jinzd-ai-cli 0.4.234 → 0.4.236

package/dist/electron-server.js

@@ -38,7 +38,7 @@ import {
   VERSION,
   buildUserIdentityPrompt,
   runTestsTool
-} from "./chunk-ETJ5X6V7.js";
+} from "./chunk-MFWAL5S2.js";
 import {
   hasSemanticIndex,
   semanticSearch
@@ -70,8 +70,8 @@ import {
 import express from "express";
 import { createServer } from "http";
 import { WebSocketServer } from "ws";
-import { join as join28, dirname as dirname11, resolve as resolve13, relative as relative4, sep as sep3 } from "path";
-import { existsSync as existsSync33, readFileSync as readFileSync26, readdirSync as readdirSync17, statSync as statSync15, realpathSync } from "fs";
+import { join as join28, dirname as dirname11, resolve as resolve13, relative as relative6, sep as sep4 } from "path";
+import { existsSync as existsSync33, readFileSync as readFileSync25, readdirSync as readdirSync16, statSync as statSync14, realpathSync as realpathSync3 } from "fs";
 import { networkInterfaces } from "os";
 
 // src/config/config-manager.ts
@@ -1908,12 +1908,12 @@ function findPhantomClaims(content, extraMessages) {
   const claimed = extractClaimedFilePaths(content);
   if (claimed.length === 0) return [];
   const normalize = (p) => p.replace(/\\/g, "/").toLowerCase().replace(/^\.\//, "");
-  const basename7 = (p) => {
+  const basename8 = (p) => {
     const parts = normalize(p).split("/");
     return parts[parts.length - 1] ?? "";
   };
   const written = extractWrittenFilePaths(extraMessages).map(normalize);
-  const writtenBases = new Set(written.map(basename7));
+  const writtenBases = new Set(written.map(basename8));
   const writtenFull = new Set(written);
   const bashText = extractBashCommands(extraMessages).map((c) => c.replace(/\\/g, "/").toLowerCase()).join("\n");
   return claimed.filter((raw) => {
@@ -1922,8 +1922,8 @@ function findPhantomClaims(content, extraMessages) {
     for (const w of writtenFull) {
       if (w.endsWith("/" + norm2) || norm2.endsWith("/" + w)) return false;
     }
-    if (writtenBases.has(basename7(norm2))) return false;
-    const base = basename7(norm2);
+    if (writtenBases.has(basename8(norm2))) return false;
+    const base = basename8(norm2);
     if (base && bashText.includes(base)) return false;
     return true;
   });
@@ -5937,11 +5937,11 @@ ${content}`;
 
 // src/tools/builtin/write-file.ts
 import { appendFileSync, mkdirSync as mkdirSync6 } from "fs";
-import { dirname as dirname4 } from "path";
+import { dirname as dirname5 } from "path";
 
 // src/tools/executor.ts
 import chalk3 from "chalk";
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
 import { tmpdir } from "os";
 
 // src/core/readline-internal.ts
@@ -6310,7 +6310,8 @@ function runHook(template, vars) {
 }
 
