jinzd-ai-cli 0.4.217 → 0.4.219

package/README.md

@@ -34,7 +34,8 @@
 - **MCP Server Mode** *(v0.4.84+)* — `aicli mcp-serve` reverses ai-cli into an MCP server (JSON-RPC 2.0 over stdio), exposing its 28 built-in tools (incl. `find_symbol` / `search_code` / `run_tests`) to Claude Desktop / Cursor / any MCP client. Opt-in destructive-tool allow, `--tools` whitelist, `--cwd` override
 - **Session Sensitive-Data Redaction** *(v0.4.88+)* — unified redactor scrubs `password=` / `api_key` / bearer tokens / OpenAI-style keys from every message **before it hits disk**. Query text is redacted too, so secrets never reach embeddings or logs. `/security status` + `/security scan` to audit
 - **Human-like Long-Term Memory** *(v0.4.89+, B4)* — semantic index over every past chat session + `recall_memory` AI tool + `/memory rebuild|refresh|status|recall` commands. AI is prompted to auto-recall when it sees "last time" / "之前" / ambiguous references. Reuses the same MiniLM embedder as semantic code search
-- **Governed Persistent Memory** *(v0.4.217+)* — `save_memory` and `/memory add` write auditable `memory.jsonl` entries with id/scope/source/sensitivity/approval/expiry; low-risk entries auto-approve, sensitive entries stay pending until `/memory approve <id>`, and project-scoped memories only inject inside the same project
+- **Governed Persistent Memory** *(v0.4.217+)* — `save_memory` and `/memory add` write auditable `memory.jsonl` entries with id/scope/source/sensitivity/approval/expiry; low-risk entries auto-approve, sensitive entries stay pending until `/memory approve <id>`, and project-scoped memories only inject inside the same project
+- **Package Plugin Ecosystem** *(v0.4.218+)* — install shareable .aicli-plugin/plugin.json packages with skills, hooks, commands, MCP servers, agents, and permission hints; only trusted+enabled plugins load, hooks still require hook trust, and MCP/tools remain under permission profiles/network policy
 - **Web UI Memory Panel** *(v0.4.90+, B4)* — new 🧠 Memory sidebar tab with semantic search across past chats; each hit has **➕ Inject** (quotes the snippet into the chat input as a markdown blockquote so you can review/edit before sending — no silent context injection) and **↗ Load** (jumps to source session). Bulk "Inject top 3" for recall bundles
 - **Streaming Tool Use** — Real-time streaming of AI reasoning and tool calls as they happen
 - **Sub-Agents** — Delegate complex subtasks to isolated child agents with independent tool loops
@@ -218,7 +219,8 @@ AI autonomously invokes these 27 tools during conversations:
 | `/export` | Export session as Markdown or JSON |
 | `/profile` | View/edit your identity (AI knows who you are across all providers) |
 | `/config` | Open configuration wizard |
-| `/help` | Show all available commands |
+| /help | Show all available commands |
+| /plugin | Install, trust, enable, disable, and inspect package plugins |
 
 **Multi-line input**: Use `\` at end of line for continuation, or paste multi-line content directly (auto-detected and merged).
 
@@ -561,6 +563,7 @@ node scripts/release.mjs patch -m "..." --dry-run
 - [`docs/USAGE.md`](docs/USAGE.md) — Complete reference manual (commands, tools, config)
 - [`docs/TUTORIAL.md`](docs/TUTORIAL.md) — Hands-on tutorial, zero to fluent in an hour
 - [`docs/ADVANCED.md`](docs/ADVANCED.md) — Architecture and internals (for developers)
+- [`docs/MIGRATION.md`](docs/MIGRATION.md) — Migration guide from Claude Code, Codex, Claude Desktop, and Cursor
 - [`docs/RECIPES.md`](docs/RECIPES.md) — Practical recipes by scenario
 - [`docs/SECURITY.md`](docs/SECURITY.md) — **Security model, deployment checklist, audit history.** Read before exposing `aicli web` to a network.
