwd;
-          const mcpPath = join5(projectRoot, MCP_PROJECT_CONFIG_NAME2);
+          const mcpPath = join6(projectRoot, MCP_PROJECT_CONFIG_NAME2);
           console.log();
-          if (!existsSync5(mcpPath)) {
+          if (!existsSync6(mcpPath)) {
             console.log(theme.dim(`  No .mcp.json in ${projectRoot}.`));
             console.log();
             return;
@@ -2169,9 +2171,9 @@ No tools match "${filter}".
       usage: "/init [--force]",
       async execute(args, ctx) {
         const cwd = process.cwd();
-        const targetPath = join2(cwd, "AICLI.md");
+        const targetPath = join3(cwd, "AICLI.md");
         const force = args.includes("--force");
-        if (existsSync2(targetPath) && !force) {
+        if (existsSync3(targetPath) && !force) {
           ctx.renderer.printInfo(`AICLI.md already exists at ${targetPath}`);
           ctx.renderer.printInfo("Use /init --force to overwrite, or edit it manually.");
           return;
@@ -3049,7 +3051,7 @@ ${hint}` : "")
       description: "Persistent memory (memory.md) + chat memory recall index (v0.4.89+)",
       usage: "/memory [show|add <text>|clear|path|rebuild|refresh|status|recall <query>|index-clear]",
       async execute(args, ctx) {
-        const memoryFile = join2(ctx.config.getConfigDir(), MEMORY_FILE_NAME);
+        const memoryFile = join3(ctx.config.getConfigDir(), MEMORY_FILE_NAME);
         const sub = args[0] ?? "show";
         if (sub === "rebuild" || sub === "refresh") {
           const full = sub === "rebuild";
@@ -3133,11 +3135,11 @@ ${hint}` : "")
           return;
         }
         if (sub === "show" || sub === "view") {
-          if (!existsSync2(memoryFile)) {
+          if (!existsSync3(memoryFile)) {
             ctx.renderer.printInfo("Memory is empty (memory.md not found)");
             return;
           }
-          const content = readFileSync(memoryFile, "utf-8").trim();
+          const content = readFileSync2(memoryFile, "utf-8").trim();
           if (!content) {
             ctx.renderer.printInfo("Memory is empty");
             return;
@@ -3168,7 +3170,7 @@ ${text}
             ctx.renderer.renderError(`Failed to write memory: ${err instanceof Error ? err.message : String(err)}`);
           }
         } else if (sub === "clear") {
-          if (!existsSync2(memoryFile)) {
+          if (!existsSync3(memoryFile)) {
             ctx.renderer.printInfo("Memory is already empty");
             return;
           }
@@ -3204,20 +3206,20 @@ ${text}
         console.log(theme.heading("Config Files:"));
         console.log(`  Dir:        ${theme.accent(configDir)}`);
         const checkFile = (label, filePath) => {
-          const exists = existsSync2(filePath);
+          const exists = existsSync3(filePath);
           const icon = exists ? theme.success("\u2713") : theme.dim("\u2013");
           let extra = "";
           if (exists) {
             try {
-              extra = theme.dim(` (${statSync2(filePath).size} bytes)`);
+              extra = theme.dim(` (${statSync3(filePath).size} bytes)`);
             } catch {
             }
           }
           console.log(`  ${icon}  ${label.padEnd(14)} ${exists ? filePath : theme.dim("(not found)")}${extra}`);
         };
-        checkFile("config.json", join2(configDir, "config.json"));
-        checkFile("memory.md", join2(configDir, MEMORY_FILE_NAME));
-        checkFile("dev-state.md", join2(configDir, "dev-state.md"));
+        checkFile("config.json", join3(configDir, "config.json"));
+        checkFile("memory.md", join3(configDir, MEMORY_FILE_NAME));
+        checkFile("dev-state.md", join3(configDir, "dev-state.md"));
         console.log();
         const mcpManager = ctx.getMcpManager();
         if (mcpManager) {
@@ -3381,9 +3383,9 @@ ${text}
         let newFiles = 0;
         let modifiedFiles = 0;
         for (const [filePath, { earliest }] of fileMap) {
-          const currentContent = existsSync2(filePath) ? (() => {
+          const currentContent = existsSync3(filePath) ? (() => {
             try {
-              return readFileSync(filePath, "utf-8");
+              return readFileSync2(filePath, "utf-8");
             } catch {
               return null;
             }
@@ -3509,12 +3511,12 @@ Summary: ${fileMap.size} file(s) \u2014 ${newFiles} new, ${modifiedFiles} modifi
           if (scanAll) {
             const metas = ctx.sessions.listSessions();
             console.log(theme.info(`  Scanning ${metas.length} session(s)\u2026`));
-            const { readFileSync: readFileSync4 } = await import("fs");
-            const { join: join5 } = await import("path");
+            const { readFileSync: readFileSync5 } = await import("fs");
+            const { join: join6 } = await import("path");
             const historyDir = ctx.config.getHistoryDir();
             for (const m of metas) {
               try {
-                const content = readFileSync4(join5(historyDir, `${m.id}.json`), "utf-8");
+                const content = readFileSync5(join6(historyDir, `${m.id}.json`), "utf-8");
                 const hits2 = scanString(content, opts);
                 if (hits2.length) {
                   filesWithHits++;
@@ -4199,13 +4201,13 @@ Managing ${displayName} API Key`);
 };
 
