jinzd-ai-cli 0.4.208 → 0.4.210

package/dist/electron-server.js

@@ -3,7 +3,7 @@ import {
 } from "./chunk-SKET65WZ.js";
 import {
   indexProject
-} from "./chunk-SQB66GP6.js";
+} from "./chunk-BNERFXVO.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
   APP_NAME,
@@ -12,6 +12,7 @@ import {
   CONFIG_DIR_NAME,
   CONFIG_FILE_NAME,
   CONTEXT_FILE_CANDIDATES,
+  CONTEXT_FILE_MAX_BYTES,
   CUSTOM_COMMANDS_DIR_NAME,
   DEFAULT_MAX_TOKENS,
   DEFAULT_MAX_TOOL_OUTPUT_CHARS_CAP,
@@ -36,7 +37,7 @@ import {
   VERSION,
   buildUserIdentityPrompt,
   runTestsTool
-} from "./chunk-QDY72ABW.js";
+} from "./chunk-HZQVX7VF.js";
 import {
   hasSemanticIndex,
   semanticSearch
@@ -59,12 +60,12 @@ import {
 import express from "express";
 import { createServer } from "http";
 import { WebSocketServer } from "ws";
-import { join as join17, dirname as dirname6, resolve as resolve6, relative as relative3, sep as sep3 } from "path";
-import { existsSync as existsSync23, readFileSync as readFileSync16, readdirSync as readdirSync11, statSync as statSync9, realpathSync } from "fs";
+import { join as join19, dirname as dirname6, resolve as resolve7, relative as relative4, sep as sep3 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync19, readdirSync as readdirSync12, statSync as statSync10, realpathSync } from "fs";
 import { networkInterfaces } from "os";
 
 // src/config/config-manager.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { readFileSync, existsSync, mkdirSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 
@@ -172,10 +173,15 @@ var ConfigSchema = z.object({
     systemPrompt: z.string().optional()
   }).default({}),
   // 项目上下文文件配置
-  // 启动时自动读取并注入 system prompt，类似 Claude Code 的 CLAUDE.md 机制
-  // 默认按顺序查找：AICLI.md → CLAUDE.md → .aicli/context.md
-  // 设为 false 可禁用此功能
+  // 启动时自动读取并注入 system prompt，类似 Claude Code 的 CLAUDE.md / Codex AGENTS.md 机制
+  // 默认按顺序查找：AICLI.override.md → AGENTS.override.md → AICLI.md → CLAUDE.md → AGENTS.md
+  // 设为 false 可禁用此功能；指定字符串时仅加载 cwd 下的该文件
   contextFile: z.union([z.string(), z.literal(false)]).default("auto"),
+  context: z.object({
+    projectDocFallbackFilenames: z.array(z.string()).default([]),
+    projectDocMaxBytes: z.number().int().positive().default(32 * 1024),
+    showLoadedContextSources: z.boolean().default(false)
+  }).default({}),
   // Google Custom Search API 的 Search Engine ID (cx 参数)
   // API Key 通过 apiKeys['google-search'] 或 AICLI_API_KEY_GOOGLESEARCH 环境变量配置
   // CX 也可通过 AICLI_GOOGLE_CX 环境变量覆盖
@@ -503,7 +509,7 @@ ${err}`
   }
   save() {
     mkdirSync(this.configDir, { recursive: true });
-    writeFileSync(this.configPath, JSON.stringify(this.config, null, 2), "utf-8");
+    atomicWriteFileSync(this.configPath, JSON.stringify(this.config, null, 2));
   }
   getApiKey(providerId) {
     const envKey = EnvLoader.getApiKey(providerId);
@@ -4736,7 +4742,7 @@ import { platform as platform2 } from "os";
 import { resolve } from "path";
 
 // src/tools/undo-stack.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, unlinkSync as unlinkSync2, rmdirSync, existsSync as existsSync3 } from "fs";
+import { readFileSync as readFileSync3, writeFileSync, unlinkSync as unlinkSync2, rmdirSync, existsSync as existsSync3 } from "fs";
 var MAX_UNDO_DEPTH = 20;
 var UndoStack = class {
   stack = [];
@@ -4819,7 +4825,7 @@ var UndoStack = class {
           return { entry, result: `Deleted newly created file: ${entry.filePath}` };
         }
       } else {
-        writeFileSync2(entry.filePath, entry.previousContent, "utf-8");
+        writeFileSync(entry.filePath, entry.previousContent, "utf-8");
         const lines = entry.previousContent.split("\n").length;
         return {
           entry,
@@ -6489,7 +6495,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(prompt);
     this.confirming = true;
-    return new Promise((resolve7) => {
+    return new Promise((resolve8) => {
       let completed = false;
       const cleanup = (result) => {
         if (completed) return;
@@ -6499,7 +6505,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve7(result);
+        resolve8(result);
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -6673,7 +6679,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(color("Proceed? [y/N] (type y + Enter to confirm) "));
     this.confirming = true;
-    return new Promise((resolve7) => {
+    return new Promise((resolve8) => {
       let completed = false;
       const cleanup = (answer) => {
         if (completed) return;
@@ -6683,7 +6689,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve7(answer === "y");
+        resolve8(answer === "y");
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -6864,7 +6870,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
     const mode = appendMode ? "appended" : "written";
     void (async () => {
       try {
-        const { updateFile } = await import("./indexer-BMYUUDLH.js");
+        const { updateFile } = await import("./indexer-4WWS3VIL.js");
         await updateFile(process.cwd(), filePath);
       } catch {
       }
@@ -7666,7 +7672,7 @@ function collectFilePaths(rootPath, filePattern, maxFiles) {
   walk(rootPath);
   return paths;
 }
-async function searchInFileAsync(fullPath, displayPath, regex, contextLines, maxResults) {
+async function searchInFileAsync(fullPath, displayPath2, regex, contextLines, maxResults) {
   let content;
   try {
     content = await readFile(fullPath, "utf-8");
@@ -7680,7 +7686,7 @@ async function searchInFileAsync(fullPath, displayPath, regex, contextLines, max
     regex.lastIndex = 0;
     if (regex.test(lines[i])) {
       const match = {
-        file: displayPath.replace(/\\/g, "/"),
+        file: displayPath2.replace(/\\/g, "/"),
         lineNumber: i + 1,
         lineText: lines[i]
       };
@@ -7699,7 +7705,7 @@ async function searchInFileAsync(fullPath, displayPath, regex, contextLines, max
   }
   return results;
 }
-function searchInFile(fullPath, displayPath, regex, contextLines, maxResults, results) {
+function searchInFile(fullPath, displayPath2, regex, contextLines, maxResults, results) {
   try {
     const stat = statSync4(fullPath);
     if (stat.size > 1e6) return;
@@ -7719,7 +7725,7 @@ function searchInFile(fullPath, displayPath, regex, contextLines, maxResults, re
     regex.lastIndex = 0;
     if (regex.test(lines[i])) {
       const result = {
-        file: displayPath,
+        file: displayPath2,
         lineNumber: i + 1,
         lineText: lines[i].trimEnd()
       };
@@ -7932,7 +7938,7 @@ var runInteractiveTool = {
       PYTHONDONTWRITEBYTECODE: "1"
     };
     const prefixWarnings = [argsTypeWarning, stdinTypeWarning].filter(Boolean).join("");
-    return new Promise((resolve7) => {
+    return new Promise((resolve8) => {
       const child = spawn2(executable, cmdArgs.map(String), {
         cwd: process.cwd(),
         env,
@@ -7965,22 +7971,22 @@ var runInteractiveTool = {
       setTimeout(writeNextLine, 400);
       const timer = setTimeout(() => {
         child.kill();
-        resolve7(`${prefixWarnings}[Timeout after ${timeout}ms]
+        resolve8(`${prefixWarnings}[Timeout after ${timeout}ms]
 ${buildOutput(stdout, stderr)}`);
       }, timeout);
       child.on("close", (code) => {
         clearTimeout(timer);
         const output = buildOutput(stdout, stderr);
         if (code !== 0 && code !== null) {
-          resolve7(`${prefixWarnings}Exit code ${code}:
+          resolve8(`${prefixWarnings}Exit code ${code}:
 ${output}`);
         } else {
-          resolve7(`${prefixWarnings}${output || "(no output)"}`);
+          resolve8(`${prefixWarnings}${output || "(no output)"}`);
         }
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve7(
+        resolve8(
           `${prefixWarnings}Failed to start process "${executable}": ${err.message}
 Hint: On Windows, use the full path to the executable, e.g.:
   C:\\Users\\Jinzd\\anaconda3\\envs\\python312\\python.exe`
@@ -8648,7 +8654,7 @@ Any of these triggers means use save_last_response, NOT write_file:
 };
 
 // src/tools/builtin/save-memory.ts
-import { existsSync as existsSync12, statSync as statSync6, appendFileSync as appendFileSync2, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync9, statSync as statSync6, mkdirSync as mkdirSync6 } from "fs";
 import { join as join7 } from "path";
 import { homedir as homedir5 } from "os";
 function getMemoryFilePath() {
@@ -8685,7 +8691,8 @@ var saveMemoryTool = {
 ## ${timestamp}
 ${content}
 `;
-    appendFileSync2(memoryPath, entry, "utf-8");
+    const previous = existsSync12(memoryPath) ? readFileSync9(memoryPath, "utf-8") : "";
+    atomicWriteFileSync(memoryPath, previous + entry);
     const byteSize = statSync6(memoryPath).size;
     return `Memory saved successfully. File size: ${byteSize} bytes in ${MEMORY_FILE_NAME}`;
   }
@@ -8731,7 +8738,7 @@ function promptUser(rl, question) {
   console.log();
   console.log(chalk4.cyan("\u2753 ") + chalk4.bold(question));
   process.stdout.write(chalk4.cyan("> "));
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let completed = false;
     const cleanup = (answer) => {
       if (completed) return;
@@ -8741,7 +8748,7 @@ function promptUser(rl, question) {
       rl.pause();
       rlAny.output = savedOutput;
       askUserContext.prompting = false;
-      resolve7(answer);
+      resolve8(answer);
     };
     const onLine = (line) => {
       cleanup(line);
@@ -9750,7 +9757,7 @@ ${commitOutput.trim()}`;
 };
 
