jinzd-ai-cli 0.4.223 → 0.4.225

package/dist/{batch-PJIRZJCT.js → batch-OWM7PN4L.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   ConfigManager
-} from "./chunk-WDUKU5HH.js";
+} from "./chunk-6ISALPIH.js";
 import "./chunk-5ULLIOVC.js";
-import "./chunk-GXAGBILB.js";
+import "./chunk-DUKZBAI4.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chat-index-FDSGKWQV.js → chat-index-O56HDGFI.js}

@@ -6,9 +6,9 @@ import {
   getChatIndexStatus,
   loadChatIndex,
   searchChatMemory
-} from "./chunk-TB4W4Y4T.js";
+} from "./chunk-NVUCDUXE.js";
 import "./chunk-KHYD3WXE.js";
-import "./chunk-SLSWPBK3.js";
+import "./chunk-B5TYJO7V.js";
 import "./chunk-IW3Q7AE5.js";
 export {
   buildChatIndex,

package/dist/{chat-index-PS274XM7.js → chat-index-WSI7ULRQ.js}

@@ -5,7 +5,7 @@ import {
   getChatIndexStatus,
   loadChatIndex,
   searchChatMemory
-} from "./chunk-VHY6NVMQ.js";
+} from "./chunk-LF3OUJHK.js";
 import "./chunk-JV5N65KN.js";
 import "./chunk-6BUTA5VW.js";
 export {

package/dist/{chunk-WDUKU5HH.js → chunk-6ISALPIH.js}

@@ -8,7 +8,7 @@ import {
   CONFIG_FILE_NAME,
   HISTORY_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-GXAGBILB.js";
+} from "./chunk-DUKZBAI4.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-SLSWPBK3.js → chunk-B5TYJO7V.js}

@@ -38,16 +38,19 @@ var DEFAULT_PATTERNS = [
   // Bearer <token> in Authorization headers
   { kind: "bearer", regex: /\b(Authorization:\s*Bearer\s+)([a-zA-Z0-9_\-.=]{20,500})/g },
   // Private key PEM blocks — catch the header+footer together
-  { kind: "private-key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g }
+  // P2-PERF-02: PEM bodies use strict Base64 + =\n — narrowed char class avoids backtracking
+  { kind: "private-key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[ \t\n\r]*[A-Za-z0-9+/=\n\r-]*[ \t\n\r]*-----END [A-Z ]*PRIVATE KEY-----/g }
 ];
 var MAX_CUSTOM = 32;
 var MAX_PATTERN_LEN = 500;
 var SUSPICIOUS_REDOS = /\([^)]*[+*][^)]*\)\s*[+*{]/;
+var MAX_REDACT_INPUT = 512e3;
 function render(placeholder, kind) {
   return placeholder.replace("{kind}", kind);
 }
 function redactString(input, options) {
   if (!options.enabled || !input) return { redacted: input, hits: [] };
+  if (input.length > MAX_REDACT_INPUT) return { redacted: input, hits: [] };
   const placeholder = options.placeholder ?? "[REDACTED:{kind}]";
   const customSrcs = (options.customRegexes ?? []).slice(0, MAX_CUSTOM);
   const patterns = [

package/dist/{chunk-OPAOQZDC.js → chunk-BWCZYPEU.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   truncateForPersist
-} from "./chunk-5ZPO47YE.js";
+} from "./chunk-IZ4VM2P5.js";
 import {
   APP_NAME,
   CONFIG_DIR_NAME,
@@ -11,7 +11,7 @@ import {
   MCP_PROTOCOL_VERSION,
   MCP_TOOL_PREFIX,
   VERSION
-} from "./chunk-GXAGBILB.js";
+} from "./chunk-DUKZBAI4.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-OJXYL2W2.js → chunk-DEHVRQWW.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   SessionManager
-} from "./chunk-5GTWZ4QF.js";
+} from "./chunk-QYQCCIBT.js";
 
 // src/hub/persist.ts
 import { join } from "path";

package/dist/{chunk-GXAGBILB.js → chunk-DUKZBAI4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/core/constants.ts
-var VERSION = "0.4.223";
+var VERSION = "0.4.225";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-5ZPO47YE.js → chunk-IZ4VM2P5.js}

