jinzd-ai-cli 0.4.234 → 0.4.236

package/README.md

@@ -7,7 +7,7 @@
 [![npm version](https://img.shields.io/npm/v/jinzd-ai-cli)](https://www.npmjs.com/package/jinzd-ai-cli)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D20-brightgreen)](https://nodejs.org)
-[![Tests](https://img.shields.io/badge/tests-1393%20passing-brightgreen)]()
+[![Tests](https://img.shields.io/badge/tests-1639%20passing-brightgreen)]()
 [![GitHub Release](https://img.shields.io/github/v/release/jinzhengdong/ai-cli)](https://github.com/jinzhengdong/ai-cli/releases)
 [![CI](https://github.com/jinzhengdong/ai-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/jinzhengdong/ai-cli/actions/workflows/ci.yml)
 
@@ -31,7 +31,7 @@
 - **Conversation Branching** *(v0.4.74+)* — `/branch list/new/switch/delete/rename` inside the REPL, plus a 🌿 "fork here" button on every replay step — explore alternate directions without losing the original thread
 - **Symbol Index** *(v0.4.76+, multi-language since v0.4.143)* — persistent tree-sitter index for TypeScript / JavaScript / TSX / Python / Go / Rust / Java / C/C++ powers three new AI tools: `find_symbol`, `get_outline`, `find_references`. Orders of magnitude faster than grep for definition lookups; background refresh on REPL startup, `/index status|rebuild|clear` to manage
 - **Semantic Code Search** *(v0.4.77+)* — `search_code` tool finds code by meaning, not name. Local sentence embeddings (multilingual MiniLM, 117 MB one-time download) score symbols by cosine similarity against natural-language queries in English or Chinese ("where are users authenticated", "哪里做了速率限制"). No API key, runs on CPU. Manage with `/index semantic-rebuild|semantic-clear`
-- **MCP Server Mode** *(v0.4.84+)* — `aicli mcp-serve` reverses ai-cli into an MCP server (JSON-RPC 2.0 over stdio), exposing its 28 built-in tools (incl. `find_symbol` / `search_code` / `run_tests`) to Claude Desktop / Cursor / any MCP client. Opt-in destructive-tool allow, `--tools` whitelist, `--cwd` override
+- **MCP Server Mode** *(v0.4.84+)* — `aicli mcp-serve` reverses ai-cli into an MCP server (JSON-RPC 2.0 over stdio), exposing its 30 built-in tools (incl. `find_symbol` / `search_code` / `run_tests`) to Claude Desktop / Cursor / any MCP client. Opt-in destructive-tool allow, `--tools` whitelist, `--cwd` override
 - **Session Sensitive-Data Redaction** *(v0.4.88+)* — unified redactor scrubs `password=` / `api_key` / bearer tokens / OpenAI-style keys from every message **before it hits disk**. Query text is redacted too, so secrets never reach embeddings or logs. `/security status` + `/security scan` to audit
 - **Human-like Long-Term Memory** *(v0.4.89+, B4)* — semantic index over every past chat session + `recall_memory` AI tool + `/memory rebuild|refresh|status|recall` commands. AI is prompted to auto-recall when it sees "last time" / "之前" / ambiguous references. Reuses the same MiniLM embedder as semantic code search
 - **Governed Persistent Memory** *(v0.4.217+)* — `save_memory` and `/memory add` write auditable `memory.jsonl` entries with id/scope/source/sensitivity/approval/expiry; low-risk entries auto-approve, sensitive entries stay pending until `/memory approve <id>`, and project-scoped memories only inject inside the same project
@@ -156,7 +156,7 @@ aicli
 
 ## Built-in Tools (Agentic)
 
-AI autonomously invokes these 27 tools during conversations:
+AI autonomously invokes these 30 tools during conversations:
 
 | Tool | Safety | Description |
 |------|--------|-------------|
@@ -225,7 +225,7 @@ AI autonomously invokes these 27 tools during conversations:
 
 **Multi-line input**: Use `\` at end of line for continuation, or paste multi-line content directly (auto-detected and merged).