 - [`CHANGELOG.md`](CHANGELOG.md) — Per-version change log

package/dist/{batch-YCOVKTXD.js → batch-CHAPYRVM.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   ConfigManager
-} from "./chunk-WKOQ5CYC.js";
+} from "./chunk-KIEZBTVD.js";
 import "./chunk-TZQHYZKT.js";
-import "./chunk-XJGEQIYS.js";
+import "./chunk-U7KVU25H.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/chunk-3I4RZYYO.js

@@ -0,0 +1,638 @@
+#!/usr/bin/env node
+import {
+  ProviderRegistry
+} from "./chunk-QMXC327F.js";
+import {
+  getActivePluginAssets,
+  getPendingHookTrust,
+  getStatsSnapshot,
+  getTopFailingTools,
+  getTopUsedTools,
+  listHooks,
+  listInstalledPlugins,
+  resetStats
+} from "./chunk-GGKQHPB3.js";
+import {
+  ConfigManager
+} from "./chunk-KIEZBTVD.js";
+import {
+  CONFIG_DIR_NAME,
+  CONTEXT_FILE_CANDIDATES,
+  CONTEXT_FILE_MAX_BYTES,
+  DEV_STATE_FILE_NAME,
+  MCP_PROJECT_CONFIG_NAME,
+  MEMORY_FILE_NAME,
+  VERSION
+} from "./chunk-U7KVU25H.js";
+import {
+  getGitRoot
+} from "./chunk-HOSJZMQS.js";
+
+// src/diagnostics/doctor-report.ts
+import { existsSync as existsSync3, statSync as statSync2 } from "fs";
+import { join as join3 } from "path";
+import { arch as arch2, platform as platform2, release as release2 } from "os";
+
+// src/core/context-files.ts
+import { existsSync, readFileSync } from "fs";
+import { join, relative, resolve } from "path";
+function uniqueNonEmpty(values) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const value of values) {
+    const trimmed = value.trim();
+    if (!trimmed || seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    out.push(trimmed);
+  }
+  return out;
+}
+function buildContextFileCandidates(fallbackFilenames = []) {
+  return uniqueNonEmpty([...CONTEXT_FILE_CANDIDATES, ...fallbackFilenames]);
+}
+function displayPath(filePath, cwd) {
+  const rel = relative(cwd, filePath);
+  if (rel && !rel.startsWith("..") && !rel.startsWith("/") && !rel.startsWith("\\")) {
+    return rel;
+  }
+  return filePath;
+}
+function isInsideOrEqual(parent, child) {
+  const rel = relative(resolve(parent), resolve(child));
+  return rel === "" || !!rel && !rel.startsWith("..") && !rel.startsWith("/") && !rel.startsWith("\\");
+}
+function readContextFile(level, filePath, cwd, maxBytes) {
+  const name = filePath.split(/[\\/]/).pop() ?? filePath;
+  const shown = displayPath(filePath, cwd);
+  try {
+    const raw = readFileSync(filePath);
+    const byteCount = raw.byteLength;
+    if (byteCount === 0) {
+      return {
+        layer: null,
+        skipped: { level, filePath, displayPath: shown, fileName: name, reason: "empty" }
+      };
+    }
+    const truncated = byteCount > maxBytes;
+    const bytes = truncated ? raw.subarray(0, maxBytes) : raw;
+    const content = bytes.toString("utf-8").trim();
+    if (!content) {
+      return {
+        layer: null,
+        skipped: { level, filePath, displayPath: shown, fileName: name, reason: "empty" }
+      };
+    }
+    return {
+      layer: {
+        level: level === "single" ? "project" : level,
+        filePath,
+        displayPath: shown,
+        fileName: name,
+        content,
+        charCount: content.length,
+        byteCount,
+        truncated
+      },
+      skipped: truncated ? { level, filePath, displayPath: shown, fileName: name, reason: "too-large", message: `truncated to ${maxBytes} bytes` } : null
+    };
+  } catch (err) {
+    return {
+      layer: null,
+      skipped: {
+        level,
+        filePath,
+        displayPath: shown,
+        fileName: name,
+        reason: "read-error",
+        message: err instanceof Error ? err.message : String(err)
