jinzd-ai-cli 0.4.229 → 0.4.230

package/dist/{hub-LIH5JEI7.js → hub-BHHNMBCY.js}

@@ -139,7 +139,7 @@ ${content}`);
       const state = await runDiscussion(config, providers, options.topic);
       if (options.save !== false && state.messages.length > 0) {
         try {
-          const { persistDiscussion } = await import("./persist-XUXIPYUU.js");
+          const { persistDiscussion } = await import("./persist-I3JI27OK.js");
           const { path } = await persistDiscussion(state, configManager, defaultProvider, defaultModel);
           console.log(chalk.dim(`
   \u{1F4BE} Saved to history \u2014 open it in the Web UI and hit \u{1F3AC} to replay.
@@ -154,7 +154,7 @@ ${content}`);
   }
 }
 async function runTaskMode(config, providers, configManager, topic) {
-  const { TaskOrchestrator } = await import("./task-orchestrator-FA4KOVD2.js");
+  const { TaskOrchestrator } = await import("./task-orchestrator-IVSLED6U.js");
   const orchestrator = new TaskOrchestrator(config, providers, configManager);
   let interrupted = false;
   const onSigint = () => {

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   scanProject,
   sessionHasMeaningfulContent,
   setupProxy
-} from "./chunk-SJ36SUG7.js";
+} from "./chunk-SKUNYJDW.js";
 import {
   buildReviewPrompt,
   buildSecurityReviewPrompt
@@ -52,7 +52,7 @@ import {
   theme,
   undoStack,
   updateMemoryApproval
-} from "./chunk-DMF6UHO6.js";
+} from "./chunk-F2DUNYGY.js";
 import "./chunk-K3CF65QH.js";
 import "./chunk-UUSRWSSX.js";
 import "./chunk-CKH4KQ4E.js";
@@ -60,7 +60,7 @@ import "./chunk-BXP6YZ2P.js";
 import {
   SessionManager,
   getContentText
-} from "./chunk-QYQCCIBT.js";
+} from "./chunk-ZWU7FWHO.js";
 import {
   CostTracker
 } from "./chunk-YVMACMXW.js";
@@ -74,10 +74,10 @@ import {
   formatDoctorReport,
   loadContextFiles,
   writeCrashLog
-} from "./chunk-QFOJ4GXC.js";
+} from "./chunk-SARJYCDV.js";
 import {
   ProviderRegistry
-} from "./chunk-EEQHP4GK.js";
+} from "./chunk-62R7CACG.js";
 import {
   describePlugin,
   getActivePluginAssets,
@@ -94,7 +94,7 @@ import {
   trustHook,
   trustPlugin,
   untrustHook
-} from "./chunk-TEXAIWUJ.js";
+} from "./chunk-ITEGK3IN.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   TEE_FINAL_USER_NUDGE,
@@ -116,7 +116,7 @@ import {
 } from "./chunk-ODYTXQ26.js";
 import {
   ConfigManager
-} from "./chunk-FEVOW3NQ.js";
+} from "./chunk-DKPHVQUA.js";
 import {
   AuthError,
   ProviderError,
@@ -130,7 +130,7 @@ import {
 import {
   fileCheckpoints
 } from "./chunk-4BKXL7SM.js";
-import "./chunk-AEXWMIRE.js";
+import "./chunk-S6SFZP3G.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
   AUTHOR,
@@ -149,7 +149,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-B3POS7LB.js";
+} from "./chunk-6GSDDDEO.js";
 import {
   buildChatIndex,
   clearChatIndex,
@@ -1048,8 +1048,7 @@ function createMiscCommands() {
             title: "Tools, context & memory",
             rows: [
               ["/tools", "List all AI tools available"],
-              ["/plugins", "Show plugin directory and loaded plugins"],
-              ["/plugin [list|install|enable|disable|inspect|trust]", "Manage package plugins"],
+              ["/plugin [list|install|enable|disable|inspect|trust]", "Manage plugins (package + legacy JS)"],
               ["/mcp [reconnect [serverId]|trust-project]", "Show MCP server connections and tools"],
               ["/skill [name|off|list]", "Manage agent skills (reusable prompt packs)"],
               ["/context", "Show or reload hierarchical context layers"],
@@ -1717,32 +1716,9 @@ No tools match "${filter}".
 `));
       }
     },
-    {
-      name: "plugins",
-      description: "Show plugin directory and list loaded plugins",
-      usage: "/plugins",
-      execute(_args, ctx) {
-        const pluginsDir = ctx.config.getPluginsDir();
-        const pluginTools = ctx.tools.listPluginTools();
-        console.log();
-        console.log(`  Plugin directory : ${pluginsDir}`);
-        console.log();
-        if (pluginTools.length === 0) {
-          console.log(theme.dim("  No plugins loaded."));
-          console.log(theme.dim("  To add a plugin, place a .js file in the directory above."));
-          console.log(theme.dim("  Format: export const tool = { definition: {...}, execute: async (args) => {...} }"));
-        } else {
-          console.log(`  Loaded plugins (${pluginTools.length}):`);
-          for (const t of pluginTools) {
-            console.log(`    ${theme.accent(t.definition.name.padEnd(22))}${theme.dim(t.definition.description)}`);
-          }
-        }
-        console.log();
-      }
-    },
     {
       name: "plugin",
-      description: "Manage package plugins (.aicli-plugin/plugin.json)",
+      description: "Manage plugins (.aicli-plugin/ + legacy JS tools)",
       usage: "/plugin [list|install <path>|enable <name>|disable <name>|inspect <name>|trust <name>]",