@@ -14,7 +14,7 @@ import {
   runHook,
   runLifecycleHooks,
   runTool
-} from "./chunk-RGL2KKCO.js";
+} from "./chunk-YUGXAALR.js";
 import {
   getDangerLevel,
   isFileWriteTool,
@@ -33,7 +33,7 @@ import {
 } from "./chunk-4BKXL7SM.js";
 import {
   runTestsTool
-} from "./chunk-ZILWADNL.js";
+} from "./chunk-RC7FBLFT.js";
 import {
   CONFIG_DIR_NAME,
   DEFAULT_MAX_TOOL_OUTPUT_CHARS_CAP,
@@ -43,23 +43,219 @@ import {
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-GXAGBILB.js";
+} from "./chunk-DUKZBAI4.js";
 import {
   loadChatIndex,
   searchChatMemory
-} from "./chunk-TB4W4Y4T.js";
+} from "./chunk-NVUCDUXE.js";
 import {
   DEFAULT_PATTERNS,
   redactString
-} from "./chunk-SLSWPBK3.js";
+} from "./chunk-B5TYJO7V.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";
 
-// src/tools/builtin/bash.ts
+// src/tools/shell-pool.ts
 import { spawn } from "child_process";
+import { platform } from "os";
+var IS_WINDOWS = platform() === "win32";
+var SHELL = IS_WINDOWS ? "powershell.exe" : process.env["SHELL"] ?? "/bin/bash";
+var pool = /* @__PURE__ */ new Map();
+var IDLE_EVICT_MS = 5 * 6e4;
+var evictionTimer = null;
+function spawnShell(cwd) {
+  const shellArgs = IS_WINDOWS ? ["-NoProfile", "-NonInteractive", "-Command", "-"] : ["-s"];
+  const proc = spawn(SHELL, shellArgs, {
+    cwd,
+    windowsHide: true,
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  proc.on("exit", () => {
+    for (const [key, entry] of pool) {
+      if (entry.proc === proc) {
+        pool.delete(key);
+        break;
+      }
+    }
+  });
+  return proc;
+}
+function startEvictionTimer() {
+  if (evictionTimer) return;
+  evictionTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [key, entry] of pool) {
+      if (now - entry.lastUsed > IDLE_EVICT_MS) {
+        try {
+          entry.proc.kill();
+        } catch {
+        }
+        pool.delete(key);
+      }
+    }
+  }, 6e4).unref();
+}
+async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
+  let entry = pool.get(sessionKey);
+  if (!entry || entry.proc.exitCode !== null || entry.cwd !== cwd) {
+    if (entry) {
+      try {
+        entry.proc.kill();
+      } catch {
+      }
+    }
+    const proc = spawnShell(cwd);
+    entry = { proc, cwd, lastUsed: Date.now() };
+    pool.set(sessionKey, entry);
+  }
+  entry.lastUsed = Date.now();
+  startEvictionTimer();
+  const id = `${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+  const markerStart = `AICLI_MARKER_START:${id}`;
+  const markerEnd = `AICLI_MARKER_END:${id}`;
+  const wrappedCmd = IS_WINDOWS ? `echo "${markerStart}"; ${command}; echo "${markerEnd}:0"` : `echo "${markerStart}"; ${command}; echo "${markerEnd}:$?"`;
+  return new Promise((resolve8) => {
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let aborted = false;
+    let resolved = false;
+    const markerStartPattern = `AICLI_MARKER_START:${id}`;
+    const markerEndPattern = `AICLI_MARKER_END:${id}`;
+    const onData = (chunk) => {
+      stdout += chunk.toString("utf-8");
+      if (!resolved && stdout.includes(markerEndPattern)) {
+        const endLine = stdout.split("\n").find((l) => l.includes(markerEndPattern));
+        const exitCode = endLine ? parseEndMarker(endLine, markerEndPattern) : null;
+        stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
+        resolved = true;
+        cleanup();
+        resolve8({ stdout, stderr, exitCode, timedOut, aborted });
+      }
+    };
+    const onErr = (chunk) => {
+      stderr += chunk.toString("utf-8");
+    };
+    const proc = entry.proc;
+    proc.stdout?.on("data", onData);
+    proc.stderr?.on("data", onErr);
+    const timeoutTimer = setTimeout(() => {
+      if (resolved) return;
+      timedOut = true;
+      resolved = true;
+      stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
+      cleanup();
+      resolve8({ stdout, stderr, exitCode: null, timedOut, aborted });
+      try {
+        proc.kill();
+      } catch {
+      }
+      pool.delete(sessionKey);
+    }, timeout);
+    const onAbort = () => {
+      if (resolved) return;
+      aborted = true;
+      resolved = true;
+      cleanup();
+      stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
+      resolve8({ stdout, stderr, exitCode: null, timedOut, aborted });
+      try {
+        proc.kill();
+      } catch {
+      }
+      pool.delete(sessionKey);
+    };
+    if (abortSignal?.aborted) {
+      onAbort();
+    } else {
+      abortSignal?.addEventListener("abort", onAbort, { once: true });
+    }
+    const onError = (err) => {
+      if (resolved) return;
+      resolved = true;
+      stderr += `
+[pool error] ${err.message}`;
+      cleanup();
+      resolve8({ stdout, stderr, exitCode: null, timedOut, aborted });
+      pool.delete(sessionKey);
+    };
+    proc.on("error", onError);
+    function cleanup() {
+      clearTimeout(timeoutTimer);
+      abortSignal?.removeEventListener("abort", onAbort);
+      proc.stdout?.removeListener("data", onData);
+      proc.stderr?.removeListener("data", onErr);
+      proc.removeListener("error", onError);
+    }
+    try {
+      proc.stdin?.write(wrappedCmd + "\n");
+    } catch (err) {
+      if (!resolved) {
+        cleanup();
+        pool.delete(sessionKey);
+      }
+    }
+  });
+}
+function parseEndMarker(line, markerEndPattern) {
+  const idx = line.lastIndexOf(":");
+  if (idx < 0) return null;
+  const code = line.slice(idx + 1).trim();
+  return /^\d+$/.test(code) ? Number(code) : null;
+}
+function stripMarkerOutput(stdout, startMarker, endMarker) {
+  const lines = stdout.split("\n");
+  let capturing = false;
+  const out = [];
+  for (const line of lines) {
+    if (line.includes(startMarker)) {
+      capturing = true;
+      continue;
+    }
+    if (line.includes(endMarker)) {
+      capturing = false;
+      continue;
+    }
+    if (capturing) {
+      out.push(line);
+    }
+  }
+  if (!stdout.includes(endMarker) && out.length === 0) {
+    const startIdx = stdout.indexOf(startMarker);
+    if (startIdx >= 0) {
+      return stdout.slice(startIdx + startMarker.length).trimStart();
+    }
+  }
+  return out.join("\n").trim();
+}
+function cleanupPoolSession(sessionKey) {
+  const entry = pool.get(sessionKey);
+  if (!entry) return;
+  try {
+    entry.proc.kill();
+  } catch {
+  }
+  pool.delete(sessionKey);
+}
+function cleanupAllSessions() {
+  for (const [key, entry] of pool) {
+    try {
+      entry.proc.kill();
+    } catch {
+    }
+    pool.delete(key);
+  }
+  if (evictionTimer) {
+    clearInterval(evictionTimer);
+    evictionTimer = null;
+  }
+}
+
+// src/tools/builtin/bash.ts
+import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync2, readdirSync, statSync } from "fs";
-import { platform as platform2 } from "os";
+import { platform as platform3 } from "os";
 import { resolve } from "path";
 
 // src/tools/undo-stack.ts
@@ -212,11 +408,11 @@ function runWithSessionKey(sessionKey, fn) {
 }
 
 // src/tools/win-shell.ts
-import { platform } from "os";
-var IS_WINDOWS = platform() === "win32";
+import { platform as platform2 } from "os";
+var IS_WINDOWS2 = platform2() === "win32";
 var WIN_UTF8_PREAMBLE = "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; $OutputEncoding = [System.Text.Encoding]::UTF8; ";
 function shellInvocation(command) {
-  if (IS_WINDOWS) {
+  if (IS_WINDOWS2) {
     return {
       shell: "powershell.exe",
       args: ["-NoProfile", "-NonInteractive", "-Command", WIN_UTF8_PREAMBLE + command]
@@ -235,8 +431,8 @@ function decodeWindowsBuffer(buf) {
 }
 