 
-Type `/help` in the REPL to see all 40 commands.
+Type `/help` in the REPL to see all 48 commands.
 
 ## CLI Parameters
 
@@ -512,7 +512,7 @@ The Web UI (`aicli web`) provides a full-featured browser interface:
 ## Testing
 
 ```bash
-npm test              # Offline regression suite: 79 files, 1393 passed, 1 skipped
+npm test              # Offline regression suite: 91 files, 1639 passed, 2 skipped
 npm run test:providers # Real-provider smoke tests (network/API-key dependent)
 npm run test:e2e-web  # Playwright browser smoke; may need browser-process permission in sandboxes
 npm run test:watch    # Watch mode

package/dist/{auth-FSTAKSYF.js → auth-PE3Z5OHS.js}

@@ -3,7 +3,7 @@ import {
   AuthManager,
   TOKEN_EXPIRY_MS,
   __resetLoginAttemptsForTests
-} from "./chunk-JVKAL5Q3.js";
+} from "./chunk-RYQBBEMM.js";
 import "./chunk-IW3Q7AE5.js";
 export {
   AuthManager,

package/dist/{batch-T3FRX4B6.js → batch-HZI7QAE7.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   ConfigManager
-} from "./chunk-L5PNAQ6O.js";
+} from "./chunk-VBAW4ZPY.js";
 import "./chunk-5ULLIOVC.js";
-import "./chunk-3KTSJ2EL.js";
+import "./chunk-CGQARJMP.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-AFT6VFMI.js → chunk-7VAE3I3D.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   TEST_TIMEOUT
-} from "./chunk-3KTSJ2EL.js";
+} from "./chunk-CGQARJMP.js";
 
 // src/tools/builtin/run-tests.ts
 import { execSync, spawnSync } from "child_process";

package/dist/{chunk-3KTSJ2EL.js → chunk-CGQARJMP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/core/constants.ts
-var VERSION = "0.4.234";
+var VERSION = "0.4.236";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-ETJ5X6V7.js → chunk-MFWAL5S2.js}

@@ -6,7 +6,7 @@ import { platform } from "os";
 import chalk from "chalk";
 
 // src/core/constants.ts
-var VERSION = "0.4.234";
+var VERSION = "0.4.236";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-6MJMHHRK.js → chunk-O4QYY6SF.js}

@@ -2,7 +2,7 @@
 import {
   evaluateCiGate,
   normalizeCiThresholds
-} from "./chunk-TAXIG7HH.js";
+} from "./chunk-SCFGLRB3.js";
 import {
   buildReviewPrompt,
   buildSecurityReviewPrompt,
@@ -13,10 +13,10 @@ import {
 } from "./chunk-QYQI7ZWK.js";
 import {
   ConfigManager
-} from "./chunk-L5PNAQ6O.js";
+} from "./chunk-VBAW4ZPY.js";
 import {
   VERSION
-} from "./chunk-3KTSJ2EL.js";
+} from "./chunk-CGQARJMP.js";
 
 // src/cli/ci.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-5DTEEWYC.js → chunk-QDP3NUPX.js}

@@ -11,10 +11,10 @@ import {
   listHooks,
   listInstalledPlugins,
   resetStats
-} from "./chunk-II6RZRTF.js";
+} from "./chunk-T6EIBUKW.js";
 import {
   ConfigManager
-} from "./chunk-L5PNAQ6O.js";
+} from "./chunk-VBAW4ZPY.js";
 import {
   getGitRoot
 } from "./chunk-HOSJZMQS.js";
@@ -26,7 +26,7 @@ import {
   MCP_PROJECT_CONFIG_NAME,
   MEMORY_FILE_NAME,
   VERSION
-} from "./chunk-3KTSJ2EL.js";
+} from "./chunk-CGQARJMP.js";
 
 // src/diagnostics/doctor-report.ts
 import { existsSync as existsSync3, statSync as statSync2 } from "fs";

package/dist/{chunk-JVKAL5Q3.js → chunk-RYQBBEMM.js}

@@ -5,7 +5,7 @@ import {
 
 // src/web/auth.ts
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, copyFileSync } from "fs";
-import { join } from "path";
+import { isAbsolute, join, relative } from "path";
 import { createHmac, randomBytes, timingSafeEqual, pbkdf2Sync } from "crypto";
 var USERS_FILE = "users.json";
 var TOKEN_EXPIRY_HOURS = 24;
@@ -241,8 +241,17 @@ var AuthManager = class {
   loadOrCreate() {
     if (existsSync(this.usersFile)) {
       try {
-        return JSON.parse(readFileSync(this.usersFile, "utf-8"));
-      } catch {
+        const parsed = JSON.parse(readFileSync(this.usersFile, "utf-8"));