       async execute(args, ctx) {
         const sub = args[0] ?? "list";
@@ -1750,12 +1726,14 @@ No tools match "${filter}".
         try {
           if (sub === "list") {
             const plugins = listInstalledPlugins(configDir);
-            console.log(theme.heading("\n\u{1F50C} Package Plugins\n"));
-            console.log(theme.dim(`  Dir: ${pluginRoot(configDir)}`));
+            const pluginTools = ctx.tools.listPluginTools();
+            console.log(theme.heading("\n\u{1F50C} Plugins\n"));
             if (plugins.length === 0) {
               console.log(theme.dim("  No package plugins installed."));
+              console.log(theme.dim(`  Dir: ${pluginRoot(configDir)}`));
               console.log(theme.dim("  Use: /plugin install <path-to-plugin-dir>"));
             } else {
+              console.log(theme.dim(`  Package dir: ${pluginRoot(configDir)}`));
               for (const p of plugins) {
                 const status = `${p.enabled ? theme.success("enabled") : theme.dim("disabled")} / ${p.trusted ? theme.success("trusted") : theme.warning("untrusted")}`;
                 console.log(`  ${theme.accent(p.name.padEnd(22))} ${p.manifest.version.padEnd(10)} ${status}`);
@@ -1763,6 +1741,15 @@ No tools match "${filter}".
                 if (!p.valid && p.error) console.log(theme.warning(`      invalid: ${p.error}`));
               }
             }
+            if (pluginTools.length > 0) {
+              console.log();
+              const legacyDir = ctx.config.getPluginsDir();
+              console.log(theme.dim(`  Legacy JS dir: ${legacyDir}`));
+              console.log(`  Legacy JS tools (${pluginTools.length}):`);
+              for (const t of pluginTools) {
+                console.log(`    ${theme.accent(t.definition.name.padEnd(22))}${theme.dim(t.definition.description)}`);
+              }
+            }
             console.log();
             return;
           }
@@ -1834,7 +1821,7 @@ No tools match "${filter}".
           const { join: join7 } = await import("path");
           const { existsSync: existsSync6 } = await import("fs");
           const { getGitRoot: getGitRoot2 } = await import("./git-context-EXOEHQSF.js");
-          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-J2MSGNFA.js");
+          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-JTHN5JSQ.js");
           const { approveProject, hashMcpFile } = await import("./project-trust-NKYHL3VZ.js");
           const cwd = process.cwd();
           const projectRoot = getGitRoot2(cwd) ?? cwd;
@@ -2813,7 +2800,7 @@ function createReviewCommands() {
       usage: "/test [command|filter]",
       async execute(args, ctx) {
         try {
-          const { executeTests } = await import("./run-tests-WBGQI5V7.js");
+          const { executeTests } = await import("./run-tests-HZMY436A.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -7758,7 +7745,7 @@ program.command("web").description("Start Web UI server with browser-based chat
     console.error("Error: Invalid port number. Must be between 1 and 65535.");
     process.exit(1);
   }
-  const { startWebServer } = await import("./server-LYTXYK6Y.js");
+  const { startWebServer } = await import("./server-RCAFE2LO.js");
   await startWebServer({ port, host: options.host });
 });
 program.command("user [action] [username]").description("Manage Web UI users (list | create <name> | delete <name> | reset-password <name> | logout-all <name> | migrate <name>)").action(async (action, username) => {
@@ -7925,11 +7912,11 @@ program.command("sessions").description("List recent conversation sessions").opt
   console.log(footer + "\n");
 });
 program.command("usage").description("Show token + cost usage grouped by provider/model (cross-session)").option("--days <n>", "Only the last N days (inclusive of today)").option("--month <ym>", "Only a specific month, format YYYY-MM (e.g. 2026-06)").option("--json", "Output as JSON (for scripting)").action(async (options) => {
-  const { runUsageCli } = await import("./usage-EHV6YVGH.js");
+  const { runUsageCli } = await import("./usage-KNMT35C2.js");
   await runUsageCli(options);
 });
 program.command("doctor").description("Health check: API keys, config, MCP, recent crashes, tool usage, disk usage").option("--json", "Output as JSON (for scripting)").option("--reset-stats", "Reset accumulated tool usage statistics").action(async (options) => {
-  const { runDoctorCli } = await import("./doctor-cli-3VNTECP2.js");
+  const { runDoctorCli } = await import("./doctor-cli-XTIL3RTQ.js");
   const argv = process.argv.slice(2);
   await runDoctorCli({
     json: !!options.json || argv.includes("--json"),
@@ -7938,7 +7925,7 @@ program.command("doctor").description("Health check: API keys, config, MCP, rece
 });