 // src/tools/builtin/bash.ts
-var IS_WINDOWS2 = platform2() === "win32";
-var SHELL = IS_WINDOWS2 ? "powershell.exe" : process.env["SHELL"] ?? "/bin/bash";
+var IS_WINDOWS3 = platform3() === "win32";
+var SHELL2 = IS_WINDOWS3 ? "powershell.exe" : process.env["SHELL"] ?? "/bin/bash";
 var cwdBySession = /* @__PURE__ */ new Map();
 function getCwd() {
   const key = getCurrentSessionKey();
@@ -250,17 +446,21 @@ function getCwd() {
 function setCwd(next) {
   cwdBySession.set(getCurrentSessionKey(), next);
 }
+function clearBashSession(sessionKey) {
+  cwdBySession.delete(sessionKey);
+  cleanupPoolSession(sessionKey);
+}
 var bashTool = {
   definition: {
     name: "bash",
-    description: IS_WINDOWS2 ? `Execute commands in PowerShell. Supports mkdir, ls, cat, python, etc.
+    description: IS_WINDOWS3 ? `Execute commands in PowerShell. Supports mkdir, ls, cat, python, etc.
 Important rules:
 1. Each bash call runs in an independent subprocess; cd commands do not persist. To run in a specific directory, use the cwd parameter, or combine commands: e.g. "cd mydir; ls" or "mkdir mydir; cd mydir; New-Item file.txt".
 2. If a command fails (returns an error or non-zero exit code), stop immediately, report the error to the user, and do not retry the same or similar commands.
 3. Multiple commands can be combined with semicolons in a single call to reduce rounds.
 4. To delete directories, use Remove-Item -Recurse (the system will automatically optimize to a more reliable method).
 5. IMPORTANT: On Windows, "curl" is an alias for Invoke-WebRequest and does NOT support curl flags like -s, -X, -H. Use Invoke-RestMethod instead for HTTP requests. Example: Invoke-RestMethod -Uri "http://localhost:3000/api/health" -Method Get
-6. NEVER run long-running / never-exiting commands through bash \u2014 they block until timeout. This includes starting an Android emulator (emulator -avd X), streaming logs (adb logcat), and dev servers (node server.js, npm run dev, metro / react-native start). Use the 'task_create' tool to run these in the background, then poll status with short bash calls (e.g. adb shell getprop sys.boot_completed).` : `Execute commands in ${SHELL}.
+6. NEVER run long-running / never-exiting commands through bash \u2014 they block until timeout. This includes starting an Android emulator (emulator -avd X), streaming logs (adb logcat), and dev servers (node server.js, npm run dev, metro / react-native start). Use the 'task_create' tool to run these in the background, then poll status with short bash calls (e.g. adb shell getprop sys.boot_completed).` : `Execute commands in ${SHELL2}.
 Important rules:
 1. Each bash call runs in an independent subprocess; cd commands do not persist. To run in a specific directory, use the cwd parameter, or combine commands: e.g. "cd mydir && ls" or "mkdir -p mydir && touch mydir/file.txt".
 2. If a command fails (returns an error or non-zero exit code), stop immediately, report the error to the user, and do not retry the same or similar commands.
@@ -269,7 +469,7 @@ Important rules:
     parameters: {
       command: {
         type: "string",
-        description: IS_WINDOWS2 ? `PowerShell command to execute. Combine multiple commands with semicolons, e.g.: "mkdir mydir; Set-Content mydir/file.txt 'content'"` : `${SHELL} command to execute. Combine multiple commands with &&, e.g.: "mkdir -p mydir && echo 'content' > mydir/file.txt"`,
+        description: IS_WINDOWS3 ? `PowerShell command to execute. Combine multiple commands with semicolons, e.g.: "mkdir mydir; Set-Content mydir/file.txt 'content'"` : `${SHELL2} command to execute. Combine multiple commands with &&, e.g.: "mkdir -p mydir && echo 'content' > mydir/file.txt"`,
         required: true
       },
       cwd: {
@@ -321,7 +521,7 @@ Important rules:
       setCwd(resolved);
     }
     let actualCommand;
-    if (IS_WINDOWS2) {
+    if (IS_WINDOWS3) {
       const fixedCommand = fixWindowsDeleteCommand(command);
       actualCommand = WIN_UTF8_PREAMBLE + fixedCommand;
     } else {
@@ -333,6 +533,44 @@ Important rules:
     for (const t of parsedTargets) {
       parsedTargetsBefore.set(t, existsSync2(t));
     }
+    let poolResult = null;
+    try {
+      poolResult = await execInPool(
+        getCurrentSessionKey(),
+        actualCommand,
+        timeout,
+        effectiveCwd,
+        currentAbortSignal()
+      );
+    } catch {
+      poolResult = null;
+    }
+    if (poolResult) {
+      const { stdout, stderr, exitCode, timedOut, aborted } = poolResult;