 // src/repl/custom-commands.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2, readdirSync as readdirSync2, mkdirSync as mkdirSync3 } from "fs";
-import { join as join3, extname } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3, readdirSync as readdirSync2, mkdirSync as mkdirSync3 } from "fs";
+import { join as join4, extname } from "path";
 import { execSync as execSync3 } from "child_process";
 function parseCommandFile(filePath) {
   let content;
   try {
-    content = readFileSync2(filePath, "utf-8");
+    content = readFileSync3(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -4229,7 +4231,7 @@ function expandTemplate(template, args) {
   result = result.replace(/\{\{input\}\}/g, args.join(" "));
   result = result.replace(/\{\{file:([^}]+)\}\}/g, (_m, p) => {
     try {
-      return readFileSync2(p.trim(), "utf-8");
+      return readFileSync3(p.trim(), "utf-8");
     } catch {
       return `[Error: cannot read ${p.trim()}]`;
     }
@@ -4254,14 +4256,14 @@ var CustomCommandManager = class {
   commands = /* @__PURE__ */ new Map();
   loadCommands() {
     this.commands.clear();
-    if (!existsSync3(this.commandsDir)) {
+    if (!existsSync4(this.commandsDir)) {
       mkdirSync3(this.commandsDir, { recursive: true });
       return 0;
     }
     let count = 0;
     for (const file of readdirSync2(this.commandsDir)) {
       if (extname(file) !== ".md") continue;
-      const cmd = parseCommandFile(join3(this.commandsDir, file));
+      const cmd = parseCommandFile(join4(this.commandsDir, file));
       if (cmd) {
         this.commands.set(cmd.meta.name, cmd);
         count++;
@@ -4566,17 +4568,17 @@ function parseAtReferences(input2, cwd) {
     const absPath = resolve2(cwd, rawPath);
     const ext = extname2(rawPath).toLowerCase();
     const mime = IMAGE_MIME[ext];
-    if (!existsSync4(absPath)) {
+    if (!existsSync5(absPath)) {
       refs.push({ path: rawPath, type: "notfound" });
       continue;
     }
     if (mime) {
-      const fileSize = statSync3(absPath).size;
+      const fileSize = statSync4(absPath).size;
       if (fileSize > MAX_IMAGE_BYTES) {
         refs.push({ path: rawPath, type: "toolarge" });
         continue;
       }
-      const data = readFileSync3(absPath).toString("base64");
+      const data = readFileSync4(absPath).toString("base64");
       imageParts.push({
         type: "image_url",
         image_url: { url: `data:${mime};base64,${data}` }
@@ -4584,7 +4586,7 @@ function parseAtReferences(input2, cwd) {
       refs.push({ path: rawPath, type: "image" });
       textBody = textBody.replace(match[0], "").trim();
     } else {
-      const content = readFileSync3(absPath, "utf-8");
+      const content = readFileSync4(absPath, "utf-8");
       const inlined = `
 
 [File: ${rawPath}]
@@ -4809,12 +4811,12 @@ var Repl = class {
       const filtered = entries.filter((e) => !SKIP_DIRS_SET.has(e));
       for (let i = 0; i < filtered.length && entryCount < MAX_TREE_ENTRIES; i++) {
         const name = filtered[i];
-        const fullPath = join4(dir, name);
+        const fullPath = join5(dir, name);
         const isLast = i === filtered.length - 1;
         const connector = isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 ";
         let isDir;
         try {
-          isDir = statSync3(fullPath).isDirectory();
+          isDir = statSync4(fullPath).isDirectory();
         } catch {
           continue;
         }
@@ -4843,10 +4845,10 @@ ${treeLines.join("\n")}`
       for (const name of entries) {
         if (totalChars >= MAX_TOTAL_CHARS) break;
         if (SKIP_DIRS_SET.has(name)) continue;
-        const fullPath = join4(dir, name);
+        const fullPath = join5(dir, name);
         let st;
         try {
-          st = statSync3(fullPath);
+          st = statSync4(fullPath);
         } catch {
           continue;
         }
@@ -4858,7 +4860,7 @@ ${treeLines.join("\n")}`
           if (!TEXT_EXTS.has(ext) && !isSpecial) continue;
           if (st.size > MAX_FILE_CHARS * 3) continue;
           try {
-            let content = readFileSync3(fullPath, "utf-8");
+            let content = readFileSync4(fullPath, "utf-8");
             if (content.length > MAX_FILE_CHARS) {
               content = content.slice(0, MAX_FILE_CHARS) + `
 ... (truncated, ${content.length} chars total)`;
@@ -4888,12 +4890,12 @@ ${content}
    */
   addExtraContextDir(dirPath) {
     const absPath = resolve2(dirPath);
-    if (!existsSync4(absPath)) {
+    if (!existsSync5(absPath)) {
       return { success: false, charCount: 0, added: false, error: `Directory not found: ${dirPath}` };
     }
     let isDir;
     try {
-      isDir = statSync3(absPath).isDirectory();
+      isDir = statSync4(absPath).isDirectory();
     } catch {
       return { success: false, charCount: 0, added: false, error: `Cannot access: ${dirPath}` };
     }
@@ -4922,9 +4924,9 @@ ${content}
    */
   findContextFile(dir, candidates = CONTEXT_FILE_CANDIDATES) {
     for (const candidate of candidates) {
-      const fullPath = join4(dir, candidate);
-      if (existsSync4(fullPath)) {
-        const content = readFileSync3(fullPath, "utf-8").trim();
+      const fullPath = join5(dir, candidate);
+      if (existsSync5(fullPath)) {
+        const content = readFileSync4(fullPath, "utf-8").trim();
         if (content) return { filePath: fullPath, content };
       }
     }
@@ -4952,10 +4954,10 @@ ${content}
     const cwd = process.cwd();
     const gitRoot = getGitRoot(cwd);
     const projectRoot = gitRoot ?? cwd;
-    const mcpPath = join4(projectRoot, MCP_PROJECT_CONFIG_NAME);
-    if (!existsSync4(mcpPath)) return null;
+    const mcpPath = join5(projectRoot, MCP_PROJECT_CONFIG_NAME);
+    if (!existsSync5(mcpPath)) return null;
     try {
-      const raw = JSON.parse(readFileSync3(mcpPath, "utf-8"));
+      const raw = JSON.parse(readFileSync4(mcpPath, "utf-8"));
       const servers = raw?.mcpServers;
       if (!servers || typeof servers !== "object") {
         process.stderr.write(
@@ -5001,8 +5003,8 @@ ${content}
         );
         return { layers: [], mergedContent: "" };
       }
-      if (existsSync4(fullPath)) {
-        const content = readFileSync3(fullPath, "utf-8").trim();
+      if (existsSync5(fullPath)) {
+        const content = readFileSync4(fullPath, "utf-8").trim();
         if (content) {
           const layer = {
             level: "project",
@@ -5059,9 +5061,9 @@ ${content}
    * 超过 MEMORY_MAX_CHARS 时只取末尾最新部分。
    */
   loadMemoryContent() {
-    const memoryPath = join4(this.config.getConfigDir(), MEMORY_FILE_NAME);
-    if (!existsSync4(memoryPath)) return null;
-    let content = readFileSync3(memoryPath, "utf-8").trim();
+    const memoryPath = join5(this.config.getConfigDir(), MEMORY_FILE_NAME);
+    if (!existsSync5(memoryPath)) return null;
+    let content = readFileSync4(memoryPath, "utf-8").trim();
     if (!content) return null;
     if (content.length > MEMORY_MAX_CHARS) {
       content = content.slice(-MEMORY_MAX_CHARS);
@@ -5449,14 +5451,14 @@ Session '${this.resumeSessionId}' not found.
       process.stdout.write(theme.dim(`  \u{1F50C} Plugins loaded: ${pluginCount} tool(s) from plugins/
 `));
     }
-    const skillsDir = join4(this.config.getConfigDir(), SKILLS_DIR_NAME);
+    const skillsDir = join5(this.config.getConfigDir(), SKILLS_DIR_NAME);
     this.skillManager = new SkillManager(skillsDir, this.config.get("ui").skillSizeWarn);
     const skillCount = this.skillManager.loadSkills();
     if (skillCount > 0) {
       process.stdout.write(theme.dim(`  \u{1F3AF} Skills: ${skillCount} available (use /skill to manage)
 `));
     }
-    const commandsDir = join4(this.config.getConfigDir(), CUSTOM_COMMANDS_DIR_NAME);
+    const commandsDir = join5(this.config.getConfigDir(), CUSTOM_COMMANDS_DIR_NAME);
     this.customCommandManager = new CustomCommandManager(commandsDir);
     const customCmdCount = this.customCommandManager.loadCommands();
     if (customCmdCount > 0) {
@@ -6092,15 +6094,15 @@ Session '${this.resumeSessionId}' not found.
       const dir = normalized.includes("/") ? dirname3(normalized) : ".";
       const prefix = normalized.includes("/") ? basename2(normalized) : normalized;
       const absDir = resolve2(process.cwd(), dir);
-      if (!existsSync4(absDir)) return [];
+      if (!existsSync5(absDir)) return [];
       const entries = readdirSync3(absDir);
       const results = [];
       for (const entry of entries) {
         if (entry.startsWith(".")) continue;
         if (!entry.toLowerCase().startsWith(prefix.toLowerCase())) continue;
         try {
-          const fullPath = join4(absDir, entry);
-          const stat = statSync3(fullPath);
+          const fullPath = join5(absDir, entry);
+          const stat = statSync4(fullPath);
           const rel = dir === "." ? entry : `${dir}/${entry}`;
           results.push(stat.isDirectory() ? `${rel}/` : rel);
         } catch {
@@ -7269,7 +7271,7 @@ program.command("web").description("Start Web UI server with browser-based chat
     console.error("Error: Invalid port number. Must be between 1 and 65535.");
     process.exit(1);
   }
-  const { startWebServer } = await import("./server-LDPQ3DLK.js");
+  const { startWebServer } = await import("./server-L2MXWYF7.js");
   await startWebServer({ port, host: options.host });
 });
 program.command("user [action] [username]").description("Manage Web UI users (list | create <name> | delete <name> | reset-password <name> | logout-all <name> | migrate <name>)").action(async (action, username) => {

