jinzd-ai-cli 0.4.209 → 0.4.211

package/dist/index.js

@@ -1,28 +1,32 @@
 #!/usr/bin/env node
-import {
-  buildReviewPrompt,
-  buildSecurityReviewPrompt
-} from "./chunk-HLWUDRBO.js";
 import {
   McpManager,
   SNAPSHOT_PROMPT,
   SkillManager,
   autoTrimSessionIfNeeded,
+  buildInitPrompt,
   clearDevState,
+  loadContextFiles,
   loadDevState,
   parseSimpleYaml,
   persistToolRound,
   readGitDiff,
   saveDevState,
+  scanProject,
   sessionHasMeaningfulContent,
   setupProxy
-} from "./chunk-ATNYI6JL.js";
+} from "./chunk-C3OU2OPF.js";
+import {
+  buildReviewPrompt,
+  buildSecurityReviewPrompt
+} from "./chunk-HLWUDRBO.js";
 import {
   ToolExecutor,
   ToolRegistry,
   askUserContext,
   cleanupRejectedTeeFile,
   estimateTokens,
+  formatPermissionProfileWarning,
   googleSearchContext,
   initTheme,
   isInterrupted,
@@ -36,10 +40,10 @@ import {
   spawnAgentContext,
   theme,
   undoStack
-} from "./chunk-JVLRMIHA.js";
+} from "./chunk-ZOPYREL5.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-EN63JA7N.js";
+import "./chunk-6NS6643Y.js";
 import {
   SessionManager,
   getContentText
@@ -56,7 +60,7 @@ import {
   getConfigDirUsage,
   listRecentCrashes,
   writeCrashLog
-} from "./chunk-D6M4E7SH.js";
+} from "./chunk-BE6ERF7M.js";
 import {
   ProviderRegistry
 } from "./chunk-QMXC327F.js";
@@ -65,7 +69,7 @@ import {
   getTopFailingTools,
   getTopUsedTools,
   installFlushOnExit
-} from "./chunk-STIEOOOL.js";
+} from "./chunk-JBWA73GK.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   TEE_FINAL_USER_NUDGE,
@@ -87,7 +91,7 @@ import {
 } from "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-DUZRQXIP.js";
+} from "./chunk-UOROWTGG.js";
 import {
   AuthError,
   ProviderError,
@@ -98,7 +102,6 @@ import {
   AUTHOR,
   AUTHOR_EMAIL,
   CONFIG_DIR_NAME,
-  CONTEXT_FILE_CANDIDATES,
   CONTEXT_PRESSURE_THRESHOLD,
   CUSTOM_COMMANDS_DIR_NAME,
   DEFAULT_MAX_TOKENS,
@@ -114,7 +117,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-UPMBIS4T.js";
+} from "./chunk-E5XCM4A6.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
@@ -145,8 +148,8 @@ import { program } from "commander";
 
 // src/repl/repl.ts
 import * as readline from "readline";
-import { existsSync as existsSync5, readFileSync as readFileSync4, readdirSync as readdirSync3, statSync as statSync4, mkdirSync as mkdirSync4 } from "fs";
-import { join as join5, resolve as resolve2, extname as extname2, dirname as dirname3, basename as basename2 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3, readdirSync as readdirSync2, statSync as statSync3, mkdirSync as mkdirSync4 } from "fs";
+import { join as join4, resolve as resolve2, extname as extname2, dirname as dirname3, basename as basename2 } from "path";
 import chalk4 from "chalk";
 
 // src/session/title-generator.ts
@@ -638,10 +641,10 @@ Error${typeName}: ${lines.join("\n")}
 };
 
 // src/repl/commands/index.ts
-import { writeFileSync, mkdirSync as mkdirSync2, existsSync as existsSync3, readFileSync as readFileSync2, statSync as statSync3 } from "fs";
+import { writeFileSync, mkdirSync as mkdirSync2, existsSync as existsSync2, readFileSync, statSync as statSync2 } from "fs";
 import { execSync as execSync2 } from "child_process";
 import { platform } from "os";
-import { resolve, dirname as dirname2, join as join3, basename } from "path";
+import { resolve, dirname as dirname2, join as join2, basename } from "path";
 import chalk2 from "chalk";
 
 // src/repl/clipboard.ts
@@ -731,195 +734,6 @@ function getClipboardHint() {
   return "";
 }
 
-// src/repl/commands/project-init.ts
-import { existsSync as existsSync2, readFileSync, readdirSync, statSync as statSync2 } from "fs";
-import { join as join2 } from "path";
-var SCAN_SKIP_DIRS = /* @__PURE__ */ new Set([
-  "node_modules",
-  ".git",
-  "dist",
-  "build",
-  "out",
-  "target",
-  ".next",
-  ".nuxt",
-  "__pycache__",
-  ".venv",
-  "venv",
-  ".tox",
-  ".mypy_cache",
-  ".pytest_cache",
-  ".gradle",
-  ".idea",
-  ".vscode",
-  ".vs",
-  "coverage",
-  ".cache",
-  ".parcel-cache",
-  "dist-cjs",
-  "release",
-  ".output",
-  ".turbo",
-  "vendor"
-]);
-function scanDirTree(dir, maxDepth = 2, maxEntries = 80) {
-  const lines = [];
-  let count = 0;
-  const walk = (d, prefix, depth) => {
-    if (depth > maxDepth || count >= maxEntries) return;
-    let entries;
-    try {
-      entries = readdirSync(d);
-    } catch {
-      return;
-    }
-    const filtered = entries.filter((e) => !e.startsWith(".") && !SCAN_SKIP_DIRS.has(e));
-    const sorted = filtered.sort((a, b) => {
-      let aIsDir = false, bIsDir = false;
-      try {
-        aIsDir = statSync2(join2(d, a)).isDirectory();
-      } catch {
-      }
-      try {