+      }
+    };
+  }
+}
+function findFirstContextFile(level, dir, cwd, candidates, maxBytes) {
+  const skipped = [];
+  for (const candidate of candidates) {
+    const filePath = join(dir, candidate);
+    if (!existsSync(filePath)) continue;
+    const result = readContextFile(level, filePath, cwd, maxBytes);
+    if (result.skipped) skipped.push(result.skipped);
+    if (result.layer) return { layer: result.layer, skipped };
+  }
+  return { layer: null, skipped };
+}
+function loadContextFiles(options) {
+  const cwd = resolve(options.cwd);
+  const maxBytes = options.maxBytes ?? CONTEXT_FILE_MAX_BYTES;
+  const candidates = options.candidates ?? buildContextFileCandidates(options.fallbackFilenames);
+  const skipped = [];
+  if (options.setting === false) {
+    return { layers: [], mergedContent: "", skipped, totalChars: 0, totalBytes: 0, maxBytes, candidates };
+  }
+  if (options.setting && options.setting !== "auto") {
+    const filePath = resolve(cwd, String(options.setting));
+    if (!isInsideOrEqual(cwd, filePath)) {
+      skipped.push({
+        level: "single",
+        filePath,
+        displayPath: filePath,
+        fileName: String(options.setting),
+        reason: "outside-cwd"
+      });
+      return { layers: [], mergedContent: "", skipped, totalChars: 0, totalBytes: 0, maxBytes, candidates };
+    }
+    if (!existsSync(filePath)) {
+      skipped.push({
+        level: "single",
+        filePath,
+        displayPath: displayPath(filePath, cwd),
+        fileName: String(options.setting),
+        reason: "missing"
+      });
+      return { layers: [], mergedContent: "", skipped, totalChars: 0, totalBytes: 0, maxBytes, candidates };
+    }
+    const result = readContextFile("single", filePath, cwd, maxBytes);
+    if (result.skipped) skipped.push(result.skipped);
+    const layers2 = result.layer ? [result.layer] : [];
+    const mergedContent2 = layers2.map((l) => l.content).join("\n\n---\n\n");
+    return {
+      layers: layers2,
+      mergedContent: mergedContent2,
+      skipped,
+      totalChars: layers2.reduce((sum, l) => sum + l.charCount, 0),
+      totalBytes: layers2.reduce((sum, l) => sum + l.byteCount, 0),
+      maxBytes,
+      candidates
+    };
+  }
+  const layers = [];
+  for (const [level, dir] of [
+    ["global", options.configDir],
+    ["project", options.projectRoot]
+  ]) {
+    const result = findFirstContextFile(level, dir, cwd, candidates, maxBytes);
+    skipped.push(...result.skipped);
+    if (result.layer) layers.push(result.layer);
+  }
+  if (resolve(options.cwd) !== resolve(options.projectRoot)) {
+    const result = findFirstContextFile("local", options.cwd, cwd, candidates, maxBytes);
+    skipped.push(...result.skipped);
+    if (result.layer) layers.push(result.layer);
+  }
+  const mergedContent = layers.map((l) => l.content).join("\n\n---\n\n");
+  return {
+    layers,
+    mergedContent,
+    skipped,
+    totalChars: layers.reduce((sum, l) => sum + l.charCount, 0),
+    totalBytes: layers.reduce((sum, l) => sum + l.byteCount, 0),
+    maxBytes,
+    candidates
+  };
+}
+
+// src/diagnostics/crash-log.ts
+import {
+  existsSync as existsSync2,
+  mkdirSync,
+  readdirSync,
+  readFileSync as readFileSync2,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { join as join2 } from "path";
+import { homedir, platform, release, arch } from "os";
+var LOGS_DIR_NAME = "logs";
+var CRASH_LOG_PREFIX = "crash-";
+var MAX_CRASH_FILES = 20;
+function getLogsDir(configDir) {
+  const base = configDir ?? join2(homedir(), CONFIG_DIR_NAME);
+  return join2(base, LOGS_DIR_NAME);
+}
+function ensureLogsDir(configDir) {