package/dist/{server-LDPQ3DLK.js → server-L2MXWYF7.js}

@@ -3528,12 +3528,9 @@ async function startWebServer(options = {}) {
       "Content-Security-Policy",
       [
         "default-src 'self'",
-        // v0.4.162: the client UI is driven by inline onclick= handlers and
-        // inline <script> blocks (SW registration, theme init). 'self' alone
-        // silently blocked EVERY button (click → nothing, no JS error, just a
-        // CSP violation in the console). localhost dev/admin tool — the
-        // unsafe-inline XSS surface is acceptable under that threat model.
-        "script-src 'self' 'unsafe-inline'",
+        // Inline event handlers and startup scripts live in app.js, so script
+        // execution stays locked to same-origin files only.
+        "script-src 'self'",
         "style-src 'self' 'unsafe-inline'",
         "img-src 'self' data: blob:",
         "font-src 'self' data:",

package/dist/web/client/actions.js

@@ -0,0 +1,84 @@
+/**
+ * Declarative Web UI actions and startup hooks.
+ * Kept separate from app.js so static and dynamic UI markup can avoid inline handlers.
+ */
+
+function handleDeclarativeAction(action, el) {
+  switch (action) {
+    case 'toggle-auth-mode': toggleAuthMode(); break;
+    case 'show-enable-auth': showEnableAuthDialog(); break;
+    case 'logout': handleLogout(); break;
+    case 'toggle-batch-select': toggleBatchSelect(); break;
+    case 'select-all-sessions': selectAllSessions(); break;
+    case 'batch-delete-selected': batchDeleteSelected(); break;
+    case 'start-hub': window.startHub(); break;
+    case 'abort-hub': window.abortHub(); break;
+    case 'close-sidebar': closeSidebar(); break;
+    case 'import-templates': importTemplates(); break;
+    case 'export-templates': exportTemplates(); break;
+    case 'show-add-template': showAddTemplate(); break;
+    case 'cancel-template-form': cancelTemplateForm(); break;
+    case 'save-template-form': saveTemplateForm(); break;
+    case 'confirm-response': window.respondConfirm(el.dataset.requestId, el.dataset.approved === 'true'); break;
+    case 'batch-confirm-response': window.respondBatchConfirm(el.dataset.requestId, el); break;
+    case 'batch-deny-response': window.respondBatchDeny(el.dataset.requestId, el); break;
+    case 'ask-user-response': window.respondAskUser(el.dataset.requestId); break;
+    case 'auto-pause-response': window.respondAutoPause(el.dataset.requestId, el.dataset.pauseAction); break;
+    case 'use-template': useTemplate(el.closest('[data-tpl-id]')?.dataset.tplId); break;
+    case 'edit-template': editTemplate(el.closest('[data-tpl-id]')?.dataset.tplId); break;
+    case 'delete-template': deleteTemplate(el.closest('[data-tpl-id]')?.dataset.tplId); break;
+    case 'insert-file-ref': insertFileRef(el.dataset.filePath || ''); break;
+    case 'show-full-preview':
+      if (el.previousElementSibling) el.previousElementSibling.style.maxHeight = 'none';
+      el.remove();
+      break;
+    case 'load-session': send({ type: 'command', name: 'session', args: ['load', el.dataset.sessionId] }); break;
+  }
+}
+
+document.addEventListener('click', (event) => {
+  const themeEl = event.target.closest('[data-theme-choice]');
+  if (themeEl) {
+    event.preventDefault();
+    window.setTheme(themeEl.dataset.themeChoice);
+    return;
+  }
+
+  const actionEl = event.target.closest('[data-action]');
+  if (!actionEl) return;
+  event.preventDefault();
+  handleDeclarativeAction(actionEl.dataset.action, actionEl);
+});
+
+document.addEventListener('keydown', (event) => {
+  if (event.key !== 'Enter') return;
+  const actionEl = event.target.closest('[data-enter-action]');
+  if (!actionEl) return;
+  event.preventDefault();
+  handleDeclarativeAction(actionEl.dataset.enterAction, actionEl);
+});
+
+document.getElementById('auth-form')?.addEventListener('submit', handleAuth);
+
+function registerServiceWorker() {
+  // Self-updating service worker (v0.4.159). A new SW postMessages
+  // 'sw-updated' (and triggers controllerchange) when it takes over; reload
+  // once so users do not stay on stale index.html/app.js after an upgrade.
+  if (!('serviceWorker' in navigator)) return;
+  let swReloaded = false;
+  const reloadOnce = () => {
+    if (!swReloaded) {
+      swReloaded = true;
+      location.reload();
+    }
+  };
+  navigator.serviceWorker.addEventListener('message', (e) => {
+    if (e.data && e.data.type === 'sw-updated') reloadOnce();
+  });
+  navigator.serviceWorker.addEventListener('controllerchange', reloadOnce);
+  navigator.serviceWorker.register('sw.js').then((reg) => {
+    reg.update();
+  }).catch(() => {});
+}
+
+registerServiceWorker();