+        if (!this.isValidUsersDB(parsed)) {
+          throw new Error("database structure is invalid");
+        }
+        return parsed;
+      } catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new Error(
+          `Authentication database is unreadable or corrupt: ${this.usersFile} (${detail}). Refusing to start without authentication; restore or remove the file explicitly.`,
+          { cause: err }
+        );
       }
     }
     const db = {
@@ -253,6 +262,27 @@ var AuthManager = class {
     this.saveDB(db);
     return db;
   }
+  isValidUsersDB(value) {
+    if (!value || typeof value !== "object") return false;
+    const db = value;
+    if (db.version !== 1 || typeof db.secret !== "string" || db.secret.length < 32 || !Array.isArray(db.users)) {
+      return false;
+    }
+    const usernames = /* @__PURE__ */ new Set();
+    for (const user of db.users) {
+      if (!user || typeof user !== "object") return false;
+      const record = user;
+      if (typeof record.username !== "string" || !/^[a-z0-9_-]{2,32}$/.test(record.username) || usernames.has(record.username) || typeof record.passwordHash !== "string" || record.passwordHash.length === 0 || typeof record.salt !== "string" || record.salt.length === 0 || typeof record.createdAt !== "string" || typeof record.dataDir !== "string" || record.dataDir.length === 0 || isAbsolute(record.dataDir)) {
+        return false;
+      }
+      const dataDirFromBase = relative(this.baseDir, join(this.baseDir, record.dataDir));
+      if (dataDirFromBase.startsWith("..") || isAbsolute(dataDirFromBase)) return false;
+      if (record.hashVersion !== void 0 && record.hashVersion !== 1 && record.hashVersion !== 2) return false;
+      if (record.tokensRevokedBefore !== void 0 && !Number.isFinite(record.tokensRevokedBefore)) return false;
+      usernames.add(record.username);
+    }
+    return true;
+  }
   save() {
     this.saveDB(this.db);
   }

package/dist/{chunk-E5RLXMSU.js → chunk-SBSWH2EG.js}

@@ -14,7 +14,7 @@ import {
   runHook,
   runLifecycleHooks,
   runTool
-} from "./chunk-II6RZRTF.js";
+} from "./chunk-T6EIBUKW.js";
 import {
   getDangerLevel,
   isFileWriteTool,
@@ -33,7 +33,7 @@ import {
 } from "./chunk-4BKXL7SM.js";
 import {
   runTestsTool
-} from "./chunk-AFT6VFMI.js";
+} from "./chunk-7VAE3I3D.js";
 import {
   CONFIG_DIR_NAME,
   DEFAULT_MAX_TOOL_OUTPUT_CHARS_CAP,
@@ -43,7 +43,7 @@ import {
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-3KTSJ2EL.js";
+} from "./chunk-CGQARJMP.js";
 import {
   loadChatIndex,
   searchChatMemory
@@ -1318,11 +1318,11 @@ ${content}`;
 
 // src/tools/builtin/write-file.ts
 import { appendFileSync, mkdirSync } from "fs";
-import { dirname as dirname2 } from "path";
+import { dirname as dirname3 } from "path";
 
 // src/tools/executor.ts
 import chalk3 from "chalk";
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
 import { tmpdir } from "os";
 
 // src/core/readline-internal.ts
@@ -1529,7 +1529,8 @@ function simpleDiff(oldLines, newLines) {
 }
 
 // src/tools/permissions.ts
-import { isAbsolute, resolve as resolve3 } from "path";
+import { existsSync as existsSync4, realpathSync } from "fs";
+import { basename as basename2, dirname as dirname2, isAbsolute, resolve as resolve3 } from "path";
 function checkPermission(toolName, args, dangerLevel, rules, defaultAction = "confirm") {
   for (const rule of rules) {
     if (rule.tool !== "*" && rule.tool !== toolName) continue;
@@ -1574,10 +1575,28 @@ var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
 function normalizePathForPermission(value) {
   return value.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
 }
+function canonicalizeWithNearestParent(value) {
+  const missing = [];