+      const status = exitCode;
+      if (aborted) {
+        pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
+        throw new ToolError(
+          "bash",
+          `Command interrupted by user (Ctrl+C).
+
+[The user pressed Ctrl+C while this command was running. Stop the current task, summarize what was done so far, and wait for the user's next instruction. Do NOT retry this command or continue with further tool calls unless explicitly asked.]`
+        );
+      }
+      if (status !== 0 || timedOut) {
+        throw {
+          status,
+          signal: null,
+          code: timedOut ? "ETIMEDOUT" : void 0,
+          stdout: Buffer.from(stdout, "utf-8"),
+          stderr: Buffer.from(stderr, "utf-8"),
+          message: timedOut ? "ETIMEDOUT" : `exit ${status}`
+        };
+      }
+      pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
+      updateCwdFromCommand(command, effectiveCwd);
+      return stdout || "(command completed with no output)";
+    }
     try {
       const { stdout, stderr, status, signal, timedOut, aborted } = await runShell(
         actualCommand,
@@ -367,7 +605,7 @@ Important rules:
       }
       updateCwdFromCommand(command, effectiveCwd);
       pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
-      const result = Buffer.isBuffer(stdout) ? IS_WINDOWS2 ? decodeWindowsBuffer(stdout) : stdout.toString("utf-8") : String(stdout ?? "");
+      const result = Buffer.isBuffer(stdout) ? IS_WINDOWS3 ? decodeWindowsBuffer(stdout) : stdout.toString("utf-8") : String(stdout ?? "");
       return result || "(command completed with no output)";
     } catch (err) {
       pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
@@ -392,8 +630,8 @@ How to recover (pick ONE \u2014 do NOT retry the same command):
           );
         }
         if ("status" in execErr && execErr.status !== void 0) {
-          const stderr = IS_WINDOWS2 && Buffer.isBuffer(execErr.stderr) ? decodeWindowsBuffer(execErr.stderr).trim() : execErr.stderr?.toString().trim() ?? "";
-          const stdout = IS_WINDOWS2 && Buffer.isBuffer(execErr.stdout) ? decodeWindowsBuffer(execErr.stdout).trim() : execErr.stdout?.toString().trim() ?? "";
+          const stderr = IS_WINDOWS3 && Buffer.isBuffer(execErr.stderr) ? decodeWindowsBuffer(execErr.stderr).trim() : execErr.stderr?.toString().trim() ?? "";
+          const stdout = IS_WINDOWS3 && Buffer.isBuffer(execErr.stdout) ? decodeWindowsBuffer(execErr.stdout).trim() : execErr.stdout?.toString().trim() ?? "";
           const combined = [stdout, stderr].filter(Boolean).join("\n");
           const hint = buildErrorHint(command, combined);
           throw new ToolError(
@@ -429,12 +667,12 @@ function fixWindowsDeleteCommand(command) {
 }
 function buildErrorHint(command, stderr) {
   const hints = [];
-  if (IS_WINDOWS2 && /\|\|/.test(command) && /(\|\||is not a valid argument|不是此版本中的有效|ParserError|Unexpected token)/i.test(stderr)) {
+  if (IS_WINDOWS3 && /\|\|/.test(command) && /(\|\||is not a valid argument|不是此版本中的有效|ParserError|Unexpected token)/i.test(stderr)) {
     hints.push(
       `Hint: PowerShell parses '||' as a pipeline operator (PS 5.x) or logical-or (PS 7+), it CANNOT be passed inline as SQL string concatenation. Workaround: write the SQL to a local .sql file with write_file, then 'scp' it to the remote host and run 'psql -f /tmp/x.sql'. Do NOT try to escape || or wrap the command differently \u2014 it will not work.`
     );
   }
-  if (IS_WINDOWS2 && /\bpython3\b/.test(command)) {
+  if (IS_WINDOWS3 && /\bpython3\b/.test(command)) {
     const trivialStderr = stderr.trim().length === 0 || /^[·\s]*exit 1\b/i.test(stderr.trim());
     if (/(not recognized|is not recognized|无法将.*识别)/i.test(stderr) || trivialStderr) {
       hints.push(
@@ -442,27 +680,27 @@ function buildErrorHint(command, stderr) {
       );
     }
   }
-  if (IS_WINDOWS2 && /^\s*ssh\b/.test(command) && /\\"/.test(command) && /(syntax error|ERROR:|ParserError|unexpected|parser|意外的|语法|不是此版本|所在位置\s+行)/i.test(stderr)) {
+  if (IS_WINDOWS3 && /^\s*ssh\b/.test(command) && /\\"/.test(command) && /(syntax error|ERROR:|ParserError|unexpected|parser|意外的|语法|不是此版本|所在位置\s+行)/i.test(stderr)) {
     hints.push(
       `Hint: SSH + nested quotes ("...\\"...\\"") is fragile across PS \u2192 ssh \u2192 remote-shell \u2192 psql layers. Use the file-based flow: (1) write_file locally to a .sql file, (2) 'scp x.sql root@host:/tmp/', (3) 'ssh root@host "sudo -u postgres psql -d <db> -f /tmp/x.sql"'. Or for remote-only SQL: 'ssh host "cat > /tmp/x.sql << \\'SQLEOF\\'\\n...\\nSQLEOF"' then run psql -f. Avoid inline psql -c with embedded quotes.`