 // src/tools/permissions.ts
-import { isAbsolute, resolve as resolve3 } from "path";
+import { existsSync as existsSync8, realpathSync } from "fs";
+import { basename as basename2, dirname as dirname3, isAbsolute, resolve as resolve3 } from "path";
 function checkPermission(toolName, args, dangerLevel, rules, defaultAction = "confirm") {
   for (const rule of rules) {
     if (rule.tool !== "*" && rule.tool !== toolName) continue;
@@ -6355,10 +6356,28 @@ var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
 function normalizePathForPermission(value) {
   return value.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
 }
+function canonicalizeWithNearestParent(value) {
+  const missing = [];
+  let cursor = resolve3(value);
+  while (!existsSync8(cursor)) {
+    const parent = dirname3(cursor);
+    if (parent === cursor) return null;
+    missing.unshift(basename2(cursor));
+    cursor = parent;
+  }
+  try {
+    return resolve3(realpathSync(cursor), ...missing);
+  } catch {
+    return null;
+  }
+}
 function isInsidePath(root, target) {
   const absoluteTarget = isAbsolute(target) ? target : resolve3(root, target);
-  const r = normalizePathForPermission(resolve3(root));
-  const t = normalizePathForPermission(absoluteTarget);
+  const canonicalRoot = canonicalizeWithNearestParent(root);
+  const canonicalTarget = canonicalizeWithNearestParent(absoluteTarget);
+  if (!canonicalRoot || !canonicalTarget) return false;
+  const r = normalizePathForPermission(canonicalRoot);
+  const t = normalizePathForPermission(canonicalTarget);
   return t === r || t.startsWith(`${r}/`);
 }
 function extractPathArg(toolName, args) {
@@ -6410,19 +6429,31 @@ function profileHardDecision(profileName, toolName, args, dangerLevel, ctx) {
     return null;
   }
   if (profileName === "workspace-write") {
-    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools always require confirmation", profileName };
+    if (dangerLevel === "destructive") {
+      return { action: "confirm", reason: "destructive tools always require confirmation", profileName, hardBoundary: true };
+    }
     if (dangerLevel === "write" && isExplicitFileWriteTool(toolName)) {
       const target = extractPathArg(toolName, args);
-      if (!target) return { action: "confirm", reason: "file write target is not explicit", profileName };
+      if (!target) {
+        return { action: "confirm", reason: "file write target is not explicit", profileName, hardBoundary: true };
+      }
       const allowedRoots = getAllowedWriteRoots(ctx);
       if (allowedRoots.length === 0 || !allowedRoots.some((root) => isInsidePath(root, target))) {
-        return { action: "deny", reason: "file write target is outside workspace/temp roots", profileName };
+        return { action: "deny", reason: "file write target is outside workspace/temp roots", profileName, hardBoundary: true };
       }
     }
+    if (toolName === "bash" || toolName === "run_interactive" || toolName === "task_create") {
+      return {
+        action: "confirm",
+        reason: "shell/process writes cannot be proven to stay inside workspace/temp roots",
+        profileName,
+        hardBoundary: true
+      };
+    }
     return null;
   }
   if (profileName === "danger-full-access") {
-    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools still require confirmation", profileName };
+    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools still require confirmation", profileName, hardBoundary: true };
     return null;
   }
   return null;
@@ -6434,7 +6465,8 @@ function checkPermissionWithProfile(toolName, args, dangerLevel, rules, defaultA
   const combinedRules = [...getProfileRules(profileContext), ...rules];
   const profileDefault = profileName === "legacy" ? defaultAction : getProfileDefaultAction(profileName, profileContext);
   const action = checkPermission(toolName, args, dangerLevel, combinedRules, profileDefault);
-  if (hard?.action === "confirm" && action === "auto-approve") return hard;
+  if (action === "deny") return { action, profileName };
+  if (hard?.action === "confirm") return hard;
   return { action, profileName };
 }
 function formatPermissionProfileWarning(profileName) {
@@ -6692,8 +6724,8 @@ var theme = new Proxy(DARK_THEME, {
 });
 
 // src/diagnostics/tool-stats.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7, mkdirSync as mkdirSync5 } from "fs";
-import { join as join5, dirname as dirname3 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7, mkdirSync as mkdirSync5 } from "fs";
+import { join as join5, dirname as dirname4 } from "path";
 import { homedir as homedir3 } from "os";
 var STATS_FILE_NAME = "tool-stats.json";
 var STATS_VERSION = 1;
@@ -6708,7 +6740,7 @@ function statsFilePath() {
 }
 function load() {
   const path3 = statsFilePath();
-  if (!existsSync8(path3)) {
+  if (!existsSync9(path3)) {
     return { version: STATS_VERSION, startedAt: (/* @__PURE__ */ new Date()).toISOString(), entries: {} };
   }
   try {
@@ -6770,7 +6802,7 @@ function flush() {
   if (!dirty || state === null) return;
   const path3 = statsFilePath();
   try {
-    mkdirSync5(dirname3(path3), { recursive: true });
+    mkdirSync5(dirname4(path3), { recursive: true });
     atomicWriteFileSync(path3, JSON.stringify(state, null, 2));
     dirty = false;
     pendingWrites = 0;
@@ -6794,7 +6826,7 @@ function getTopUsedTools(limit = 5) {
 }
 