+  let cursor = resolve3(value);
+  while (!existsSync4(cursor)) {
+    const parent = dirname2(cursor);
+    if (parent === cursor) return null;
+    missing.unshift(basename2(cursor));
+    cursor = parent;
+  }
+  try {
+    return resolve3(realpathSync(cursor), ...missing);
+  } catch {
+    return null;
+  }
+}
 function isInsidePath(root, target) {
   const absoluteTarget = isAbsolute(target) ? target : resolve3(root, target);
-  const r = normalizePathForPermission(resolve3(root));
-  const t = normalizePathForPermission(absoluteTarget);
+  const canonicalRoot = canonicalizeWithNearestParent(root);
+  const canonicalTarget = canonicalizeWithNearestParent(absoluteTarget);
+  if (!canonicalRoot || !canonicalTarget) return false;
+  const r = normalizePathForPermission(canonicalRoot);
+  const t = normalizePathForPermission(canonicalTarget);
   return t === r || t.startsWith(`${r}/`);
 }
 function extractPathArg(toolName, args) {
@@ -1629,19 +1648,31 @@ function profileHardDecision(profileName, toolName, args, dangerLevel, ctx) {
     return null;
   }
   if (profileName === "workspace-write") {
-    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools always require confirmation", profileName };
+    if (dangerLevel === "destructive") {
+      return { action: "confirm", reason: "destructive tools always require confirmation", profileName, hardBoundary: true };
+    }
     if (dangerLevel === "write" && isExplicitFileWriteTool(toolName)) {
       const target = extractPathArg(toolName, args);
-      if (!target) return { action: "confirm", reason: "file write target is not explicit", profileName };
+      if (!target) {
+        return { action: "confirm", reason: "file write target is not explicit", profileName, hardBoundary: true };
+      }
       const allowedRoots = getAllowedWriteRoots(ctx);
       if (allowedRoots.length === 0 || !allowedRoots.some((root) => isInsidePath(root, target))) {
-        return { action: "deny", reason: "file write target is outside workspace/temp roots", profileName };
+        return { action: "deny", reason: "file write target is outside workspace/temp roots", profileName, hardBoundary: true };
       }
     }
+    if (toolName === "bash" || toolName === "run_interactive" || toolName === "task_create") {
+      return {
+        action: "confirm",
+        reason: "shell/process writes cannot be proven to stay inside workspace/temp roots",
+        profileName,
+        hardBoundary: true
+      };
+    }
     return null;
   }
   if (profileName === "danger-full-access") {
-    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools still require confirmation", profileName };
+    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools still require confirmation", profileName, hardBoundary: true };
     return null;
   }
   return null;
@@ -1653,7 +1684,8 @@ function checkPermissionWithProfile(toolName, args, dangerLevel, rules, defaultA
   const combinedRules = [...getProfileRules(profileContext), ...rules];
   const profileDefault = profileName === "legacy" ? defaultAction : getProfileDefaultAction(profileName, profileContext);
   const action = checkPermission(toolName, args, dangerLevel, combinedRules, profileDefault);
-  if (hard?.action === "confirm" && action === "auto-approve") return hard;
+  if (action === "deny") return { action, profileName };
+  if (hard?.action === "confirm") return hard;
   return { action, profileName };
 }
 function formatPermissionProfileWarning(profileName) {
@@ -1950,7 +1982,7 @@ var theme = new Proxy(DARK_THEME, {
 });
 
 // src/tools/action-classifier.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
 import { isAbsolute as isAbsolute2, join, resolve as resolve4 } from "path";