package/dist/web/client/app.js

@@ -336,8 +336,8 @@ function handleConfirmRequest(msg) {
     </div>
     ${msg.diff ? `<div class="confirm-diff w-full">${renderDiffHtml(msg.diff)}</div>` : ''}
     <div class="flex gap-2 mt-2">
-      <button class="btn btn-success btn-sm btn-outline" onclick="respondConfirm('${msg.requestId}', true)">✓ Approve</button>
-      <button class="btn btn-error btn-sm btn-outline" onclick="respondConfirm('${msg.requestId}', false)">✗ Deny</button>
+      <button class="btn btn-success btn-sm btn-outline" data-action="confirm-response" data-request-id="${msg.requestId}" data-approved="true">✓ Approve</button>
+      <button class="btn btn-error btn-sm btn-outline" data-action="confirm-response" data-request-id="${msg.requestId}" data-approved="false">✗ Deny</button>
     </div>
   `;
   messagesEl.appendChild(el);
@@ -363,8 +363,8 @@ function handleBatchConfirmRequest(msg) {
     </div>
     <div class="w-full my-1">${fileListHtml}</div>
     <div class="flex gap-2 mt-2">
-      <button class="btn btn-success btn-sm btn-outline" onclick="respondBatchConfirm('${msg.requestId}', this)">✓ Approve Selected</button>
-      <button class="btn btn-error btn-sm btn-outline" onclick="respondBatchDeny('${msg.requestId}', this)">✗ Reject All</button>
+      <button class="btn btn-success btn-sm btn-outline" data-action="batch-confirm-response" data-request-id="${msg.requestId}">✓ Approve Selected</button>
+      <button class="btn btn-error btn-sm btn-outline" data-action="batch-deny-response" data-request-id="${msg.requestId}">✗ Reject All</button>
     </div>
   `;
   messagesEl.appendChild(el);
@@ -383,8 +383,8 @@ function handleAskUserRequest(msg) {
       <input type="text" id="ask-input-${msg.requestId}"
         class="input input-sm input-bordered flex-1"
         placeholder="Your answer..."
-        onkeydown="if(event.key==='Enter')respondAskUser('${msg.requestId}')">
-      <button class="btn btn-primary btn-sm" onclick="respondAskUser('${msg.requestId}')">Send</button>
+        data-enter-action="ask-user-response" data-request-id="${msg.requestId}">
+      <button class="btn btn-primary btn-sm" data-action="ask-user-response" data-request-id="${msg.requestId}">Send</button>
     </div>
   `;
   messagesEl.appendChild(el);
@@ -407,12 +407,12 @@ function handleAutoPauseRequest(msg) {
       <input type="text" id="pause-input-${msg.requestId}"
         class="input input-sm input-bordered flex-1"
         placeholder="Optional: redirect AI with a new instruction..."
-        onkeydown="if(event.key==='Enter')respondAutoPause('${msg.requestId}','redirect')">
+        data-enter-action="auto-pause-response" data-request-id="${msg.requestId}" data-pause-action="redirect">
     </div>
     <div class="flex gap-2">
-      <button class="btn btn-success btn-sm flex-1" onclick="respondAutoPause('${msg.requestId}','continue')">▶ Continue</button>
-      <button class="btn btn-primary btn-sm flex-1" onclick="respondAutoPause('${msg.requestId}','redirect')">↪ Redirect</button>
-      <button class="btn btn-error btn-sm flex-1" onclick="respondAutoPause('${msg.requestId}','stop')">⏹ Stop</button>
+      <button class="btn btn-success btn-sm flex-1" data-action="auto-pause-response" data-request-id="${msg.requestId}" data-pause-action="continue">▶ Continue</button>
+      <button class="btn btn-primary btn-sm flex-1" data-action="auto-pause-response" data-request-id="${msg.requestId}" data-pause-action="redirect">↪ Redirect</button>
+      <button class="btn btn-error btn-sm flex-1" data-action="auto-pause-response" data-request-id="${msg.requestId}" data-pause-action="stop">⏹ Stop</button>
     </div>
   `;
   messagesEl.appendChild(el);
@@ -666,6 +666,7 @@ window.setTheme = function(theme) {
 
 // ── UI helpers ─────────────────────────────────────────────────────
 
+
 function createAssistantMessage() {
   const el = document.createElement('div');
   el.className = 'msg-assistant';
@@ -714,11 +715,11 @@ function renderMarkdown(el, text) {
         const btn = document.createElement('button');
         btn.className = 'copy-code-btn btn btn-ghost btn-xs';
         btn.textContent = '📋 Copy';
-        btn.onclick = () => {
-          navigator.clipboard.writeText(block.textContent || '');
-          btn.textContent = '✓ Copied';
-          setTimeout(() => btn.textContent = '📋 Copy', 1500);
-        };
+        btn.addEventListener('click', () => {
+          navigator.clipboard.writeText(block.textContent || '');
+          btn.textContent = 'Copied';
+          setTimeout(() => btn.textContent = 'Copy', 1500);
+        });
         pre.style.position = 'relative';
         pre.appendChild(btn);
       }
@@ -1920,12 +1921,12 @@ function addImageToPreview(file) {
       <img src="${reader.result}" class="rounded max-h-16 max-w-[100px] object-contain border border-base-content/20" alt="${escapeHtml(file.name)}">
       <button class="btn btn-xs btn-circle btn-error absolute -top-1 -right-1 opacity-80" title="Remove">✕</button>
     `;
-    thumb.querySelector('button').onclick = () => {
+    thumb.querySelector('button').addEventListener('click', () => {
       const idx = pendingImages.findIndex(img => img.name === file.name && img.data === base64);
       if (idx >= 0) pendingImages.splice(idx, 1);
       thumb.remove();
       if (pendingImages.length === 0) imagePreviewArea.classList.add('hidden');
-    };
+    });
     imagePreviewArea.appendChild(thumb);
     imagePreviewArea.classList.remove('hidden');
   };
@@ -1991,189 +1992,6 @@ function handleMemoryContent(msg) {
 