+  const dir = getLogsDir(configDir);
+  if (!existsSync2(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+  return dir;
+}
+function isoTimestampForFilename(d = /* @__PURE__ */ new Date()) {
+  return d.toISOString().replace(/[:.]/g, "-");
+}
+function writeCrashLog(err, context, configDir) {
+  try {
+    const dir = ensureLogsDir(configDir);
+    const ts = /* @__PURE__ */ new Date();
+    const file = join2(dir, `${CRASH_LOG_PREFIX}${isoTimestampForFilename(ts)}.log`);
+    const errMessage = err instanceof Error ? err.message : String(err);
+    const errStack = err instanceof Error ? err.stack ?? "(no stack)" : "(non-Error thrown)";
+    const lines = [
+      `# ai-cli crash log`,
+      `timestamp: ${ts.toISOString()}`,
+      `kind:      ${context.kind}`,
+      `version:   ${VERSION}`,
+      `node:      ${process.version}`,
+      `platform:  ${platform()} ${release()} (${arch()})`,
+      `pid:       ${process.pid}`,
+      context.provider ? `provider:  ${context.provider}` : "",
+      context.model ? `model:     ${context.model}` : "",
+      context.lastAction ? `lastAction: ${truncate(context.lastAction, 500)}` : "",
+      "",
+      `## message`,
+      errMessage,
+      "",
+      `## stack`,
+      errStack,
+      ""
+    ].filter(Boolean);
+    writeFileSync(file, lines.join("\n"), "utf-8");
+    pruneOldCrashes(configDir);
+    return file;
+  } catch {
+    return null;
+  }
+}
+function truncate(s, n) {
+  return s.length <= n ? s : s.slice(0, n) + "\u2026";
+}
+function pruneOldCrashes(configDir) {
+  try {
+    const dir = getLogsDir(configDir);
+    if (!existsSync2(dir)) return;
+    const entries = readdirSync(dir).filter((f) => f.startsWith(CRASH_LOG_PREFIX) && f.endsWith(".log")).map((f) => {
+      const full = join2(dir, f);
+      let mtime = 0;
+      try {
+        mtime = statSync(full).mtimeMs;
+      } catch {
+      }
+      return { file: full, mtime };
+    }).sort((a, b) => b.mtime - a.mtime);
+    for (const e of entries.slice(MAX_CRASH_FILES)) {
+      try {
+        unlinkSync(e.file);
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
+function listRecentCrashes(limit = 10, configDir) {
+  const dir = getLogsDir(configDir);
+  if (!existsSync2(dir)) return [];
+  const files = [];
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  for (const name of names) {
+    if (!name.startsWith(CRASH_LOG_PREFIX) || !name.endsWith(".log")) continue;
+    const full = join2(dir, name);
+    try {
+      const st = statSync(full);
+      const head = readFileSync2(full, "utf-8").split("\n").slice(0, 20);
+      const tsLine = head.find((l) => l.startsWith("timestamp:"));
+      const kindLine = head.find((l) => l.startsWith("kind:"));
+      const msgIdx = head.findIndex((l) => l.trim() === "## message");
+      const message = msgIdx >= 0 && head[msgIdx + 1] ? head[msgIdx + 1] : "";
+      files.push({
+        file: full,
+        timestamp: tsLine ? tsLine.replace("timestamp:", "").trim() : st.mtime.toISOString(),
+        kind: kindLine ? kindLine.replace("kind:", "").trim() : "unknown",
+        message: truncate(message, 200),
+        sizeBytes: st.size
+      });
+    } catch {
+    }
+  }
+  files.sort((a, b) => a.timestamp < b.timestamp ? 1 : -1);
+  return files.slice(0, limit);
+}
+function getConfigDirUsage(configDir) {
+  const base = configDir ?? join2(homedir(), CONFIG_DIR_NAME);
+  if (!existsSync2(base)) return { totalBytes: 0, entries: [] };
+  const entries = [];
+  let total = 0;
+  let names;
+  try {
+    names = readdirSync(base);
+  } catch {
+    return { totalBytes: 0, entries: [] };