 // src/tools/action-classifier.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
 import { isAbsolute as isAbsolute2, join as join6, resolve as resolve4 } from "path";
 var RECENT_DENIED_LIMIT = 50;
 var recentlyDenied = [];
@@ -6837,7 +6869,7 @@ function splitShellWords(command) {
 }
 function readPackageManifest(root) {
   const p = join6(root, "package.json");
-  if (!existsSync9(p)) return null;
+  if (!existsSync10(p)) return null;
   try {
     return JSON.parse(readFileSync8(p, "utf-8"));
   } catch {
@@ -6856,7 +6888,7 @@ function manifestHasDependency(root, name) {
 function lockfileMentions(root, name) {
   for (const file of ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"]) {
     const p = join6(root, file);
-    if (!existsSync9(p)) continue;
+    if (!existsSync10(p)) continue;
     try {
       if (readFileSync8(p, "utf-8").includes(name)) return true;
     } catch {
@@ -7132,14 +7164,15 @@ var ToolExecutor = class {
         return { callId: call.id, content: message, isError: true };
       }
     }
-    if (networkPermission?.action === "confirm" && dangerLevel === "safe") {
+    const requiresHardConfirmation = permission.action === "confirm" && permission.hardBoundary === true;
+    if ((networkPermission?.action === "confirm" || requiresHardConfirmation) && dangerLevel === "safe") {
       this.printToolCall(call);
       toolCallAlreadyPrinted = true;
       const confirmed = await this.confirm(call, "write");
       if (!confirmed) {
         return {
           callId: call.id,
-          content: `[User cancelled] The user declined network access for ${call.name}. Do not retry without asking.`,
+          content: `[User cancelled] The user declined permission for ${call.name}. Do not retry without asking.`,
           isError: true
         };
       }
@@ -7157,7 +7190,7 @@ var ToolExecutor = class {
           isError: true
         };
       }
-      if (classification.decision === "auto-approve") {
+      if (classification.decision === "auto-approve" && !requiresHardConfirmation) {
         this.printToolCall(call);
         if (dangerLevel === "write") this.printDiffPreview(call);
         console.log(theme.warning(`  \u26A1 Auto-approved (/auto: ${classification.ruleId})`));
@@ -7178,7 +7211,7 @@ var ToolExecutor = class {
         }
       }
     }
-    if (this.sessionAutoApprove && dangerLevel === "write") {
+    if (this.sessionAutoApprove && dangerLevel === "write" && !requiresHardConfirmation) {
       this.printToolCall(call);
       if (dangerLevel === "write") this.printDiffPreview(call);
       console.log(theme.warning("  \u26A1 Auto-approved (session /yolo mode)"));
@@ -7422,7 +7455,7 @@ var ToolExecutor = class {
       const filePath = String(call.arguments["path"] ?? "");
       const newContent = String(call.arguments["content"] ?? "");
       if (!filePath) return;
-      if (existsSync10(filePath)) {
+      if (existsSync11(filePath)) {
         let oldContent;
         try {
           oldContent = readFileSync9(filePath, "utf-8");
@@ -7448,7 +7481,7 @@ var ToolExecutor = class {
       }
     } else if (call.name === "edit_file") {
       const filePath = String(call.arguments["path"] ?? "");
-      if (!filePath || !existsSync10(filePath)) return;
+      if (!filePath || !existsSync11(filePath)) return;
       const oldStr = call.arguments["old_str"];
       const newStr = call.arguments["new_str"];
       if (oldStr !== void 0) {
@@ -7567,7 +7600,7 @@ var ToolExecutor = class {
 };
 
 // src/tools/sensitive-paths.ts
-import { resolve as resolve5, sep as sep2, basename as basename2 } from "path";
+import { resolve as resolve5, sep as sep2, basename as basename3 } from "path";
 import { homedir as homedir4 } from "os";
 var home = homedir4();
 function norm(p) {
@@ -7586,7 +7619,7 @@ function homeRel(p) {
 function classifyWritePath(path3) {
   if (!path3) return { sensitive: false };
   const abs = norm(path3);
-  const base = basename2(abs);
+  const base = basename3(abs);
   const rel = homeRel(path3);
   if (rel) {
     const shellRc = /* @__PURE__ */ new Set([
@@ -7710,7 +7743,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
     }
     undoStack.push(filePath, `write_file${appendMode ? " (append)" : ""}: ${filePath}`);
     fileCheckpoints.snapshot(filePath, ToolExecutor.currentMessageIndex);
-    mkdirSync6(dirname4(filePath), { recursive: true });
+    mkdirSync6(dirname5(filePath), { recursive: true });
     if (appendMode) {
       appendFileSync(filePath, content, encoding);
     } else {
@@ -7730,7 +7763,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
 };
 