 var RECENT_DENIED_LIMIT = 50;
 var recentlyDenied = [];
@@ -1993,7 +2025,7 @@ function splitShellWords(command) {
 }
 function readPackageManifest(root) {
   const p = join(root, "package.json");
-  if (!existsSync4(p)) return null;
+  if (!existsSync5(p)) return null;
   try {
     return JSON.parse(readFileSync3(p, "utf-8"));
   } catch {
@@ -2012,7 +2044,7 @@ function manifestHasDependency(root, name) {
 function lockfileMentions(root, name) {
   for (const file of ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"]) {
     const p = join(root, file);
-    if (!existsSync4(p)) continue;
+    if (!existsSync5(p)) continue;
     try {
       if (readFileSync3(p, "utf-8").includes(name)) return true;
     } catch {
@@ -2288,14 +2320,15 @@ var ToolExecutor = class {
         return { callId: call.id, content: message, isError: true };
       }
     }
-    if (networkPermission?.action === "confirm" && dangerLevel === "safe") {
+    const requiresHardConfirmation = permission.action === "confirm" && permission.hardBoundary === true;
+    if ((networkPermission?.action === "confirm" || requiresHardConfirmation) && dangerLevel === "safe") {
       this.printToolCall(call);
       toolCallAlreadyPrinted = true;
       const confirmed = await this.confirm(call, "write");
       if (!confirmed) {
         return {
           callId: call.id,
-          content: `[User cancelled] The user declined network access for ${call.name}. Do not retry without asking.`,
+          content: `[User cancelled] The user declined permission for ${call.name}. Do not retry without asking.`,
           isError: true
         };
       }
@@ -2313,7 +2346,7 @@ var ToolExecutor = class {
           isError: true
         };
       }
-      if (classification.decision === "auto-approve") {
+      if (classification.decision === "auto-approve" && !requiresHardConfirmation) {
         this.printToolCall(call);
         if (dangerLevel === "write") this.printDiffPreview(call);
         console.log(theme.warning(`  \u26A1 Auto-approved (/auto: ${classification.ruleId})`));
@@ -2334,7 +2367,7 @@ var ToolExecutor = class {
         }
       }
     }
-    if (this.sessionAutoApprove && dangerLevel === "write") {
+    if (this.sessionAutoApprove && dangerLevel === "write" && !requiresHardConfirmation) {
       this.printToolCall(call);
       if (dangerLevel === "write") this.printDiffPreview(call);
       console.log(theme.warning("  \u26A1 Auto-approved (session /yolo mode)"));
@@ -2578,7 +2611,7 @@ var ToolExecutor = class {
       const filePath = String(call.arguments["path"] ?? "");
       const newContent = String(call.arguments["content"] ?? "");
       if (!filePath) return;
-      if (existsSync5(filePath)) {
+      if (existsSync6(filePath)) {
         let oldContent;
         try {
           oldContent = readFileSync4(filePath, "utf-8");
@@ -2604,7 +2637,7 @@ var ToolExecutor = class {
       }
     } else if (call.name === "edit_file") {
       const filePath = String(call.arguments["path"] ?? "");
-      if (!filePath || !existsSync5(filePath)) return;
+      if (!filePath || !existsSync6(filePath)) return;
       const oldStr = call.arguments["old_str"];
       const newStr = call.arguments["new_str"];
       if (oldStr !== void 0) {
@@ -2723,7 +2756,7 @@ var ToolExecutor = class {
 };
 
 // src/tools/sensitive-paths.ts
-import { resolve as resolve5, sep as sep2, basename as basename2 } from "path";
+import { resolve as resolve5, sep as sep2, basename as basename3 } from "path";
 import { homedir as homedir2 } from "os";
 var home = homedir2();
 function norm(p) {
@@ -2742,7 +2775,7 @@ function homeRel(p) {
 function classifyWritePath(path3) {
   if (!path3) return { sensitive: false };