 program.command("batch <action> [arg] [arg2]").description("Anthropic Message Batches: submit | list | status <id> | results <id> [out] | cancel <id>").option("--dry-run", "Parse and validate input without submitting (submit only)").action(async (action, arg, arg2, options) => {
   try {
-    const batch = await import("./batch-XZHTNJXJ.js");
+    const batch = await import("./batch-T74D2CCK.js");
     switch (action) {
       case "submit":
         if (!arg) {
@@ -7981,7 +7968,7 @@ program.command("batch <action> [arg] [arg2]").description("Anthropic Message Ba
   }
 });
 program.command("mcp-serve").description("Start an MCP server over STDIO, exposing aicli's built-in tools to Claude Desktop / Cursor / other MCP clients").option("--allow-destructive", "Allow bash / run_interactive / task_create (always destructive in MCP mode)").option("--allow-outside-cwd", "Allow tool path arguments to escape the sandbox root \u2014 disabled by default").option("--tools <list>", "Comma-separated whitelist of tools to expose (default: all eligible tools)").option("--cwd <path>", "Working directory AND sandbox root (default: current directory)").action(async (options) => {
-  const { startMcpServer } = await import("./server-5RXWIX4I.js");
+  const { startMcpServer } = await import("./server-Q7MNZB4X.js");
   await startMcpServer({
     allowDestructive: !!options.allowDestructive,
     allowOutsideCwd: !!options.allowOutsideCwd,
@@ -7994,7 +7981,7 @@ program.command("pr <action> [target]").description("PR review helpers: review |
     console.error(`Unknown pr action: ${action}. Use review | security-review | summarize.`);
     process.exit(1);
   }
-  const { runPrCli } = await import("./pr-HY2QCVUY.js");
+  const { runPrCli } = await import("./pr-NUHU64NS.js");
   const result = await runPrCli({
     action,
     target,
@@ -8014,8 +8001,8 @@ program.command("pr <action> [target]").description("PR review helpers: review |
   process.exit(result.exitCode);
 });
 program.command("ci").description("Headless PR review (code + security) \u2014 reads git/gh diff, optionally posts to PR. Designed for GitHub Actions.").option("--pr <num>", "PR number or URL; diff fetched via gh pr diff <value>", (v) => /^#?\d+$/.test(v) ? parseInt(v.replace(/^#/, ""), 10) : v).option("--base <ref>", "Base ref for git diff <ref>...HEAD (ignored when --pr set)").option("--post", "Post review as a PR comment (requires gh CLI + GH_TOKEN, needs --pr)").option("--no-update", "Always create a new comment instead of updating the previous aicli review").option("--skip-code", "Skip the code review section").option("--skip-security", "Skip the security review section").option("--detailed", "Use the detailed code-review prompt").option("--max-diff <n>", "Max diff chars sent to the model (default 30000)", (v) => parseInt(v, 10)).option("--provider <id>", "Override provider (default: config.defaultProvider)").option("--model <id>", "Override model").option("--dry-run", "Print result to stdout instead of posting (overrides --post)").option("--json", "Output a structured JSON report").option("--markdown", "Output Markdown report (default)").option("--sarif", "Output SARIF 2.1.0 for code scanning artifacts").option("--fail-on-security-high", "Fail when the security review contains HIGH/CRITICAL findings (default)").option("--no-fail-on-security-high", "Do not fail on security HIGH/CRITICAL findings").option("--fail-on-test-failure", "Fail when the report mentions test failures (default)").option("--no-fail-on-test-failure", "Do not fail on test failure findings").option("--fail-on-lint-failure", "Fail when the report mentions lint/typecheck failures (default)").option("--no-fail-on-lint-failure", "Do not fail on lint/typecheck failure findings").action(async (options) => {
-  const { runCi } = await import("./ci-ZCVDKFXY.js");
-  const { formatCiResult } = await import("./ci-format-CKXDFTN3.js");
+  const { runCi } = await import("./ci-ADQTAYOZ.js");
+  const { formatCiResult } = await import("./ci-format-KZSTHIEW.js");
   const formats = [options.json, options.markdown, options.sarif].filter(Boolean).length;
   if (formats > 1) {
     console.error("Choose only one output format: --json, --markdown, or --sarif.");
@@ -8173,7 +8160,7 @@ program.command("hub [topic]").description("Start multi-agent hub (discuss / bra
     config.get("customProviders"),
     config.getConfigDir()
   );
-  const { startHub } = await import("./hub-LIH5JEI7.js");
+  const { startHub } = await import("./hub-BHHNMBCY.js");
   await startHub(
     {
       topic: topic ?? "",
@@ -8459,7 +8446,7 @@ Provider '${options.provider}' is not configured. Run: ai-cli config
     config.setTransient("defaultModels", { ...defaultModels, [provider]: options.model });
   }
   process.on("SIGTERM", async () => {
-    await sessions.save();
+    await sessions.save(true);
     process.exit(0);
   });
   await repl.start();