 // ── Prompt Templates ───────────────────────────────────────────────
 
-const TEMPLATES_KEY = 'aicli-templates';
-
-function loadTemplates() {
-  try {
-    return JSON.parse(localStorage.getItem(TEMPLATES_KEY) || '[]');
-  } catch { return []; }
-}
-
-function saveTemplatesToStorage(templates) {
-  localStorage.setItem(TEMPLATES_KEY, JSON.stringify(templates));
-}
-
-function openTemplatesModal() {
-  const modal = document.getElementById('templates-modal');
-  if (!modal) return;
-  cancelTemplateForm();
-  renderTemplateList();
-  document.getElementById('template-search').value = '';
-  modal.showModal();
-}
-
-function renderTemplateList(filter) {
-  const listEl = document.getElementById('template-list');
-  if (!listEl) return;
-  const templates = loadTemplates();
-  const q = (filter || '').toLowerCase();
-  const filtered = q
-    ? templates.filter(t => t.name.toLowerCase().includes(q) || (t.tags || []).some(tag => tag.toLowerCase().includes(q)) || t.content.toLowerCase().includes(q))
-    : templates;
-
-  if (filtered.length === 0) {
-    listEl.innerHTML = `<div class="template-empty">${q ? 'No matching templates' : 'No templates yet. Click ＋ New to create one.'}</div>`;
-    return;
-  }
-
-  listEl.innerHTML = filtered.map(t => {
-    const preview = t.content.length > 80 ? t.content.slice(0, 80) + '...' : t.content;
-    const tagsHtml = (t.tags || []).map(tag => `<span class="template-item-tag">${escapeHtml(tag)}</span>`).join('');
-    return `
-      <div class="template-item" data-tpl-id="${t.id}" onclick="useTemplate('${t.id}')">
-        <div class="template-item-body">
-          <div class="template-item-name">${escapeHtml(t.name)}</div>
-          <div class="template-item-preview">${escapeHtml(preview)}</div>
-          ${tagsHtml ? `<div class="template-item-tags">${tagsHtml}</div>` : ''}
-        </div>
-        <div class="template-item-actions">
-          <button class="btn btn-xs btn-ghost" onclick="event.stopPropagation(); editTemplate('${t.id}')" title="Edit">✏️</button>
-          <button class="btn btn-xs btn-ghost" onclick="event.stopPropagation(); deleteTemplate('${t.id}')" title="Delete">🗑️</button>
-        </div>
-      </div>`;
-  }).join('');
-}
-
-function useTemplate(id) {
-  const templates = loadTemplates();
-  const tpl = templates.find(t => t.id === id);
-  if (!tpl) return;
-  userInput.value = tpl.content;
-  userInput.focus();
-  userInput.style.height = 'auto';
-  userInput.style.height = Math.min(userInput.scrollHeight, 200) + 'px';
-  document.getElementById('templates-modal')?.close();
-}
-
-function showAddTemplate() {
-  const form = document.getElementById('template-form');
-  form.classList.remove('hidden');
-  document.getElementById('tpl-edit-id').value = '';
-  document.getElementById('tpl-name').value = '';
-  document.getElementById('tpl-content').value = '';
-  document.getElementById('tpl-tags').value = '';
-  document.getElementById('tpl-name').focus();
-}
-
-function editTemplate(id) {
-  const templates = loadTemplates();
-  const tpl = templates.find(t => t.id === id);
-  if (!tpl) return;
-  const form = document.getElementById('template-form');
-  form.classList.remove('hidden');
-  document.getElementById('tpl-edit-id').value = tpl.id;
-  document.getElementById('tpl-name').value = tpl.name;
-  document.getElementById('tpl-content').value = tpl.content;
-  document.getElementById('tpl-tags').value = (tpl.tags || []).join(', ');
-  document.getElementById('tpl-name').focus();
-}
-
-function cancelTemplateForm() {
-  document.getElementById('template-form')?.classList.add('hidden');
-}
-
-function saveTemplateForm() {
-  const name = document.getElementById('tpl-name').value.trim();
-  const content = document.getElementById('tpl-content').value.trim();
-  const tagsRaw = document.getElementById('tpl-tags').value.trim();
-  const editId = document.getElementById('tpl-edit-id').value;
-
-  if (!name || !content) return;
-
-  const tags = tagsRaw ? tagsRaw.split(',').map(s => s.trim()).filter(Boolean) : [];
-  const templates = loadTemplates();
-
-  if (editId) {
-    const idx = templates.findIndex(t => t.id === editId);
-    if (idx >= 0) {
-      templates[idx].name = name;
-      templates[idx].content = content;
-      templates[idx].tags = tags;
-    }
-  } else {
-    templates.unshift({
-      id: 'tpl-' + Date.now().toString(36) + Math.random().toString(36).slice(2, 6),
-      name,
-      content,
-      tags,
-      createdAt: new Date().toISOString(),
-    });
-  }
-
-  saveTemplatesToStorage(templates);
-  cancelTemplateForm();
-  renderTemplateList();
-}
-
-function deleteTemplate(id) {
-  const templates = loadTemplates().filter(t => t.id !== id);
-  saveTemplatesToStorage(templates);
-  renderTemplateList(document.getElementById('template-search')?.value);
-}
-
-function exportTemplates() {
-  const templates = loadTemplates();
-  if (templates.length === 0) return;
-  const blob = new Blob([JSON.stringify(templates, null, 2)], { type: 'application/json' });
-  const url = URL.createObjectURL(blob);
-  const a = document.createElement('a');
-  a.href = url;
-  a.download = `aicli-templates-${new Date().toISOString().slice(0, 10)}.json`;
-  a.click();
-  URL.revokeObjectURL(url);
-}
-
-function importTemplates() {
-  const input = document.createElement('input');
-  input.type = 'file';
-  input.accept = '.json';
-  input.onchange = () => {
-    const file = input.files[0];
-    if (!file) return;
-    const reader = new FileReader();
-    reader.onload = () => {
-      try {
-        const imported = JSON.parse(reader.result);
-        if (!Array.isArray(imported)) throw new Error('Not an array');
-        const existing = loadTemplates();
-        const existingIds = new Set(existing.map(t => t.id));
-        let added = 0;
-        for (const t of imported) {
-          if (t.id && t.name && t.content && !existingIds.has(t.id)) {
-            existing.push(t);
-            added++;
-          }
-        }
-        saveTemplatesToStorage(existing);
-        renderTemplateList();
-        addInfoMessage(`📥 Imported ${added} template(s).`);
-      } catch {
-        addErrorMessage('Failed to import templates: invalid JSON format.');
-      }
-    };
-    reader.readAsText(file);
-  };
-  input.click();
-}
-
-// Template button + search binding
-document.getElementById('btn-templates')?.addEventListener('click', openTemplatesModal);
-document.getElementById('template-search')?.addEventListener('input', (e) => {
-  renderTemplateList(e.target.value);
-});
-
-// ── File Tree ──────────────────────────────────────────────────────
-
 const fileTreeEl = document.getElementById('file-tree');
 const fileTreeCwdEl = document.getElementById('file-tree-cwd');
 const btnFileTreeRefresh = document.getElementById('btn-file-tree-refresh');
@@ -2324,10 +2142,10 @@ async function previewFileInChat(filePath) {
       <div class="flex items-center gap-2 mb-1">
         <span class="text-xs font-semibold opacity-70">📄 ${escapeHtml(filePath)}</span>
         <span class="badge badge-ghost badge-xs">${sizeKb} KB</span>
-        <button class="btn btn-xs btn-ghost ml-auto opacity-50" onclick="insertFileRef('${escapeHtml(filePath).replace(/'/g, "\\'")}')">Insert @ref</button>
+        <button class="btn btn-xs btn-ghost ml-auto opacity-50" data-action="insert-file-ref" data-file-path="${escapeHtml(filePath)}">Insert @ref</button>
       </div>
       <pre style="max-height:300px"><code class="language-${escapeHtml(ext)}">${escapeHtml(data.content)}</code></pre>
-      <button class="btn btn-xs btn-ghost mt-1 opacity-50 text-xs" onclick="this.previousElementSibling.style.maxHeight='none';this.remove()">▼ Show all</button>
+      <button class="btn btn-xs btn-ghost mt-1 opacity-50 text-xs" data-action="show-full-preview">▼ Show all</button>
     `;
     el.querySelectorAll('pre code').forEach(block => {
       try { hljs.highlightElement(block); } catch {}
@@ -3308,7 +3126,7 @@ function hubDone(msg) {
   document.getElementById('hub-abort-btn').classList.add('hidden');
   const status = document.getElementById('hub-status');
   if (msg.saved && msg.sessionId) {
-    status.innerHTML = `Saved. <a class="link link-primary" onclick="send({type:'command',name:'session',args:['load','${msg.sessionId}']})">Open session</a>`;
+    status.innerHTML = `Saved. <a class="link link-primary" data-action="load-session" data-session-id="${msg.sessionId}">Open session</a>`;
   } else {
     status.textContent = msg.saved ? 'Saved to history.' : 'Done (not saved).';
   }

