jinzd-ai-cli 0.4.233 → 0.4.235

package/dist/electron-server.js

@@ -38,7 +38,7 @@ import {
   VERSION,
   buildUserIdentityPrompt,
   runTestsTool
-} from "./chunk-4OAV7QMB.js";
+} from "./chunk-HHYMSEWS.js";
 import {
   hasSemanticIndex,
   semanticSearch
@@ -49,12 +49,18 @@ import {
 import "./chunk-IEQAE3QG.js";
 import {
   DEFAULT_PATTERNS,
+  listFromIndex,
   loadChatIndex,
+  readSessionMeta,
   redactJson,
   redactString,
+  removeSessionFromIndex,
+  safeDate,
   scanString,
-  searchChatMemory
-} from "./chunk-LF3OUJHK.js";
+  searchCandidates,
+  searchChatMemory,
+  updateSessionInIndex
+} from "./chunk-UO3XWZFE.js";
 import "./chunk-JV5N65KN.js";
 import {
   atomicWriteFileSync
@@ -64,8 +70,8 @@ import {
 import express from "express";
 import { createServer } from "http";
 import { WebSocketServer } from "ws";
-import { join as join28, dirname as dirname11, resolve as resolve13, relative as relative4, sep as sep3 } from "path";
-import { existsSync as existsSync33, readFileSync as readFileSync26, readdirSync as readdirSync17, statSync as statSync15, realpathSync } from "fs";
+import { join as join28, dirname as dirname12, resolve as resolve13, relative as relative5, sep as sep3 } from "path";
+import { existsSync as existsSync34, readFileSync as readFileSync26, readdirSync as readdirSync17, statSync as statSync15, realpathSync as realpathSync2 } from "fs";
 import { networkInterfaces } from "os";
 
 // src/config/config-manager.ts
@@ -1902,12 +1908,12 @@ function findPhantomClaims(content, extraMessages) {
   const claimed = extractClaimedFilePaths(content);
   if (claimed.length === 0) return [];
   const normalize = (p) => p.replace(/\\/g, "/").toLowerCase().replace(/^\.\//, "");
-  const basename7 = (p) => {
+  const basename8 = (p) => {
     const parts = normalize(p).split("/");
     return parts[parts.length - 1] ?? "";
   };
   const written = extractWrittenFilePaths(extraMessages).map(normalize);
-  const writtenBases = new Set(written.map(basename7));
+  const writtenBases = new Set(written.map(basename8));
   const writtenFull = new Set(written);
   const bashText = extractBashCommands(extraMessages).map((c) => c.replace(/\\/g, "/").toLowerCase()).join("\n");
   return claimed.filter((raw) => {
@@ -1916,8 +1922,8 @@ function findPhantomClaims(content, extraMessages) {
     for (const w of writtenFull) {
       if (w.endsWith("/" + norm2) || norm2.endsWith("/" + w)) return false;
     }
-    if (writtenBases.has(basename7(norm2))) return false;
-    const base = basename7(norm2);
+    if (writtenBases.has(basename8(norm2))) return false;
+    const base = basename8(norm2);
     if (base && bashText.includes(base)) return false;
     return true;
   });
@@ -3947,7 +3953,7 @@ var ProviderRegistry = class {
 };
 
 // src/session/session-manager.ts
-import { readFileSync as readFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync, unlinkSync as unlinkSync2, openSync, readSync, closeSync, statSync } from "fs";
+import { readFileSync as readFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync, unlinkSync as unlinkSync2, statSync } from "fs";
 import { join as join3 } from "path";
 import { v4 as uuidv4 } from "uuid";
 
@@ -4483,19 +4489,6 @@ var Session = class _Session {
 };
 
 // src/session/session-manager.ts
-function safeDate(value) {
-  const d = new Date(value);
-  return isNaN(d.getTime()) ? /* @__PURE__ */ new Date(0) : d;
-}
-function extractJsonField(header, field) {
-  const re = new RegExp(`"${field}"\\s*:\\s*"([^"]*)"`, "i");
-  const m = header.match(re);
-  return m ? m[1] : void 0;
-}
-function extractJsonNumberField(header, field) {
-  const m = header.match(new RegExp(`"${field}"\\s*:\\s*(\\d+)`));
-  return m ? Number(m[1]) : void 0;
-}
 var SessionManager = class {
   _current = null;
   historyDir;
@@ -4553,6 +4546,18 @@ var SessionManager = class {
     this.lastRedactionHits = hits.length;
     atomicWriteFileSync(filePath, JSON.stringify(payload, null, 2));
     this._current.dirty = false;
+    try {
+      updateSessionInIndex(this.historyDir, {
+        id: this._current.id,
+        provider: this._current.provider,
+        model: this._current.model,
+        title: this._current.title,
+        messageCount: this._current.messages.length,
+        created: this._current.created,
+        updated: this._current.updated
+      }, filePath);
+    } catch {
+    }
   }
   loadSession(id) {
     const filePath = join3(this.historyDir, `${id}.json`);
@@ -4571,12 +4576,16 @@ var SessionManager = class {
   }
   listSessions(opts) {
     if (!existsSync3(this.historyDir)) return [];
+    try {
+      return listFromIndex(this.historyDir, opts);
+    } catch {
+    }
     const files = readdirSync(this.historyDir).filter((f) => f.endsWith(".json"));
     const metas = [];
     for (const file of files) {
       try {
         const filePath = join3(this.historyDir, file);
-        const meta = this.readSessionMeta(filePath);
+        const meta = readSessionMeta(filePath);
         if (!meta) continue;
         if (opts?.includeFileSize) {
           try {
@@ -4594,78 +4603,6 @@ var SessionManager = class {
     }
     return metas.sort((a, b) => b.updated.getTime() - a.updated.getTime());
   }
-  /**
-   * P1-B: Read only the first ~1KB of a session file to extract metadata fields.
-   * Session JSON format puts id/provider/model/created/updated/title before the
-   * large "messages" array, so a small header read suffices for metadata extraction.
-   * Falls back to full file read if header parsing fails.
-   */
-  readSessionMeta(filePath) {
-    const HEADER_SIZE = 1024;
-    let header;
-    try {
-      const fd = openSync(filePath, "r");
-      const buf = Buffer.alloc(HEADER_SIZE);
-      const bytesRead = readSync(fd, buf, 0, HEADER_SIZE, 0);
-      closeSync(fd);
-      header = buf.toString("utf-8", 0, bytesRead);
-    } catch {
-      return null;
-    }
-    const id = extractJsonField(header, "id");
-    const provider = extractJsonField(header, "provider");
-    const model = extractJsonField(header, "model");
-    const created = extractJsonField(header, "created");
-    const updated = extractJsonField(header, "updated");
-    const title = extractJsonField(header, "title");
-    if (id && provider && model) {
-      let messageCount = extractJsonNumberField(header, "messageCount");
-      if (messageCount === void 0) {
-        messageCount = 0;
-        try {
-          const full = readFileSync3(filePath, "utf-8");
-          const matches = full.match(/"role"\s*:/g);
-          messageCount = matches ? matches.length : 0;
-        } catch {
-        }
-      }
-      let branchCount;
-      let activeBranch;
-      try {
-        const brMatch = header.match(/"branches"\s*:\s*\[/);
-        if (brMatch) {
-          const brIds = header.match(/"id"\s*:\s*"[^"]*"/g);
-          const parentMatches = header.match(/"parentBranchId"/g);
-          branchCount = parentMatches ? parentMatches.length + 1 : 1;
-        }
-        activeBranch = extractJsonField(header, "activeBranchId");
-      } catch {
-      }
-      return {
-        id,
-        provider,
-        model,
-        messageCount,
-        created: safeDate(created),
-        updated: safeDate(updated),
-        title: title || void 0,
-        branchCount,
-        activeBranch
-      };
-    }
-    const data = JSON.parse(readFileSync3(filePath, "utf-8"));
-    return {
-      id: data.id,
-      provider: data.provider,
-      model: data.model,
-      messageCount: data.messages?.length ?? 0,
-      created: safeDate(data.created),
-      updated: safeDate(data.updated),
-      title: data.title,
-      branchCount: data.branches?.length ?? 1,
-      activeBranch: data.activeBranchId
-    };
-  }
   deleteSession(id) {
     const filePath = join3(this.historyDir, `${id}.json`);
     if (!existsSync3(filePath)) return false;
@@ -4674,6 +4611,10 @@ var SessionManager = class {
       if (this._current && this._current.id === id) {
         this._current = null;
       }
+      try {
+        removeSessionFromIndex(this.historyDir, id);
+      } catch {
+      }
       return true;
     } catch {
       return false;
@@ -4707,9 +4648,15 @@ var SessionManager = class {
   searchMessages(query, maxResults = 20) {
     if (!existsSync3(this.historyDir)) return [];
     const q = query.toLowerCase();
-    const files = readdirSync(this.historyDir).filter((f) => f.endsWith(".json")).map((f) => join3(this.historyDir, f));
+    const candidateIds = searchCandidates(this.historyDir, q);
+    let filesToSearch;
+    if (candidateIds !== null) {
+      filesToSearch = candidateIds.map((id) => join3(this.historyDir, `${id}.json`)).filter((fp) => existsSync3(fp));
+    } else {
+      filesToSearch = readdirSync(this.historyDir).filter((f) => f.endsWith(".json")).map((f) => join3(this.historyDir, f));
+    }
     const results = [];
-    for (const filePath of files) {
+    for (const filePath of filesToSearch) {
       if (results.length >= maxResults) break;
       try {
         const data = JSON.parse(readFileSync3(filePath, "utf-8"));
@@ -5990,11 +5937,11 @@ ${content}`;
 