+  }
+  for (const name of names) {
+    const full = join2(base, name);
+    const bytes = dirSize(full);
+    entries.push({ name, bytes });
+    total += bytes;
+  }
+  entries.sort((a, b) => b.bytes - a.bytes);
+  return { totalBytes: total, entries };
+}
+function dirSize(path) {
+  try {
+    const st = statSync(path);
+    if (st.isFile()) return st.size;
+    if (!st.isDirectory()) return 0;
+    let sum = 0;
+    for (const name of readdirSync(path)) {
+      sum += dirSize(join2(path, name));
+    }
+    return sum;
+  } catch {
+    return 0;
+  }
+}
+
+// src/diagnostics/doctor-report.ts
+function checkFile(label, path) {
+  const exists = existsSync3(path);
+  let sizeBytes = null;
+  if (exists) {
+    try {
+      sizeBytes = statSync2(path).size;
+    } catch {
+    }
+  }
+  return { label, path, exists, sizeBytes };
+}
+function buildDoctorReport(options) {
+  const config = options.config;
+  const cwd = options.cwd ?? process.cwd();
+  const configDir = config.getConfigDir();
+  const projectRoot = getGitRoot(cwd) ?? cwd;
+  const contextCfg = config.get("context");
+  const contextSetting = config.get("contextFile");
+  const context = loadContextFiles({
+    cwd,
+    configDir,
+    projectRoot,
+    setting: contextSetting,
+    maxBytes: contextCfg.projectDocMaxBytes,
+    fallbackFilenames: contextCfg.projectDocFallbackFilenames
+  });
+  const hooksConfig = config.get("hooks");
+  const hooks = listHooks(hooksConfig, configDir);
+  const pendingHooks = getPendingHookTrust(hooksConfig, configDir);
+  const plugins = listInstalledPlugins(configDir);
+  const activeAssets = getActivePluginAssets(configDir);
+  const network = config.get("networkPolicy");
+  const mcpServers = config.get("mcpServers");
+  const allStats = getStatsSnapshot();
+  return {
+    version: VERSION,
+    npmCheck: options.npmCheck,
+    node: process.version,
+    platform: `${platform2()} ${release2()} (${arch2()})`,
+    cwd,
+    projectRoot,
+    configDir,
+    providers: options.providers.listAll().map((p) => ({ id: p.id, displayName: p.displayName, configured: p.configured })),
+    files: [
+      checkFile("config.json", join3(configDir, "config.json")),
+      checkFile("memory.md", join3(configDir, MEMORY_FILE_NAME)),
+      checkFile("memory.jsonl", join3(configDir, "memory.jsonl")),
+      checkFile("dev-state.md", join3(configDir, DEV_STATE_FILE_NAME)),
+      checkFile("hooks-trust.json", join3(configDir, "hooks-trust.json")),
+      checkFile("plugin-state.json", join3(configDir, "plugins", "plugin-state.json"))
+    ],
+    context: {
+      enabled: contextSetting !== false,
+      setting: contextSetting,
+      candidates: context.candidates,
+      maxBytes: context.maxBytes,
+      layers: context.layers.map((l) => ({ level: l.level, fileName: l.fileName, displayPath: l.displayPath, bytes: l.byteCount, chars: l.charCount, truncated: l.truncated })),
+      skipped: context.skipped.map((s) => ({ level: s.level, fileName: s.fileName, displayPath: s.displayPath, reason: s.reason, message: s.message }))
+    },
+    permissions: {
+      defaultProfile: config.get("defaultPermissionProfile"),
+      allowedProfiles: config.get("allowedPermissionProfiles"),
+      customProfileCount: Object.keys(config.get("permissionProfiles")).length,
+      legacyDefaultAction: config.get("defaultPermission"),
+      ruleCount: config.get("permissionRules").length
+    },
+    networkPolicy: {
+      enabled: network.enabled,
+      defaultAction: network.defaultAction,
+      allowDomains: network.allowDomains.length,
+      denyDomains: network.denyDomains.length,