 // src/tools/builtin/edit-file.ts
-import { readFileSync as readFileSync10, existsSync as existsSync11 } from "fs";
+import { readFileSync as readFileSync10, existsSync as existsSync12 } from "fs";
 
 // src/tools/builtin/patch-apply.ts
 function parseUnifiedDiff(patch) {
@@ -8091,7 +8124,7 @@ Note: Path can be absolute or relative to cwd.`,
     const filePath = String(args["path"] ?? args["file"] ?? "");
     const encoding = args["encoding"] ?? "utf-8";
     if (!filePath) throw new ToolError("edit_file", "path is required");
-    if (!existsSync11(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
+    if (!existsSync12(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
     const verdict = classifyWritePath(filePath);
     if (verdict.sensitive && subAgentGuard.active) {
       throw new ToolError(
@@ -8257,8 +8290,8 @@ function truncatePreview(str, maxLen = 80) {
 }
 
 // src/tools/builtin/list-dir.ts
-import { readdirSync as readdirSync4, statSync as statSync4, existsSync as existsSync12 } from "fs";
-import { join as join7, basename as basename3 } from "path";
+import { readdirSync as readdirSync4, statSync as statSync4, existsSync as existsSync13 } from "fs";
+import { join as join7, basename as basename4 } from "path";
 var listDirTool = {
   definition: {
     name: "list_dir",
@@ -8280,8 +8313,8 @@ var listDirTool = {
   async execute(args) {
     const dirPath = String(args["path"] ?? process.cwd());
     const recursive = Boolean(args["recursive"] ?? false);
-    if (!existsSync12(dirPath)) {
-      const targetName = basename3(dirPath).toLowerCase();
+    if (!existsSync13(dirPath)) {
+      const targetName = basename4(dirPath).toLowerCase();
       const cwd = process.cwd();
       const suggestions = [];
       try {
@@ -8358,7 +8391,7 @@ function formatSize(bytes) {
 }
 
 // src/tools/builtin/grep-files.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync5, existsSync as existsSync13 } from "fs";
+import { readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync5, existsSync as existsSync14 } from "fs";
 import { readFile } from "fs/promises";
 import { join as join8, relative } from "path";
 var grepFilesTool = {
@@ -8411,7 +8444,7 @@ Supports regex. Automatically skips node_modules, dist, .git directories.`,
     const contextLines = Math.max(0, Number(args["context_lines"] ?? 0));
     const maxResults = Math.max(1, Number(args["max_results"] ?? 50));
     if (!pattern) throw new ToolError("grep_files", "pattern is required");
-    if (!existsSync13(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
+    if (!existsSync14(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
     const MAX_PATTERN_LENGTH = 1e3;
     if (pattern.length > MAX_PATTERN_LENGTH) {
       throw new ToolError("grep_files", `Pattern too long (${pattern.length} chars, max ${MAX_PATTERN_LENGTH}). Use a shorter pattern.`);
@@ -8595,8 +8628,8 @@ function searchInFile(fullPath, displayPath2, regex, contextLines, maxResults, r
 }
 