package/dist/web/client/index.html

@@ -36,7 +36,7 @@
         <p id="auth-subtitle" class="text-sm text-base-content/60 mt-1">Sign in to continue</p>
       </div>
       <div id="auth-error" class="alert alert-error text-sm mb-4 hidden"></div>
-      <form id="auth-form" onsubmit="handleAuth(event)">
+      <form id="auth-form" >
         <div class="form-control mb-3">
           <label class="label"><span class="label-text">Username</span></label>
           <input id="auth-username" type="text" class="input input-bordered w-full" placeholder="username" autocomplete="username" required minlength="2" maxlength="32">
@@ -48,7 +48,7 @@
         <button id="auth-submit" type="submit" class="btn btn-primary w-full">Sign In</button>
       </form>
       <div class="text-center mt-4">
-        <button id="auth-toggle" class="btn btn-ghost btn-sm" onclick="toggleAuthMode()">
+        <button id="auth-toggle" class="btn btn-ghost btn-sm" data-action="toggle-auth-mode" type="button">
           Don't have an account? <span class="text-primary">Register</span>
         </button>
       </div>
@@ -76,18 +76,18 @@
         <div class="dropdown dropdown-end">
           <div tabindex="0" role="button" class="btn btn-sm btn-ghost">🎨</div>
           <ul tabindex="0" class="dropdown-content menu bg-base-200 rounded-box z-10 w-40 p-2 shadow-lg border border-base-content/10">
-            <li><a onclick="setTheme('dark')">🌙 Dark</a></li>
-            <li><a onclick="setTheme('night')">🌃 Night</a></li>
-            <li><a onclick="setTheme('dim')">🌑 Dim</a></li>
-            <li><a onclick="setTheme('synthwave')">🎵 Synthwave</a></li>
-            <li><a onclick="setTheme('cyberpunk')">🤖 Cyberpunk</a></li>
-            <li><a onclick="setTheme('light')">☀️ Light</a></li>
-            <li><a onclick="setTheme('cupcake')">🧁 Cupcake</a></li>
-            <li><a onclick="setTheme('nord')">❄️ Nord</a></li>
+            <li><a data-theme-choice="dark">🌙 Dark</a></li>
+            <li><a data-theme-choice="night">🌃 Night</a></li>
+            <li><a data-theme-choice="dim">🌑 Dim</a></li>
+            <li><a data-theme-choice="synthwave">🎵 Synthwave</a></li>
+            <li><a data-theme-choice="cyberpunk">🤖 Cyberpunk</a></li>
+            <li><a data-theme-choice="light">☀️ Light</a></li>
+            <li><a data-theme-choice="cupcake">🧁 Cupcake</a></li>
+            <li><a data-theme-choice="nord">❄️ Nord</a></li>
           </ul>
         </div>
         <!-- Enable Auth button (shown when no users registered) -->
-        <button id="btn-enable-auth" class="btn btn-sm btn-ghost hidden" title="Enable multi-user auth" onclick="showEnableAuthDialog()">👤 Enable Auth</button>
+        <button id="btn-enable-auth" class="btn btn-sm btn-ghost hidden" title="Enable multi-user auth" data-action="show-enable-auth">👤 Enable Auth</button>
         <!-- User menu (shown when authenticated) -->
         <div id="user-menu" class="dropdown dropdown-end hidden">
           <div tabindex="0" role="button" class="btn btn-sm btn-ghost gap-1">
@@ -95,7 +95,7 @@
           </div>
           <ul tabindex="0" class="dropdown-content menu bg-base-200 rounded-box z-10 w-40 p-2 shadow-lg border border-base-content/10">
             <li><a id="user-label" class="text-sm font-semibold pointer-events-none"></a></li>
-            <li><a onclick="handleLogout()">🚪 Logout</a></li>
+            <li><a data-action="logout">🚪 Logout</a></li>
           </ul>
         </div>
       </div>
@@ -119,16 +119,16 @@
         <div id="tab-sessions" class="sidebar-tab-content flex flex-col flex-1 overflow-hidden">
           <div class="p-2 border-b border-base-content/10 flex items-center justify-between gap-1">
             <input id="session-search" type="text" class="input input-xs input-bordered flex-1 min-w-0" placeholder="Search...">
-            <button id="btn-batch-select" class="btn btn-xs btn-ghost flex-shrink-0" title="Select multiple" onclick="toggleBatchSelect()">☑</button>
+            <button id="btn-batch-select" class="btn btn-xs btn-ghost flex-shrink-0" title="Select multiple" data-action="toggle-batch-select">☑</button>
             <button id="btn-new-session" class="btn btn-xs btn-primary btn-outline flex-shrink-0 whitespace-nowrap" title="New session">+ New</button>
           </div>
           <!-- Batch action bar (hidden by default) -->
           <div id="batch-bar" class="hidden px-2 py-1 border-b border-base-content/10 flex items-center gap-1 bg-base-300 text-xs">
             <span class="batch-count opacity-60">0 selected</span>
             <span class="flex-1"></span>
-            <button class="btn btn-xs btn-ghost" onclick="selectAllSessions()">All</button>
-            <button class="btn btn-xs btn-error btn-outline" onclick="batchDeleteSelected()">🗑 Delete</button>
-            <button class="btn btn-xs btn-ghost" onclick="toggleBatchSelect()">Cancel</button>
+            <button class="btn btn-xs btn-ghost" data-action="select-all-sessions">All</button>
+            <button class="btn btn-xs btn-error btn-outline" data-action="batch-delete-selected">🗑 Delete</button>
+            <button class="btn btn-xs btn-ghost" data-action="toggle-batch-select">Cancel</button>
           </div>
           <div id="session-list" class="flex-1 overflow-y-auto p-2 flex flex-col gap-1 text-sm">
             <div class="text-xs opacity-40 text-center py-4">No sessions yet</div>
@@ -216,8 +216,8 @@
             <label class="flex items-center gap-2 text-xs cursor-pointer">
               <input id="hub-lanes" type="checkbox" class="checkbox checkbox-xs"> Lanes view (one column per agent)
             </label>
-            <button id="hub-start-btn" class="btn btn-primary btn-sm w-full" onclick="startHub()">🏛 Start discussion</button>
-            <button id="hub-abort-btn" class="btn btn-error btn-outline btn-xs w-full hidden" onclick="abortHub()">⏹ Stop</button>
+            <button id="hub-start-btn" class="btn btn-primary btn-sm w-full" data-action="start-hub">🏛 Start discussion</button>
+            <button id="hub-abort-btn" class="btn btn-error btn-outline btn-xs w-full hidden" data-action="abort-hub">⏹ Stop</button>
             <div id="hub-status" class="text-xs opacity-60"></div>
           </div>
         </div>
@@ -225,7 +225,7 @@
       <!-- Sidebar resize handle -->
       <div id="sidebar-resize" class="sidebar-resize-handle" title="Drag to resize sidebar"></div>
       <!-- Sidebar backdrop (mobile overlay) -->
-      <div id="sidebar-backdrop" class="sidebar-backdrop hidden" onclick="closeSidebar()"></div>
+      <div id="sidebar-backdrop" class="sidebar-backdrop hidden" data-action="close-sidebar"></div>
 