package/dist/{persist-XUXIPYUU.js → persist-I3JI27OK.js}

@@ -2,8 +2,8 @@
 import {
   discussionToMessages,
   persistDiscussion
-} from "./chunk-DEHVRQWW.js";
-import "./chunk-QYQCCIBT.js";
+} from "./chunk-4KM53GLG.js";
+import "./chunk-ZWU7FWHO.js";
 import "./chunk-B5TYJO7V.js";
 import "./chunk-IW3Q7AE5.js";
 export {

package/dist/{pr-HY2QCVUY.js → pr-NUHU64NS.js}

@@ -2,8 +2,8 @@
 import {
   countSeverity,
   runCi
-} from "./chunk-PQLRX7US.js";
-import "./chunk-AXIMNQSY.js";
+} from "./chunk-LMKCS5XH.js";
+import "./chunk-T3A74XGG.js";
 import {
   buildReviewPrompt,
   buildSecurityReviewPrompt,
@@ -11,15 +11,15 @@ import {
 } from "./chunk-HLWUDRBO.js";
 import {
   ProviderRegistry
-} from "./chunk-EEQHP4GK.js";
+} from "./chunk-62R7CACG.js";
 import "./chunk-ODYTXQ26.js";
 import {
   ConfigManager
-} from "./chunk-FEVOW3NQ.js";
+} from "./chunk-DKPHVQUA.js";
 import "./chunk-5ULLIOVC.js";
 import {
   VERSION
-} from "./chunk-B3POS7LB.js";
+} from "./chunk-6GSDDDEO.js";
 import "./chunk-IW3Q7AE5.js";
 