 // src/tools/builtin/glob-files.ts
-import { readdirSync as readdirSync6, statSync as statSync6, existsSync as existsSync14 } from "fs";
-import { join as join9, relative as relative2, basename as basename4 } from "path";
+import { readdirSync as readdirSync6, statSync as statSync6, existsSync as existsSync15 } from "fs";
+import { join as join9, relative as relative2, basename as basename5 } from "path";
 var globFilesTool = {
   definition: {
     name: "glob_files",
@@ -8629,7 +8662,7 @@ Results sorted by most recent modification time. Automatically skips node_module
     const rootPath = String(args["path"] ?? process.cwd());
     const maxResults = Math.max(1, Number(args["max_results"] ?? 100));
     if (!pattern) throw new ToolError("glob_files", "pattern is required");
-    if (!existsSync14(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
+    if (!existsSync15(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
     const regex = globToRegex(pattern);
     const matches = [];
     collectMatchingFiles(rootPath, rootPath, regex, matches, maxResults);
@@ -8712,7 +8745,7 @@ function collectMatchingFiles(dirPath, rootPath, regex, results, maxResults) {
       collectMatchingFiles(fullPath, rootPath, regex, results, maxResults);
     } else if (entry.isFile()) {
       const relPath = relative2(rootPath, fullPath).replace(/\\/g, "/");
-      if (regex.test(relPath) || regex.test(basename4(relPath))) {
+      if (regex.test(relPath) || regex.test(basename5(relPath))) {
         try {
           const stat = statSync6(fullPath);
           results.push({ relPath, absPath: fullPath, mtime: stat.mtimeMs });
@@ -9447,7 +9480,7 @@ ${preamble}`;
 
 // src/tools/builtin/save-last-response.ts
 import { mkdirSync as mkdirSync7, unlinkSync as unlinkSync4, rmdirSync as rmdirSync2 } from "fs";
-import { dirname as dirname5 } from "path";
+import { dirname as dirname6 } from "path";
 var lastResponseStore = { content: "" };
 function cleanupRejectedTeeFile(filePath) {
   try {
@@ -9455,7 +9488,7 @@ function cleanupRejectedTeeFile(filePath) {
   } catch {
   }
   try {
-    rmdirSync2(dirname5(filePath));
+    rmdirSync2(dirname6(filePath));
   } catch {
   }
 }
@@ -9496,7 +9529,7 @@ Any of these triggers means use save_last_response, NOT write_file:
       throw new ToolError("save_last_response", "No content to save: AI has not produced any response yet, or the last response was empty.");
     }
     undoStack.push(filePath, `save_last_response: ${filePath}`);
-    mkdirSync7(dirname5(filePath), { recursive: true });
+    mkdirSync7(dirname6(filePath), { recursive: true });
     atomicWriteFileSync(filePath, content);
     const lines = content.split("\n").length;
     return `File saved: ${filePath} (${lines} lines, ${content.length} bytes)`;
@@ -9508,13 +9541,13 @@ import { join as join12 } from "path";
 import { homedir as homedir5 } from "os";
 
 // src/memory/persistent-memory.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync12 } from "fs";
 import { randomUUID, createHash as createHash2 } from "crypto";
-import { dirname as dirname6, join as join11, resolve as resolve6 } from "path";
+import { dirname as dirname7, join as join11, resolve as resolve6 } from "path";
 
 // src/tools/git-context.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { join as join10 } from "path";
 function runGit(cmd, cwd) {
   try {
@@ -9532,7 +9565,7 @@ function getGitRoot(cwd = process.cwd()) {
   return runGit("rev-parse --show-toplevel", cwd);
 }
 function getGitContext(cwd = process.cwd()) {
-  if (!existsSync15(join10(cwd, ".git"))) {
+  if (!existsSync16(join10(cwd, ".git"))) {
     const result = runGit("rev-parse --git-dir", cwd);
     if (!result) return null;
   }
@@ -9643,7 +9676,7 @@ function normalizeEntry(value) {
 }
 function legacyEntriesFromMarkdown(configDir) {
   const file = memoryMarkdownPath(configDir);
-  if (!existsSync16(file)) return [];
+  if (!existsSync17(file)) return [];
   const content = readFileSync12(file, "utf-8").trim();
   if (!content) return [];
   const parts = content.split(/\n(?=##\s+\d{4}-\d{2}-\d{2})/g);
@@ -9660,7 +9693,7 @@ ${chunk}`).digest("hex").slice(0, 12);
 }
 function loadMemoryEntries(configDir) {
   const file = memoryStorePath(configDir);
-  if (!existsSync16(file)) return legacyEntriesFromMarkdown(configDir);
+  if (!existsSync17(file)) return legacyEntriesFromMarkdown(configDir);
   const text = readFileSync12(file, "utf-8").trim();
   if (!text) return [];
   const entries = [];
@@ -10108,13 +10141,13 @@ function formatResults2(query, data, _requested) {
 }
 