 // src/tools/builtin/write-file.ts
 import { appendFileSync, mkdirSync as mkdirSync6 } from "fs";
-import { dirname as dirname4 } from "path";
+import { dirname as dirname5 } from "path";
 
 // src/tools/executor.ts
 import chalk3 from "chalk";
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
 import { tmpdir } from "os";
 
 // src/core/readline-internal.ts
@@ -6363,7 +6310,8 @@ function runHook(template, vars) {
 }
 
 // src/tools/permissions.ts
-import { isAbsolute, resolve as resolve3 } from "path";
+import { existsSync as existsSync8, realpathSync } from "fs";
+import { basename as basename2, dirname as dirname3, isAbsolute, resolve as resolve3 } from "path";
 function checkPermission(toolName, args, dangerLevel, rules, defaultAction = "confirm") {
   for (const rule of rules) {
     if (rule.tool !== "*" && rule.tool !== toolName) continue;
@@ -6408,10 +6356,28 @@ var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
 function normalizePathForPermission(value) {
   return value.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
 }
+function canonicalizeWithNearestParent(value) {
+  const missing = [];
+  let cursor = resolve3(value);
+  while (!existsSync8(cursor)) {
+    const parent = dirname3(cursor);
+    if (parent === cursor) return null;
+    missing.unshift(basename2(cursor));
+    cursor = parent;
+  }
+  try {
+    return resolve3(realpathSync(cursor), ...missing);
+  } catch {
+    return null;
+  }
+}
 function isInsidePath(root, target) {
   const absoluteTarget = isAbsolute(target) ? target : resolve3(root, target);
-  const r = normalizePathForPermission(resolve3(root));
-  const t = normalizePathForPermission(absoluteTarget);
+  const canonicalRoot = canonicalizeWithNearestParent(root);
+  const canonicalTarget = canonicalizeWithNearestParent(absoluteTarget);
+  if (!canonicalRoot || !canonicalTarget) return false;
+  const r = normalizePathForPermission(canonicalRoot);
+  const t = normalizePathForPermission(canonicalTarget);
   return t === r || t.startsWith(`${r}/`);
 }
 function extractPathArg(toolName, args) {
@@ -6463,19 +6429,31 @@ function profileHardDecision(profileName, toolName, args, dangerLevel, ctx) {
     return null;
   }
   if (profileName === "workspace-write") {
-    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools always require confirmation", profileName };
+    if (dangerLevel === "destructive") {
+      return { action: "confirm", reason: "destructive tools always require confirmation", profileName, hardBoundary: true };
+    }
     if (dangerLevel === "write" && isExplicitFileWriteTool(toolName)) {
       const target = extractPathArg(toolName, args);
-      if (!target) return { action: "confirm", reason: "file write target is not explicit", profileName };
+      if (!target) {
+        return { action: "confirm", reason: "file write target is not explicit", profileName, hardBoundary: true };
+      }
       const allowedRoots = getAllowedWriteRoots(ctx);
       if (allowedRoots.length === 0 || !allowedRoots.some((root) => isInsidePath(root, target))) {
-        return { action: "deny", reason: "file write target is outside workspace/temp roots", profileName };
+        return { action: "deny", reason: "file write target is outside workspace/temp roots", profileName, hardBoundary: true };
       }
     }
+    if (toolName === "bash" || toolName === "run_interactive" || toolName === "task_create") {
+      return {
+        action: "confirm",
+        reason: "shell/process writes cannot be proven to stay inside workspace/temp roots",
+        profileName,
+        hardBoundary: true
+      };
+    }
     return null;
   }
   if (profileName === "danger-full-access") {
-    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools still require confirmation", profileName };
+    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools still require confirmation", profileName, hardBoundary: true };
     return null;
   }
   return null;
@@ -6487,7 +6465,8 @@ function checkPermissionWithProfile(toolName, args, dangerLevel, rules, defaultA
   const combinedRules = [...getProfileRules(profileContext), ...rules];
   const profileDefault = profileName === "legacy" ? defaultAction : getProfileDefaultAction(profileName, profileContext);
   const action = checkPermission(toolName, args, dangerLevel, combinedRules, profileDefault);
-  if (hard?.action === "confirm" && action === "auto-approve") return hard;
+  if (action === "deny") return { action, profileName };
+  if (hard?.action === "confirm") return hard;
   return { action, profileName };
 }
 function formatPermissionProfileWarning(profileName) {
@@ -6745,8 +6724,8 @@ var theme = new Proxy(DARK_THEME, {
 });
 
 // src/diagnostics/tool-stats.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7, mkdirSync as mkdirSync5 } from "fs";
-import { join as join5, dirname as dirname3 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7, mkdirSync as mkdirSync5 } from "fs";
+import { join as join5, dirname as dirname4 } from "path";
 import { homedir as homedir3 } from "os";
 var STATS_FILE_NAME = "tool-stats.json";
 var STATS_VERSION = 1;
@@ -6761,7 +6740,7 @@ function statsFilePath() {
 }
 function load() {
   const path3 = statsFilePath();
-  if (!existsSync8(path3)) {
+  if (!existsSync9(path3)) {
     return { version: STATS_VERSION, startedAt: (/* @__PURE__ */ new Date()).toISOString(), entries: {} };
   }
   try {
@@ -6823,7 +6802,7 @@ function flush() {
   if (!dirty || state === null) return;
   const path3 = statsFilePath();
   try {
-    mkdirSync5(dirname3(path3), { recursive: true });
+    mkdirSync5(dirname4(path3), { recursive: true });
     atomicWriteFileSync(path3, JSON.stringify(state, null, 2));
     dirty = false;
     pendingWrites = 0;
@@ -6847,7 +6826,7 @@ function getTopUsedTools(limit = 5) {
 }
 