 // src/tools/builtin/notebook-edit.ts
-import { readFileSync as readFileSync9, existsSync as existsSync14 } from "fs";
+import { readFileSync as readFileSync10, existsSync as existsSync14 } from "fs";
 import { writeFile } from "fs/promises";
 import { resolve as resolve4, extname as extname2 } from "path";
 var notebookEditTool = {
@@ -9808,7 +9815,7 @@ var notebookEditTool = {
     if (!existsSync14(absPath)) {
       throw new ToolError("notebook_edit", `Notebook not found: ${filePath}`);
     }
-    const raw = readFileSync9(absPath, "utf-8");
+    const raw = readFileSync10(absPath, "utf-8");
     const nb = parseNotebook(raw);
     const cellIdx0 = cellIndexRaw - 1;
     undoStack.push(absPath, `notebook_edit (${action}): ${filePath}`);
@@ -10580,7 +10587,7 @@ var McpClient = class {
   // 内部方法：JSON-RPC 通信
   // ══════════════════════════════════════════════════════════════════
   sendRequest(method, params) {
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve8, reject) => {
       if (!this.process?.stdin?.writable) {
         return reject(new Error(`MCP server [${this.serverId}] stdin not writable`));
       }
@@ -10604,7 +10611,7 @@ var McpClient = class {
       this.pendingRequests.set(id, {
         resolve: (result) => {
           cleanup();
-          resolve7(result);
+          resolve8(result);
         },
         reject: (error) => {
           cleanup();
@@ -10681,13 +10688,13 @@ var McpClient = class {
   }
   /** Promise 超时包装 */
   withTimeout(promise, ms, label) {
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve8, reject) => {
       const timer = setTimeout(() => {
         reject(new Error(`MCP [${this.serverId}] ${label} timed out after ${ms}ms`));
       }, ms);
       promise.then((val) => {
         clearTimeout(timer);
-        resolve7(val);
+        resolve8(val);
       }).catch((err) => {
         clearTimeout(timer);
         reject(err);
@@ -10968,7 +10975,7 @@ import { existsSync as existsSync16, readdirSync as readdirSync8, mkdirSync as m
 import { join as join10 } from "path";
 
 // src/skills/types.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 import { basename as basename5 } from "path";
 function parseSimpleYaml(yaml) {
   const result = {};
@@ -10990,7 +10997,7 @@ function parseYamlArray(value) {
 function parseSkillFile(filePath) {
   let raw;
   try {
-    raw = readFileSync10(filePath, "utf-8");
+    raw = readFileSync11(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -11119,7 +11126,7 @@ var SkillManager = class {
 
 // src/web/tool-executor-web.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { existsSync as existsSync17, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync12 } from "fs";
 var ToolExecutorWeb = class _ToolExecutorWeb {
   constructor(registry, ws) {
     this.registry = registry;
@@ -11175,33 +11182,33 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
   }
   /** Resolve a pending confirm from client response */
   resolveConfirm(requestId, approved) {
-    const resolve7 = this.pendingConfirms.get(requestId);
-    if (resolve7) {
+    const resolve8 = this.pendingConfirms.get(requestId);
+    if (resolve8) {
       this.clearPendingTimer(requestId);
       this.pendingConfirms.delete(requestId);
       this.confirming = false;
-      resolve7(approved);
+      resolve8(approved);
     }
   }
   /** Resolve a pending batch confirm from client response */
   resolveBatchConfirm(requestId, decision) {
-    const resolve7 = this.pendingBatchConfirms.get(requestId);
-    if (resolve7) {
+    const resolve8 = this.pendingBatchConfirms.get(requestId);
+    if (resolve8) {
       this.clearPendingTimer(requestId);
       this.pendingBatchConfirms.delete(requestId);
       this.confirming = false;
       if (decision === "all" || decision === "none") {
-        resolve7(decision);
+        resolve8(decision);
       } else {
-        resolve7(new Set(decision));
+        resolve8(new Set(decision));
       }
     }
   }
   /** Cancel all pending confirms (e.g., on disconnect) */
   cancelAll() {
-    for (const resolve7 of this.pendingConfirms.values()) resolve7(false);
+    for (const resolve8 of this.pendingConfirms.values()) resolve8(false);
     this.pendingConfirms.clear();
-    for (const resolve7 of this.pendingBatchConfirms.values()) resolve7("none");
+    for (const resolve8 of this.pendingBatchConfirms.values()) resolve8("none");
     this.pendingBatchConfirms.clear();
     this.confirming = false;
   }
@@ -11246,7 +11253,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       const newContent = String(call.arguments["content"] ?? "");
       if (filePath && existsSync17(filePath)) {
         try {
-          const old = readFileSync11(filePath, "utf-8");
+          const old = readFileSync12(filePath, "utf-8");
           return renderDiff(old, newContent, { filePath });
         } catch {
         }
@@ -11277,8 +11284,8 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       diff: this.getDiffPreview(call)
     };
     this.send(msg);
-    return new Promise((resolve7) => {
-      this.pendingConfirms.set(requestId, resolve7);
+    return new Promise((resolve8) => {
+      this.pendingConfirms.set(requestId, resolve8);
       this.pendingTimers.set(requestId, setTimeout(() => {
         if (this.pendingConfirms.has(requestId)) {
           this.resolveConfirm(requestId, false);
@@ -11302,8 +11309,8 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       files
     };
     this.send(msg);
-    return new Promise((resolve7) => {
-      this.pendingBatchConfirms.set(requestId, resolve7);
+    return new Promise((resolve8) => {
+      this.pendingBatchConfirms.set(requestId, resolve8);
       this.pendingTimers.set(requestId, setTimeout(() => {
         if (this.pendingBatchConfirms.has(requestId)) {
           this.resolveBatchConfirm(requestId, "none");
@@ -11447,11 +11454,11 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
 };
 
 // src/core/system-prompt-builder.ts
-import { existsSync as existsSync19, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync14 } from "fs";
 import { join as join12 } from "path";
 
 // src/repl/dev-state.ts
-import { existsSync as existsSync18, readFileSync as readFileSync12, writeFileSync as writeFileSync3, unlinkSync as unlinkSync4, mkdirSync as mkdirSync9 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync13, unlinkSync as unlinkSync4, mkdirSync as mkdirSync9 } from "fs";
 import { join as join11 } from "path";
 import { homedir as homedir6 } from "os";
 function getDevStatePath() {
@@ -11460,7 +11467,7 @@ function getDevStatePath() {
 function loadDevState() {
   const path3 = getDevStatePath();
   if (!existsSync18(path3)) return null;
-  const content = readFileSync12(path3, "utf-8").trim();
+  const content = readFileSync13(path3, "utf-8").trim();
   return content || null;
 }
 
@@ -11520,7 +11527,7 @@ ${ctx.activeSkill.content}`);
 function loadMemoryContent(configDir) {
   const memoryPath = join12(configDir, MEMORY_FILE_NAME);
   if (!existsSync19(memoryPath)) return null;
-  let content = readFileSync13(memoryPath, "utf-8").trim();
+  let content = readFileSync14(memoryPath, "utf-8").trim();
   if (!content) return null;
   if (content.length > MEMORY_MAX_CHARS) {
     content = content.slice(-MEMORY_MAX_CHARS);
@@ -11728,15 +11735,171 @@ function autoTrimSessionIfNeeded(session, sizeLimit = SESSION_SIZE_LIMIT) {
   return committedSize < originalSize;
 }
 