 // src/agents/agent-config.ts
-import { existsSync as existsSync18, readdirSync as readdirSync8, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync19, readdirSync as readdirSync8, readFileSync as readFileSync14 } from "fs";
 import { join as join14 } from "path";
 import { homedir as homedir6 } from "os";
 
 // src/plugins/plugin-manager.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync13, cpSync, rmSync, statSync as statSync7 } from "fs";
-import { basename as basename5, dirname as dirname7, join as join13, resolve as resolve7 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync13, realpathSync as realpathSync2, cpSync, rmSync, statSync as statSync7 } from "fs";
+import { basename as basename6, dirname as dirname8, join as join13, relative as relative3, resolve as resolve7, sep as sep3 } from "path";
 import { createHash as createHash3 } from "crypto";
 import { z as z2 } from "zod";
 var MANIFEST_RELATIVE = ".aicli-plugin/plugin.json";
@@ -10184,30 +10217,127 @@ function statePath(configDir) {
 }
 function loadState(configDir) {
   const file = statePath(configDir);
-  if (!existsSync17(file)) return { version: 1, plugins: [] };
+  if (!existsSync18(file)) return { version: 2, plugins: [] };
   try {
     const parsed = JSON.parse(readFileSync13(file, "utf-8"));
-    return { version: 1, plugins: Array.isArray(parsed.plugins) ? parsed.plugins : [] };
+    const rawPlugins = Array.isArray(parsed.plugins) ? parsed.plugins : [];
+    return { version: 2, plugins: rawPlugins.map((p) => migrateEntry(p)) };
   } catch {
-    return { version: 1, plugins: [] };
+    return { version: 2, plugins: [] };
   }
 }
+function migrateEntry(entry) {
+  const name = String(entry.name ?? "");
+  const contentHash = typeof entry.contentHash === "string" ? entry.contentHash : void 0;
+  const legacyHash = typeof entry.hash === "string" ? entry.hash : void 0;
+  const trusted = contentHash ? entry.trusted === true : false;
+  return {
+    name,
+    enabled: entry.enabled === true,
+    trusted,
+    contentHash: contentHash ?? legacyHash,
+    installedAt: String(entry.installedAt ?? (/* @__PURE__ */ new Date(0)).toISOString()),
+    trustedAt: trusted && entry.trustedAt ? String(entry.trustedAt) : void 0,
+    enabledAt: entry.enabledAt ? String(entry.enabledAt) : void 0
+  };
+}
 function saveState(configDir, state2) {
   mkdirSync9(pluginRoot(configDir), { recursive: true });
   atomicWriteFileSync(statePath(configDir), JSON.stringify(state2, null, 2));
 }
-function hashPluginManifest(manifestPath) {
-  return createHash3("sha256").update(readFileSync13(manifestPath)).digest("hex");
+function normalizeForHash(buf) {
+  const str = buf.toString("utf-8").replaceAll("\r\n", "\n");
+  return Buffer.from(str, "utf-8");
+}
+function extractCommandPaths(command, pluginDir) {
+  const resolvedDir = resolve7(pluginDir);
+  const refs = [];
+  for (const m of command.matchAll(/\$PLUGIN_DIR[\\/]([^"'\s]+)/g)) {
+    refs.push(m[1]);
+  }
+  for (const m of command.matchAll(/\$\{pluginDir\}[\\/]([^"'\s}]+)/g)) {
+    refs.push(m[1]);
+  }
+  for (const m of command.matchAll(/(?<=["'\s])(\.?[.\\/][^"'\s]+)/g)) {
+    refs.push(m[0]);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const valid = [];
+  for (const ref of refs) {
+    if (seen.has(ref)) continue;
+    seen.add(ref);
+    try {
+      const abs = resolve7(resolvedDir, ref);
+      if (!abs.startsWith(resolvedDir + sep3)) continue;
+      if (existsSync18(abs)) {
+        const real = realpathSync2(abs);
+        if (!real.startsWith(resolvedDir + sep3)) continue;
+        valid.push(relative3(resolvedDir, real));
+      }
+    } catch {
+    }
+  }
+  return valid;
+}
+function hashPluginContent(pluginDir, manifest) {
+  const resolvedDir = resolve7(pluginDir);