 // src/tools/action-classifier.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
 import { isAbsolute as isAbsolute2, join as join6, resolve as resolve4 } from "path";
 var RECENT_DENIED_LIMIT = 50;
 var recentlyDenied = [];
@@ -6890,7 +6869,7 @@ function splitShellWords(command) {
 }
 function readPackageManifest(root) {
   const p = join6(root, "package.json");
-  if (!existsSync9(p)) return null;
+  if (!existsSync10(p)) return null;
   try {
     return JSON.parse(readFileSync8(p, "utf-8"));
   } catch {
@@ -6909,7 +6888,7 @@ function manifestHasDependency(root, name) {
 function lockfileMentions(root, name) {
   for (const file of ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"]) {
     const p = join6(root, file);
-    if (!existsSync9(p)) continue;
+    if (!existsSync10(p)) continue;
     try {
       if (readFileSync8(p, "utf-8").includes(name)) return true;
     } catch {
@@ -7185,14 +7164,15 @@ var ToolExecutor = class {
         return { callId: call.id, content: message, isError: true };
       }
     }
-    if (networkPermission?.action === "confirm" && dangerLevel === "safe") {
+    const requiresHardConfirmation = permission.action === "confirm" && permission.hardBoundary === true;
+    if ((networkPermission?.action === "confirm" || requiresHardConfirmation) && dangerLevel === "safe") {
       this.printToolCall(call);
       toolCallAlreadyPrinted = true;
       const confirmed = await this.confirm(call, "write");
       if (!confirmed) {
         return {
           callId: call.id,
-          content: `[User cancelled] The user declined network access for ${call.name}. Do not retry without asking.`,
+          content: `[User cancelled] The user declined permission for ${call.name}. Do not retry without asking.`,
           isError: true
         };
       }
@@ -7210,7 +7190,7 @@ var ToolExecutor = class {
           isError: true
         };
       }
-      if (classification.decision === "auto-approve") {
+      if (classification.decision === "auto-approve" && !requiresHardConfirmation) {
         this.printToolCall(call);
         if (dangerLevel === "write") this.printDiffPreview(call);
         console.log(theme.warning(`  \u26A1 Auto-approved (/auto: ${classification.ruleId})`));
@@ -7231,7 +7211,7 @@ var ToolExecutor = class {
         }
       }
     }
-    if (this.sessionAutoApprove && dangerLevel === "write") {
+    if (this.sessionAutoApprove && dangerLevel === "write" && !requiresHardConfirmation) {
       this.printToolCall(call);
       if (dangerLevel === "write") this.printDiffPreview(call);
       console.log(theme.warning("  \u26A1 Auto-approved (session /yolo mode)"));
@@ -7475,7 +7455,7 @@ var ToolExecutor = class {
       const filePath = String(call.arguments["path"] ?? "");
       const newContent = String(call.arguments["content"] ?? "");
       if (!filePath) return;
-      if (existsSync10(filePath)) {
+      if (existsSync11(filePath)) {
         let oldContent;
         try {
           oldContent = readFileSync9(filePath, "utf-8");
@@ -7501,7 +7481,7 @@ var ToolExecutor = class {
       }
     } else if (call.name === "edit_file") {
       const filePath = String(call.arguments["path"] ?? "");
-      if (!filePath || !existsSync10(filePath)) return;
+      if (!filePath || !existsSync11(filePath)) return;
       const oldStr = call.arguments["old_str"];
       const newStr = call.arguments["new_str"];
       if (oldStr !== void 0) {
@@ -7620,7 +7600,7 @@ var ToolExecutor = class {
 };
 
 // src/tools/sensitive-paths.ts
-import { resolve as resolve5, sep as sep2, basename as basename2 } from "path";
+import { resolve as resolve5, sep as sep2, basename as basename3 } from "path";
 import { homedir as homedir4 } from "os";
 var home = homedir4();
 function norm(p) {
@@ -7639,7 +7619,7 @@ function homeRel(p) {
 function classifyWritePath(path3) {
   if (!path3) return { sensitive: false };
   const abs = norm(path3);
-  const base = basename2(abs);
+  const base = basename3(abs);
   const rel = homeRel(path3);
   if (rel) {
     const shellRc = /* @__PURE__ */ new Set([
@@ -7763,7 +7743,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
     }
     undoStack.push(filePath, `write_file${appendMode ? " (append)" : ""}: ${filePath}`);
     fileCheckpoints.snapshot(filePath, ToolExecutor.currentMessageIndex);
-    mkdirSync6(dirname4(filePath), { recursive: true });
+    mkdirSync6(dirname5(filePath), { recursive: true });
     if (appendMode) {
       appendFileSync(filePath, content, encoding);
     } else {
@@ -7783,7 +7763,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
 };
 
 // src/tools/builtin/edit-file.ts
-import { readFileSync as readFileSync10, existsSync as existsSync11 } from "fs";
+import { readFileSync as readFileSync10, existsSync as existsSync12 } from "fs";
 
 // src/tools/builtin/patch-apply.ts
 function parseUnifiedDiff(patch) {
@@ -8144,7 +8124,7 @@ Note: Path can be absolute or relative to cwd.`,
     const filePath = String(args["path"] ?? args["file"] ?? "");
     const encoding = args["encoding"] ?? "utf-8";
     if (!filePath) throw new ToolError("edit_file", "path is required");
-    if (!existsSync11(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
+    if (!existsSync12(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
     const verdict = classifyWritePath(filePath);
     if (verdict.sensitive && subAgentGuard.active) {
       throw new ToolError(
@@ -8310,8 +8290,8 @@ function truncatePreview(str, maxLen = 80) {
 }
 
 // src/tools/builtin/list-dir.ts
-import { readdirSync as readdirSync4, statSync as statSync4, existsSync as existsSync12 } from "fs";
-import { join as join7, basename as basename3 } from "path";
+import { readdirSync as readdirSync4, statSync as statSync4, existsSync as existsSync13 } from "fs";
+import { join as join7, basename as basename4 } from "path";
 var listDirTool = {
   definition: {
     name: "list_dir",
@@ -8333,8 +8313,8 @@ var listDirTool = {
   async execute(args) {
     const dirPath = String(args["path"] ?? process.cwd());
     const recursive = Boolean(args["recursive"] ?? false);
-    if (!existsSync12(dirPath)) {
-      const targetName = basename3(dirPath).toLowerCase();
+    if (!existsSync13(dirPath)) {
+      const targetName = basename4(dirPath).toLowerCase();
       const cwd = process.cwd();
       const suggestions = [];
       try {
@@ -8411,7 +8391,7 @@ function formatSize(bytes) {
 }
 