-        bIsDir = statSync2(join2(d, b)).isDirectory();
-      } catch {
-      }
-      if (aIsDir !== bIsDir) return aIsDir ? -1 : 1;
-      return a.localeCompare(b);
-    });
-    for (let i = 0; i < sorted.length && count < maxEntries; i++) {
-      const name = sorted[i];
-      const fullPath = join2(d, name);
-      const isLast = i === sorted.length - 1;
-      const connector = isLast ? "+-- " : "|-- ";
-      let isDir;
-      try {
-        isDir = statSync2(fullPath).isDirectory();
-      } catch {
-        continue;
-      }
-      lines.push(prefix + connector + name + (isDir ? "/" : ""));
-      count++;
-      if (isDir) {
-        walk(fullPath, prefix + (isLast ? "    " : "|   "), depth + 1);
-      }
-    }
-  };
-  walk(dir, "", 0);
-  if (count >= maxEntries) lines.push("... (truncated)");
-  return lines.join("\n");
-}
-function scanProject(cwd) {
-  const info = {
-    type: "unknown",
-    language: "unknown",
-    configFiles: [],
-    directoryStructure: ""
-  };
-  const check = (file) => existsSync2(join2(cwd, file));
-  const configCandidates = [
-    "package.json",
-    "tsconfig.json",
-    "Cargo.toml",
-    "pyproject.toml",
-    "setup.py",
-    "requirements.txt",
-    "go.mod",
-    "pom.xml",
-    "build.gradle",
-    "build.gradle.kts",
-    "CMakeLists.txt",
-    "Makefile",
-    ".csproj",
-    ".sln",
-    "composer.json",
-    "Gemfile",
-    "mix.exs",
-    "deno.json",
-    "bun.lockb"
-  ];
-  info.configFiles = configCandidates.filter(check);
-  if (check("package.json")) {
-    info.type = "node";
-    info.language = check("tsconfig.json") ? "TypeScript" : "JavaScript";
-    try {
-      const pkg = JSON.parse(readFileSync(join2(cwd, "package.json"), "utf-8"));
-      const scripts = pkg.scripts ?? {};
-      info.buildCommand = scripts.build ? "npm run build" : void 0;
-      info.testCommand = scripts.test ? "npm test" : void 0;
-      info.devCommand = scripts.dev ? "npm run dev" : void 0;
-      const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-      if (allDeps["react"]) info.framework = "React";
-      else if (allDeps["vue"]) info.framework = "Vue";
-      else if (allDeps["@angular/core"]) info.framework = "Angular";
-      else if (allDeps["next"]) info.framework = "Next.js";
-      else if (allDeps["nuxt"]) info.framework = "Nuxt";
-      else if (allDeps["express"]) info.framework = "Express";
-      else if (allDeps["fastify"]) info.framework = "Fastify";
-      else if (allDeps["svelte"]) info.framework = "Svelte";
-    } catch {
-    }
-  } else if (check("Cargo.toml")) {
-    info.type = "rust";
-    info.language = "Rust";
-    info.buildCommand = "cargo build";
-    info.testCommand = "cargo test";
-  } else if (check("pyproject.toml") || check("setup.py") || check("requirements.txt")) {
-    info.type = "python";
-    info.language = "Python";
-    info.testCommand = check("pytest.ini") || check("pyproject.toml") ? "pytest" : "python -m unittest";
-  } else if (check("go.mod")) {
-    info.type = "go";
-    info.language = "Go";
-    info.buildCommand = "go build ./...";
-    info.testCommand = "go test ./...";
-  } else if (check("pom.xml")) {
-    info.type = "java";
-    info.language = "Java";
-    info.buildCommand = "mvn package";
-    info.testCommand = "mvn test";
-  } else if (check("build.gradle") || check("build.gradle.kts")) {
-    info.type = "java";
-    info.language = "Java/Kotlin";
-    info.buildCommand = "./gradlew build";
-    info.testCommand = "./gradlew test";
-  }
-  info.directoryStructure = scanDirTree(cwd);
-  return info;
-}
-function buildInitPrompt(info, cwd) {
-  const parts = [
-    "Please generate an AICLI.md context file (Markdown format) for the following project. This file will be injected into the AI conversation system prompt to help the AI understand the project structure and coding conventions.",
-    "\n## Project Info\n",
-    `- Working directory: ${cwd}`,
-    `- Type: ${info.type}`,
-    `- Language: ${info.language}`
-  ];
-  if (info.framework) parts.push(`- Framework: ${info.framework}`);
-  if (info.buildCommand) parts.push(`- Build command: ${info.buildCommand}`);
-  if (info.testCommand) parts.push(`- Test command: ${info.testCommand}`);
-  if (info.devCommand) parts.push(`- Dev command: ${info.devCommand}`);
-  parts.push(`
-## Detected Config Files
-${info.configFiles.map((f) => `- ${f}`).join("\n")}`);
-  parts.push(`
-## Directory Structure
-\`\`\`
-${info.directoryStructure}
-\`\`\``);
-  parts.push(`
-## Requirements
-Please generate a structured Markdown file containing:
-1. Project overview (one-sentence summary)
-2. Tech stack
-3. Project structure description (based on the directory structure above)
-4. Common commands (build, test, dev, etc.)