 // src/cli/pr.ts

package/dist/{run-tests-WBGQI5V7.js → run-tests-HZMY436A.js}

@@ -2,8 +2,8 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-AEXWMIRE.js";
-import "./chunk-B3POS7LB.js";
+} from "./chunk-S6SFZP3G.js";
+import "./chunk-6GSDDDEO.js";
 export {
   executeTests,
   runTestsTool

package/dist/{run-tests-QVXDTJ3O.js → run-tests-M45ZJPR6.js}

@@ -1,7 +1,7 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-QCGKCNBX.js";
+} from "./chunk-7I4GGVIS.js";
 export {
   executeTests,
   runTestsTool

package/dist/{server-5RXWIX4I.js → server-Q7MNZB4X.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   ToolRegistry
-} from "./chunk-DMF6UHO6.js";
+} from "./chunk-F2DUNYGY.js";
 import "./chunk-K3CF65QH.js";
 import "./chunk-UUSRWSSX.js";
 import "./chunk-CKH4KQ4E.js";
 import "./chunk-BXP6YZ2P.js";
 import {
   runTool
-} from "./chunk-TEXAIWUJ.js";
+} from "./chunk-ITEGK3IN.js";
 import {
   getDangerLevel,
   schemaToJsonSchema
@@ -16,10 +16,10 @@ import {
 import "./chunk-5ULLIOVC.js";
 import "./chunk-HOSJZMQS.js";
 import "./chunk-4BKXL7SM.js";
-import "./chunk-AEXWMIRE.js";
+import "./chunk-S6SFZP3G.js";
 import {
   VERSION
-} from "./chunk-B3POS7LB.js";
+} from "./chunk-6GSDDDEO.js";
 import "./chunk-NVUCDUXE.js";
 import "./chunk-KHYD3WXE.js";
 import "./chunk-B5TYJO7V.js";