 // src/tools/builtin/grep-files.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync5, existsSync as existsSync13 } from "fs";
+import { readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync5, existsSync as existsSync14 } from "fs";
 import { readFile } from "fs/promises";
 import { join as join8, relative } from "path";
 var grepFilesTool = {
@@ -8464,7 +8444,7 @@ Supports regex. Automatically skips node_modules, dist, .git directories.`,
     const contextLines = Math.max(0, Number(args["context_lines"] ?? 0));
     const maxResults = Math.max(1, Number(args["max_results"] ?? 50));
     if (!pattern) throw new ToolError("grep_files", "pattern is required");
-    if (!existsSync13(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
+    if (!existsSync14(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
     const MAX_PATTERN_LENGTH = 1e3;
     if (pattern.length > MAX_PATTERN_LENGTH) {
       throw new ToolError("grep_files", `Pattern too long (${pattern.length} chars, max ${MAX_PATTERN_LENGTH}). Use a shorter pattern.`);
@@ -8648,8 +8628,8 @@ function searchInFile(fullPath, displayPath2, regex, contextLines, maxResults, r
 }
 
 // src/tools/builtin/glob-files.ts
-import { readdirSync as readdirSync6, statSync as statSync6, existsSync as existsSync14 } from "fs";
-import { join as join9, relative as relative2, basename as basename4 } from "path";
+import { readdirSync as readdirSync6, statSync as statSync6, existsSync as existsSync15 } from "fs";
+import { join as join9, relative as relative2, basename as basename5 } from "path";
 var globFilesTool = {
   definition: {
     name: "glob_files",
@@ -8682,7 +8662,7 @@ Results sorted by most recent modification time. Automatically skips node_module
     const rootPath = String(args["path"] ?? process.cwd());
     const maxResults = Math.max(1, Number(args["max_results"] ?? 100));
     if (!pattern) throw new ToolError("glob_files", "pattern is required");
-    if (!existsSync14(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
+    if (!existsSync15(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
     const regex = globToRegex(pattern);
     const matches = [];
     collectMatchingFiles(rootPath, rootPath, regex, matches, maxResults);
@@ -8765,7 +8745,7 @@ function collectMatchingFiles(dirPath, rootPath, regex, results, maxResults) {
       collectMatchingFiles(fullPath, rootPath, regex, results, maxResults);
     } else if (entry.isFile()) {
       const relPath = relative2(rootPath, fullPath).replace(/\\/g, "/");
-      if (regex.test(relPath) || regex.test(basename4(relPath))) {
+      if (regex.test(relPath) || regex.test(basename5(relPath))) {
         try {
           const stat = statSync6(fullPath);
           results.push({ relPath, absPath: fullPath, mtime: stat.mtimeMs });
@@ -9500,7 +9480,7 @@ ${preamble}`;
 
 // src/tools/builtin/save-last-response.ts
 import { mkdirSync as mkdirSync7, unlinkSync as unlinkSync4, rmdirSync as rmdirSync2 } from "fs";
-import { dirname as dirname5 } from "path";
+import { dirname as dirname6 } from "path";
 var lastResponseStore = { content: "" };
 function cleanupRejectedTeeFile(filePath) {
   try {
@@ -9508,7 +9488,7 @@ function cleanupRejectedTeeFile(filePath) {
   } catch {
   }
   try {
-    rmdirSync2(dirname5(filePath));
+    rmdirSync2(dirname6(filePath));
   } catch {
   }
 }
@@ -9549,7 +9529,7 @@ Any of these triggers means use save_last_response, NOT write_file:
       throw new ToolError("save_last_response", "No content to save: AI has not produced any response yet, or the last response was empty.");
     }
     undoStack.push(filePath, `save_last_response: ${filePath}`);
-    mkdirSync7(dirname5(filePath), { recursive: true });
+    mkdirSync7(dirname6(filePath), { recursive: true });
     atomicWriteFileSync(filePath, content);
     const lines = content.split("\n").length;
     return `File saved: ${filePath} (${lines} lines, ${content.length} bytes)`;
@@ -9561,13 +9541,13 @@ import { join as join12 } from "path";
 import { homedir as homedir5 } from "os";
 
 // src/memory/persistent-memory.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync12 } from "fs";
 import { randomUUID, createHash as createHash2 } from "crypto";
-import { dirname as dirname6, join as join11, resolve as resolve6 } from "path";
+import { dirname as dirname7, join as join11, resolve as resolve6 } from "path";
 
 // src/tools/git-context.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { join as join10 } from "path";
 function runGit(cmd, cwd) {
   try {
@@ -9585,7 +9565,7 @@ function getGitRoot(cwd = process.cwd()) {
   return runGit("rev-parse --show-toplevel", cwd);
 }
 function getGitContext(cwd = process.cwd()) {
-  if (!existsSync15(join10(cwd, ".git"))) {
+  if (!existsSync16(join10(cwd, ".git"))) {
     const result = runGit("rev-parse --git-dir", cwd);
     if (!result) return null;
   }
@@ -9696,7 +9676,7 @@ function normalizeEntry(value) {
 }
 function legacyEntriesFromMarkdown(configDir) {
   const file = memoryMarkdownPath(configDir);
-  if (!existsSync16(file)) return [];
+  if (!existsSync17(file)) return [];
   const content = readFileSync12(file, "utf-8").trim();
   if (!content) return [];
   const parts = content.split(/\n(?=##\s+\d{4}-\d{2}-\d{2})/g);
@@ -9713,7 +9693,7 @@ ${chunk}`).digest("hex").slice(0, 12);
 }
 function loadMemoryEntries(configDir) {
   const file = memoryStorePath(configDir);
-  if (!existsSync16(file)) return legacyEntriesFromMarkdown(configDir);
+  if (!existsSync17(file)) return legacyEntriesFromMarkdown(configDir);
   const text = readFileSync12(file, "utf-8").trim();
   if (!text) return [];
   const entries = [];
@@ -10161,13 +10141,13 @@ function formatResults2(query, data, _requested) {
 }
 
 // src/agents/agent-config.ts
-import { existsSync as existsSync18, readdirSync as readdirSync8, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync19, readdirSync as readdirSync8, readFileSync as readFileSync14 } from "fs";
 import { join as join14 } from "path";
 import { homedir as homedir6 } from "os";
 