-5. Code style and conventions (inferred from config files)
-
-Output the Markdown content directly, do not wrap the entire file in a code block. Keep it concise, within 200 lines.`);
-  return parts.join("\n");
-}
-
 // src/repl/commands/index.ts
 function fmtCtx(tokens) {
   if (tokens >= 1e6) return `${Math.round(tokens / 1e5) / 10}M`;
@@ -1489,7 +1303,7 @@ No commands match "${filter}".
     {
       name: "context",
       description: "Show or reload hierarchical context files",
-      usage: "/context [reload]",
+      usage: "/context [status|reload]",
       execute(args, ctx) {
         const sub = args[0];
         if (sub === "reload") {
@@ -1499,7 +1313,7 @@ No commands match "${filter}".
             const summary = layers2.map((l) => `${l.level}:${l.charCount}`).join(", ");
             ctx.renderer.printSuccess(`Context reloaded: ${layers2.length} layer(s) (${summary} chars)`);
           } else {
-            ctx.renderer.printInfo("No context file found. Place AICLI.md or CLAUDE.md in your project root or ~/.aicli/.");
+            ctx.renderer.printInfo("No context file found. Place AICLI.md, CLAUDE.md, or AGENTS.md in your project root or ~/.aicli/.");
           }
           return;
         }
@@ -1509,16 +1323,16 @@ No commands match "${filter}".
           console.log("  Context layers:");
           const levelLabels = { global: "Global ", project: "Project", local: "Local  " };
           for (const l of layers) {
-            console.log(`    ${levelLabels[l.level] ?? l.level}  : ${l.filePath} (${l.charCount} chars)`);
+            console.log(`    ${levelLabels[l.level] ?? l.level}  : ${l.displayPath ?? l.filePath} (${l.charCount} chars${l.truncated ? ", truncated" : ""})`);
           }
           const totalChars = layers.reduce((s, l) => s + l.charCount, 0);
           console.log(`  Total     : ${totalChars} chars (${layers.length} layer${layers.length > 1 ? "s" : ""})`);
         } else {
           console.log("  No context files loaded.");
           console.log("  Hierarchical context search order:");
-          console.log("    1. Global  : ~/.aicli/AICLI.md (or CLAUDE.md)");
-          console.log("    2. Project : <git-root>/AICLI.md");
-          console.log("    3. Local   : <cwd>/AICLI.md (when cwd \u2260 project root)");
+          console.log("    1. Global  : ~/.aicli/AICLI.override.md, AGENTS.override.md, AICLI.md, CLAUDE.md, or AGENTS.md");
+          console.log("    2. Project : <git-root>/same candidate order");
+          console.log("    3. Local   : <cwd>/same candidate order (when cwd \u2260 project root)");
         }
         console.log();
       }
@@ -1540,6 +1354,8 @@ No commands match "${filter}".
         console.log(`  Provider : ${ctx.getCurrentProvider()}`);
         console.log(`  Model    : ${currentModel}`);
         console.log(`  Ctx Win  : ${ctxStr}`);
+        console.log("  PermProf : " + (ctx.config.get("defaultPermissionProfile") ?? "legacy"));
+        console.log("  Network  : " + (ctx.config.get("networkPolicy")?.enabled ?? false ? "on" : "off"));
         console.log(`  Messages : ${session?.messages.length ?? 0}`);
         console.log(`  Session  : ${session?.id.slice(0, 8) ?? "none"}`);
         if (layers.length > 0) {
@@ -1830,16 +1646,16 @@ No tools match "${filter}".
       usage: "/mcp [reconnect [serverId] | trust-project]",
       async execute(args, ctx) {
         if (args[0] === "trust-project") {
-          const { join: join6 } = await import("path");
-          const { existsSync: existsSync6 } = await import("fs");
+          const { join: join5 } = await import("path");
+          const { existsSync: existsSync5 } = await import("fs");
           const { getGitRoot: getGitRoot2 } = await import("./git-context-EXOEHQSF.js");
-          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-VTZLKDAG.js");
+          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-AWTIQIWG.js");
           const { approveProject, hashMcpFile } = await import("./project-trust-NKYHL3VZ.js");
           const cwd = process.cwd();
           const projectRoot = getGitRoot2(cwd) ?? cwd;
-          const mcpPath = join6(projectRoot, MCP_PROJECT_CONFIG_NAME2);
+          const mcpPath = join5(projectRoot, MCP_PROJECT_CONFIG_NAME2);
           console.log();
-          if (!existsSync6(mcpPath)) {
+          if (!existsSync5(mcpPath)) {
             console.log(theme.dim(`  No .mcp.json in ${projectRoot}.`));
             console.log();
             return;
@@ -2172,9 +1988,9 @@ No tools match "${filter}".