package/dist/{server-LYTXYK6Y.js → server-RCAFE2LO.js}

@@ -7,7 +7,7 @@ import {
 import "./chunk-3ARPAVNV.js";
 import {
   persistDiscussion
-} from "./chunk-DEHVRQWW.js";
+} from "./chunk-4KM53GLG.js";
 import {
   AuthManager,
   TOKEN_EXPIRY_MS
@@ -23,7 +23,7 @@ import {
   scanDirTree,
   scanProject,
   setupProxy
-} from "./chunk-SJ36SUG7.js";
+} from "./chunk-SKUNYJDW.js";
 import {
   buildReviewPrompt,
   buildSecurityReviewPrompt
@@ -67,7 +67,7 @@ import {
   truncateOutput,
   undoStack,
   updateMemoryApproval
-} from "./chunk-DMF6UHO6.js";
+} from "./chunk-F2DUNYGY.js";
 import "./chunk-K3CF65QH.js";
 import "./chunk-UUSRWSSX.js";
 import "./chunk-CKH4KQ4E.js";
@@ -75,7 +75,7 @@ import "./chunk-BXP6YZ2P.js";
 import {
   SessionManager,
   getContentText
-} from "./chunk-QYQCCIBT.js";
+} from "./chunk-ZWU7FWHO.js";
 import {
   computeCost,
   formatCost
@@ -84,10 +84,10 @@ import {
   buildDoctorReport,
   formatDoctorReport,
   loadContextFiles
-} from "./chunk-QFOJ4GXC.js";
+} from "./chunk-SARJYCDV.js";
 import {
   ProviderRegistry
-} from "./chunk-EEQHP4GK.js";
+} from "./chunk-62R7CACG.js";
 import {
   describePlugin,
   getActivePluginAssets,
@@ -102,7 +102,7 @@ import {
   runTool,
   setPluginEnabled,
   trustPlugin
-} from "./chunk-TEXAIWUJ.js";
+} from "./chunk-ITEGK3IN.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   TEE_FINAL_USER_NUDGE,
@@ -121,7 +121,7 @@ import {
 } from "./chunk-ODYTXQ26.js";
 import {
   ConfigManager
-} from "./chunk-FEVOW3NQ.js";
+} from "./chunk-DKPHVQUA.js";
 import "./chunk-5ULLIOVC.js";
 import {
   formatGitContextForPrompt,
@@ -129,7 +129,7 @@ import {
   getGitRoot
 } from "./chunk-HOSJZMQS.js";
 import "./chunk-4BKXL7SM.js";
-import "./chunk-AEXWMIRE.js";
+import "./chunk-S6SFZP3G.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
   AUTHOR,
@@ -146,7 +146,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-B3POS7LB.js";
+} from "./chunk-6GSDDDEO.js";
 import "./chunk-NVUCDUXE.js";
 import "./chunk-KHYD3WXE.js";
 import {
@@ -1352,37 +1352,32 @@ async function handleRewind(args, ctx) {
 async function handleTools(_args, ctx) {
   ctx.sendToolsList();
 }
-async function handlePlugins(_args, ctx) {
-  const configDir = ctx.config.getConfigDir();
-  const pluginsDir = join(configDir, PLUGINS_DIR_NAME);
-  const pluginTools = ctx.toolRegistry.listPluginTools();
-  const pluginPackages = listInstalledPlugins(configDir);
-  const lines = [`\u{1F50C} **Plugins:**`, `Dir: ${pluginsDir}`, ""];
-  if (pluginTools.length === 0 && pluginPackages.length === 0) {
-    lines.push("No plugins loaded.");
-    lines.push("Use /plugin install <path>, /plugin trust <name>, then /plugin enable <name>.");
-  } else {
-    if (pluginPackages.length > 0) {
-      lines.push(`Package plugins (${pluginPackages.length}):`);
-      for (const p of pluginPackages) lines.push(`  \u2022 ${p.name}@${p.manifest.version} \u2014 ${p.enabled ? "enabled" : "disabled"} / ${p.trusted ? "trusted" : "untrusted"}`);
-      lines.push("");
-    }
-    if (pluginTools.length > 0) {
-      lines.push(`Legacy JS plugin tools (${pluginTools.length}):`);
-      for (const t of pluginTools) lines.push(`  \u2022 ${t.definition.name} \u2014 ${t.definition.description}`);
-    }
-  }
-  ctx.send({ type: "info", message: lines.join("\n") });
-}
 async function handlePlugin(args, ctx) {
   const configDir = ctx.config.getConfigDir();
   const sub = args[0] ?? "list";
   try {
     if (sub === "list") {
       const plugins = listInstalledPlugins(configDir);
-      const lines = [`\u{1F50C} **Package Plugins**`, `Dir: ${pluginRoot(configDir)}`, ""];
-      if (plugins.length === 0) lines.push("No package plugins installed.");
-      for (const p of plugins) lines.push(`  \u2022 ${p.name}@${p.manifest.version} \u2014 ${p.enabled ? "enabled" : "disabled"} / ${p.trusted ? "trusted" : "untrusted"}`);
+      const pluginTools = ctx.toolRegistry.listPluginTools();
+      const lines = ["\u{1F50C} **Plugins**", ""];
+      if (plugins.length === 0 && pluginTools.length === 0) {
+        lines.push("No plugins loaded.");
+        lines.push(`Dir: ${pluginRoot(configDir)}`);
+        lines.push("Use /plugin install <path>, /plugin trust <name>, then /plugin enable <name>.");
+      } else {
+        if (plugins.length > 0) {
+          lines.push(`**Package plugins** (${plugins.length}):`);
+          lines.push(`Dir: ${pluginRoot(configDir)}`);
+          for (const p of plugins) lines.push(`  \u2022 ${p.name}@${p.manifest.version} \u2014 ${p.enabled ? "enabled" : "disabled"} / ${p.trusted ? "trusted" : "untrusted"}`);
+          lines.push("");
+        }
+        if (pluginTools.length > 0) {
+          const legacyDir = join(configDir, PLUGINS_DIR_NAME);
+          lines.push(`**Legacy JS tools** (${pluginTools.length}):`);
+          lines.push(`Dir: ${legacyDir}`);
+          for (const t of pluginTools) lines.push(`  \u2022 ${t.definition.name} \u2014 ${t.definition.description}`);
+        }
+      }
       ctx.send({ type: "info", message: lines.join("\n") });
       return;
     }
@@ -1598,7 +1593,7 @@ async function handleSecurityReview(args, ctx) {
 async function handleTest(args, ctx) {
   ctx.send({ type: "info", message: "\u{1F9EA} Running tests..." });
   try {
-    const { executeTests } = await import("./run-tests-WBGQI5V7.js");
+    const { executeTests } = await import("./run-tests-HZMY436A.js");
     const argStr = args.join(" ").trim();
     let testArgs = {};
     if (argStr) {
@@ -2078,8 +2073,7 @@ async function handleHelp(_args, ctx) {
       "  /scaffold <desc>     \u2014 Generate project scaffolding with AI",
       "  /add-dir [path|remove] \u2014 Add/remove directory from AI context",
       "  /mcp [reconnect]     \u2014 Show/manage MCP servers",
-      "  /plugins             \u2014 Show loaded plugins",
-      "  /plugin <cmd>        \u2014 Manage package plugins",
+      "  /plugin <cmd>        \u2014 Manage plugins (list/install/enable/disable/inspect/trust)",
       "  /commands            \u2014 List custom commands",
       "  /doctor              \u2014 Health check (API keys, config, MCP)",
       "  /bug                 \u2014 Generate bug report template",
@@ -2196,7 +2190,6 @@ var webCommandHandlers = {
   fork: handleFork,
   rewind: handleRewind,
   tools: handleTools,
-  plugins: handlePlugins,
   plugin: handlePlugin,
   mcp: handleMcp,
   skill: handleSkill,