 // src/plugins/plugin-manager.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync13, cpSync, rmSync, statSync as statSync7 } from "fs";
-import { basename as basename5, dirname as dirname7, join as join13, resolve as resolve7 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync13, cpSync, rmSync, statSync as statSync7 } from "fs";
+import { basename as basename6, dirname as dirname8, join as join13, resolve as resolve7 } from "path";
 import { createHash as createHash3 } from "crypto";
 import { z as z2 } from "zod";
 var MANIFEST_RELATIVE = ".aicli-plugin/plugin.json";
@@ -10237,7 +10217,7 @@ function statePath(configDir) {
 }
 function loadState(configDir) {
   const file = statePath(configDir);
-  if (!existsSync17(file)) return { version: 1, plugins: [] };
+  if (!existsSync18(file)) return { version: 1, plugins: [] };
   try {
     const parsed = JSON.parse(readFileSync13(file, "utf-8"));
     return { version: 1, plugins: Array.isArray(parsed.plugins) ? parsed.plugins : [] };
@@ -10257,10 +10237,10 @@ function readPluginManifest(manifestPath) {
 }
 function findPluginSourceDir(inputPath) {
   const abs = resolve7(inputPath);
-  const direct = statSync7(abs).isDirectory() ? abs : dirname7(abs);
-  if (existsSync17(pluginManifestPath(direct))) return direct;
+  const direct = statSync7(abs).isDirectory() ? abs : dirname8(abs);
+  if (existsSync18(pluginManifestPath(direct))) return direct;
   const nested = join13(direct, ".aicli-plugin");
-  if (existsSync17(join13(nested, "plugin.json"))) return direct;
+  if (existsSync18(join13(nested, "plugin.json"))) return direct;
   throw new Error(`plugin manifest not found: ${MANIFEST_RELATIVE}`);
 }
 function installPlugin(configDir, inputPath) {
@@ -10268,7 +10248,7 @@ function installPlugin(configDir, inputPath) {
   const manifest = readPluginManifest(pluginManifestPath(sourceDir));
   const targetDir = join13(pluginRoot(configDir), manifest.name);
   mkdirSync9(pluginRoot(configDir), { recursive: true });
-  if (existsSync17(targetDir)) rmSync(targetDir, { recursive: true, force: true });
+  if (existsSync18(targetDir)) rmSync(targetDir, { recursive: true, force: true });
   cpSync(sourceDir, targetDir, { recursive: true });
   const manifestPath = pluginManifestPath(targetDir);
   const hash = hashPluginManifest(manifestPath);
@@ -10326,7 +10306,7 @@ function getInstalledPlugin(configDir, name) {
 }
 function listInstalledPlugins(configDir) {
   const root = pluginRoot(configDir);
-  if (!existsSync17(root)) return [];
+  if (!existsSync18(root)) return [];
   const state2 = loadState(configDir);
   const out = [];
   for (const entry of readdirSync7(root)) {
@@ -10337,7 +10317,7 @@ function listInstalledPlugins(configDir) {
       continue;
     }
     const manifestPath = pluginManifestPath(dir);
-    if (!existsSync17(manifestPath)) continue;
+    if (!existsSync18(manifestPath)) continue;
     try {
       const manifest = readPluginManifest(manifestPath);
       const hash = hashPluginManifest(manifestPath);
@@ -10377,7 +10357,7 @@ function uniqueDirs(plugin, rels) {
   for (const rel of rels) {
     const abs = resolve7(plugin.dir, rel);
     if (!abs.startsWith(resolve7(plugin.dir))) continue;
-    if (existsSync17(abs)) dirs.add(statSync7(abs).isDirectory() ? abs : dirname7(abs));
+    if (existsSync18(abs)) dirs.add(statSync7(abs).isDirectory() ? abs : dirname8(abs));
   }
   return [...dirs];
 }
@@ -10540,7 +10520,7 @@ function parseAgentConfig(raw, source, path3) {
   return cfg;
 }
 function loadAgentDir(dir, source) {
-  if (!existsSync18(dir)) return [];
+  if (!existsSync19(dir)) return [];
   const out = [];
   for (const file of readdirSync8(dir)) {
     if (!file.endsWith(".json")) continue;
@@ -11272,13 +11252,13 @@ var taskStopTool = {
 
 // src/tools/builtin/git-tools.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync19 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 import { join as join15 } from "path";
 function assertGitRepo(cwd) {
   let dir = cwd;
   const root = dir.split(/[\\/]/)[0] + (dir.includes("\\") ? "\\" : "/");
   while (dir && dir !== root) {
-    if (existsSync19(join15(dir, ".git"))) return;
+    if (existsSync20(join15(dir, ".git"))) return;
     const parent = join15(dir, "..");
     if (parent === dir) break;
     dir = parent;
@@ -11544,7 +11524,7 @@ ${commitOutput.trim()}`;
 };
 
 // src/tools/builtin/notebook-edit.ts
-import { readFileSync as readFileSync15, existsSync as existsSync20 } from "fs";
+import { readFileSync as readFileSync15, existsSync as existsSync21 } from "fs";
 import { writeFile } from "fs/promises";
 import { resolve as resolve8, extname as extname2 } from "path";
 var notebookEditTool = {
@@ -11599,7 +11579,7 @@ var notebookEditTool = {
     if (extname2(absPath).toLowerCase() !== ".ipynb") {
       throw new ToolError("notebook_edit", "path must point to a .ipynb file");
     }
-    if (!existsSync20(absPath)) {
+    if (!existsSync21(absPath)) {
       throw new ToolError("notebook_edit", `Notebook not found: ${filePath}`);
     }
     const raw = readFileSync15(absPath, "utf-8");
@@ -12019,7 +11999,7 @@ function estimateToolDefinitionTokens(def) {
 
 // src/tools/registry.ts
 import { pathToFileURL } from "url";
-import { existsSync as existsSync21, mkdirSync as mkdirSync10, readdirSync as readdirSync9 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync10, readdirSync as readdirSync9 } from "fs";
 import { join as join16 } from "path";
 var ToolRegistry = class {
   tools = /* @__PURE__ */ new Map();
@@ -12181,7 +12161,7 @@ var ToolRegistry = class {
    * Returns the number of successfully loaded plugins.
    */
   async loadPlugins(pluginsDir, allowPlugins = false) {
-    if (!existsSync21(pluginsDir)) {
+    if (!existsSync22(pluginsDir)) {
       try {
         mkdirSync10(pluginsDir, { recursive: true });
       } catch {
@@ -12758,12 +12738,12 @@ var McpManager = class {
 };
 
 // src/skills/manager.ts
-import { existsSync as existsSync22, readdirSync as readdirSync10, mkdirSync as mkdirSync11, statSync as statSync8 } from "fs";
+import { existsSync as existsSync23, readdirSync as readdirSync10, mkdirSync as mkdirSync11, statSync as statSync8 } from "fs";
 import { join as join17 } from "path";
 
 // src/skills/types.ts
 import { readFileSync as readFileSync16 } from "fs";
-import { basename as basename6 } from "path";
+import { basename as basename7 } from "path";
 function parseSimpleYaml(yaml) {
   const result = {};
   for (const line of yaml.split("\n")) {
@@ -12792,7 +12772,7 @@ function parseSkillFile(filePath) {
   if (!frontmatterMatch) {
     return {
       meta: {
-        name: basename6(filePath, ".md"),
+        name: basename7(filePath, ".md"),
         description: ""
       },
       content: raw.trim(),
@@ -12803,7 +12783,7 @@ function parseSkillFile(filePath) {
   const parsed = parseSimpleYaml(yaml);
   return {
     meta: {
-      name: parsed["name"] ?? basename6(filePath, ".md"),
+      name: parsed["name"] ?? basename7(filePath, ".md"),
       description: parsed["description"] ?? "",
       tools: parsed["tools"] ? parseYamlArray(parsed["tools"]) : void 0
     },
@@ -12832,7 +12812,7 @@ var SkillManager = class {
     return this.skills.size;
   }
   loadSkillDir(dir, createIfMissing) {
-    if (!existsSync22(dir)) {
+    if (!existsSync23(dir)) {
       if (createIfMissing) {
         try {
           mkdirSync11(dir, { recursive: true });
@@ -12856,7 +12836,7 @@ var SkillManager = class {
         try {
           if (statSync8(fullPath).isDirectory()) {
             const skillMd = join17(fullPath, "SKILL.md");
-            if (existsSync22(skillMd)) filePath = skillMd;
+            if (existsSync23(skillMd)) filePath = skillMd;
             else continue;
           } else {
             continue;
@@ -12915,7 +12895,7 @@ var SkillManager = class {
 // src/web/tool-executor-web.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { tmpdir as tmpdir2 } from "os";
-import { existsSync as existsSync23, readFileSync as readFileSync17 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync17 } from "fs";
 var ToolExecutorWeb = class _ToolExecutorWeb {
   constructor(registry, ws) {
     this.registry = registry;
@@ -13054,7 +13034,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
     if (call.name === "write_file") {
       const filePath = String(call.arguments["path"] ?? "");
       const newContent = String(call.arguments["content"] ?? "");
-      if (filePath && existsSync23(filePath)) {
+      if (filePath && existsSync24(filePath)) {
         try {
           const old = readFileSync17(filePath, "utf-8");
           return renderDiff(old, newContent, { filePath });
@@ -13212,12 +13192,13 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
         return { callId: call.id, content: message, isError: true };
       }
     }
-    if (networkPermission?.action === "confirm" && dangerLevel === "safe") {
+    const requiresHardConfirmation = permission.action === "confirm" && permission.hardBoundary === true;
+    if ((networkPermission?.action === "confirm" || requiresHardConfirmation) && dangerLevel === "safe") {
       this.sendToolCallStart(call);
       toolCallStarted = true;
       const confirmed = await this.confirm(call, "write");
       if (!confirmed) {
-        const rejectionMsg = `[User cancelled] The user declined network access for ${call.name}. Do not retry without asking.`;
+        const rejectionMsg = `[User cancelled] The user declined permission for ${call.name}. Do not retry without asking.`;
         this.sendToolCallResult(call, rejectionMsg, true);
         return { callId: call.id, content: rejectionMsg, isError: true };
       }
@@ -13234,7 +13215,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
         this.sendToolCallResult(call, rejectionMsg, true);
         return { callId: call.id, content: rejectionMsg, isError: true };
       }
-      if (classification.decision === "auto-approve") {
+      if (classification.decision === "auto-approve" && !requiresHardConfirmation) {
         this.send({ type: "info", message: `\u26A1 Auto-approved (/auto: ${classification.ruleId})` });
         try {
           const rawContent = await runTool(tool, call.arguments, call.name);
@@ -13252,7 +13233,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
         }
       }
     }
-    if (this.sessionAutoApprove && dangerLevel === "write") {
+    if (this.sessionAutoApprove && dangerLevel === "write" && !requiresHardConfirmation) {
       try {
         const rawContent = await runTool(tool, call.arguments, call.name);
         const content = truncateOutput(rawContent, call.name);
@@ -13359,7 +13340,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
 };
 