       usage: "/init [--force]",
       async execute(args, ctx) {
         const cwd = process.cwd();
-        const targetPath = join3(cwd, "AICLI.md");
+        const targetPath = join2(cwd, "AICLI.md");
         const force = args.includes("--force");
-        if (existsSync3(targetPath) && !force) {
+        if (existsSync2(targetPath) && !force) {
           ctx.renderer.printInfo(`AICLI.md already exists at ${targetPath}`);
           ctx.renderer.printInfo("Use /init --force to overwrite, or edit it manually.");
           return;
@@ -2892,7 +2708,7 @@ ${hint}` : "")
       usage: "/test [command|filter]",
       async execute(args, ctx) {
         try {
-          const { executeTests } = await import("./run-tests-NDS2IEMK.js");
+          const { executeTests } = await import("./run-tests-3MHWUF43.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -3050,7 +2866,7 @@ ${hint}` : "")
       description: "Persistent memory (memory.md) + chat memory recall index (v0.4.89+)",
       usage: "/memory [show|add <text>|clear|path|rebuild|refresh|status|recall <query>|index-clear]",
       async execute(args, ctx) {
-        const memoryFile = join3(ctx.config.getConfigDir(), MEMORY_FILE_NAME);
+        const memoryFile = join2(ctx.config.getConfigDir(), MEMORY_FILE_NAME);
         const sub = args[0] ?? "show";
         if (sub === "rebuild" || sub === "refresh") {
           const full = sub === "rebuild";
@@ -3134,11 +2950,11 @@ ${hint}` : "")
           return;
         }
         if (sub === "show" || sub === "view") {
-          if (!existsSync3(memoryFile)) {
+          if (!existsSync2(memoryFile)) {
             ctx.renderer.printInfo("Memory is empty (memory.md not found)");
             return;
           }
-          const content = readFileSync2(memoryFile, "utf-8").trim();
+          const content = readFileSync(memoryFile, "utf-8").trim();
           if (!content) {
             ctx.renderer.printInfo("Memory is empty");
             return;
@@ -3163,14 +2979,14 @@ ${text}
 `;
           try {
             mkdirSync2(dirname2(memoryFile), { recursive: true });
-            const previous = existsSync3(memoryFile) ? readFileSync2(memoryFile, "utf-8") : "";
+            const previous = existsSync2(memoryFile) ? readFileSync(memoryFile, "utf-8") : "";
             atomicWriteFileSync(memoryFile, previous + entry);
             ctx.renderer.printSuccess(`Added to memory: "${text.slice(0, 60)}${text.length > 60 ? "\u2026" : ""}"`);
           } catch (err) {
             ctx.renderer.renderError(`Failed to write memory: ${err instanceof Error ? err.message : String(err)}`);
           }
         } else if (sub === "clear") {
-          if (!existsSync3(memoryFile)) {
+          if (!existsSync2(memoryFile)) {
             ctx.renderer.printInfo("Memory is already empty");
             return;
           }
@@ -3206,20 +3022,20 @@ ${text}
         console.log(theme.heading("Config Files:"));
         console.log(`  Dir:        ${theme.accent(configDir)}`);
         const checkFile = (label, filePath) => {
-          const exists = existsSync3(filePath);
+          const exists = existsSync2(filePath);
           const icon = exists ? theme.success("\u2713") : theme.dim("\u2013");
           let extra = "";
           if (exists) {
             try {
-              extra = theme.dim(` (${statSync3(filePath).size} bytes)`);
+              extra = theme.dim(` (${statSync2(filePath).size} bytes)`);
             } catch {
             }
           }
           console.log(`  ${icon}  ${label.padEnd(14)} ${exists ? filePath : theme.dim("(not found)")}${extra}`);
         };
-        checkFile("config.json", join3(configDir, "config.json"));
-        checkFile("memory.md", join3(configDir, MEMORY_FILE_NAME));
-        checkFile("dev-state.md", join3(configDir, "dev-state.md"));
+        checkFile("config.json", join2(configDir, "config.json"));
+        checkFile("memory.md", join2(configDir, MEMORY_FILE_NAME));
+        checkFile("dev-state.md", join2(configDir, "dev-state.md"));
         console.log();
         const mcpManager = ctx.getMcpManager();
         if (mcpManager) {
@@ -3383,9 +3199,9 @@ ${text}
         let newFiles = 0;
         let modifiedFiles = 0;
         for (const [filePath, { earliest }] of fileMap) {
-          const currentContent = existsSync3(filePath) ? (() => {
+          const currentContent = existsSync2(filePath) ? (() => {
             try {
-              return readFileSync2(filePath, "utf-8");
+              return readFileSync(filePath, "utf-8");
             } catch {
               return null;
             }
@@ -3488,6 +3304,8 @@ Summary: ${fileMap.size} file(s) \u2014 ${newFiles} new, ${modifiedFiles} modifi
           console.log(`    redactOnSave : ${security.redactOnSave ? theme.success("on") : theme.warning("off")}`);
           console.log(`    redactOnSend : ${security.redactOnSend ? theme.success("on") : theme.dim("off")}`);
           console.log(`    mode         : ${security.mode}`);
+          console.log("    profile      : " + (ctx.config.get("defaultPermissionProfile") ?? "legacy"));
+          console.log("    network      : " + (ctx.config.get("networkPolicy")?.enabled ?? false ? "on" : "off"));
           console.log(`    patterns     : ${DEFAULT_PATTERNS.length} built-in + ${security.customPatterns?.length ?? 0} custom`);