     );
   }
-  if (IS_WINDOWS2 && /\bmkdir\b/.test(command) && /\s-p\b/.test(command) && /(已存在|already exists|ItemExistsUnauthorizedAccessError|exists)/i.test(stderr)) {
+  if (IS_WINDOWS3 && /\bmkdir\b/.test(command) && /\s-p\b/.test(command) && /(已存在|already exists|ItemExistsUnauthorizedAccessError|exists)/i.test(stderr)) {
     hints.push(
       `Hint: PowerShell's mkdir does not support the '-p' flag. When the directory already exists it exits with code 1. Use instead: New-Item -ItemType Directory -Force -Path <dir> ('-Force' silently succeeds even if the directory already exists, mimicking 'mkdir -p').`
     );
   }
-  if (IS_WINDOWS2 && /Remove-Item/i.test(command) && /cannot find path|no such file|exit 1/i.test(stderr || command)) {
+  if (IS_WINDOWS3 && /Remove-Item/i.test(command) && /cannot find path|no such file|exit 1/i.test(stderr || command)) {
     hints.push(
       `Hint: On Windows, "Remove-Item ... -ErrorAction SilentlyContinue" still makes the powershell process exit 1 when no files match (even though the error is silenced). Use Test-Path as a guard: @('tmp_a.sql','tmp_b.sql','tmp_c.csv') | Where-Object { Test-Path $_ } | Remove-Item -Force \u2014 Test-Path returns a bool without raising, so missing paths are filtered out and exit code is 0.`
     );
   }
-  if (IS_WINDOWS2 && /-(?:EA|ErrorAction)\s+(?:SilentlyContinue|Ignore)\b/i.test(command) && /\b(Get-ChildItem|Get-Item|Get-Content|gci|gi|gc|dir|ls)\b/i.test(command) && !/Remove-Item/i.test(command) && !/Test-Path/i.test(command) && /cannot find path|no such file|does not exist|exit 1|不存在|找不到/i.test(stderr || command)) {
+  if (IS_WINDOWS3 && /-(?:EA|ErrorAction)\s+(?:SilentlyContinue|Ignore)\b/i.test(command) && /\b(Get-ChildItem|Get-Item|Get-Content|gci|gi|gc|dir|ls)\b/i.test(command) && !/Remove-Item/i.test(command) && !/Test-Path/i.test(command) && /cannot find path|no such file|does not exist|exit 1|不存在|找不到/i.test(stderr || command)) {
     hints.push(
       `Hint: On Windows, "-ErrorAction SilentlyContinue" silences the error MESSAGE but does NOT change the exit code \u2014 the process still exits 1 when the path doesn't exist (because powershell.exe -NonInteractive flips the exit code on any non-terminating error, silenced or not). If you're just probing for existence, use Test-Path instead \u2014 it returns $true/$false without raising: \`if (Test-Path ./mydir) { Get-ChildItem ./mydir }\` or unconditionally use \`New-Item -ItemType Directory -Force -Path ./mydir\` which is idempotent. Don't retry the same -ErrorAction SilentlyContinue probe expecting a different result.`
     );
   }
-  if (IS_WINDOWS2 && /\bWrite-(?:Content|File)\b/i.test(command) && /(not recognized|无法将.*识别|不是.*cmdlet|CommandNotFoundException)/i.test(stderr)) {
+  if (IS_WINDOWS3 && /\bWrite-(?:Content|File)\b/i.test(command) && /(not recognized|无法将.*识别|不是.*cmdlet|CommandNotFoundException)/i.test(stderr)) {
     hints.push(
       `Hint: 'Write-Content' / 'Write-File' are NOT PowerShell cmdlets (common LLM hallucination). To write a file, prefer the built-in 'write_file' tool \u2014 it handles encoding/escaping cleanly and supports diff preview. If you must stay in bash: use 'Set-Content -Path <file> -Value <string> -Encoding utf8' (overwrites) or 'Add-Content' (appends) or 'Out-File -FilePath <file> -Encoding utf8'.`
     );
@@ -574,8 +812,8 @@ function pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, cwd) {
 }
 function runShell(command, opts) {
   return new Promise((resolvePromise) => {
-    const shellArgs = IS_WINDOWS2 ? ["-NoProfile", "-NonInteractive", "-Command", command] : ["-c", command];
-    const child = spawn(SHELL, shellArgs, {
+    const shellArgs = IS_WINDOWS3 ? ["-NoProfile", "-NonInteractive", "-Command", command] : ["-c", command];
+    const child = spawn2(SHELL2, shellArgs, {
       cwd: opts.cwd,
       env: opts.env,
       windowsHide: true,
@@ -637,9 +875,9 @@ function runShell(command, opts) {
 }
 function killChild(child) {
   if (child.killed || child.exitCode !== null) return;
-  if (IS_WINDOWS2 && child.pid) {
+  if (IS_WINDOWS3 && child.pid) {
     try {
-      spawn("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
+      spawn2("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
         windowsHide: true,
         stdio: "ignore"
       });
@@ -3626,9 +3864,9 @@ function collectMatchingFiles(dirPath, rootPath, regex, results, maxResults) {
 }
 