       <!-- Chat Area -->
       <div class="flex-1 flex flex-col overflow-hidden">
@@ -293,9 +293,9 @@
       <div class="flex items-center justify-between mb-3">
         <h3 class="font-bold text-lg">📝 Prompt Templates</h3>
         <div class="flex gap-1">
-          <button class="btn btn-xs btn-ghost" onclick="importTemplates()" title="Import">📥 Import</button>
-          <button class="btn btn-xs btn-ghost" onclick="exportTemplates()" title="Export">📤 Export</button>
-          <button class="btn btn-xs btn-ghost" onclick="showAddTemplate()" title="New template">＋ New</button>
+          <button class="btn btn-xs btn-ghost" data-action="import-templates" title="Import">📥 Import</button>
+          <button class="btn btn-xs btn-ghost" data-action="export-templates" title="Export">📤 Export</button>
+          <button class="btn btn-xs btn-ghost" data-action="show-add-template" title="New template">＋ New</button>
         </div>
       </div>
 
@@ -305,8 +305,8 @@
         <textarea id="tpl-content" class="textarea textarea-bordered w-full text-sm mb-2" rows="4" placeholder="Prompt content..."></textarea>
         <input id="tpl-tags" type="text" class="input input-sm input-bordered w-full mb-2" placeholder="Tags (comma-separated, optional)">
         <div class="flex gap-2 justify-end">
-          <button class="btn btn-sm btn-ghost" onclick="cancelTemplateForm()">Cancel</button>
-          <button class="btn btn-sm btn-primary" onclick="saveTemplateForm()">Save</button>
+          <button class="btn btn-sm btn-ghost" data-action="cancel-template-form">Cancel</button>
+          <button class="btn btn-sm btn-primary" data-action="save-template-form">Save</button>
         </div>
         <input type="hidden" id="tpl-edit-id">
       </div>
@@ -338,23 +338,8 @@
     <form method="dialog" class="modal-backdrop"><button>close</button></form>
   </dialog>
 
-  <script src="app.js"></script>
-  <script>
-    // Self-updating service worker (v0.4.159). A new SW postMessages
-    // 'sw-updated' (and triggers controllerchange) when it takes over; we
-    // reload once so the user never gets stuck on a stale index.html/app.js
-    // after upgrading aicli. index.html/app.js are also network-only in sw.js.
-    if ('serviceWorker' in navigator) {
-      let swReloaded = false;
-      const reloadOnce = () => { if (!swReloaded) { swReloaded = true; location.reload(); } };
-      navigator.serviceWorker.addEventListener('message', (e) => {
-        if (e.data && e.data.type === 'sw-updated') reloadOnce();
-      });
-      navigator.serviceWorker.addEventListener('controllerchange', reloadOnce);
-      navigator.serviceWorker.register('sw.js').then((reg) => {
-        reg.update();
-      }).catch(() => {});
-    }
-  </script>
+  <script src="app.js"></script>
+  <script src="templates.js"></script>
+  <script src="actions.js"></script>
 </body>
 </html>

package/dist/web/client/sw.js

@@ -16,7 +16,7 @@ const CACHE_NAME = 'aicli-v3';
 // HTML/JS that must always be fresh — never served from the SW cache, so an
 // upgraded server is reflected on the very next load. Other assets (vendored
 // CSS/JS, icons) are large + content-stable and fine to cache.
-const NEVER_CACHE = new Set(['/', '/index.html', '/app.js']);
+const NEVER_CACHE = new Set(['/', '/index.html', '/app.js', '/templates.js', '/actions.js']);
 
 // App shell to precache (offline-capable startup). Deliberately EXCLUDES the
 // always-fresh HTML/JS in NEVER_CACHE — only large content-stable assets.