           console.log(`    last save    : ${ctx.sessions.lastRedactionHits} hit(s) redacted`);
           console.log();
@@ -3511,12 +3329,12 @@ Summary: ${fileMap.size} file(s) \u2014 ${newFiles} new, ${modifiedFiles} modifi
           if (scanAll) {
             const metas = ctx.sessions.listSessions();
             console.log(theme.info(`  Scanning ${metas.length} session(s)\u2026`));
-            const { readFileSync: readFileSync5 } = await import("fs");
-            const { join: join6 } = await import("path");
+            const { readFileSync: readFileSync4 } = await import("fs");
+            const { join: join5 } = await import("path");
             const historyDir = ctx.config.getHistoryDir();
             for (const m of metas) {
               try {
-                const content = readFileSync5(join6(historyDir, `${m.id}.json`), "utf-8");
+                const content = readFileSync4(join5(historyDir, `${m.id}.json`), "utf-8");
                 const hits2 = scanString(content, opts);
                 if (hits2.length) {
                   filesWithHits++;
@@ -4201,12 +4019,12 @@ Managing ${displayName} API Key`);
 };
 
 // src/repl/custom-commands.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, readdirSync as readdirSync2, mkdirSync as mkdirSync3 } from "fs";
-import { join as join4, extname } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2, readdirSync, mkdirSync as mkdirSync3 } from "fs";
+import { join as join3, extname } from "path";
 function parseCommandFile(filePath) {
   let content;
   try {
-    content = readFileSync3(filePath, "utf-8");
+    content = readFileSync2(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -4230,7 +4048,7 @@ function expandTemplate(template, args) {
   result = result.replace(/\{\{input\}\}/g, args.join(" "));
   result = result.replace(/\{\{file:([^}]+)\}\}/g, (_m, p) => {
     try {
-      return readFileSync3(p.trim(), "utf-8");
+      return readFileSync2(p.trim(), "utf-8");
     } catch {
       return `[Error: cannot read ${p.trim()}]`;
     }
@@ -4255,14 +4073,14 @@ var CustomCommandManager = class {
   commands = /* @__PURE__ */ new Map();
   loadCommands() {
     this.commands.clear();
-    if (!existsSync4(this.commandsDir)) {
+    if (!existsSync3(this.commandsDir)) {
       mkdirSync3(this.commandsDir, { recursive: true });
       return 0;
     }
     let count = 0;
-    for (const file of readdirSync2(this.commandsDir)) {
+    for (const file of readdirSync(this.commandsDir)) {
       if (extname(file) !== ".md") continue;
-      const cmd = parseCommandFile(join4(this.commandsDir, file));
+      const cmd = parseCommandFile(join3(this.commandsDir, file));
       if (cmd) {
         this.commands.set(cmd.meta.name, cmd);
         count++;
@@ -4567,17 +4385,17 @@ function parseAtReferences(input2, cwd) {
     const absPath = resolve2(cwd, rawPath);
     const ext = extname2(rawPath).toLowerCase();
     const mime = IMAGE_MIME[ext];
-    if (!existsSync5(absPath)) {
+    if (!existsSync4(absPath)) {
       refs.push({ path: rawPath, type: "notfound" });
       continue;
     }
     if (mime) {
-      const fileSize = statSync4(absPath).size;
+      const fileSize = statSync3(absPath).size;
       if (fileSize > MAX_IMAGE_BYTES) {
         refs.push({ path: rawPath, type: "toolarge" });
         continue;
       }
-      const data = readFileSync4(absPath).toString("base64");
+      const data = readFileSync3(absPath).toString("base64");
       imageParts.push({
         type: "image_url",
         image_url: { url: `data:${mime};base64,${data}` }
@@ -4585,7 +4403,7 @@ function parseAtReferences(input2, cwd) {
       refs.push({ path: rawPath, type: "image" });
       textBody = textBody.replace(match[0], "").trim();
     } else {
-      const content = readFileSync4(absPath, "utf-8");
+      const content = readFileSync3(absPath, "utf-8");
       const inlined = `
 
 [File: ${rawPath}]
@@ -4643,10 +4461,17 @@ var Repl = class {
     this.toolRegistry = new ToolRegistry();
     this.toolExecutor = new ToolExecutor(this.toolRegistry);
     this.toolExecutor.setReadline(this.rl);
+    const permissionProfileName = this.config.get("defaultPermissionProfile") ?? "legacy";
+    const permissionProfiles = this.config.get("permissionProfiles") ?? {};
     this.toolExecutor.setConfig({
       hookConfig: this.config.get("hooks") ?? void 0,
       permissionRules: this.config.get("permissionRules") ?? [],
-      defaultPermission: this.config.get("defaultPermission") ?? "confirm"
+      defaultPermission: this.config.get("defaultPermission") ?? "confirm",
+      permissionProfileName,
+      permissionProfile: permissionProfiles[permissionProfileName],
+      allowedPermissionProfiles: this.config.get("allowedPermissionProfiles") ?? [],
+      workspaceRoot: process.cwd(),
+      networkPolicy: this.config.get("networkPolicy")
     });
     if (this.config.get("alwaysYolo") === true) {
       this.toolExecutor.sessionAutoApprove = true;
@@ -4677,6 +4502,7 @@ var Repl = class {
   };
   /** 当前加载的层级上下文（全局/项目/子目录） */
   contextLayers = [];
+  contextLoadResult = null;
   /** 本次会话累计 token 用量 */
   sessionTokenUsage = { inputTokens: 0, outputTokens: 0, cacheCreationTokens: 0, cacheReadTokens: 0 };
   /** Fold a single-request TokenUsage (with optional cache fields) into sessionTokenUsage + cost tracker.