+      allowPorts: network.allowPorts.length,
+      denyPorts: network.denyPorts.length,
+      allowPrivateNetwork: network.allowPrivateNetwork,
+      toolOverrides: Object.fromEntries(Object.entries(network.tools).filter(([, v]) => v !== void 0))
+    },
+    hooks: {
+      enabled: hooksConfig?.enabled !== false,
+      total: hooks.length,
+      project: hooks.filter((h) => h.source === "project").length,
+      pendingTrust: pendingHooks.length,
+      disabled: hooks.filter((h) => h.disabled).length
+    },
+    plugins: {
+      root: join3(configDir, "plugins"),
+      installed: plugins.length,
+      active: activeAssets.plugins.length,
+      invalid: plugins.filter((p) => !p.valid).length,
+      untrusted: plugins.filter((p) => p.valid && !p.trusted).length,
+      disabled: plugins.filter((p) => p.valid && !p.enabled).length,
+      mcpServers: Object.keys(activeAssets.mcpServers).length,
+      skillDirs: activeAssets.skillDirs.length,
+      commandDirs: activeAssets.commandDirs.length,
+      agentDirs: activeAssets.agentDirs.length,
+      entries: plugins.map((p) => ({ name: p.name, version: p.manifest.version, enabled: p.enabled, trusted: p.trusted, valid: p.valid, error: p.error }))
+    },
+    mcp: {
+      enabled: config.get("mcpEnabled"),
+      configured: Object.keys(mcpServers).length,
+      projectConfigExists: existsSync3(join3(projectRoot, MCP_PROJECT_CONFIG_NAME)),
+      statuses: options.mcpStatuses ?? []
+    },
+    recentCrashes: listRecentCrashes(5, configDir),
+    diskUsage: getConfigDirUsage(configDir),
+    toolStats: {
+      totalCalls: allStats.reduce((a, b) => a + b.calls, 0),
+      totalFailures: allStats.reduce((a, b) => a + b.failures, 0),
+      topUsed: getTopUsedTools(5),
+      topFailing: getTopFailingTools(5)
+    }
+  };
+}
+
+// src/diagnostics/doctor-cli.ts
+function compareVersion(a, b) {
+  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
+  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
+  const len = Math.max(pa.length, pb.length);
+  for (let i = 0; i < len; i++) {
+    const da = pa[i] ?? 0;
+    const db = pb[i] ?? 0;
+    if (da !== db) return da - db;
+  }
+  return 0;
+}
+async function checkNpmLatest() {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 3e3);
+  try {
+    const res = await fetch("https://registry.npmjs.org/jinzd-ai-cli/latest", {
+      signal: controller.signal,
+      headers: { accept: "application/json" }
+    });
+    if (!res.ok) return { latest: null, status: "skipped", reason: `HTTP ${res.status}` };
+    const data = await res.json();
+    const latest = typeof data.version === "string" ? data.version : null;
+    if (!latest) return { latest: null, status: "skipped", reason: "no version in response" };
+    return { latest, status: compareVersion(latest, VERSION) > 0 ? "outdated" : "up-to-date" };
+  } catch (err) {
+    const reason = err?.name === "AbortError" ? "timeout (3s)" : err?.message ?? "network error";
+    return { latest: null, status: "skipped", reason };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function collect() {
+  const config = new ConfigManager();
+  const registry = new ProviderRegistry();
+  await registry.initialize(
+    (id) => config.getApiKey(id),
+    (id) => ({ baseUrl: config.get("customBaseUrls")[id], timeout: config.get("timeouts")[id] }),
+    config.get("customProviders")
+  );
+  return buildDoctorReport({ config, providers: registry, npmCheck: await checkNpmLatest() });
+}
+function formatBytes(n) {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  if (n < 1024 * 1024 * 1024) return `${(n / 1024 / 1024).toFixed(1)} MB`;