 // src/tools/builtin/run-interactive.ts
-import { spawn as spawn2 } from "child_process";
-import { platform as platform3 } from "os";
-var IS_WINDOWS3 = platform3() === "win32";
+import { spawn as spawn3 } from "child_process";
+import { platform as platform4 } from "os";
+var IS_WINDOWS4 = platform4() === "win32";
 var runInteractiveTool = {
   definition: {
     name: "run_interactive",
@@ -3690,7 +3928,7 @@ var runInteractiveTool = {
     };
     const prefixWarnings = [argsTypeWarning, stdinTypeWarning].filter(Boolean).join("");
     return new Promise((resolve8) => {
-      const child = spawn2(executable, cmdArgs.map(String), {
+      const child = spawn3(executable, cmdArgs.map(String), {
         cwd: process.cwd(),
         env,
         stdio: ["pipe", "pipe", "pipe"]
@@ -3708,7 +3946,7 @@ var runInteractiveTool = {
       let lineIdx = 0;
       const writeNextLine = () => {
         if (lineIdx < stdinLines.length && !child.stdin.destroyed) {
-          const line = stdinLines[lineIdx++] + (IS_WINDOWS3 ? "\r\n" : "\n");
+          const line = stdinLines[lineIdx++] + (IS_WINDOWS4 ? "\r\n" : "\n");
           const canContinue = child.stdin.write(line);
           if (canContinue) {
             setTimeout(writeNextLine, 150);
@@ -5549,9 +5787,9 @@ var spawnAgentTool = {
 };
 