+// src/core/context-files.ts
+import { existsSync as existsSync20, readFileSync as readFileSync15 } from "fs";
+import { join as join13, relative as relative3, resolve as resolve5 } from "path";
+function uniqueNonEmpty(values) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const value of values) {
+    const trimmed = value.trim();
+    if (!trimmed || seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    out.push(trimmed);
+  }
+  return out;
+}
+function buildContextFileCandidates(fallbackFilenames = []) {
+  return uniqueNonEmpty([...CONTEXT_FILE_CANDIDATES, ...fallbackFilenames]);
+}
+function displayPath(filePath, cwd) {
+  const rel = relative3(cwd, filePath);
+  if (rel && !rel.startsWith("..") && !rel.startsWith("/") && !rel.startsWith("\\")) {
+    return rel;
+  }
+  return filePath;
+}
+function isInsideOrEqual(parent, child) {
+  const rel = relative3(resolve5(parent), resolve5(child));
+  return rel === "" || !!rel && !rel.startsWith("..") && !rel.startsWith("/") && !rel.startsWith("\\");
+}
+function readContextFile(level, filePath, cwd, maxBytes) {
+  const name = filePath.split(/[\\/]/).pop() ?? filePath;
+  const shown = displayPath(filePath, cwd);
+  try {
+    const raw = readFileSync15(filePath);
+    const byteCount = raw.byteLength;
+    if (byteCount === 0) {
+      return {
+        layer: null,
+        skipped: { level, filePath, displayPath: shown, fileName: name, reason: "empty" }
+      };
+    }
+    const truncated = byteCount > maxBytes;
+    const bytes = truncated ? raw.subarray(0, maxBytes) : raw;
+    const content = bytes.toString("utf-8").trim();
+    if (!content) {
+      return {
+        layer: null,
+        skipped: { level, filePath, displayPath: shown, fileName: name, reason: "empty" }
+      };
+    }
+    return {
+      layer: {
+        level: level === "single" ? "project" : level,
+        filePath,
+        displayPath: shown,
+        fileName: name,
+        content,
+        charCount: content.length,
+        byteCount,
+        truncated
+      },
+      skipped: truncated ? { level, filePath, displayPath: shown, fileName: name, reason: "too-large", message: `truncated to ${maxBytes} bytes` } : null
+    };
+  } catch (err) {
+    return {
+      layer: null,
+      skipped: {
+        level,
+        filePath,
+        displayPath: shown,
+        fileName: name,
+        reason: "read-error",
+        message: err instanceof Error ? err.message : String(err)
+      }
+    };
+  }
+}
+function findFirstContextFile(level, dir, cwd, candidates, maxBytes) {
+  const skipped = [];
+  for (const candidate of candidates) {
+    const filePath = join13(dir, candidate);
+    if (!existsSync20(filePath)) continue;
+    const result = readContextFile(level, filePath, cwd, maxBytes);
+    if (result.skipped) skipped.push(result.skipped);
+    if (result.layer) return { layer: result.layer, skipped };
+  }
+  return { layer: null, skipped };
+}
+function loadContextFiles(options) {
+  const cwd = resolve5(options.cwd);
+  const maxBytes = options.maxBytes ?? CONTEXT_FILE_MAX_BYTES;
+  const candidates = options.candidates ?? buildContextFileCandidates(options.fallbackFilenames);
+  const skipped = [];
+  if (options.setting === false) {
+    return { layers: [], mergedContent: "", skipped, totalChars: 0, totalBytes: 0, maxBytes, candidates };
+  }
+  if (options.setting && options.setting !== "auto") {
+    const filePath = resolve5(cwd, String(options.setting));
+    if (!isInsideOrEqual(cwd, filePath)) {
+      skipped.push({
+        level: "single",
+        filePath,
+        displayPath: filePath,
+        fileName: String(options.setting),
+        reason: "outside-cwd"
+      });
+      return { layers: [], mergedContent: "", skipped, totalChars: 0, totalBytes: 0, maxBytes, candidates };
+    }
+    if (!existsSync20(filePath)) {
+      skipped.push({
+        level: "single",
+        filePath,
+        displayPath: displayPath(filePath, cwd),
+        fileName: String(options.setting),
+        reason: "missing"
+      });
+      return { layers: [], mergedContent: "", skipped, totalChars: 0, totalBytes: 0, maxBytes, candidates };
+    }
+    const result = readContextFile("single", filePath, cwd, maxBytes);
+    if (result.skipped) skipped.push(result.skipped);
+    const layers2 = result.layer ? [result.layer] : [];
+    const mergedContent2 = layers2.map((l) => l.content).join("\n\n---\n\n");
+    return {
+      layers: layers2,
+      mergedContent: mergedContent2,
+      skipped,
+      totalChars: layers2.reduce((sum, l) => sum + l.charCount, 0),
+      totalBytes: layers2.reduce((sum, l) => sum + l.byteCount, 0),
+      maxBytes,
+      candidates
+    };
+  }
+  const layers = [];
+  for (const [level, dir] of [
+    ["global", options.configDir],
+    ["project", options.projectRoot]
+  ]) {
+    const result = findFirstContextFile(level, dir, cwd, candidates, maxBytes);
+    skipped.push(...result.skipped);
+    if (result.layer) layers.push(result.layer);
+  }
+  if (resolve5(options.cwd) !== resolve5(options.projectRoot)) {
+    const result = findFirstContextFile("local", options.cwd, cwd, candidates, maxBytes);
+    skipped.push(...result.skipped);
+    if (result.layer) layers.push(result.layer);
+  }
+  const mergedContent = layers.map((l) => l.content).join("\n\n---\n\n");
+  return {
+    layers,
+    mergedContent,
+    skipped,
+    totalChars: layers.reduce((sum, l) => sum + l.charCount, 0),
+    totalBytes: layers.reduce((sum, l) => sum + l.byteCount, 0),
+    maxBytes,
+    candidates
+  };
+}
+
 // src/web/session-handler.ts
-import { existsSync as existsSync21, readFileSync as readFileSync14, appendFileSync as appendFileSync3, writeFileSync as writeFileSync4, mkdirSync as mkdirSync10, readdirSync as readdirSync9, statSync as statSync8, createWriteStream } from "fs";
-import { join as join15, resolve as resolve5, dirname as dirname5 } from "path";
-import { execSync as execSync3 } from "child_process";
+import { existsSync as existsSync23, readFileSync as readFileSync17, writeFileSync as writeFileSync2, mkdirSync as mkdirSync10, readdirSync as readdirSync10, statSync as statSync9, createWriteStream } from "fs";
+import { join as join17, resolve as resolve6, dirname as dirname5 } from "path";
 
 // src/tools/git-context.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync20 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync21 } from "fs";
+import { join as join14 } from "path";
 function runGit2(cmd, cwd) {
   try {
     return execSync2(`git ${cmd}`, {
@@ -11753,7 +11916,7 @@ function getGitRoot(cwd = process.cwd()) {
   return runGit2("rev-parse --show-toplevel", cwd);
 }
 function getGitContext(cwd = process.cwd()) {
-  if (!existsSync20(join13(cwd, ".git"))) {
+  if (!existsSync21(join14(cwd, ".git"))) {
     const result = runGit2("rev-parse --git-dir", cwd);
     if (!result) return null;
   }
@@ -11823,6 +11986,264 @@ function formatGitContextForPrompt(ctx) {
   return lines.join("\n");
 }
 