package/dist/web/client/templates.js

@@ -0,0 +1,188 @@
+/**
+ * Prompt template modal and import/export helpers.
+ * Loaded after app.js so it can use shared UI helpers.
+ */
+
+const TEMPLATES_KEY = 'aicli-templates';
+
+function loadTemplates() {
+  try {
+    return JSON.parse(localStorage.getItem(TEMPLATES_KEY) || '[]');
+  } catch {
+    return [];
+  }
+}
+
+function saveTemplatesToStorage(templates) {
+  localStorage.setItem(TEMPLATES_KEY, JSON.stringify(templates));
+}
+
+function openTemplatesModal() {
+  const modal = document.getElementById('templates-modal');
+  if (!modal) return;
+  cancelTemplateForm();
+  renderTemplateList();
+  document.getElementById('template-search').value = '';
+  modal.showModal();
+}
+
+function renderTemplateList(filter) {
+  const listEl = document.getElementById('template-list');
+  if (!listEl) return;
+  const templates = loadTemplates();
+  const q = (filter || '').toLowerCase();
+  const filtered = q
+    ? templates.filter(t => t.name.toLowerCase().includes(q) || (t.tags || []).some(tag => tag.toLowerCase().includes(q)) || t.content.toLowerCase().includes(q))
+    : templates;
+
+  if (filtered.length === 0) {
+    listEl.innerHTML = `<div class="template-empty">${q ? 'No matching templates' : 'No templates yet. Click + New to create one.'}</div>`;
+    return;
+  }
+
+  listEl.innerHTML = filtered.map(t => {
+    const preview = t.content.length > 80 ? t.content.slice(0, 80) + '...' : t.content;
+    const tagsHtml = (t.tags || []).map(tag => `<span class="template-item-tag">${escapeHtml(tag)}</span>`).join('');
+    return `
+      <div class="template-item" data-tpl-id="${t.id}" data-action="use-template">
+        <div class="template-item-body">
+          <div class="template-item-name">${escapeHtml(t.name)}</div>
+          <div class="template-item-preview">${escapeHtml(preview)}</div>
+          ${tagsHtml ? `<div class="template-item-tags">${tagsHtml}</div>` : ''}
+        </div>
+        <div class="template-item-actions">
+          <button class="btn btn-xs btn-ghost" data-action="edit-template" title="Edit">Edit</button>
+          <button class="btn btn-xs btn-ghost" data-action="delete-template" title="Delete">Delete</button>
+        </div>
+      </div>`;
+  }).join('');
+}
+
+function useTemplate(id) {
+  const templates = loadTemplates();
+  const tpl = templates.find(t => t.id === id);
+  if (!tpl) return;
+  const input = document.getElementById('user-input');
+  if (!input) return;
+  input.value = tpl.content;
+  input.focus();
+  input.style.height = 'auto';
+  input.style.height = Math.min(input.scrollHeight, 200) + 'px';
+  document.getElementById('templates-modal')?.close();
+}
+
+function showAddTemplate() {
+  const form = document.getElementById('template-form');
+  form.classList.remove('hidden');
+  document.getElementById('tpl-edit-id').value = '';
+  document.getElementById('tpl-name').value = '';
+  document.getElementById('tpl-content').value = '';
+  document.getElementById('tpl-tags').value = '';
+  document.getElementById('tpl-name').focus();
+}
+
+function editTemplate(id) {
+  const templates = loadTemplates();
+  const tpl = templates.find(t => t.id === id);
+  if (!tpl) return;
+  const form = document.getElementById('template-form');
+  form.classList.remove('hidden');
+  document.getElementById('tpl-edit-id').value = tpl.id;
+  document.getElementById('tpl-name').value = tpl.name;
+  document.getElementById('tpl-content').value = tpl.content;
+  document.getElementById('tpl-tags').value = (tpl.tags || []).join(', ');
+  document.getElementById('tpl-name').focus();
+}
+
+function cancelTemplateForm() {
+  document.getElementById('template-form')?.classList.add('hidden');
+}
+
+function saveTemplateForm() {
+  const name = document.getElementById('tpl-name').value.trim();
+  const content = document.getElementById('tpl-content').value.trim();
+  const tagsRaw = document.getElementById('tpl-tags').value.trim();
+  const editId = document.getElementById('tpl-edit-id').value;
+
+  if (!name || !content) return;
+
+  const tags = tagsRaw ? tagsRaw.split(',').map(s => s.trim()).filter(Boolean) : [];
+  const templates = loadTemplates();
+
+  if (editId) {
+    const idx = templates.findIndex(t => t.id === editId);
+    if (idx >= 0) {
+      templates[idx].name = name;
+      templates[idx].content = content;
+      templates[idx].tags = tags;
+    }
+  } else {
+    templates.unshift({
+      id: 'tpl-' + Date.now().toString(36) + Math.random().toString(36).slice(2, 6),
+      name,
+      content,
+      tags,
+      createdAt: new Date().toISOString(),
+    });
+  }
+
+  saveTemplatesToStorage(templates);
+  cancelTemplateForm();
+  renderTemplateList();
+}
+
+function deleteTemplate(id) {
+  const templates = loadTemplates().filter(t => t.id !== id);
+  saveTemplatesToStorage(templates);
+  renderTemplateList(document.getElementById('template-search')?.value);
+}
+
+function exportTemplates() {
+  const templates = loadTemplates();
+  if (templates.length === 0) return;
+  const blob = new Blob([JSON.stringify(templates, null, 2)], { type: 'application/json' });
+  const url = URL.createObjectURL(blob);
+  const a = document.createElement('a');
+  a.href = url;
+  a.download = `aicli-templates-${new Date().toISOString().slice(0, 10)}.json`;
+  a.click();
+  URL.revokeObjectURL(url);
+}
+
+function importTemplates() {
+  const input = document.createElement('input');
+  input.type = 'file';
+  input.accept = '.json';
+  input.addEventListener('change', () => {
+    const file = input.files[0];
+    if (!file) return;
+    const reader = new FileReader();
+    reader.addEventListener('load', () => {
+      try {
+        const imported = JSON.parse(reader.result);
+        if (!Array.isArray(imported)) throw new Error('Not an array');
+        const existing = loadTemplates();
+        const existingIds = new Set(existing.map(t => t.id));
+        let added = 0;
+        for (const t of imported) {
+          if (t.id && t.name && t.content && !existingIds.has(t.id)) {
+            existing.push(t);
+            added++;
+          }
+        }
+        saveTemplatesToStorage(existing);
+        renderTemplateList();
+        addInfoMessage(`Imported ${added} template(s).`);
+      } catch {
+        addErrorMessage('Failed to import templates: invalid JSON format.');
+      }
+    });
+    reader.readAsText(file);
+  });
+  input.click();
+}
+
+document.getElementById('btn-templates')?.addEventListener('click', openTemplatesModal);
+document.getElementById('template-search')?.addEventListener('input', (e) => {
+  renderTemplateList(e.target.value);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jinzd-ai-cli",
-  "version": "0.4.206",
+  "version": "0.4.207",
   "description": "Cross-platform REPL-style AI CLI with multi-provider support",
   "type": "module",
   "main": "./dist/index.js",