+  const assetRels = /* @__PURE__ */ new Set(
+    [...manifest.skills, ...manifest.commands, ...manifest.agents]
+  );
+  for (const raw of Object.values(manifest.hooks?.events ?? {})) {
+    const items = Array.isArray(raw) ? raw : [raw];
+    for (const item of items) {
+      const cmd = typeof item === "string" ? item : item.command;
+      if (cmd) {
+        for (const p of extractCommandPaths(cmd, pluginDir)) assetRels.add(p);
+      }
+    }
+  }
+  for (const server of Object.values(manifest.mcpServers ?? {})) {
+    for (const p of extractCommandPaths(server.command, pluginDir)) assetRels.add(p);
+    for (const arg of server.args ?? []) {
+      for (const p of extractCommandPaths(arg, pluginDir)) assetRels.add(p);
+    }
+  }
+  const sorted = [...assetRels].sort();
+  const hasher = createHash3("sha256");
+  const manifestPath = join13(resolvedDir, MANIFEST_RELATIVE);
+  hasher.update(normalizeForHash(readFileSync13(manifestPath)));
+  for (const rel of sorted) {
+    const abs = resolve7(resolvedDir, rel);
+    if (!abs.startsWith(resolvedDir + sep3)) {
+      throw new Error(`plugin asset escapes plugin dir: ${rel}`);
+    }
+    let realPath;
+    try {
+      realPath = realpathSync2(abs);
+    } catch {
+      continue;
+    }
+    try {
+      if (statSync7(realPath).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    if (!realPath.startsWith(resolvedDir + sep3)) {
+      throw new Error(`plugin asset symlink escapes plugin dir: ${rel} \u2192 ${realPath}`);
+    }
+    hasher.update(normalizeForHash(readFileSync13(abs)));
+  }
+  return hasher.digest("hex");
+}
+function effectiveHash(entry) {
+  return entry.contentHash ?? entry.hash ?? "";
 }
 function readPluginManifest(manifestPath) {
   return PluginManifestSchema.parse(JSON.parse(readFileSync13(manifestPath, "utf-8")));
 }
 function findPluginSourceDir(inputPath) {
   const abs = resolve7(inputPath);
-  const direct = statSync7(abs).isDirectory() ? abs : dirname7(abs);
-  if (existsSync17(pluginManifestPath(direct))) return direct;
+  const direct = statSync7(abs).isDirectory() ? abs : dirname8(abs);
+  if (existsSync18(pluginManifestPath(direct))) return direct;
   const nested = join13(direct, ".aicli-plugin");
-  if (existsSync17(join13(nested, "plugin.json"))) return direct;
+  if (existsSync18(join13(nested, "plugin.json"))) return direct;
   throw new Error(`plugin manifest not found: ${MANIFEST_RELATIVE}`);
 }
 function installPlugin(configDir, inputPath) {
@@ -10215,22 +10345,22 @@ function installPlugin(configDir, inputPath) {
   const manifest = readPluginManifest(pluginManifestPath(sourceDir));
   const targetDir = join13(pluginRoot(configDir), manifest.name);
   mkdirSync9(pluginRoot(configDir), { recursive: true });
-  if (existsSync17(targetDir)) rmSync(targetDir, { recursive: true, force: true });
+  if (existsSync18(targetDir)) rmSync(targetDir, { recursive: true, force: true });
   cpSync(sourceDir, targetDir, { recursive: true });
   const manifestPath = pluginManifestPath(targetDir);
-  const hash = hashPluginManifest(manifestPath);
+  const contentHash = hashPluginContent(targetDir, manifest);
   const state2 = loadState(configDir);
   const previous = state2.plugins.find((p) => p.name === manifest.name);
   const next = {
     name: manifest.name,
     enabled: previous?.enabled ?? false,
     trusted: false,
-    hash,
+    contentHash,
     installedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   state2.plugins = [...state2.plugins.filter((p) => p.name !== manifest.name), next];
   saveState(configDir, state2);
-  return { name: manifest.name, dir: targetDir, manifestPath, manifest, hash, enabled: next.enabled, trusted: false, valid: true };
+  return { name: manifest.name, dir: targetDir, manifestPath, manifest, hash: contentHash, enabled: next.enabled, trusted: false, valid: true };