+// src/cli/review-prompts.ts
+function buildReviewPrompt(diff, gitContextStr, detailed) {
+  const level = detailed ? "Please perform a detailed in-depth review covering: security, performance, maintainability, error handling, naming conventions, and code duplication." : "Please perform a concise code review focusing on bugs, security issues, and key improvement suggestions.";
+  return `# Code Review Request
+
+${level}
+
+## Git Status
+${gitContextStr}
+
+## Code Changes (diff)
+\`\`\`diff
+${diff}
+\`\`\`
+
+## Output Format
+Please structure your review as follows:
+1. **Overall Assessment**: One-sentence summary of the change quality
+2. **Issues** (if any): Each issue with [Severity] file:line \u2014 description + suggested fix
+3. **Improvement Suggestions** (if any): Non-critical but recommended optimizations
+4. **Highlights** (if any): Good practices worth acknowledging
+
+Severity levels: \u{1F534} Critical / \u{1F7E1} Warning / \u{1F535} Info`;
+}
+function buildSecurityReviewPrompt(diff, gitContextStr) {
+  return `# Security Vulnerability Review
+
+Analyze the following code changes **exclusively for security vulnerabilities**.
+
+## Categories to check:
+1. **Injection** \u2014 SQL, command, path traversal, XSS, template injection
+2. **Authentication & Authorization** \u2014 hardcoded credentials, missing auth checks, privilege escalation
+3. **Secrets & Sensitive Data** \u2014 API keys, tokens, passwords in code, logging sensitive data
+4. **Input Validation** \u2014 missing validation, unsafe deserialization, buffer issues
+5. **Cryptography** \u2014 weak algorithms, improper random, hardcoded IVs/salts
+6. **Dependencies** \u2014 known vulnerable packages, unsafe dynamic imports
+7. **File System** \u2014 path traversal, unsafe file permissions, symlink attacks
+8. **Network** \u2014 SSRF, insecure protocols, missing TLS validation
+
+## Git Status
+${gitContextStr}
+
+## Code Changes (diff)
+\`\`\`diff
+${diff}
+\`\`\`
+
+## Output Format
+For each finding:
+- **Severity**: \u{1F534} CRITICAL / \u{1F7E0} HIGH / \u{1F7E1} MEDIUM / \u{1F535} LOW / \u2139\uFE0F INFO
+- **Category**: (from list above)
+- **File & location**: file:line
+- **Description**: what the vulnerability is and how it could be exploited
+- **Recommended fix**: specific code change to resolve
+
+If no security issues found, state "\u2705 No security vulnerabilities detected" with a brief explanation of what was checked.`;
+}
+
+// src/repl/commands/project-init.ts
+import { existsSync as existsSync22, readFileSync as readFileSync16, readdirSync as readdirSync9, statSync as statSync8 } from "fs";
+import { join as join15 } from "path";
+var SCAN_SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "out",
+  "target",
+  ".next",
+  ".nuxt",
+  "__pycache__",
+  ".venv",
+  "venv",
+  ".tox",
+  ".mypy_cache",
+  ".pytest_cache",
+  ".gradle",
+  ".idea",
+  ".vscode",
+  ".vs",
+  "coverage",
+  ".cache",
+  ".parcel-cache",
+  "dist-cjs",
+  "release",
+  ".output",
+  ".turbo",
+  "vendor"
+]);
+function scanDirTree(dir, maxDepth = 2, maxEntries = 80) {
+  const lines = [];
+  let count = 0;
+  const walk = (d, prefix, depth) => {
+    if (depth > maxDepth || count >= maxEntries) return;
+    let entries;
+    try {
+      entries = readdirSync9(d);
+    } catch {
+      return;
+    }
+    const filtered = entries.filter((e) => !e.startsWith(".") && !SCAN_SKIP_DIRS.has(e));
+    const sorted = filtered.sort((a, b) => {
+      let aIsDir = false, bIsDir = false;
+      try {
+        aIsDir = statSync8(join15(d, a)).isDirectory();
+      } catch {
+      }
+      try {
+        bIsDir = statSync8(join15(d, b)).isDirectory();
+      } catch {
+      }
+      if (aIsDir !== bIsDir) return aIsDir ? -1 : 1;
+      return a.localeCompare(b);
+    });
+    for (let i = 0; i < sorted.length && count < maxEntries; i++) {
+      const name = sorted[i];
+      const fullPath = join15(d, name);
+      const isLast = i === sorted.length - 1;
+      const connector = isLast ? "+-- " : "|-- ";
+      let isDir;
+      try {
+        isDir = statSync8(fullPath).isDirectory();
+      } catch {
+        continue;
+      }
+      lines.push(prefix + connector + name + (isDir ? "/" : ""));
+      count++;
+      if (isDir) {
+        walk(fullPath, prefix + (isLast ? "    " : "|   "), depth + 1);
+      }
+    }
+  };
+  walk(dir, "", 0);
+  if (count >= maxEntries) lines.push("... (truncated)");
+  return lines.join("\n");
+}
+function scanProject(cwd) {
+  const info = {
+    type: "unknown",
+    language: "unknown",
+    configFiles: [],
+    directoryStructure: ""
+  };
+  const check = (file) => existsSync22(join15(cwd, file));
+  const configCandidates = [
+    "package.json",
+    "tsconfig.json",
+    "Cargo.toml",
+    "pyproject.toml",
+    "setup.py",
+    "requirements.txt",
+    "go.mod",
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "CMakeLists.txt",
+    "Makefile",
+    ".csproj",
+    ".sln",
+    "composer.json",
+    "Gemfile",
+    "mix.exs",
+    "deno.json",
+    "bun.lockb"
+  ];
+  info.configFiles = configCandidates.filter(check);
+  if (check("package.json")) {
+    info.type = "node";
+    info.language = check("tsconfig.json") ? "TypeScript" : "JavaScript";
+    try {
+      const pkg = JSON.parse(readFileSync16(join15(cwd, "package.json"), "utf-8"));
+      const scripts = pkg.scripts ?? {};
+      info.buildCommand = scripts.build ? "npm run build" : void 0;
+      info.testCommand = scripts.test ? "npm test" : void 0;
+      info.devCommand = scripts.dev ? "npm run dev" : void 0;
+      const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+      if (allDeps["react"]) info.framework = "React";
+      else if (allDeps["vue"]) info.framework = "Vue";
+      else if (allDeps["@angular/core"]) info.framework = "Angular";
+      else if (allDeps["next"]) info.framework = "Next.js";
+      else if (allDeps["nuxt"]) info.framework = "Nuxt";
+      else if (allDeps["express"]) info.framework = "Express";
+      else if (allDeps["fastify"]) info.framework = "Fastify";
+      else if (allDeps["svelte"]) info.framework = "Svelte";
+    } catch {
+    }
+  } else if (check("Cargo.toml")) {
+    info.type = "rust";
+    info.language = "Rust";
+    info.buildCommand = "cargo build";
+    info.testCommand = "cargo test";
+  } else if (check("pyproject.toml") || check("setup.py") || check("requirements.txt")) {
+    info.type = "python";
+    info.language = "Python";
+    info.testCommand = check("pytest.ini") || check("pyproject.toml") ? "pytest" : "python -m unittest";
+  } else if (check("go.mod")) {
+    info.type = "go";
+    info.language = "Go";
+    info.buildCommand = "go build ./...";
+    info.testCommand = "go test ./...";
+  } else if (check("pom.xml")) {
+    info.type = "java";
+    info.language = "Java";
+    info.buildCommand = "mvn package";
+    info.testCommand = "mvn test";
+  } else if (check("build.gradle") || check("build.gradle.kts")) {
+    info.type = "java";
+    info.language = "Java/Kotlin";
+    info.buildCommand = "./gradlew build";
+    info.testCommand = "./gradlew test";
+  }
+  info.directoryStructure = scanDirTree(cwd);
+  return info;
+}
+function buildInitPrompt(info, cwd) {
+  const parts = [
+    "Please generate an AICLI.md context file (Markdown format) for the following project. This file will be injected into the AI conversation system prompt to help the AI understand the project structure and coding conventions.",
+    "\n## Project Info\n",
+    `- Working directory: ${cwd}`,
+    `- Type: ${info.type}`,
+    `- Language: ${info.language}`
+  ];
+  if (info.framework) parts.push(`- Framework: ${info.framework}`);
+  if (info.buildCommand) parts.push(`- Build command: ${info.buildCommand}`);
+  if (info.testCommand) parts.push(`- Test command: ${info.testCommand}`);
+  if (info.devCommand) parts.push(`- Dev command: ${info.devCommand}`);
+  parts.push(`
+## Detected Config Files
+${info.configFiles.map((f) => `- ${f}`).join("\n")}`);
+  parts.push(`
+## Directory Structure
+\`\`\`
+${info.directoryStructure}
+\`\`\``);
+  parts.push(`
+## Requirements
+Please generate a structured Markdown file containing:
+1. Project overview (one-sentence summary)
+2. Tech stack
+3. Project structure description (based on the directory structure above)
+4. Common commands (build, test, dev, etc.)
+5. Code style and conventions (inferred from config files)
+
+Output the Markdown content directly, do not wrap the entire file in a code block. Keep it concise, within 200 lines.`);
+  return parts.join("\n");
+}
+
+// src/core/git-diff.ts
+import { execFileSync as execFileSync3 } from "child_process";
+function readGitDiff(options = {}) {
+  const args = ["diff"];
+  if (options.staged) args.push("--staged");
+  return execFileSync3("git", args, {
+    encoding: "utf-8",
+    timeout: options.timeoutMs ?? 1e4
+  }).trim();
+}
+
 // src/hub/convergence.ts
 function convergenceThreshold(total) {
   if (total <= 0) return Infinity;
@@ -12395,7 +12816,7 @@ function resolveRoleProviders(roles, lookup, defaultProvider, defaultModel, avai
 }
 
 // src/hub/persist.ts
-import { join as join14 } from "path";
+import { join as join16 } from "path";
 function discussionToMessages(state2) {
   const out = [];
   const t0 = state2.messages[0]?.timestamp ?? /* @__PURE__ */ new Date();
@@ -12433,7 +12854,7 @@ async function persistDiscussion(state2, config, defaultProvider, defaultModel)
   session.title = `[Hub] ${state2.topic.slice(0, 48)}`.replace(/\n/g, " ");
   session.titleAiGenerated = true;
   await sm.save();
-  return { id: session.id, path: join14(config.getHistoryDir(), `${session.id}.json`) };
+  return { id: session.id, path: join16(config.getHistoryDir(), `${session.id}.json`) };
 }
 