package/dist/{task-orchestrator-FA4KOVD2.js → task-orchestrator-IVSLED6U.js}

@@ -3,14 +3,14 @@ import {
   ToolRegistry,
   googleSearchContext,
   truncateOutput
-} from "./chunk-DMF6UHO6.js";
+} from "./chunk-F2DUNYGY.js";
 import "./chunk-K3CF65QH.js";
 import "./chunk-UUSRWSSX.js";
 import "./chunk-CKH4KQ4E.js";
 import "./chunk-BXP6YZ2P.js";
 import {
   runTool
-} from "./chunk-TEXAIWUJ.js";
+} from "./chunk-ITEGK3IN.js";
 import {
   getDangerLevel,
   runLeanAgentLoop
@@ -18,10 +18,10 @@ import {
 import "./chunk-5ULLIOVC.js";
 import "./chunk-HOSJZMQS.js";
 import "./chunk-4BKXL7SM.js";
-import "./chunk-AEXWMIRE.js";
+import "./chunk-S6SFZP3G.js";
 import {
   SUBAGENT_ALLOWED_TOOLS
-} from "./chunk-B3POS7LB.js";
+} from "./chunk-6GSDDDEO.js";
 import "./chunk-NVUCDUXE.js";
 import "./chunk-KHYD3WXE.js";
 import "./chunk-B5TYJO7V.js";

package/dist/{usage-EHV6YVGH.js → usage-KNMT35C2.js}

@@ -8,9 +8,9 @@ import {
 } from "./chunk-E44DTERW.js";
 import {
   ConfigManager
-} from "./chunk-FEVOW3NQ.js";
+} from "./chunk-DKPHVQUA.js";
 import "./chunk-5ULLIOVC.js";
-import "./chunk-B3POS7LB.js";
+import "./chunk-6GSDDDEO.js";
 import "./chunk-IW3Q7AE5.js";
 