 // src/repl/dev-state.ts
-import { existsSync as existsSync24, readFileSync as readFileSync18, unlinkSync as unlinkSync5, mkdirSync as mkdirSync12 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync18, unlinkSync as unlinkSync5, mkdirSync as mkdirSync12 } from "fs";
 import { join as join18 } from "path";
 import { homedir as homedir7 } from "os";
 function getDevStatePath() {
@@ -13367,7 +13348,7 @@ function getDevStatePath() {
 }
 function loadDevState() {
   const path3 = getDevStatePath();
-  if (!existsSync24(path3)) return null;
+  if (!existsSync25(path3)) return null;
   const content = readFileSync18(path3, "utf-8").trim();
   return content || null;
 }
@@ -13625,7 +13606,7 @@ function autoTrimSessionIfNeeded(session, sizeLimit = SESSION_SIZE_LIMIT) {
 }
 
 // src/core/context-files.ts
-import { existsSync as existsSync25, readFileSync as readFileSync19 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync19 } from "fs";
 import { join as join19, relative as relative3, resolve as resolve9 } from "path";
 function uniqueNonEmpty(values) {
   const seen = /* @__PURE__ */ new Set();
@@ -13704,7 +13685,7 @@ function findFirstContextFile(level, dir, cwd, candidates, maxBytes) {
   const skipped = [];
   for (const candidate of candidates) {
     const filePath = join19(dir, candidate);
-    if (!existsSync25(filePath)) continue;
+    if (!existsSync26(filePath)) continue;
     const result = readContextFile(level, filePath, cwd, maxBytes);
     if (result.skipped) skipped.push(result.skipped);
     if (result.layer) return { layer: result.layer, skipped };
@@ -13731,7 +13712,7 @@ function loadContextFiles(options) {
       });
       return { layers: [], mergedContent: "", skipped, totalChars: 0, totalBytes: 0, maxBytes, candidates };
     }
-    if (!existsSync25(filePath)) {
+    if (!existsSync26(filePath)) {
       skipped.push({
         level: "single",
         filePath,
@@ -13783,10 +13764,10 @@ function loadContextFiles(options) {
 
 // src/web/session-handler.ts
 import { mkdirSync as mkdirSync16, createWriteStream as createWriteStream3 } from "fs";
-import { join as join26, dirname as dirname10 } from "path";
+import { join as join26, dirname as dirname11 } from "path";
 
 // src/repl/commands/project-init.ts
-import { existsSync as existsSync26, readFileSync as readFileSync20, readdirSync as readdirSync11, statSync as statSync9 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync20, readdirSync as readdirSync11, statSync as statSync9 } from "fs";
 import { join as join20 } from "path";
 var SCAN_SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
@@ -13870,7 +13851,7 @@ function scanProject(cwd) {
     configFiles: [],
     directoryStructure: ""
   };
-  const check = (file) => existsSync26(join20(cwd, file));
+  const check = (file) => existsSync27(join20(cwd, file));
   const configCandidates = [
     "package.json",
     "tsconfig.json",
@@ -14672,8 +14653,8 @@ async function handlePlan(args, ctx) {
 }
 
 // src/web/commands/_shared.ts
-import { existsSync as existsSync29, readFileSync as readFileSync22, writeFileSync as writeFileSync3, mkdirSync as mkdirSync14, readdirSync as readdirSync13, statSync as statSync12, createWriteStream } from "fs";
-import { join as join24, resolve as resolve10, dirname as dirname8 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync22, writeFileSync as writeFileSync3, mkdirSync as mkdirSync14, readdirSync as readdirSync13, statSync as statSync12, createWriteStream } from "fs";
+import { join as join24, resolve as resolve10, dirname as dirname9 } from "path";
 
 // src/cli/review-prompts.ts
 function buildReviewPrompt(diff, gitContextStr, detailed) {
@@ -14745,13 +14726,13 @@ function readGitDiff(options = {}) {
 }
 
 // src/diagnostics/doctor-report.ts
-import { existsSync as existsSync28, statSync as statSync11 } from "fs";
+import { existsSync as existsSync29, statSync as statSync11 } from "fs";
 import { join as join23 } from "path";
 import { arch as arch2, platform as platform7, release as release2 } from "os";
 
 // src/diagnostics/crash-log.ts
 import {
-  existsSync as existsSync27,
+  existsSync as existsSync28,
   mkdirSync as mkdirSync13,
   readdirSync as readdirSync12,
   readFileSync as readFileSync21,
@@ -14772,7 +14753,7 @@ function truncate(s, n) {
 }
 function listRecentCrashes(limit = 10, configDir) {
   const dir = getLogsDir(configDir);
-  if (!existsSync27(dir)) return [];
+  if (!existsSync28(dir)) return [];
   const files = [];
   let names;
   try {
@@ -14805,7 +14786,7 @@ function listRecentCrashes(limit = 10, configDir) {
 }
 function getConfigDirUsage(configDir) {
   const base = configDir ?? join22(homedir8(), CONFIG_DIR_NAME);
-  if (!existsSync27(base)) return { totalBytes: 0, entries: [] };
+  if (!existsSync28(base)) return { totalBytes: 0, entries: [] };
   const entries = [];
   let total = 0;
   let names;
@@ -14840,7 +14821,7 @@ function dirSize(path3) {
 