@@ -4803,19 +4629,19 @@ var Repl = class {
       if (depth > 2 || entryCount >= MAX_TREE_ENTRIES) return;
       let entries;
       try {
-        entries = readdirSync3(dir);
+        entries = readdirSync2(dir);
       } catch {
         return;
       }
       const filtered = entries.filter((e) => !SKIP_DIRS_SET.has(e));
       for (let i = 0; i < filtered.length && entryCount < MAX_TREE_ENTRIES; i++) {
         const name = filtered[i];
-        const fullPath = join5(dir, name);
+        const fullPath = join4(dir, name);
         const isLast = i === filtered.length - 1;
         const connector = isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 ";
         let isDir;
         try {
-          isDir = statSync4(fullPath).isDirectory();
+          isDir = statSync3(fullPath).isDirectory();
         } catch {
           continue;
         }
@@ -4837,17 +4663,17 @@ ${treeLines.join("\n")}`
       if (totalChars >= MAX_TOTAL_CHARS) return;
       let entries;
       try {
-        entries = readdirSync3(dir);
+        entries = readdirSync2(dir);
       } catch {
         return;
       }
       for (const name of entries) {
         if (totalChars >= MAX_TOTAL_CHARS) break;
         if (SKIP_DIRS_SET.has(name)) continue;
-        const fullPath = join5(dir, name);
+        const fullPath = join4(dir, name);
         let st;
         try {
-          st = statSync4(fullPath);
+          st = statSync3(fullPath);
         } catch {
           continue;
         }
@@ -4859,7 +4685,7 @@ ${treeLines.join("\n")}`
           if (!TEXT_EXTS.has(ext) && !isSpecial) continue;
           if (st.size > MAX_FILE_CHARS * 3) continue;
           try {
-            let content = readFileSync4(fullPath, "utf-8");
+            let content = readFileSync3(fullPath, "utf-8");
             if (content.length > MAX_FILE_CHARS) {
               content = content.slice(0, MAX_FILE_CHARS) + `
 ... (truncated, ${content.length} chars total)`;
@@ -4889,12 +4715,12 @@ ${content}
    */
   addExtraContextDir(dirPath) {
     const absPath = resolve2(dirPath);
-    if (!existsSync5(absPath)) {
+    if (!existsSync4(absPath)) {
       return { success: false, charCount: 0, added: false, error: `Directory not found: ${dirPath}` };
     }
     let isDir;
     try {
-      isDir = statSync4(absPath).isDirectory();
+      isDir = statSync3(absPath).isDirectory();
     } catch {
       return { success: false, charCount: 0, added: false, error: `Cannot access: ${dirPath}` };
     }
@@ -4917,33 +4743,6 @@ ${content}
     this.extraContextDirs.splice(idx, 1);
     return true;
   }
-  /**
-   * 在指定目录中按候选文件名列表查找第一个存在且非空的上下文文件。
-   * 返回 { filePath, content } 或 null。
-   */
-  findContextFile(dir, candidates = CONTEXT_FILE_CANDIDATES) {
-    for (const candidate of candidates) {
-      const fullPath = join5(dir, candidate);
-      if (existsSync5(fullPath)) {
-        const content = readFileSync4(fullPath, "utf-8").trim();
-        if (content) return { filePath: fullPath, content };
-      }
-    }
-    return null;
-  }
-  /**
-   * 加载层级上下文文件系统。
-   *
-   * 三层级结构（按顺序拼接）：
-   *   1. 全局层  ~/.aicli/AICLI.md      — 所有项目通用的个人偏好
-   *   2. 项目层  <git-root>/AICLI.md    — 项目级规则（提交到 git 供团队共享）
-   *   3. 子目录层 <cwd>/AICLI.md        — 当前工作子目录的特定指令
-   *
-   * contextFile 配置语义：
-   *   - 'auto'（默认）：启用三层级自动发现
-   *   - false：禁用所有上下文加载
-   *   - 具体文件名：仅加载 cwd 下的指定文件（回退到旧的单文件行为）
-   */
   /**
    * 加载项目级 .mcp.json 文件（位于 git 根目录或 cwd）。
    * 格式兼容 Claude Desktop：`{ "mcpServers": { ... } }`
@@ -4953,10 +4752,10 @@ ${content}
     const cwd = process.cwd();
     const gitRoot = getGitRoot(cwd);
     const projectRoot = gitRoot ?? cwd;
-    const mcpPath = join5(projectRoot, MCP_PROJECT_CONFIG_NAME);
-    if (!existsSync5(mcpPath)) return null;
+    const mcpPath = join4(projectRoot, MCP_PROJECT_CONFIG_NAME);
+    if (!existsSync4(mcpPath)) return null;
     try {
-      const raw = JSON.parse(readFileSync4(mcpPath, "utf-8"));
+      const raw = JSON.parse(readFileSync3(mcpPath, "utf-8"));
       const servers = raw?.mcpServers;
       if (!servers || typeof servers !== "object") {
         process.stderr.write(
@@ -4990,79 +4789,25 @@ ${content}
     }
   }
   loadHierarchicalContext() {
-    const setting = this.config.get("contextFile");
-    if (setting === false) return { layers: [], mergedContent: "" };
+    const contextConfig = this.config.get("context");
     const cwd = process.cwd();
-    if (setting !== "auto") {
-      const fullPath = resolve2(cwd, String(setting));
-      if (!fullPath.startsWith(resolve2(cwd))) {
-        process.stderr.write(
-          `[Warning] contextFile path "${setting}" is outside current directory, ignoring.