 // src/tools/builtin/task-manager.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
-import { platform as platform4 } from "os";
+import { platform as platform5 } from "os";
 var MAX_OUTPUT_CHARS = 1e4;
 var MAX_OUTPUT_BYTES = 64 * 1024;
 var MAX_TASKS = 20;
@@ -5565,7 +5803,7 @@ function capChunks(chunks) {
 }
 function decodeField(chunks) {
   const buf = Buffer.concat(chunks);
-  const text = IS_WINDOWS ? decodeWindowsBuffer(buf) : buf.toString("utf-8");
+  const text = IS_WINDOWS2 ? decodeWindowsBuffer(buf) : buf.toString("utf-8");
   return text.length > MAX_OUTPUT_CHARS ? "... [truncated] ...\n" + text.slice(-MAX_OUTPUT_CHARS) : text;
 }
 function appendOutput(task, field, chunk) {
@@ -5585,7 +5823,7 @@ function createTask(command, description) {
   }
   const id = randomUUID2().slice(0, 8);
   const { shell, args } = shellInvocation(command);
-  const proc = spawn3(shell, args, {
+  const proc = spawn4(shell, args, {
     stdio: ["ignore", "pipe", "pipe"],
     detached: false,
     env: { ...process.env, PYTHONUTF8: "1", PYTHONIOENCODING: "utf-8" }
@@ -5635,9 +5873,9 @@ function stopTask(id) {
   if (!task || task.status !== "running") return false;
   try {
     const proc = task.process;
-    if (platform4() === "win32" && proc.pid) {
+    if (platform5() === "win32" && proc.pid) {
       try {
-        spawn3("taskkill", ["/PID", String(proc.pid), "/T", "/F"], {
+        spawn4("taskkill", ["/PID", String(proc.pid), "/T", "/F"], {
           windowsHide: true,
           stdio: "ignore"
         });
@@ -6733,6 +6971,7 @@ var ToolRegistry = class {
 };
 