 // src/diagnostics/doctor-report.ts
 function checkFile(label, path3) {
-  const exists = existsSync28(path3);
+  const exists = existsSync29(path3);
   let sizeBytes = null;
   if (exists) {
     try {
@@ -14938,7 +14919,7 @@ function buildDoctorReport(options) {
     mcp: {
       enabled: config.get("mcpEnabled"),
       configured: Object.keys(mcpServers).length,
-      projectConfigExists: existsSync28(join23(projectRoot, MCP_PROJECT_CONFIG_NAME)),
+      projectConfigExists: existsSync29(join23(projectRoot, MCP_PROJECT_CONFIG_NAME)),
       statuses: options.mcpStatuses ?? []
     },
     recentCrashes: listRecentCrashes(5, configDir),
@@ -15808,7 +15789,7 @@ ${activated.meta.description || ""}` });
 async function handleCommands(_args, ctx) {
   const configDir = ctx.config.getConfigDir();
   const commandsDir = join24(configDir, CUSTOM_COMMANDS_DIR_NAME);
-  if (!existsSync29(commandsDir)) {
+  if (!existsSync30(commandsDir)) {
     ctx.send({ type: "info", message: `No custom commands directory.
 Create: ${commandsDir}/ with .md files.` });
     return;
@@ -15908,7 +15889,7 @@ async function handleSecurityReview(args, ctx) {
 async function handleTest(args, ctx) {
   ctx.send({ type: "info", message: "\u{1F9EA} Running tests..." });
   try {
-    const { executeTests } = await import("./run-tests-NNXBS4EL.js");
+    const { executeTests } = await import("./run-tests-YSRET52H.js");
     const argStr = args.join(" ").trim();
     let testArgs = {};
     if (argStr) {
@@ -15938,7 +15919,7 @@ async function handleDiff(args, ctx) {
   let modifiedFiles = 0;
   const diffLines2 = [];
   for (const [filePath, { earliest }] of fileMap) {
-    const currentContent = existsSync29(filePath) ? (() => {
+    const currentContent = existsSync30(filePath) ? (() => {
       try {
         return readFileSync22(filePath, "utf-8");
       } catch {
@@ -15977,7 +15958,7 @@ async function handleInit(args, ctx) {
   const cwd = process.cwd();
   const targetPath = join24(cwd, "AICLI.md");
   const force = args.includes("--force");
-  if (existsSync29(targetPath) && !force) {
+  if (existsSync30(targetPath) && !force) {
     ctx.send({ type: "info", message: `AICLI.md already exists at ${targetPath}
 Use /init --force to overwrite.` });
     return;
@@ -16161,7 +16142,7 @@ Use /add-dir remove to clear.` : "No directories added.\nUsage: /add-dir <path>
     return;
   }
   const dirPath = resolve10(sub);
-  if (!existsSync29(dirPath)) {
+  if (!existsSync30(dirPath)) {
     ctx.send({ type: "error", message: `Directory not found: ${dirPath}` });
     return;
   }
@@ -17236,7 +17217,7 @@ Try: /compact to reduce context, /clear to reset, or switch to a larger-context
           this.send({ type: "response_done", content, usage });
           if (pendingTeeSave && isCleanDocumentBody(content)) {
             try {
-              mkdirSync16(dirname10(pendingTeeSave), { recursive: true });
+              mkdirSync16(dirname11(pendingTeeSave), { recursive: true });
               const bodyToSave = stripOuterCodeFence(content);
               atomicWriteFileSync(pendingTeeSave, bodyToSave);
               undoStack.push(pendingTeeSave, `save_last_response (deferred): ${pendingTeeSave}`);
@@ -17412,7 +17393,7 @@ ${summaryContent}`,
     let isError = false;
     let summary;
     try {
-      mkdirSync16(dirname10(saveToFile), { recursive: true });
+      mkdirSync16(dirname11(saveToFile), { recursive: true });
       fileStream = createWriteStream3(saveToFile);
       const teeSystemPrompt = stripToolCallReminder(systemPrompt ?? "") + CONTENT_ONLY_STREAM_REMINDER;
       const teeExtraMessages = extraMessages.length > 0 ? [...extraMessages, { role: "user", content: TEE_FINAL_USER_NUDGE }] : [{ role: "user", content: TEE_FINAL_USER_NUDGE }];
@@ -17771,7 +17752,7 @@ ${entry.content}`;
       return;
     }
     try {
-      const { searchChatMemory: searchChatMemory2, loadChatIndex: loadChatIndex2 } = await import("./chat-index-WSI7ULRQ.js");
+      const { searchChatMemory: searchChatMemory2, loadChatIndex: loadChatIndex2 } = await import("./chat-index-WYXYD7YP.js");
       const loaded = loadChatIndex2();
       if (!loaded || loaded.idx.chunks.length === 0) {
         this.send({ type: "memory_hits", query: q, hits: [], indexMissing: true });
@@ -17807,7 +17788,7 @@ ${entry.content}`;
   }
   async handleMemoryStatus() {
     try {
-      const { getChatIndexStatus } = await import("./chat-index-WSI7ULRQ.js");
+      const { getChatIndexStatus } = await import("./chat-index-WYXYD7YP.js");
       const s = getChatIndexStatus();
       this.send({
         type: "memory_status",
@@ -17832,7 +17813,7 @@ ${entry.content}`;
         type: "info",
         message: full ? "\u{1F9E0} Rebuilding chat memory index (this may take a while on first run \u2014 ~117 MB embedder)." : "\u{1F9E0} Refreshing chat memory index (incremental)\u2026"
       });
-      const { buildChatIndex } = await import("./chat-index-WSI7ULRQ.js");
+      const { buildChatIndex } = await import("./chat-index-WYXYD7YP.js");
       const stats = await buildChatIndex({
         full,
         onProgress: (p) => {
@@ -17987,8 +17968,8 @@ async function setupProxy(configProxy) {
 }
 