-`
-        );
-        return { layers: [], mergedContent: "" };
-      }
-      if (existsSync5(fullPath)) {
-        const content = readFileSync4(fullPath, "utf-8").trim();
-        if (content) {
-          const layer = {
-            level: "project",
-            filePath: setting,
-            content,
-            charCount: content.length
-          };
-          return { layers: [layer], mergedContent: content };
-        }
-      }
-      return { layers: [], mergedContent: "" };
-    }
-    const layers = [];
-    const configDir = this.config.getConfigDir();
-    const globalCtx = this.findContextFile(configDir);
-    if (globalCtx) {
-      layers.push({
-        level: "global",
-        filePath: globalCtx.filePath,
-        content: globalCtx.content,
-        charCount: globalCtx.content.length
-      });
-    }
     const gitRoot = getGitRoot(cwd);
     const projectRoot = gitRoot ?? cwd;
-    const projectCtx = this.findContextFile(projectRoot);
-    if (projectCtx) {
-      layers.push({
-        level: "project",
-        filePath: projectCtx.filePath,
-        content: projectCtx.content,
-        charCount: projectCtx.content.length
-      });
-    }
-    const normalizedCwd = resolve2(cwd);
-    const normalizedRoot = resolve2(projectRoot);
-    if (normalizedCwd !== normalizedRoot) {
-      const localCtx = this.findContextFile(cwd);
-      if (localCtx) {
-        layers.push({
-          level: "local",
-          filePath: localCtx.filePath,
-          content: localCtx.content,
-          charCount: localCtx.content.length
-        });
-      }
-    }
-    const mergedContent = layers.map((l) => l.content).join("\n\n---\n\n");
-    return { layers, mergedContent };
+    const result = loadContextFiles({
+      cwd,
+      configDir: this.config.getConfigDir(),
+      projectRoot,
+      setting: this.config.get("contextFile"),
+      fallbackFilenames: contextConfig.projectDocFallbackFilenames,
+      maxBytes: contextConfig.projectDocMaxBytes
+    });
+    this.contextLoadResult = result;
+    return { layers: result.layers, mergedContent: result.mergedContent };
   }
-  /**
-   * 加载持久记忆内容（~/.aicli/memory.md）。
-   * 不存在或为空时返回 null。
-   * 超过 MEMORY_MAX_CHARS 时只取末尾最新部分。
-   */
   loadMemoryContent() {
-    const memoryPath = join5(this.config.getConfigDir(), MEMORY_FILE_NAME);
-    if (!existsSync5(memoryPath)) return null;
-    let content = readFileSync4(memoryPath, "utf-8").trim();
+    const memoryPath = join4(this.config.getConfigDir(), MEMORY_FILE_NAME);
+    if (!existsSync4(memoryPath)) return null;
+    let content = readFileSync3(memoryPath, "utf-8").trim();
     if (!content) return null;
     if (content.length > MEMORY_MAX_CHARS) {
       content = content.slice(-MEMORY_MAX_CHARS);
@@ -5397,6 +5142,11 @@ Session '${this.resumeSessionId}' not found.
         theme.warning("  \u26A1 YOLO mode ON (alwaysYolo=true in config) \u2014 write tools auto-approved; destructive tools still require confirmation.\n")
       );
     }
+    const permissionProfileWarning = formatPermissionProfileWarning(this.config.get("defaultPermissionProfile") ?? "legacy");
+    if (permissionProfileWarning) {
+      process.stdout.write(theme.warning(`  ${permissionProfileWarning}
+`));
+    }
     const cfgOutputCap = this.config.get("maxToolOutputChars");
     if (typeof cfgOutputCap === "number" && cfgOutputCap > 0) setMaxOutputCap(cfgOutputCap);
     if (welcomeModelInfo?.contextWindow) setContextWindow(welcomeModelInfo.contextWindow);
@@ -5450,14 +5200,14 @@ Session '${this.resumeSessionId}' not found.
       process.stdout.write(theme.dim(`  \u{1F50C} Plugins loaded: ${pluginCount} tool(s) from plugins/
 `));
     }
-    const skillsDir = join5(this.config.getConfigDir(), SKILLS_DIR_NAME);
+    const skillsDir = join4(this.config.getConfigDir(), SKILLS_DIR_NAME);
     this.skillManager = new SkillManager(skillsDir, this.config.get("ui").skillSizeWarn);
     const skillCount = this.skillManager.loadSkills();
     if (skillCount > 0) {
       process.stdout.write(theme.dim(`  \u{1F3AF} Skills: ${skillCount} available (use /skill to manage)
 `));
     }
-    const commandsDir = join5(this.config.getConfigDir(), CUSTOM_COMMANDS_DIR_NAME);
+    const commandsDir = join4(this.config.getConfigDir(), CUSTOM_COMMANDS_DIR_NAME);
     this.customCommandManager = new CustomCommandManager(commandsDir);
     const customCmdCount = this.customCommandManager.loadCommands();
     if (customCmdCount > 0) {
@@ -6093,15 +5843,15 @@ Session '${this.resumeSessionId}' not found.