 // src/web/session-handler.ts
@@ -12451,7 +12872,7 @@ function lastAssistantText(messages) {
   }
   return void 0;
 }
-var SessionHandler = class _SessionHandler {
+var SessionHandler = class {
   ws;
   config;
   providers;
@@ -12488,6 +12909,7 @@ var SessionHandler = class _SessionHandler {
   pendingAutoPause = /* @__PURE__ */ new Map();
   /** Active system prompt from context files */
   activeSystemPrompt;
+  contextLoadResult = null;
   /** Directories added via /add-dir */
   addedDirs = /* @__PURE__ */ new Set();
   /** Track MCP tool names used across this session (for MCP budget prioritization) */
@@ -12594,10 +13016,10 @@ var SessionHandler = class _SessionHandler {
         return;
       }
       case "ask_user_response": {
-        const resolve7 = this.pendingAskUser.get(msg.requestId);
-        if (resolve7) {
+        const resolve8 = this.pendingAskUser.get(msg.requestId);
+        if (resolve8) {
           this.pendingAskUser.delete(msg.requestId);
-          resolve7(msg.answer);
+          resolve8(msg.answer);
         }
         return;
       }
@@ -12608,10 +13030,10 @@ var SessionHandler = class _SessionHandler {
       case "memory_rebuild":
         return this.handleMemoryRebuild(Boolean(msg.full));
       case "auto_pause_response": {
-        const resolve7 = this.pendingAutoPause.get(msg.requestId);
-        if (resolve7) {
+        const resolve8 = this.pendingAutoPause.get(msg.requestId);
+        if (resolve8) {
           this.pendingAutoPause.delete(msg.requestId);
-          resolve7({ action: msg.action, message: msg.message });
+          resolve8({ action: msg.action, message: msg.message });
         }
         return;
       }
@@ -12626,10 +13048,10 @@ var SessionHandler = class _SessionHandler {
         this.hubOrchestrator?.abort();
         return;
       case "hub_steer": {
-        const resolve7 = this.pendingHubReview.get(msg.requestId);
-        if (resolve7) {
+        const resolve8 = this.pendingHubReview.get(msg.requestId);
+        if (resolve8) {
           this.pendingHubReview.delete(msg.requestId);
-          resolve7({ action: msg.action, message: msg.message });
+          resolve8({ action: msg.action, message: msg.message });
         }
         return;
       }
@@ -12641,9 +13063,9 @@ var SessionHandler = class _SessionHandler {
   onDisconnect() {
     this.toolExecutor.cancelAll();
     if (this.abortController) this.abortController.abort();
-    for (const resolve7 of this.pendingAskUser.values()) resolve7(null);
+    for (const resolve8 of this.pendingAskUser.values()) resolve8(null);
     this.pendingAskUser.clear();
-    for (const resolve7 of this.pendingAutoPause.values()) resolve7({ action: "stop" });
+    for (const resolve8 of this.pendingAutoPause.values()) resolve8({ action: "stop" });
     this.pendingAutoPause.clear();
     this.saveIfNeeded();
   }
@@ -12777,9 +13199,9 @@ var SessionHandler = class _SessionHandler {
     this.hubOrchestrator = orchestrator;
     orchestrator.onEvent = (event) => this.send({ type: "hub_event", event });
     if (config.humanSteer) {
-      orchestrator.onRoundReview = ({ round, maxRounds }) => new Promise((resolve7) => {
+      orchestrator.onRoundReview = ({ round, maxRounds }) => new Promise((resolve8) => {
         const requestId = `hubrev_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
-        this.pendingHubReview.set(requestId, resolve7);
+        this.pendingHubReview.set(requestId, resolve8);
         this.send({ type: "hub_review", requestId, round, maxRounds });
       });
     }
@@ -13116,8 +13538,8 @@ Try: /compact to reduce context, /clear to reset, or switch to a larger-context
         onMcpToolUsed: (name) => this.usedMcpToolNames.add(name),
         requestAutoPause: async ({ effectiveRound, maxToolRounds: totalRounds, toolSummary }) => {
           const requestId = `pause_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
-          const pauseResp = await new Promise((resolve7) => {
-            this.pendingAutoPause.set(requestId, resolve7);
+          const pauseResp = await new Promise((resolve8) => {
+            this.pendingAutoPause.set(requestId, resolve8);
             this.send({
               type: "auto_pause_request",
               requestId,
@@ -13296,8 +13718,8 @@ ${summaryContent}`,
         }
         if (chunk.done) break;
       }
-      await new Promise((resolve7, reject) => {
-        fileStream.end((err) => err ? reject(err) : resolve7());
+      await new Promise((resolve8, reject) => {
+        fileStream.end((err) => err ? reject(err) : resolve8());
       });
       const verdict = evaluateTeeContent(fullContent, saveToFile, priorContent);
       if (verdict.kind === "reject") {
@@ -13323,7 +13745,7 @@ ${summaryContent}`,
     } catch (err) {
       if (fileStream) {
         try {
-          await new Promise((resolve7) => fileStream.end(() => resolve7()));
+          await new Promise((resolve8) => fileStream.end(() => resolve8()));
         } catch {
         }
       }
@@ -13612,7 +14034,7 @@ Tokens: in=${this.sessionTokenUsage.inputTokens} out=${this.sessionTokenUsage.ou
             "  /plan [enter|exit]   \u2014 Toggle read-only planning mode",
             "  /session new|list|load|delete <id> \u2014 Session management",
             "  /system [prompt|clear] \u2014 Set/view/reset system prompt",
-            "  /context [reload]    \u2014 Show/reload context layers",
+            "  /context [status|reload] \u2014 Show/reload context layers",
             "  /status              \u2014 Show session info & token usage",
             "  /cost                \u2014 Show cumulative token usage",
             "  /config [show|get|set] \u2014 View/modify configuration",
@@ -13853,9 +14275,9 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
         let modifiedFiles = 0;
         const diffLines2 = [];
         for (const [filePath, { earliest }] of fileMap) {
-          const currentContent = existsSync21(filePath) ? (() => {
+          const currentContent = existsSync23(filePath) ? (() => {
             try {
-              return readFileSync14(filePath, "utf-8");
+              return readFileSync17(filePath, "utf-8");
             } catch {
               return null;
             }
@@ -13956,7 +14378,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
           break;
         }
         const sub = args[0]?.toLowerCase();
-        const resolve7 = (ref) => {
+        const resolve8 = (ref) => {
           const r = session.resolveBranchRef(ref);
           if (r.ok) return r.id;
           if (r.reason === "ambiguous") {
@@ -14010,7 +14432,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch switch <id|title>" });
             break;
           }
-          const id = resolve7(ref);
+          const id = resolve8(ref);
           if (!id) break;
           const ok = session.switchBranch(id);
           if (ok) {
@@ -14030,7 +14452,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch delete <id|title>" });
             break;
           }
-          const id = resolve7(ref);
+          const id = resolve8(ref);
           if (!id) break;
           const ok = session.deleteBranch(id);
           if (ok) {
@@ -14049,7 +14471,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch rename <id|title> <new title>" });
             break;
           }
-          const id = resolve7(ref);
+          const id = resolve8(ref);
           if (!id) break;
           const ok = session.renameBranch(id, title);
           if (ok) {
@@ -14067,7 +14489,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch diff <id|title>" });
             break;
           }
-          const id = resolve7(ref);
+          const id = resolve8(ref);
           if (!id) break;
           const d = session.diffBranches(id);
           if (!d) {
@@ -14109,7 +14531,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch cherry-pick <source-id|title> <msg-index>" });
             break;
           }
-          const id = resolve7(ref);
+          const id = resolve8(ref);
           if (!id) break;
           const idx = parseInt(idxStr, 10);
           if (Number.isNaN(idx)) {
@@ -14136,7 +14558,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
         const sub = (args[0] ?? "status").toLowerCase();
         const root = process.cwd();
         const { loadIndex: loadIndex2, clearIndex } = await import("./store-VO37H6LS.js");
-        const { indexProject: indexProject2 } = await import("./indexer-BMYUUDLH.js");
+        const { indexProject: indexProject2 } = await import("./indexer-4WWS3VIL.js");
         const { loadVectorStore, clearVectorStore } = await import("./vector-store-JBAE6PS4.js");
         if (sub === "status") {
           const idx = loadIndex2(root);
@@ -14255,8 +14677,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
         const detailed = args.includes("--detailed");
         let diff;
         try {
-          const cmd = staged ? "git diff --staged" : "git diff";
-          diff = execSync3(cmd, { encoding: "utf-8", timeout: 1e4 }).trim();
+          diff = readGitDiff({ staged });
         } catch {
           this.send({ type: "error", message: "Failed to run git diff." });
           break;
@@ -14273,7 +14694,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
           diff = head + "\n\n... [diff truncated, " + diff.length + " chars total] ...\n\n" + tail;
           truncated = true;
         }
-        const reviewPrompt = this.buildReviewPrompt(diff, formatGitContextForPrompt(gitCtx), detailed);
+        const reviewPrompt = buildReviewPrompt(diff, formatGitContextForPrompt(gitCtx), detailed);
         this.send({ type: "info", message: "\u{1F50D} Analyzing changes..." });
         try {
           const review = await this.chatOnce(reviewPrompt, { temperature: 0.3, maxTokens: 8192 });
@@ -14294,8 +14715,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
         const secStaged = args.includes("--staged");
         let secDiff;