 export {
+  cleanupAllSessions,
   initTheme,
   theme,
   undoStack,
@@ -6755,6 +6994,7 @@ export {
   requestInterrupt,
   resetInterrupt,
   runWithSessionKey,
+  clearBashSession,
   rlInternal,
   groupCallsByPhase,
   runSafePhases,

package/dist/{chunk-VHY6NVMQ.js → chunk-LF3OUJHK.js}

@@ -51,16 +51,19 @@ var DEFAULT_PATTERNS = [
   // Bearer <token> in Authorization headers
   { kind: "bearer", regex: /\b(Authorization:\s*Bearer\s+)([a-zA-Z0-9_\-.=]{20,500})/g },
   // Private key PEM blocks — catch the header+footer together
-  { kind: "private-key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g }
+  // P2-PERF-02: PEM bodies use strict Base64 + =\n — narrowed char class avoids backtracking
+  { kind: "private-key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[ \t\n\r]*[A-Za-z0-9+/=\n\r-]*[ \t\n\r]*-----END [A-Z ]*PRIVATE KEY-----/g }
 ];
 var MAX_CUSTOM = 32;
 var MAX_PATTERN_LEN = 500;
 var SUSPICIOUS_REDOS = /\([^)]*[+*][^)]*\)\s*[+*{]/;
+var MAX_REDACT_INPUT = 512e3;
 function render(placeholder, kind) {
   return placeholder.replace("{kind}", kind);
 }
 function redactString(input, options) {
   if (!options.enabled || !input) return { redacted: input, hits: [] };
+  if (input.length > MAX_REDACT_INPUT) return { redacted: input, hits: [] };
   const placeholder = options.placeholder ?? "[REDACTED:{kind}]";
   const customSrcs = (options.customRegexes ?? []).slice(0, MAX_CUSTOM);
   const patterns = [

package/dist/{chunk-GH37CLOE.js → chunk-M4QZYFPN.js}

@@ -6,7 +6,7 @@ import { platform } from "os";
 import chalk from "chalk";
 
 // src/core/constants.ts
-var VERSION = "0.4.223";
+var VERSION = "0.4.225";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";