       const dir = normalized.includes("/") ? dirname3(normalized) : ".";
       const prefix = normalized.includes("/") ? basename2(normalized) : normalized;
       const absDir = resolve2(process.cwd(), dir);
-      if (!existsSync5(absDir)) return [];
-      const entries = readdirSync3(absDir);
+      if (!existsSync4(absDir)) return [];
+      const entries = readdirSync2(absDir);
       const results = [];
       for (const entry of entries) {
         if (entry.startsWith(".")) continue;
         if (!entry.toLowerCase().startsWith(prefix.toLowerCase())) continue;
         try {
-          const fullPath = join5(absDir, entry);
-          const stat = statSync4(fullPath);
+          const fullPath = join4(absDir, entry);
+          const stat = statSync3(fullPath);
           const rel = dir === "." ? entry : `${dir}/${entry}`;
           results.push(stat.isDirectory() ? `${rel}/` : rel);
         } catch {
@@ -7270,7 +7020,7 @@ program.command("web").description("Start Web UI server with browser-based chat
     console.error("Error: Invalid port number. Must be between 1 and 65535.");
     process.exit(1);
   }
-  const { startWebServer } = await import("./server-4URLNC7P.js");
+  const { startWebServer } = await import("./server-BTSKOPQI.js");
   await startWebServer({ port, host: options.host });
 });
 program.command("user [action] [username]").description("Manage Web UI users (list | create <name> | delete <name> | reset-password <name> | logout-all <name> | migrate <name>)").action(async (action, username) => {
@@ -7437,16 +7187,16 @@ program.command("sessions").description("List recent conversation sessions").opt
   console.log(footer + "\n");
 });
 program.command("usage").description("Show token + cost usage grouped by provider/model (cross-session)").option("--days <n>", "Only the last N days (inclusive of today)").option("--month <ym>", "Only a specific month, format YYYY-MM (e.g. 2026-06)").option("--json", "Output as JSON (for scripting)").action(async (options) => {
-  const { runUsageCli } = await import("./usage-ZNCKGF6U.js");
+  const { runUsageCli } = await import("./usage-T2P6FTE7.js");
   await runUsageCli(options);
 });
 program.command("doctor").description("Health check: API keys, config, MCP, recent crashes, tool usage, disk usage").option("--json", "Output as JSON (for scripting)").option("--reset-stats", "Reset accumulated tool usage statistics").action(async (options) => {
-  const { runDoctorCli } = await import("./doctor-cli-IU6FSVLF.js");
+  const { runDoctorCli } = await import("./doctor-cli-SSI6ETFT.js");
   await runDoctorCli({ json: !!options.json, resetStats: !!options.resetStats });
 });
 program.command("batch <action> [arg] [arg2]").description("Anthropic Message Batches: submit | list | status <id> | results <id> [out] | cancel <id>").option("--dry-run", "Parse and validate input without submitting (submit only)").action(async (action, arg, arg2, options) => {
   try {
-    const batch = await import("./batch-45WLJUVP.js");
+    const batch = await import("./batch-DE4RXKZD.js");
     switch (action) {
       case "submit":
         if (!arg) {
@@ -7489,7 +7239,7 @@ program.command("batch <action> [arg] [arg2]").description("Anthropic Message Ba
   }
 });
 program.command("mcp-serve").description("Start an MCP server over STDIO, exposing aicli's built-in tools to Claude Desktop / Cursor / other MCP clients").option("--allow-destructive", "Allow bash / run_interactive / task_create (always destructive in MCP mode)").option("--allow-outside-cwd", "Allow tool path arguments to escape the sandbox root \u2014 disabled by default").option("--tools <list>", "Comma-separated whitelist of tools to expose (default: all eligible tools)").option("--cwd <path>", "Working directory AND sandbox root (default: current directory)").action(async (options) => {
-  const { startMcpServer } = await import("./server-72SAPLPS.js");
+  const { startMcpServer } = await import("./server-7USZJJAH.js");
   await startMcpServer({
     allowDestructive: !!options.allowDestructive,
     allowOutsideCwd: !!options.allowOutsideCwd,
@@ -7498,7 +7248,7 @@ program.command("mcp-serve").description("Start an MCP server over STDIO, exposi
   });
 });
 program.command("ci").description("Headless PR review (code + security) \u2014 reads git/gh diff, optionally posts to PR. Designed for GitHub Actions.").option("--pr <num>", "PR number; diff fetched via `gh pr diff <num>`", (v) => parseInt(v, 10)).option("--base <ref>", "Base ref for `git diff <ref>...HEAD` (ignored when --pr set)").option("--post", "Post review as a PR comment (requires gh CLI + GH_TOKEN, needs --pr)").option("--no-update", "Always create a new comment instead of updating the previous aicli review").option("--skip-code", "Skip the code review section").option("--skip-security", "Skip the security review section").option("--detailed", "Use the detailed code-review prompt").option("--max-diff <n>", "Max diff chars sent to the model (default 30000)", (v) => parseInt(v, 10)).option("--provider <id>", "Override provider (default: config.defaultProvider)").option("--model <id>", "Override model").option("--dry-run", "Print result to stdout instead of posting (overrides --post)").action(async (options) => {
-  const { runCi } = await import("./ci-PUE3MQ7J.js");
+  const { runCi } = await import("./ci-XMUEX526.js");
   const result = await runCi({
     pr: options.pr,
     base: options.base,
@@ -7644,7 +7394,7 @@ program.command("hub [topic]").description("Start multi-agent hub (discuss / bra
     }),
     config.get("customProviders")
   );
-  const { startHub } = await import("./hub-4ETK4R2J.js");
+  const { startHub } = await import("./hub-INUJND2G.js");
   await startHub(
     {
       topic: topic ?? "",
@@ -7744,7 +7494,27 @@ ${options.prompt}` : options.prompt;
   const maxTokens = modelParams.maxTokens ?? DEFAULT_MAX_TOKENS;
   const timeout = modelParams.timeout ?? 6e4;
   const temperature = modelParams.temperature;
-  const systemPrompt = options.system ?? config.get("session").systemPrompt ?? void 0;
+  let systemPrompt = options.system;
+  if (!systemPrompt) {
+    const contextConfig = config.get("context");
+    const cwd = process.cwd();
+    const gitRoot = getGitRoot(cwd);
+    const loaded = loadContextFiles({
+      cwd,
+      configDir: config.getConfigDir(),
+      projectRoot: gitRoot ?? cwd,
+      setting: config.get("contextFile"),
+      fallbackFilenames: contextConfig.projectDocFallbackFilenames,
+      maxBytes: contextConfig.projectDocMaxBytes
+    });
+    const parts = [
+      config.get("session").systemPrompt,
+      loaded.mergedContent ? `# Project Context
+
+${loaded.mergedContent}` : void 0
+    ].filter(Boolean);
+    systemPrompt = parts.length > 0 ? parts.join("\n\n---\n\n") : void 0;
+  }
   const isStreamingJson = options.outputFormat === "streaming-json";
   const useStream = options.stream !== false && !options.json && !isStreamingJson;
   try {