         try {
-          const cmd = secStaged ? "git diff --staged" : "git diff";
-          secDiff = execSync3(cmd, { encoding: "utf-8", timeout: 1e4 }).trim();
+          secDiff = readGitDiff({ staged: secStaged });
         } catch {
           this.send({ type: "error", message: "Failed to run git diff." });
           break;
@@ -14312,7 +14732,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
           secDiff = head + "\n\n... [diff truncated, " + secDiff.length + " chars total] ...\n\n" + tail;
           secTruncated = true;
         }
-        const secPrompt = this.buildSecurityReviewPrompt(secDiff, formatGitContextForPrompt(gitCtx));
+        const secPrompt = buildSecurityReviewPrompt(secDiff, formatGitContextForPrompt(gitCtx));
         this.send({ type: "info", message: "\u{1F512} Scanning for security vulnerabilities..." });
         try {
           const secReview = await this.chatOnce(secPrompt, { temperature: 0.2, maxTokens: 8192 });
@@ -14373,7 +14793,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-HZ2CRCTZ.js");
+          const { executeTests } = await import("./run-tests-NT2UIUVB.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -14390,19 +14810,19 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       // ── /init ───────────────────────────────────────────────────────
       case "init": {
         const cwd = process.cwd();
-        const targetPath = join15(cwd, "AICLI.md");
+        const targetPath = join17(cwd, "AICLI.md");
         const force = args.includes("--force");
-        if (existsSync21(targetPath) && !force) {
+        if (existsSync23(targetPath) && !force) {
           this.send({ type: "info", message: `AICLI.md already exists at ${targetPath}
 Use /init --force to overwrite.` });
           break;
         }
         this.send({ type: "info", message: "\u{1F4DD} Scanning project structure..." });
         try {
-          const projectInfo = this.scanProject(cwd);
-          const prompt = this.buildInitPrompt(projectInfo, cwd);
+          const projectInfo = scanProject(cwd);
+          const prompt = buildInitPrompt(projectInfo, cwd);
           const content = await this.chatOnce(prompt, { temperature: 0.3, maxTokens: 4096 });
-          writeFileSync4(targetPath, content, "utf-8");
+          writeFileSync2(targetPath, content, "utf-8");
           this.send({ type: "info", message: `\u2713 Generated: ${targetPath} (${content.length} chars)
 Use /context reload to load it.` });
         } catch (err) {
@@ -14425,19 +14845,19 @@ Use /context reload to load it.` });
         lines.push("**Config Files:**");
         lines.push(`  Dir: ${configDir}`);
         const checkFile = (label, filePath) => {
-          const exists = existsSync21(filePath);
+          const exists = existsSync23(filePath);
           let extra = "";
           if (exists) {
             try {
-              extra = ` (${statSync8(filePath).size} bytes)`;
+              extra = ` (${statSync9(filePath).size} bytes)`;
             } catch {
             }
           }
           lines.push(`  ${exists ? "\u2713" : "\u2013"}  ${label.padEnd(14)} ${exists ? filePath + extra : "(not found)"}`);
         };
-        checkFile("config.json", join15(configDir, "config.json"));
-        checkFile("memory.md", join15(configDir, MEMORY_FILE_NAME));
-        checkFile("dev-state.md", join15(configDir, "dev-state.md"));
+        checkFile("config.json", join17(configDir, "config.json"));
+        checkFile("memory.md", join17(configDir, MEMORY_FILE_NAME));
+        checkFile("dev-state.md", join17(configDir, "dev-state.md"));
         lines.push("");
         if (this.mcpManager) {
           lines.push("**MCP Servers:**");
@@ -14537,29 +14957,24 @@ ${this.config.toFormattedJSON()}
           this.send({ type: "info", message: this.activeSystemPrompt ? `\u2713 Context reloaded (${this.activeSystemPrompt.length} chars).` : "\u2713 No context files found." });
           break;
         }
-        const configDir = this.config.getConfigDir();
-        const cwd = process.cwd();
-        const gitRoot = getGitRoot(cwd);
-        const projectRoot = gitRoot ?? cwd;
+        const result = this.contextLoadResult;
         const layers = ["\u{1F4DA} **Context Layers:**", ""];
-        const checkLayer = (label, dir) => {
-          for (const name2 of CONTEXT_FILE_CANDIDATES) {
-            const fullPath = join15(dir, name2);
-            if (existsSync21(fullPath)) {
-              try {
-                const size = statSync8(fullPath).size;
-                layers.push(`  \u2713 ${label}: ${fullPath} (${size} bytes)`);
-                return;
-              } catch {
-              }
-            }
+        if (result && result.layers.length > 0) {
+          const labels = { global: "Global ", project: "Project", local: "Local  " };
+          for (const layer of result.layers) {
+            layers.push(`  \u2713 ${labels[layer.level] ?? layer.level}: ${layer.displayPath} (${layer.charCount} chars${layer.truncated ? ", truncated" : ""})`);
+          }
+          layers.push(`  Total: ${result.totalChars} chars (${result.layers.length} layer${result.layers.length > 1 ? "s" : ""})`);
+        } else {
+          layers.push("  No context files loaded.");
+          layers.push("  Search order per layer: AICLI.override.md \u2192 AGENTS.override.md \u2192 AICLI.md \u2192 CLAUDE.md \u2192 AGENTS.md");
+        }
+        if (result && result.skipped.length > 0) {
+          layers.push("");
+          layers.push("Skipped:");
+          for (const skipped of result.skipped.slice(0, 5)) {
+            layers.push(`  - ${skipped.displayPath}: ${skipped.reason}${skipped.message ? ` (${skipped.message})` : ""}`);
           }
-          layers.push(`  \u2013  ${label}: (none)`);
-        };
-        checkLayer("Global", configDir);
-        checkLayer("Project", projectRoot);
-        if (resolve5(cwd) !== resolve5(projectRoot)) {
-          checkLayer("Subdir", cwd);
         }
         layers.push("");
         layers.push(`Total prompt length: ${this.activeSystemPrompt?.length ?? 0} chars`);
@@ -14629,12 +15044,12 @@ Use /add-dir remove to clear.` : "No directories added.\nUsage: /add-dir <path>
           this.send({ type: "info", message: "\u2713 All added directories removed from context." });
           break;
         }
-        const dirPath = resolve5(sub);
-        if (!existsSync21(dirPath)) {
+        const dirPath = resolve6(sub);
+        if (!existsSync23(dirPath)) {
           this.send({ type: "error", message: `Directory not found: ${dirPath}` });
           break;
         }
-        if (!statSync8(dirPath).isDirectory()) {
+        if (!statSync9(dirPath).isDirectory()) {
           this.send({ type: "error", message: `Not a directory: ${dirPath}` });
           break;
         }
@@ -14646,14 +15061,14 @@ It will be included in AI context for subsequent messages.` });
       // ── /commands ───────────────────────────────────────────────────
       case "commands": {
         const configDir = this.config.getConfigDir();
-        const commandsDir = join15(configDir, CUSTOM_COMMANDS_DIR_NAME);
-        if (!existsSync21(commandsDir)) {
+        const commandsDir = join17(configDir, CUSTOM_COMMANDS_DIR_NAME);
+        if (!existsSync23(commandsDir)) {
           this.send({ type: "info", message: `No custom commands directory.
 Create: ${commandsDir}/ with .md files.` });
           break;
         }
         try {
-          const files = readdirSync9(commandsDir).filter((f) => f.endsWith(".md"));
+          const files = readdirSync10(commandsDir).filter((f) => f.endsWith(".md"));
           if (files.length === 0) {
             this.send({ type: "info", message: `No custom commands found in ${commandsDir}
 Add .md files to create commands.` });
@@ -14673,7 +15088,7 @@ Add .md files to create commands.` });
       // ── /plugins ────────────────────────────────────────────────────
       case "plugins": {
         const configDir = this.config.getConfigDir();
-        const pluginsDir = join15(configDir, PLUGINS_DIR_NAME);
+        const pluginsDir = join17(configDir, PLUGINS_DIR_NAME);
         const pluginTools = this.toolRegistry.listPluginTools();
         const lines = [`\u{1F50C} **Plugins:**`, `Dir: ${pluginsDir}`, ""];
         if (pluginTools.length === 0) {
@@ -14847,11 +15262,11 @@ Add .md files to create commands.` });
   }
   memoryShow() {
     const configDir = this.config.getConfigDir();
-    const memPath = join15(configDir, MEMORY_FILE_NAME);
+    const memPath = join17(configDir, MEMORY_FILE_NAME);
     let content = "";
     try {
-      if (existsSync21(memPath)) {
-        content = readFileSync14(memPath, "utf-8");
+      if (existsSync23(memPath)) {
+        content = readFileSync17(memPath, "utf-8");
       }
     } catch (err) {
       process.stderr.write(`[web] Failed to read memory file: ${err instanceof Error ? err.message : err}
@@ -14865,13 +15280,15 @@ Add .md files to create commands.` });
   }
   memoryAdd(text) {
     const configDir = this.config.getConfigDir();
-    const memPath = join15(configDir, MEMORY_FILE_NAME);
+    const memPath = join17(configDir, MEMORY_FILE_NAME);
     try {
       mkdirSync10(configDir, { recursive: true });
       const timestamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replace("T", " ");
-      appendFileSync3(memPath, `
+      const previous = existsSync23(memPath) ? readFileSync17(memPath, "utf-8") : "";
+      const entry = `
 - [${timestamp}] ${text}
-`, "utf-8");
+`;
+      atomicWriteFileSync(memPath, previous + entry);
       this.send({ type: "info", message: `\u{1F4DD} Memory entry added: "${text}"` });
     } catch (err) {
       this.send({ type: "error", message: `Failed to write memory: ${err.message}` });
@@ -14879,9 +15296,9 @@ Add .md files to create commands.` });
   }
   memoryClear() {
     const configDir = this.config.getConfigDir();
-    const memPath = join15(configDir, MEMORY_FILE_NAME);