 // src/cli/usage.ts

package/dist/web/client/app.js

@@ -716,14 +716,22 @@ window.copyConfirmDiff = function(el) {
 };
 // DaisyUI light themes → highlight.js light stylesheet; others → dark
 const LIGHT_DAISYUI_THEMES = new Set(['light', 'cupcake', 'bumblebee', 'emerald', 'corporate', 'garden', 'lofi', 'pastel', 'fantasy', 'wireframe', 'cmyk', 'autumn', 'acid', 'lemonade', 'winter', 'nord']);
-// v0.4.153: vendored locally (was cdn.jsdelivr.net) — see index.html.
-const HLJS_CDN = 'vendor';
+// v0.4.153: vendored locally (was cdn.jsdelivr.net).
 
 function updateCodeTheme(daisyTheme) {
   const isLight = LIGHT_DAISYUI_THEMES.has(daisyTheme);
-  const hljsFile = isLight ? 'github.min.css' : 'github-dark.min.css';
-  const link = document.getElementById('hljs-theme');
-  if (link) link.href = `${HLJS_CDN}/${hljsFile}`;
+  // P2-SEC-01: toggle disabled instead of changing href — preserves SRI integrity
+  const darkLink = document.getElementById('hljs-theme-dark');
+  const lightLink = document.getElementById('hljs-theme-light');
+  if (darkLink && lightLink) {
+    if (isLight) {
+      darkLink.disabled = true;
+      lightLink.disabled = false;
+    } else {
+      lightLink.disabled = true;
+      darkLink.disabled = false;
+    }
+  }
 }
 
 window.setTheme = function(theme) {

package/dist/web/client/index.html

@@ -17,12 +17,20 @@
        CDN failed the whole UI rendered unstyled AND the `.hidden` login overlay
        became visible (no users → "can't log in"). Serving locally makes the UI
        work offline / behind GFW with zero behavior change. -->
-  <link href="vendor/daisyui-full.min.css" rel="stylesheet">
-  <script src="vendor/tailwind.js"></script>
-  <!-- Markdown + Code highlighting -->
-  <script src="vendor/marked.min.js"></script>
-  <link id="hljs-theme" rel="stylesheet" href="vendor/github-dark.min.css">
-  <script src="vendor/highlight.min.js"></script>
+  <link href="vendor/daisyui-full.min.css" rel="stylesheet"
+        integrity="sha384-Qn1dWOhPHD8ZitIQRnpquZJZmyWs+sq1SKENTuBIc3+Yg16SG2u3RqsC8LVbkZre" crossorigin="anonymous">
+  <script src="vendor/tailwind.js"
+          integrity="sha384-igm5BeiBt36UU4gqwWS7imYmelpTsZlQ45FZf+XBn9MuJbn4nQr7yx1yFydocC/K" crossorigin="anonymous"></script>
+  <!-- Markdown + Code highlighting -->
+  <script src="vendor/marked.min.js"
+          integrity="sha384-948ahk4ZmxYVYOc+rxN1H2gM1EJ2Duhp7uHtZ4WSLkV4Vtx5MUqnV+l7u9B+jFv+" crossorigin="anonymous"></script>
+  <!-- P2-SEC-01: SRI integrity for both hljs themes — toggle disabled instead of changing href -->
+  <link id="hljs-theme-dark" rel="stylesheet" href="vendor/github-dark.min.css"
+        integrity="sha384-wH75j6z1lH97ZOpMOInqhgKzFkAInZPPSPlZpYKYTOqsaizPvhQZmAtLcPKXpLyH" crossorigin="anonymous">
+  <link id="hljs-theme-light" rel="stylesheet" href="vendor/github.min.css" disabled
+        integrity="sha384-eFTL69TLRZTkNfYZOLM+G04821K1qZao/4QLJbet1pP4tcF+fdXq/9CdqAbWRl/L" crossorigin="anonymous">
+  <script src="vendor/highlight.min.js"
+          integrity="sha384-F/bZzf7p3Joyp5psL90p/p89AZJsndkSoGwRpXcZhleCWhd8SnRuoYo4d0yirjJp" crossorigin="anonymous"></script>
   <link rel="stylesheet" href="style.css">
 </head>
 <body class="bg-base-300 h-screen overflow-hidden">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jinzd-ai-cli",
-  "version": "0.4.229",
+  "version": "0.4.230",
   "description": "Cross-platform REPL-style AI CLI with multi-provider support",
   "type": "module",
   "main": "./dist/index.js",