   const abs = norm(path3);
-  const base = basename2(abs);
+  const base = basename3(abs);
   const rel = homeRel(path3);
   if (rel) {
     const shellRc = /* @__PURE__ */ new Set([
@@ -2866,7 +2899,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
     }
     undoStack.push(filePath, `write_file${appendMode ? " (append)" : ""}: ${filePath}`);
     fileCheckpoints.snapshot(filePath, ToolExecutor.currentMessageIndex);
-    mkdirSync(dirname2(filePath), { recursive: true });
+    mkdirSync(dirname3(filePath), { recursive: true });
     if (appendMode) {
       appendFileSync(filePath, content, encoding);
     } else {
@@ -2886,7 +2919,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
 };
 
 // src/tools/builtin/edit-file.ts
-import { readFileSync as readFileSync5, existsSync as existsSync6 } from "fs";
+import { readFileSync as readFileSync5, existsSync as existsSync7 } from "fs";
 
 // src/tools/builtin/patch-apply.ts
 function parseUnifiedDiff(patch) {
@@ -3247,7 +3280,7 @@ Note: Path can be absolute or relative to cwd.`,
     const filePath = String(args["path"] ?? args["file"] ?? "");
     const encoding = args["encoding"] ?? "utf-8";
     if (!filePath) throw new ToolError("edit_file", "path is required");
-    if (!existsSync6(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
+    if (!existsSync7(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
     const verdict = classifyWritePath(filePath);
     if (verdict.sensitive && subAgentGuard.active) {
       throw new ToolError(
@@ -3413,8 +3446,8 @@ function truncatePreview(str, maxLen = 80) {
 }
 
 // src/tools/builtin/list-dir.ts
-import { readdirSync as readdirSync3, statSync as statSync3, existsSync as existsSync7 } from "fs";
-import { join as join2, basename as basename3 } from "path";
+import { readdirSync as readdirSync3, statSync as statSync3, existsSync as existsSync8 } from "fs";
+import { join as join2, basename as basename4 } from "path";
 var listDirTool = {
   definition: {
     name: "list_dir",
@@ -3436,8 +3469,8 @@ var listDirTool = {
   async execute(args) {
     const dirPath = String(args["path"] ?? process.cwd());
     const recursive = Boolean(args["recursive"] ?? false);
-    if (!existsSync7(dirPath)) {
-      const targetName = basename3(dirPath).toLowerCase();
+    if (!existsSync8(dirPath)) {
+      const targetName = basename4(dirPath).toLowerCase();
       const cwd = process.cwd();
       const suggestions = [];
       try {
@@ -3514,7 +3547,7 @@ function formatSize(bytes) {
 }
 
 // src/tools/builtin/grep-files.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync6, statSync as statSync4, existsSync as existsSync8 } from "fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync6, statSync as statSync4, existsSync as existsSync9 } from "fs";
 import { readFile } from "fs/promises";
 import { join as join3, relative } from "path";
 var grepFilesTool = {
@@ -3567,7 +3600,7 @@ Supports regex. Automatically skips node_modules, dist, .git directories.`,
     const contextLines = Math.max(0, Number(args["context_lines"] ?? 0));
     const maxResults = Math.max(1, Number(args["max_results"] ?? 50));
     if (!pattern) throw new ToolError("grep_files", "pattern is required");
-    if (!existsSync8(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
+    if (!existsSync9(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
     const MAX_PATTERN_LENGTH = 1e3;
     if (pattern.length > MAX_PATTERN_LENGTH) {
       throw new ToolError("grep_files", `Pattern too long (${pattern.length} chars, max ${MAX_PATTERN_LENGTH}). Use a shorter pattern.`);
@@ -3751,8 +3784,8 @@ function searchInFile(fullPath, displayPath, regex, contextLines, maxResults, re