+    const memPath = join17(configDir, MEMORY_FILE_NAME);
     try {
-      writeFileSync4(memPath, "", "utf-8");
+      atomicWriteFileSync(memPath, "");
       this.send({ type: "info", message: "\u{1F5D1}\uFE0F Persistent memory cleared." });
     } catch (err) {
       this.send({ type: "error", message: `Failed to clear memory: ${err.message}` });
@@ -15044,7 +15461,7 @@ Add .md files to create commands.` });
         dirContext += `
 [Directory: ${dir}]
 `;
-        dirContext += this.scanDirTree(dir, 2, 40) + "\n";
+        dirContext += scanDirTree(dir, 2, 40) + "\n";
         totalLen = dirContext.length;
       }
       stable += dirContext;
@@ -15083,265 +15500,21 @@ Add .md files to create commands.` });
     }
     return { toolDefs: this.toolRegistry.getDefinitions(), mcpBudgetNote: null };
   }
-  /**
-   * Find first matching context file in a directory.
-   */
-  findContextFile(dir) {
-    for (const name of CONTEXT_FILE_CANDIDATES) {
-      const fullPath = join15(dir, name);
-      try {
-        if (existsSync21(fullPath)) {
-          const content = readFileSync14(fullPath, "utf-8").trim();
-          if (content) return content;
-        }
-      } catch {
-      }
-    }
-    return null;
-  }
-  /**
-   * Load hierarchical context files (same as CLI):
-   *   1. Global:  ~/.aicli/AICLI.md or CLAUDE.md
-   *   2. Project: <git-root>/AICLI.md or CLAUDE.md
-   *   3. Subdir:  <cwd>/AICLI.md or CLAUDE.md (only if cwd ≠ project root)
-   */
-  // ── /init helpers ─────────────────────────────────────────────────
-  static SCAN_SKIP_DIRS = /* @__PURE__ */ new Set([
-    "node_modules",
-    ".git",
-    "dist",
-    "build",
-    "out",
-    "target",
-    ".next",
-    ".nuxt",
-    "__pycache__",
-    ".venv",
-    "venv",
-    ".tox",
-    ".mypy_cache",
-    ".pytest_cache",
-    ".gradle",
-    ".idea",
-    ".vscode",
-    ".vs",
-    "coverage",
-    ".cache",
-    ".parcel-cache",
-    "dist-cjs",
-    "release",
-    ".output",
-    ".turbo",
-    "vendor"
-  ]);
-  scanDirTree(dir, maxDepth = 2, maxEntries = 80) {
-    const lines = [];
-    let count = 0;
-    const walk = (d, prefix, depth) => {
-      if (depth > maxDepth || count >= maxEntries) return;
-      let entries;
-      try {
-        entries = readdirSync9(d);
-      } catch {
-        return;
-      }
-      const filtered = entries.filter((e) => !e.startsWith(".") && !_SessionHandler.SCAN_SKIP_DIRS.has(e));
-      const sorted = filtered.sort((a, b) => {
-        let aIsDir = false, bIsDir = false;
-        try {
-          aIsDir = statSync8(join15(d, a)).isDirectory();
-        } catch {
-        }
-        try {
-          bIsDir = statSync8(join15(d, b)).isDirectory();
-        } catch {
-        }
-        if (aIsDir !== bIsDir) return aIsDir ? -1 : 1;
-        return a.localeCompare(b);
-      });
-      for (let i = 0; i < sorted.length && count < maxEntries; i++) {
-        const name = sorted[i];
-        const fullPath = join15(d, name);
-        const isLast = i === sorted.length - 1;
-        let isDir;
-        try {
-          isDir = statSync8(fullPath).isDirectory();
-        } catch {
-          continue;
-        }
-        lines.push(prefix + (isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 ") + name + (isDir ? "/" : ""));
-        count++;
-        if (isDir) walk(fullPath, prefix + (isLast ? "    " : "\u2502   "), depth + 1);
-      }
-    };
-    walk(dir, "", 0);
-    if (count >= maxEntries) lines.push("... (truncated)");
-    return lines.join("\n");
-  }
-  scanProject(cwd) {
-    const info = { type: "unknown", language: "unknown", configFiles: [], directoryStructure: "" };
-    const check = (file) => existsSync21(join15(cwd, file));
-    const configCandidates = [
-      "package.json",
-      "tsconfig.json",
-      "Cargo.toml",
-      "pyproject.toml",
-      "setup.py",
-      "requirements.txt",
-      "go.mod",
-      "pom.xml",
-      "build.gradle",
-      "build.gradle.kts",
-      "CMakeLists.txt",
-      "Makefile",
-      ".csproj",
-      ".sln",
-      "composer.json",
-      "Gemfile",
-      "mix.exs",
-      "deno.json",
-      "bun.lockb"
-    ];
-    info.configFiles = configCandidates.filter(check);
-    if (check("package.json")) {
-      info.type = "node";
-      info.language = check("tsconfig.json") ? "TypeScript" : "JavaScript";
-      try {
-        const pkg = JSON.parse(readFileSync14(join15(cwd, "package.json"), "utf-8"));
-        const scripts = pkg.scripts ?? {};
-        info.buildCommand = scripts.build ? "npm run build" : void 0;
-        info.testCommand = scripts.test ? "npm test" : void 0;
-        info.devCommand = scripts.dev ? "npm run dev" : void 0;
-        const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-        if (allDeps["react"]) info.framework = "React";
-        else if (allDeps["vue"]) info.framework = "Vue";
-        else if (allDeps["@angular/core"]) info.framework = "Angular";
-        else if (allDeps["next"]) info.framework = "Next.js";
-        else if (allDeps["express"]) info.framework = "Express";
-      } catch {
-      }
-    } else if (check("Cargo.toml")) {
-      info.type = "rust";
-      info.language = "Rust";
-      info.buildCommand = "cargo build";
-      info.testCommand = "cargo test";
-    } else if (check("pyproject.toml") || check("setup.py") || check("requirements.txt")) {
-      info.type = "python";
-      info.language = "Python";
-      info.testCommand = "pytest";
-    } else if (check("go.mod")) {
-      info.type = "go";
-      info.language = "Go";
-      info.buildCommand = "go build ./...";
-      info.testCommand = "go test ./...";
-    } else if (check("pom.xml")) {
-      info.type = "java";
-      info.language = "Java";
-      info.buildCommand = "mvn package";
-      info.testCommand = "mvn test";
-    } else if (check("build.gradle") || check("build.gradle.kts")) {
-      info.type = "java";
-      info.language = "Java/Kotlin";
-      info.buildCommand = "./gradlew build";
-      info.testCommand = "./gradlew test";
-    }
-    info.directoryStructure = this.scanDirTree(cwd);
-    return info;
-  }
-  buildInitPrompt(info, cwd) {
-    const parts = [
-      "Please generate an AICLI.md context file (Markdown format) for the following project.",
-      "\n## Project Info\n",
-      `- Working directory: ${cwd}`,
-      `- Type: ${info.type}`,
-      `- Language: ${info.language}`
-    ];
-    if (info.framework) parts.push(`- Framework: ${info.framework}`);
-    if (info.buildCommand) parts.push(`- Build command: ${info.buildCommand}`);
-    if (info.testCommand) parts.push(`- Test command: ${info.testCommand}`);
-    if (info.devCommand) parts.push(`- Dev command: ${info.devCommand}`);
-    parts.push(`
-## Detected Config Files
-${info.configFiles.map((f) => `- ${f}`).join("\n")}`);
-    parts.push(`
-## Directory Structure
-\`\`\`
-${info.directoryStructure}
-\`\`\``);
-    parts.push(`
-## Requirements
-Generate a structured Markdown file with: project overview, tech stack, project structure, common commands, code style. Keep it concise, within 200 lines.`);
-    return parts.join("\n");
-  }
-  // ── /review helper ──────────────────────────────────────────────────
-  buildReviewPrompt(diff, gitContextStr, detailed) {
-    const level = detailed ? "Please perform a detailed in-depth review covering: security, performance, maintainability, error handling, naming conventions, and code duplication." : "Please perform a concise code review focusing on bugs, security issues, and key improvement suggestions.";
-    return `# Code Review Request
-
-${level}
-
-## Git Status
-${gitContextStr}
-
-## Code Changes (diff)
-\`\`\`diff
-${diff}
-\`\`\`
-
-## Output Format
-1. **Overall Assessment**: One-sentence summary
-2. **Issues** (if any): [Severity] file:line \u2014 description + fix
-3. **Improvement Suggestions** (if any)
-4. **Highlights** (if any)
-
-Severity: \u{1F534} Critical / \u{1F7E1} Warning / \u{1F535} Info`;
-  }
-  buildSecurityReviewPrompt(diff, gitContextStr) {
-    return `# Security Vulnerability Review
-
-Analyze the following code changes **exclusively for security vulnerabilities**.
-
-## Categories
-1. Injection (SQL, command, path traversal, XSS)
-2. Auth & Authorization (hardcoded creds, missing checks)
-3. Secrets & Sensitive Data (API keys, tokens in code)
-4. Input Validation (missing validation, unsafe deserialization)
-5. Cryptography (weak algorithms, hardcoded IVs)
-6. File System (path traversal, symlink attacks)
-7. Network (SSRF, insecure protocols)
-
-## Git Status
-${gitContextStr}
-
-## Code Changes
-\`\`\`diff
-${diff}
-\`\`\`
-
-## Output Format
-For each finding:
-- **Severity**: \u{1F534} CRITICAL / \u{1F7E0} HIGH / \u{1F7E1} MEDIUM / \u{1F535} LOW
-- **Category** + **File:line**
-- **Description** + exploitation scenario
-- **Recommended fix**
-
-If none found: "\u2705 No security vulnerabilities detected"`;
-  }
   loadContextFiles() {
-    const parts = [];
+    const contextConfig = this.config.get("context");
     const cwd = process.cwd();
-    const configDir = this.config.getConfigDir();
-    const globalCtx = this.findContextFile(configDir);
-    if (globalCtx) parts.push(globalCtx);
     const gitRoot = getGitRoot(cwd);
     const projectRoot = gitRoot ?? cwd;
-    const projectCtx = this.findContextFile(projectRoot);
-    if (projectCtx) parts.push(projectCtx);
-    if (resolve5(cwd) !== resolve5(projectRoot)) {
-      const localCtx = this.findContextFile(cwd);
-      if (localCtx) parts.push(localCtx);
-    }
-    return parts.length > 0 ? parts.join("\n\n---\n\n") : void 0;
+    const result = loadContextFiles({
+      cwd,
+      configDir: this.config.getConfigDir(),
+      projectRoot,
+      setting: this.config.get("contextFile"),
+      fallbackFilenames: contextConfig.projectDocFallbackFilenames,
+      maxBytes: contextConfig.projectDocMaxBytes
+    });
+    this.contextLoadResult = result;
+    return result.mergedContent || void 0;
   }
 };
 