+  return `${(n / 1024 / 1024 / 1024).toFixed(2)} GB`;
+}
+function formatDoctorReport(report, ansi = true) {
+  const wrap = (code, s) => ansi ? `${code}${s}\x1B[0m` : s;
+  const B = (s) => wrap("\x1B[1m", s);
+  const D = (s) => wrap("\x1B[2m", s);
+  const G = (s) => wrap("\x1B[32m", s);
+  const Y = (s) => wrap("\x1B[33m", s);
+  const R = (s) => wrap("\x1B[31m", s);
+  const out = [];
+  out.push("");
+  out.push(B("\u{1FA7A} AI-CLI Health Check"));
+  out.push("");
+  const nc = report.npmCheck;
+  let versionLine = `  version:  ${report.version}`;
+  if (nc?.status === "up-to-date") versionLine += `  ${D("(latest on npm)")}`;
+  else if (nc?.status === "outdated" && nc.latest) versionLine += `  ${Y(`\u2192 ${nc.latest} available`)}  ${D("(npm i -g jinzd-ai-cli@latest)")}`;
+  else if (nc?.status === "skipped") versionLine += `  ${D(`(npm check skipped: ${nc.reason ?? "unknown"})`)}`;
+  out.push(versionLine);
+  out.push(`  node:     ${report.node}`);
+  out.push(`  platform: ${report.platform}`);
+  out.push(`  cwd:      ${report.cwd}`);
+  out.push(`  project:  ${report.projectRoot}`);
+  out.push(`  config:   ${report.configDir}`);
+  out.push("");
+  out.push(B("API Keys:"));
+  for (const p of report.providers) {
+    out.push(`  ${p.configured ? G("\u2713") : D("\u25CB")}  ${p.id.padEnd(14)} ${p.configured ? G("configured") : D("not configured")}`);
+  }
+  out.push("");
+  out.push(B("Context Files:"));
+  out.push(`  status: ${report.context.enabled ? G("enabled") : D("disabled")} \xB7 max ${formatBytes(report.context.maxBytes)}`);
+  if (report.context.layers.length === 0) out.push(`  ${D("(no context files loaded)")}`);
+  for (const l of report.context.layers) {
+    out.push(`  ${G("\u2713")}  ${l.level.padEnd(7)} ${l.displayPath} ${D(`(${formatBytes(l.bytes)}${l.truncated ? ", truncated" : ""})`)}`);
+  }
+  if (report.context.skipped.length > 0) {
+    out.push(`  ${D("skipped:")}`);
+    for (const s of report.context.skipped.slice(0, 5)) {
+      out.push(`    ${Y("!")} ${s.level}:${s.fileName} ${s.reason}${s.message ? ` \xB7 ${s.message}` : ""}`);
+    }
+  }
+  out.push("");
+  out.push(B("Permissions / Network:"));
+  out.push(`  profile: ${report.permissions.defaultProfile} \xB7 allowed ${report.permissions.allowedProfiles.join(", ")} \xB7 rules ${report.permissions.ruleCount} \xB7 custom profiles ${report.permissions.customProfileCount}`);
+  const np = report.networkPolicy;
+  out.push(`  networkPolicy: ${np.enabled ? G("enabled") : D("disabled")} \xB7 default ${np.defaultAction} \xB7 allow ${np.allowDomains} domain(s)/${np.allowPorts} port(s) \xB7 deny ${np.denyDomains} domain(s)/${np.denyPorts} port(s) \xB7 private ${np.allowPrivateNetwork ? "allow" : "block/confirm"}`);
+  const overrides = Object.entries(np.toolOverrides).map(([k, v]) => `${k}=${v}`).join(", ");
+  if (overrides) out.push(`  tool overrides: ${overrides}`);
+  out.push("");
+  out.push(B("Hooks / Plugins:"));
+  out.push(`  hooks: ${report.hooks.enabled ? G("enabled") : D("disabled")} \xB7 total ${report.hooks.total} \xB7 project ${report.hooks.project} \xB7 pending trust ${report.hooks.pendingTrust} \xB7 disabled ${report.hooks.disabled}`);
+  out.push(`  plugins: installed ${report.plugins.installed} \xB7 active ${report.plugins.active} \xB7 disabled ${report.plugins.disabled} \xB7 untrusted ${report.plugins.untrusted} \xB7 invalid ${report.plugins.invalid}`);
+  out.push(`  plugin assets: ${report.plugins.skillDirs} skill dir(s), ${report.plugins.commandDirs} command dir(s), ${report.plugins.agentDirs} agent dir(s), ${report.plugins.mcpServers} MCP server(s)`);