 }
 
 // src/tools/builtin/glob-files.ts
-import { readdirSync as readdirSync5, statSync as statSync5, existsSync as existsSync9 } from "fs";
-import { join as join4, relative as relative2, basename as basename4 } from "path";
+import { readdirSync as readdirSync5, statSync as statSync5, existsSync as existsSync10 } from "fs";
+import { join as join4, relative as relative2, basename as basename5 } from "path";
 var globFilesTool = {
   definition: {
     name: "glob_files",
@@ -3785,7 +3818,7 @@ Results sorted by most recent modification time. Automatically skips node_module
     const rootPath = String(args["path"] ?? process.cwd());
     const maxResults = Math.max(1, Number(args["max_results"] ?? 100));
     if (!pattern) throw new ToolError("glob_files", "pattern is required");
-    if (!existsSync9(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
+    if (!existsSync10(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
     const regex = globToRegex(pattern);
     const matches = [];
     collectMatchingFiles(rootPath, rootPath, regex, matches, maxResults);
@@ -3868,7 +3901,7 @@ function collectMatchingFiles(dirPath, rootPath, regex, results, maxResults) {
       collectMatchingFiles(fullPath, rootPath, regex, results, maxResults);
     } else if (entry.isFile()) {
       const relPath = relative2(rootPath, fullPath).replace(/\\/g, "/");
-      if (regex.test(relPath) || regex.test(basename4(relPath))) {
+      if (regex.test(relPath) || regex.test(basename5(relPath))) {
         try {
           const stat = statSync5(fullPath);
           results.push({ relPath, absPath: fullPath, mtime: stat.mtimeMs });
@@ -4603,7 +4636,7 @@ ${preamble}`;
 
 // src/tools/builtin/save-last-response.ts
 import { mkdirSync as mkdirSync2, unlinkSync as unlinkSync2, rmdirSync as rmdirSync2 } from "fs";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname4 } from "path";
 var lastResponseStore = { content: "" };
 function cleanupRejectedTeeFile(filePath) {
   try {
@@ -4611,7 +4644,7 @@ function cleanupRejectedTeeFile(filePath) {
   } catch {
   }
   try {
-    rmdirSync2(dirname3(filePath));
+    rmdirSync2(dirname4(filePath));
   } catch {
   }
 }
@@ -4652,7 +4685,7 @@ Any of these triggers means use save_last_response, NOT write_file:
       throw new ToolError("save_last_response", "No content to save: AI has not produced any response yet, or the last response was empty.");
     }
     undoStack.push(filePath, `save_last_response: ${filePath}`);
-    mkdirSync2(dirname3(filePath), { recursive: true });
+    mkdirSync2(dirname4(filePath), { recursive: true });
     atomicWriteFileSync(filePath, content);
     const lines = content.split("\n").length;
     return `File saved: ${filePath} (${lines} lines, ${content.length} bytes)`;
@@ -4664,9 +4697,9 @@ import { join as join6 } from "path";
 import { homedir as homedir3 } from "os";
 
 // src/memory/persistent-memory.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "fs";
 import { randomUUID, createHash } from "crypto";
-import { dirname as dirname4, join as join5, resolve as resolve6 } from "path";
+import { dirname as dirname5, join as join5, resolve as resolve6 } from "path";
 function memoryStorePath(configDir) {
   return join5(configDir, MEMORY_STORE_FILE_NAME);
 }
@@ -4707,7 +4740,7 @@ function normalizeEntry(value) {
 }
 function legacyEntriesFromMarkdown(configDir) {
   const file = memoryMarkdownPath(configDir);
-  if (!existsSync10(file)) return [];
+  if (!existsSync11(file)) return [];
   const content = readFileSync7(file, "utf-8").trim();
   if (!content) return [];
   const parts = content.split(/\n(?=##\s+\d{4}-\d{2}-\d{2})/g);
@@ -4724,7 +4757,7 @@ ${chunk}`).digest("hex").slice(0, 12);
 }