@@ -15357,8 +15530,8 @@ async function setupProxy(configProxy) {
 }
 
 // src/web/auth.ts
-import { existsSync as existsSync22, readFileSync as readFileSync15, writeFileSync as writeFileSync5, mkdirSync as mkdirSync11, readdirSync as readdirSync10, copyFileSync } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync18, writeFileSync as writeFileSync3, mkdirSync as mkdirSync11, readdirSync as readdirSync11, copyFileSync } from "fs";
+import { join as join18 } from "path";
 import { createHmac, randomBytes, timingSafeEqual, pbkdf2Sync } from "crypto";
 var USERS_FILE = "users.json";
 var TOKEN_EXPIRY_HOURS = 24;
@@ -15373,7 +15546,7 @@ var AuthManager = class {
   db;
   constructor(baseDir) {
     this.baseDir = baseDir;
-    this.usersFile = join16(baseDir, USERS_FILE);
+    this.usersFile = join18(baseDir, USERS_FILE);
     this.db = this.loadOrCreate();
   }
   // ── Public API ─────────────────────────────────────────────────
@@ -15402,9 +15575,9 @@ var AuthManager = class {
     }
     const salt = randomBytes(16).toString("hex");
     const passwordHash = this.hashPassword(password, salt);
-    const dataDir = join16(USERS_DIR, username);
-    const fullDataDir = join16(this.baseDir, dataDir);
-    mkdirSync11(join16(fullDataDir, "history"), { recursive: true });
+    const dataDir = join18(USERS_DIR, username);
+    const fullDataDir = join18(this.baseDir, dataDir);
+    mkdirSync11(join18(fullDataDir, "history"), { recursive: true });
     const user = {
       username,
       passwordHash,
@@ -15519,7 +15692,7 @@ var AuthManager = class {
   getUserDataDir(username) {
     const user = this.db.users.find((u) => u.username === username);
     if (!user) throw new Error(`User not found: ${username}`);
-    return join16(this.baseDir, user.dataDir);
+    return join18(this.baseDir, user.dataDir);
   }
   /** List all usernames */
   listUsers() {
@@ -15555,30 +15728,30 @@ var AuthManager = class {
     const err = this.register(username, password);
     if (err) return err;
     const userDir = this.getUserDataDir(username);
-    const globalConfig = join16(this.baseDir, "config.json");
-    if (existsSync22(globalConfig)) {
+    const globalConfig = join18(this.baseDir, "config.json");
+    if (existsSync24(globalConfig)) {
       try {
-        const content = readFileSync15(globalConfig, "utf-8");
-        writeFileSync5(join16(userDir, "config.json"), content, "utf-8");
+        const content = readFileSync18(globalConfig, "utf-8");
+        writeFileSync3(join18(userDir, "config.json"), content, "utf-8");
       } catch {
       }
     }
-    const globalMemory = join16(this.baseDir, "memory.md");
-    if (existsSync22(globalMemory)) {
+    const globalMemory = join18(this.baseDir, "memory.md");
+    if (existsSync24(globalMemory)) {
       try {
-        const content = readFileSync15(globalMemory, "utf-8");
-        writeFileSync5(join16(userDir, "memory.md"), content, "utf-8");
+        const content = readFileSync18(globalMemory, "utf-8");
+        writeFileSync3(join18(userDir, "memory.md"), content, "utf-8");
       } catch {
       }
     }
-    const globalHistory = join16(this.baseDir, "history");
-    if (existsSync22(globalHistory)) {
+    const globalHistory = join18(this.baseDir, "history");
+    if (existsSync24(globalHistory)) {
       try {
-        const files = readdirSync10(globalHistory).filter((f) => f.endsWith(".json"));
-        const userHistory = join16(userDir, "history");
+        const files = readdirSync11(globalHistory).filter((f) => f.endsWith(".json"));
+        const userHistory = join18(userDir, "history");
         for (const f of files) {
           try {
-            copyFileSync(join16(globalHistory, f), join16(userHistory, f));
+            copyFileSync(join18(globalHistory, f), join18(userHistory, f));
           } catch {
           }
         }
@@ -15589,9 +15762,9 @@ var AuthManager = class {
   }
   // ── Private methods ────────────────────────────────────────────
   loadOrCreate() {
-    if (existsSync22(this.usersFile)) {
+    if (existsSync24(this.usersFile)) {
       try {
-        return JSON.parse(readFileSync15(this.usersFile, "utf-8"));
+        return JSON.parse(readFileSync18(this.usersFile, "utf-8"));
       } catch {
       }
     }
@@ -15643,7 +15816,7 @@ function getModuleDir() {
     }
   } catch {
   }
-  return resolve6(".");
+  return resolve7(".");
 }
 async function startWebServer(options = {}) {
   const port = options.port ?? 3e3;
@@ -15708,8 +15881,8 @@ async function startWebServer(options = {}) {
     }
   }
   let skillManager = null;
-  const skillsDir = join17(config.getConfigDir(), SKILLS_DIR_NAME);
-  if (existsSync23(skillsDir)) {
+  const skillsDir = join19(config.getConfigDir(), SKILLS_DIR_NAME);
+  if (existsSync25(skillsDir)) {
     skillManager = new SkillManager(skillsDir, config.get("ui").skillSizeWarn);
     skillManager.loadSkills();
     const count = skillManager.listSkills().length;
@@ -15780,17 +15953,18 @@ async function startWebServer(options = {}) {
     next();
   };
   const moduleDir = getModuleDir();
-  let clientDir = join17(moduleDir, "web", "client");
-  if (!existsSync23(clientDir)) {
-    clientDir = join17(moduleDir, "client");
+  let clientDir = join19(moduleDir, "web", "client");
+  if (!existsSync25(clientDir)) {
+    clientDir = join19(moduleDir, "client");
   }
-  if (!existsSync23(clientDir)) {
-    clientDir = join17(moduleDir, "..", "..", "src", "web", "client");
+  if (!existsSync25(clientDir)) {
+    clientDir = join19(moduleDir, "..", "..", "src", "web", "client");
   }
-  if (!existsSync23(clientDir)) {
-    clientDir = join17(process.cwd(), "src", "web", "client");
+  if (!existsSync25(clientDir)) {
+    clientDir = join19(process.cwd(), "src", "web", "client");
   }
   console.log(`   Static files: ${clientDir}`);
+  app.use("/vendor", express.static(join19(clientDir, "vendor"), { maxAge: "1y", immutable: true }));
   app.use(express.static(clientDir));
   app.get("/api/status", (_req, res) => {
     res.json({
@@ -15833,7 +16007,7 @@ async function startWebServer(options = {}) {
     }
     const token = authManager.login(username, password);
     console.log(`   \u2713 User registered via API: ${username}${firstRun ? " (first-run)" : ""}`);
-    res.cookie("aicli_token", token, { httpOnly: true, sameSite: "strict", maxAge: TOKEN_EXPIRY_MS });
+    res.cookie("aicli_token", token, authCookieOptions(req));
     res.json({ success: true, username });
   });
   app.post("/api/auth/login", (req, res) => {
@@ -15847,20 +16021,20 @@ async function startWebServer(options = {}) {
       res.status(401).json({ error: "Invalid username or password" });
       return;
     }
-    res.cookie("aicli_token", token, { httpOnly: true, sameSite: "strict", maxAge: TOKEN_EXPIRY_MS });
+    res.cookie("aicli_token", token, authCookieOptions(req));
     res.json({ success: true, username });
   });
-  app.post("/api/auth/logout", (_req, res) => {
-    res.clearCookie("aicli_token", { httpOnly: true, sameSite: "strict" });
+  app.post("/api/auth/logout", (req, res) => {
+    res.clearCookie("aicli_token", clearAuthCookieOptions(req));
     res.json({ success: true });
   });
   app.get("/api/files", requireAuth, (req, res) => {
     const cwd = process.cwd();
     const prefix = req.query.prefix || "";
-    const targetDir = join17(cwd, prefix);
+    const targetDir = join19(cwd, prefix);
     try {
-      const canonicalTarget = realpathSync(resolve6(targetDir));
-      const canonicalCwd = realpathSync(resolve6(cwd));
+      const canonicalTarget = realpathSync(resolve7(targetDir));
+      const canonicalCwd = realpathSync(resolve7(cwd));
       if (!canonicalTarget.startsWith(canonicalCwd + sep3) && canonicalTarget !== canonicalCwd) {
         res.json({ files: [] });
         return;
@@ -15871,10 +16045,10 @@ async function startWebServer(options = {}) {
     }
     try {
       const SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "dist-cjs", "release", "__pycache__", ".next", ".nuxt", "coverage", ".cache"]);
-      const entries = readdirSync11(targetDir, { withFileTypes: true });
+      const entries = readdirSync12(targetDir, { withFileTypes: true });
       const files = entries.filter((e) => !SKIP.has(e.name) && !e.name.startsWith(".")).slice(0, 50).map((e) => ({
         name: e.name,
-        path: relative3(cwd, join17(targetDir, e.name)).replace(/\\/g, "/"),
+        path: relative4(cwd, join19(targetDir, e.name)).replace(/\\/g, "/"),
         isDir: e.isDirectory()
       }));
       res.json({ files });
@@ -15910,8 +16084,8 @@ async function startWebServer(options = {}) {
     try {
       const authUser = req._authUser;
       const histDir = authUser ? getUserShared(authUser).config.getHistoryDir() : config.getHistoryDir();
-      const filePath = join17(histDir, `${id}.json`);
-      if (!existsSync23(filePath)) {
+      const filePath = join19(histDir, `${id}.json`);
+      if (!existsSync25(filePath)) {
         res.status(404).json({ error: "Session not found" });
         return;
       }
@@ -15926,7 +16100,7 @@ async function startWebServer(options = {}) {
         res.status(404).json({ error: "Session not found" });
         return;
       }
-      const data = JSON.parse(readFileSync16(filePath, "utf-8"));
+      const data = JSON.parse(readFileSync19(filePath, "utf-8"));
       res.json({ session: data });
     } catch (err) {
       res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
@@ -15939,10 +16113,10 @@ async function startWebServer(options = {}) {
       return;
     }
     const cwd = process.cwd();
-    const fullPath = resolve6(join17(cwd, filePath));
+    const fullPath = resolve7(join19(cwd, filePath));
     try {
       const canonicalFull = realpathSync(fullPath);
-      const canonicalCwd = realpathSync(resolve6(cwd));
+      const canonicalCwd = realpathSync(resolve7(cwd));
       if (!canonicalFull.startsWith(canonicalCwd + sep3) && canonicalFull !== canonicalCwd) {
         res.json({ error: "Access denied" });
         return;
@@ -15952,12 +16126,12 @@ async function startWebServer(options = {}) {
       return;
     }
     try {
-      const stat = statSync9(fullPath);
+      const stat = statSync10(fullPath);
       if (stat.size > 512 * 1024) {
         res.json({ error: `File too large (${(stat.size / 1024).toFixed(0)} KB, max 512 KB)` });
         return;
       }
-      const content = readFileSync16(fullPath, "utf-8");
+      const content = readFileSync19(fullPath, "utf-8");
       res.json({ content, size: stat.size });
     } catch {
       res.json({ error: "Cannot read file" });
@@ -16161,7 +16335,7 @@ async function startWebServer(options = {}) {
   });
   const MAX_PORT_ATTEMPTS = 10;
   let actualPort = port;
-  const result = await new Promise((resolve7, reject) => {
+  const result = await new Promise((resolve8, reject) => {
     const tryListen = (attempt) => {
       server.once("error", (err) => {
         if (err.code === "EADDRINUSE" && attempt < MAX_PORT_ATTEMPTS) {
@@ -16192,7 +16366,7 @@ async function startWebServer(options = {}) {
         }
         console.log(`   Press Ctrl+C to stop
 `);
-        resolve7({ port: actualPort, host, url });
+        resolve8({ port: actualPort, host, url });
       });
     };
     tryListen(1);
@@ -16212,22 +16386,43 @@ function resolveProjectMcpPath() {
   const cwd = process.cwd();
   const gitRoot = getGitRoot(cwd);
   const projectRoot = gitRoot ?? cwd;
-  const configPath = join17(projectRoot, MCP_PROJECT_CONFIG_NAME);
-  return existsSync23(configPath) ? configPath : null;
+  const configPath = join19(projectRoot, MCP_PROJECT_CONFIG_NAME);
+  return existsSync25(configPath) ? configPath : null;
 }
 function loadProjectMcpConfig() {
   const cwd = process.cwd();
   const gitRoot = getGitRoot(cwd);
   const projectRoot = gitRoot ?? cwd;
-  const configPath = join17(projectRoot, MCP_PROJECT_CONFIG_NAME);
-  if (!existsSync23(configPath)) return null;
+  const configPath = join19(projectRoot, MCP_PROJECT_CONFIG_NAME);
+  if (!existsSync25(configPath)) return null;
   try {
-    const raw = JSON.parse(readFileSync16(configPath, "utf-8"));
+    const raw = JSON.parse(readFileSync19(configPath, "utf-8"));
     return raw.mcpServers ?? raw;
   } catch {
     return null;
   }
 }
+function isHttpsRequest(req) {
+  if (req.secure) return true;
+  const forwardedProto = req.headers["x-forwarded-proto"];
+  const proto = Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto;
+  return proto?.split(",")[0]?.trim().toLowerCase() === "https";
+}
+function authCookieOptions(req) {
+  return {
+    httpOnly: true,
+    sameSite: "strict",
+    maxAge: TOKEN_EXPIRY_MS,
+    secure: isHttpsRequest(req)
+  };
+}
+function clearAuthCookieOptions(req) {
+  return {
+    httpOnly: true,
+    sameSite: "strict",
+    secure: isHttpsRequest(req)
+  };
+}
 function parseCookie(cookie) {
   const result = {};
   for (const part of cookie.split(";")) {