+  if (report.plugins.entries.length > 0) {
+    for (const p of report.plugins.entries.slice(0, 5)) {
+      const state = p.valid ? `${p.enabled ? "enabled" : "disabled"} \xB7 ${p.trusted ? "trusted" : "untrusted"}` : `invalid \xB7 ${p.error ?? ""}`;
+      out.push(`    ${p.valid ? G("\u2713") : R("\u2717")} ${p.name}@${p.version} ${D(state)}`);
+    }
+  }
+  out.push("");
+  out.push(B("MCP Servers:"));
+  out.push(`  global configured: ${report.mcp.configured} \xB7 project .mcp.json: ${report.mcp.projectConfigExists ? "yes" : "no"} \xB7 mcpEnabled: ${report.mcp.enabled ? "true" : "false"}`);
+  if (report.mcp.statuses.length === 0) out.push(`  ${D("(no connected manager status in this mode)")}`);
+  for (const s of report.mcp.statuses) {
+    const state = s.connected ? `${G("connected")} \xB7 ${s.serverName} \xB7 ${s.toolCount} tools` : `${R("disconnected")}${s.error ? D(` \xB7 ${s.error}`) : ""}`;
+    out.push(`  ${s.connected ? G("\u2713") : R("\u2717")}  ${s.serverId.padEnd(16)} ${state}`);
+  }
+  out.push("");
+  out.push(B("Config Files:"));
+  for (const f of report.files) {
+    const extra = f.exists && f.sizeBytes !== null ? ` ${D(`(${formatBytes(f.sizeBytes)})`)}` : "";
+    out.push(`  ${f.exists ? G("\u2713") : D("\u2013")}  ${f.label.padEnd(16)} ${f.exists ? f.path : D("(not found)")}${extra}`);
+  }
+  out.push("");
+  out.push(B("Recent Crashes (last 5):"));
+  if (report.recentCrashes.length === 0) out.push(`  ${D("(none - clean!)")}`);
+  for (const c of report.recentCrashes) {
+    out.push(`  ${R("\u2717")}  ${c.timestamp}  ${Y(c.kind)}`);
+    out.push(`     ${D(c.message)}`);
+    out.push(`     ${D(c.file)}`);
+  }
+  out.push("");
+  const ts = report.toolStats;
+  out.push(B("Tool Usage:"));
+  out.push(`  total: ${ts.totalCalls} calls \xB7 ${ts.totalFailures} failures (${ts.totalCalls ? (ts.totalFailures * 100 / ts.totalCalls).toFixed(1) : "0.0"}%)`);
+  if (ts.topUsed.length > 0) {
+    out.push(`  ${D("top used:")}`);
+    for (const t of ts.topUsed) out.push(`    ${t.name.padEnd(20)} ${String(t.calls).padStart(6)} calls \xB7 avg ${t.calls ? (t.totalDurationMs / t.calls).toFixed(0) : "0"}ms`);
+  }
+  if (ts.topFailing.length > 0) {
+    out.push(`  ${D("top failing:")}`);
+    for (const t of ts.topFailing) out.push(`    ${R(t.name.padEnd(20))} ${t.failures}/${t.calls} (${(t.failures * 100 / Math.max(1, t.calls)).toFixed(1)}%)  ${D(t.lastFailureMessage ?? "")}`.slice(0, 200));
+  }
+  out.push("");
+  const dirAnnotations = {
+    models: "semantic search model -> /index semantic-clear",
+    index: "symbol index -> /index clear",
+    history: "conversation history",
+    logs: "crash logs",
+    "memory-index": "chat memory index -> /memory index-clear",
+    plugins: "installed package plugins"
+  };
+  out.push(B("Disk Usage (~/.aicli):"));
+  out.push(`  total: ${formatBytes(report.diskUsage.totalBytes)}`);
+  for (const e of report.diskUsage.entries.slice(0, 10)) {
+    const note = dirAnnotations[e.name];
+    out.push(`    ${e.name.padEnd(18)} ${formatBytes(e.bytes)}${note ? `  ${D(`\xB7 ${note}`)}` : ""}`);
+  }
+  out.push("");
+  out.push(G("\u2713 Health check complete"));
+  out.push("");
+  return out.join("\n");
+}
+async function runDoctorCli(options = {}) {
+  if (options.resetStats) {
+    resetStats();
+    process.stdout.write("Tool stats reset.\n");
+    return;
+  }
+  const report = await collect();
+  process.stdout.write(options.json ? JSON.stringify(report, null, 2) + "\n" : formatDoctorReport(report, true));
+}
+
+export {
+  writeCrashLog,
+  loadContextFiles,
+  buildDoctorReport,
+  formatDoctorReport,
+  runDoctorCli
+};