 function loadMemoryEntries(configDir) {
   const file = memoryStorePath(configDir);
-  if (!existsSync10(file)) return legacyEntriesFromMarkdown(configDir);
+  if (!existsSync11(file)) return legacyEntriesFromMarkdown(configDir);
   const text = readFileSync7(file, "utf-8").trim();
   if (!text) return [];
   const entries = [];
@@ -5172,7 +5205,7 @@ function formatResults2(query, data, _requested) {
 }
 
 // src/agents/agent-config.ts
-import { existsSync as existsSync11, readdirSync as readdirSync6, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync12, readdirSync as readdirSync6, readFileSync as readFileSync8 } from "fs";
 import { join as join7 } from "path";
 import { homedir as homedir4 } from "os";
 var READ_ONLY_TOOLS2 = /* @__PURE__ */ new Set([
@@ -5268,7 +5301,7 @@ function parseAgentConfig(raw, source, path3) {
   return cfg;
 }
 function loadAgentDir(dir, source) {
-  if (!existsSync11(dir)) return [];
+  if (!existsSync12(dir)) return [];
   const out = [];
   for (const file of readdirSync6(dir)) {
     if (!file.endsWith(".json")) continue;
@@ -6000,13 +6033,13 @@ var taskStopTool = {
 
 // src/tools/builtin/git-tools.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync12 } from "fs";
+import { existsSync as existsSync13 } from "fs";
 import { join as join8 } from "path";
 function assertGitRepo(cwd) {
   let dir = cwd;
   const root = dir.split(/[\\/]/)[0] + (dir.includes("\\") ? "\\" : "/");
   while (dir && dir !== root) {
-    if (existsSync12(join8(dir, ".git"))) return;
+    if (existsSync13(join8(dir, ".git"))) return;
     const parent = join8(dir, "..");
     if (parent === dir) break;
     dir = parent;
@@ -6272,7 +6305,7 @@ ${commitOutput.trim()}`;
 };
 
 // src/tools/builtin/notebook-edit.ts
-import { readFileSync as readFileSync9, existsSync as existsSync13 } from "fs";
+import { readFileSync as readFileSync9, existsSync as existsSync14 } from "fs";
 import { writeFile } from "fs/promises";
 import { resolve as resolve7, extname as extname2 } from "path";
 var notebookEditTool = {
@@ -6327,7 +6360,7 @@ var notebookEditTool = {
     if (extname2(absPath).toLowerCase() !== ".ipynb") {
       throw new ToolError("notebook_edit", "path must point to a .ipynb file");
     }
-    if (!existsSync13(absPath)) {
+    if (!existsSync14(absPath)) {
       throw new ToolError("notebook_edit", `Notebook not found: ${filePath}`);
     }
     const raw = readFileSync9(absPath, "utf-8");
@@ -6747,7 +6780,7 @@ function estimateToolDefinitionTokens(def) {
 
 // src/tools/registry.ts
 import { pathToFileURL } from "url";
-import { existsSync as existsSync14, mkdirSync as mkdirSync4, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync4, readdirSync as readdirSync7 } from "fs";
 import { join as join9 } from "path";
 var ToolRegistry = class {
   tools = /* @__PURE__ */ new Map();
@@ -6909,7 +6942,7 @@ var ToolRegistry = class {
    * Returns the number of successfully loaded plugins.
    */
   async loadPlugins(pluginsDir, allowPlugins = false) {
-    if (!existsSync14(pluginsDir)) {
+    if (!existsSync15(pluginsDir)) {
       try {
         mkdirSync4(pluginsDir, { recursive: true });
       } catch {
@@ -6972,10 +7005,6 @@ export {
   initTheme,
   theme,
   undoStack,
-  recordRecentlyDeniedAutoAction,
-  getRecentlyDeniedAutoActions,
-  clearRecentlyDeniedAutoActions,
-  defaultActionClassifier,
   renderDiff,
   memoryStorePath,
   memoryMarkdownPath,
@@ -6987,6 +7016,10 @@ export {
   expireMemoryEntry,
   exportMemoryEntries,
   formatMemoryForPrompt,
+  recordRecentlyDeniedAutoAction,
+  getRecentlyDeniedAutoActions,
+  clearRecentlyDeniedAutoActions,
+  defaultActionClassifier,
   isInterrupted,
   requestInterrupt,
   resetInterrupt,