 // src/web/auth.ts
-import { existsSync as existsSync32, readFileSync as readFileSync25, writeFileSync as writeFileSync6, mkdirSync as mkdirSync17, readdirSync as readdirSync16, copyFileSync } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync33, readFileSync as readFileSync25, writeFileSync as writeFileSync6, mkdirSync as mkdirSync17, readdirSync as readdirSync16, copyFileSync } from "fs";
+import { isAbsolute as isAbsolute3, join as join27, relative as relative4 } from "path";
 import { createHmac, randomBytes, timingSafeEqual, pbkdf2Sync } from "crypto";
 var USERS_FILE = "users.json";
 var TOKEN_EXPIRY_HOURS = 24;
@@ -18186,7 +18167,7 @@ var AuthManager = class {
     if (err) return err;
     const userDir = this.getUserDataDir(username);
     const globalConfig = join27(this.baseDir, "config.json");
-    if (existsSync32(globalConfig)) {
+    if (existsSync33(globalConfig)) {
       try {
         const content = readFileSync25(globalConfig, "utf-8");
         writeFileSync6(join27(userDir, "config.json"), content, "utf-8");
@@ -18194,7 +18175,7 @@ var AuthManager = class {
       }
     }
     const globalMemory = join27(this.baseDir, "memory.md");
-    if (existsSync32(globalMemory)) {
+    if (existsSync33(globalMemory)) {
       try {
         const content = readFileSync25(globalMemory, "utf-8");
         writeFileSync6(join27(userDir, "memory.md"), content, "utf-8");
@@ -18202,7 +18183,7 @@ var AuthManager = class {
       }
     }
     const globalHistory = join27(this.baseDir, "history");
-    if (existsSync32(globalHistory)) {
+    if (existsSync33(globalHistory)) {
       try {
         const files = readdirSync16(globalHistory).filter((f) => f.endsWith(".json"));
         const userHistory = join27(userDir, "history");
@@ -18219,10 +18200,19 @@ var AuthManager = class {
   }
   // ── Private methods ────────────────────────────────────────────
   loadOrCreate() {
-    if (existsSync32(this.usersFile)) {
+    if (existsSync33(this.usersFile)) {
       try {
-        return JSON.parse(readFileSync25(this.usersFile, "utf-8"));
-      } catch {
+        const parsed = JSON.parse(readFileSync25(this.usersFile, "utf-8"));
+        if (!this.isValidUsersDB(parsed)) {
+          throw new Error("database structure is invalid");
+        }
+        return parsed;
+      } catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new Error(
+          `Authentication database is unreadable or corrupt: ${this.usersFile} (${detail}). Refusing to start without authentication; restore or remove the file explicitly.`,
+          { cause: err }
+        );
       }
     }
     const db = {
@@ -18233,6 +18223,27 @@ var AuthManager = class {
     this.saveDB(db);
     return db;
   }
+  isValidUsersDB(value) {
+    if (!value || typeof value !== "object") return false;
+    const db = value;
+    if (db.version !== 1 || typeof db.secret !== "string" || db.secret.length < 32 || !Array.isArray(db.users)) {
+      return false;
+    }
+    const usernames = /* @__PURE__ */ new Set();
+    for (const user of db.users) {
+      if (!user || typeof user !== "object") return false;
+      const record = user;
+      if (typeof record.username !== "string" || !/^[a-z0-9_-]{2,32}$/.test(record.username) || usernames.has(record.username) || typeof record.passwordHash !== "string" || record.passwordHash.length === 0 || typeof record.salt !== "string" || record.salt.length === 0 || typeof record.createdAt !== "string" || typeof record.dataDir !== "string" || record.dataDir.length === 0 || isAbsolute3(record.dataDir)) {
+        return false;
+      }
+      const dataDirFromBase = relative4(this.baseDir, join27(this.baseDir, record.dataDir));
+      if (dataDirFromBase.startsWith("..") || isAbsolute3(dataDirFromBase)) return false;
+      if (record.hashVersion !== void 0 && record.hashVersion !== 1 && record.hashVersion !== 2) return false;
+      if (record.tokensRevokedBefore !== void 0 && !Number.isFinite(record.tokensRevokedBefore)) return false;
+      usernames.add(record.username);
+    }
+    return true;
+  }
   save() {
     this.saveDB(this.db);
   }
@@ -18269,7 +18280,7 @@ function getModuleDir() {
     if (typeof import.meta?.url === "string") {
       const url = new URL(import.meta.url);
       const filePath = url.pathname.replace(/^\/([A-Z]:)/i, "$1");
-      return dirname11(filePath);
+      return dirname12(filePath);
     }
   } catch {
   }
@@ -18342,7 +18353,7 @@ async function startWebServer(options = {}) {
   }
   let skillManager = null;
   const skillsDir = join28(config.getConfigDir(), SKILLS_DIR_NAME);
-  if (existsSync33(skillsDir)) {
+  if (existsSync34(skillsDir)) {
     skillManager = new SkillManager(skillsDir, config.get("ui").skillSizeWarn);
     skillManager.loadSkills(pluginAssets.skillDirs);
     const count = skillManager.listSkills().length;
@@ -18414,13 +18425,13 @@ async function startWebServer(options = {}) {
   };
   const moduleDir = getModuleDir();
   let clientDir = join28(moduleDir, "web", "client");
-  if (!existsSync33(clientDir)) {
+  if (!existsSync34(clientDir)) {
     clientDir = join28(moduleDir, "client");
   }
-  if (!existsSync33(clientDir)) {
+  if (!existsSync34(clientDir)) {
     clientDir = join28(moduleDir, "..", "..", "src", "web", "client");
   }
-  if (!existsSync33(clientDir)) {
+  if (!existsSync34(clientDir)) {
     clientDir = join28(process.cwd(), "src", "web", "client");
   }
   console.log(`   Static files: ${clientDir}`);
@@ -18493,8 +18504,8 @@ async function startWebServer(options = {}) {
     const prefix = req.query.prefix || "";
     const targetDir = join28(cwd, prefix);
     try {
-      const canonicalTarget = realpathSync(resolve13(targetDir));
-      const canonicalCwd = realpathSync(resolve13(cwd));
+      const canonicalTarget = realpathSync2(resolve13(targetDir));
+      const canonicalCwd = realpathSync2(resolve13(cwd));
       if (!canonicalTarget.startsWith(canonicalCwd + sep3) && canonicalTarget !== canonicalCwd) {
         res.json({ files: [] });
         return;
@@ -18508,7 +18519,7 @@ async function startWebServer(options = {}) {
       const entries = readdirSync17(targetDir, { withFileTypes: true });
       const files = entries.filter((e) => !SKIP.has(e.name) && !e.name.startsWith(".")).slice(0, 50).map((e) => ({
         name: e.name,
-        path: relative4(cwd, join28(targetDir, e.name)).replace(/\\/g, "/"),
+        path: relative5(cwd, join28(targetDir, e.name)).replace(/\\/g, "/"),
         isDir: e.isDirectory()
       }));
       res.json({ files });
@@ -18549,13 +18560,13 @@ async function startWebServer(options = {}) {
       const authUser = req._authUser;
       const histDir = authUser ? getUserShared(authUser).config.getHistoryDir() : config.getHistoryDir();
       const filePath = join28(histDir, `${id}.json`);
-      if (!existsSync33(filePath)) {
+      if (!existsSync34(filePath)) {
         res.status(404).json({ error: "Session not found" });
         return;
       }
       try {
-        const canonicalFile = realpathSync(filePath);
-        const canonicalDir = realpathSync(histDir);
+        const canonicalFile = realpathSync2(filePath);
+        const canonicalDir = realpathSync2(histDir);
         if (!canonicalFile.startsWith(canonicalDir + sep3)) {
           res.status(404).json({ error: "Session not found" });
           return;
@@ -18579,8 +18590,8 @@ async function startWebServer(options = {}) {
     const cwd = process.cwd();
     const fullPath = resolve13(join28(cwd, filePath));
     try {
-      const canonicalFull = realpathSync(fullPath);
-      const canonicalCwd = realpathSync(resolve13(cwd));
+      const canonicalFull = realpathSync2(fullPath);
+      const canonicalCwd = realpathSync2(resolve13(cwd));
       if (!canonicalFull.startsWith(canonicalCwd + sep3) && canonicalFull !== canonicalCwd) {
         res.json({ error: "Access denied" });
         return;
@@ -18851,14 +18862,14 @@ function resolveProjectMcpPath() {
   const gitRoot = getGitRoot(cwd);
   const projectRoot = gitRoot ?? cwd;
   const configPath = join28(projectRoot, MCP_PROJECT_CONFIG_NAME);
-  return existsSync33(configPath) ? configPath : null;
+  return existsSync34(configPath) ? configPath : null;
 }
 function loadProjectMcpConfig() {
   const cwd = process.cwd();
   const gitRoot = getGitRoot(cwd);
   const projectRoot = gitRoot ?? cwd;
   const configPath = join28(projectRoot, MCP_PROJECT_CONFIG_NAME);
-  if (!existsSync33(configPath)) return null;
+  if (!existsSync34(configPath)) return null;
   try {
     const raw = JSON.parse(readFileSync26(configPath, "utf-8"));
     return raw.mcpServers ?? raw;