 }
 function setPluginEnabled(configDir, name, enabled) {
   const plugin = getInstalledPlugin(configDir, name);
@@ -10240,10 +10370,10 @@ function setPluginEnabled(configDir, name, enabled) {
     name: plugin.name,
     enabled: false,
     trusted: false,
-    hash: plugin.hash,
+    contentHash: plugin.hash,
     installedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  const next = { ...current, enabled, hash: plugin.hash, enabledAt: enabled ? (/* @__PURE__ */ new Date()).toISOString() : current.enabledAt };
+  const next = { ...current, enabled, contentHash: plugin.hash, enabledAt: enabled ? (/* @__PURE__ */ new Date()).toISOString() : current.enabledAt };
   state2.plugins = [...state2.plugins.filter((p) => p.name !== plugin.name), next];
   saveState(configDir, state2);
   return next;
@@ -10256,10 +10386,10 @@ function trustPlugin(configDir, name) {
     name: plugin.name,
     enabled: false,
     trusted: false,
-    hash: plugin.hash,
+    contentHash: plugin.hash,
     installedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  const next = { ...current, trusted: true, hash: plugin.hash, trustedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  const next = { ...current, trusted: true, contentHash: plugin.hash, trustedAt: (/* @__PURE__ */ new Date()).toISOString() };
   state2.plugins = [...state2.plugins.filter((p) => p.name !== plugin.name), next];
   saveState(configDir, state2);
   return next;
@@ -10273,7 +10403,7 @@ function getInstalledPlugin(configDir, name) {
 }
 function listInstalledPlugins(configDir) {
   const root = pluginRoot(configDir);
-  if (!existsSync17(root)) return [];
+  if (!existsSync18(root)) return [];
   const state2 = loadState(configDir);
   const out = [];
   for (const entry of readdirSync7(root)) {
@@ -10284,18 +10414,18 @@ function listInstalledPlugins(configDir) {
       continue;
     }
     const manifestPath = pluginManifestPath(dir);
-    if (!existsSync17(manifestPath)) continue;
+    if (!existsSync18(manifestPath)) continue;
     try {
       const manifest = readPluginManifest(manifestPath);
-      const hash = hashPluginManifest(manifestPath);
+      const contentHash = hashPluginContent(dir, manifest);
       const st = state2.plugins.find((p) => p.name === manifest.name);
-      const trusted = st?.trusted === true && st.hash === hash;
+      const trusted = st?.trusted === true && effectiveHash(st) === contentHash;
       out.push({
         name: manifest.name,
         dir,
         manifestPath,
         manifest,
-        hash,
+        hash: contentHash,
         enabled: st?.enabled === true,
         trusted,
         valid: true
@@ -10324,7 +10454,7 @@ function uniqueDirs(plugin, rels) {
   for (const rel of rels) {
     const abs = resolve7(plugin.dir, rel);
     if (!abs.startsWith(resolve7(plugin.dir))) continue;
-    if (existsSync17(abs)) dirs.add(statSync7(abs).isDirectory() ? abs : dirname7(abs));
+    if (existsSync18(abs)) dirs.add(statSync7(abs).isDirectory() ? abs : dirname8(abs));
   }
   return [...dirs];
 }
@@ -10487,7 +10617,7 @@ function parseAgentConfig(raw, source, path3) {
   return cfg;
 }
 function loadAgentDir(dir, source) {
-  if (!existsSync18(dir)) return [];
+  if (!existsSync19(dir)) return [];
   const out = [];
   for (const file of readdirSync8(dir)) {
     if (!file.endsWith(".json")) continue;
@@ -11219,13 +11349,13 @@ var taskStopTool = {
 
 // src/tools/builtin/git-tools.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync19 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 import { join as join15 } from "path";
 function assertGitRepo(cwd) {
   let dir = cwd;
   const root = dir.split(/[\\/]/)[0] + (dir.includes("\\") ? "\\" : "/");
   while (dir && dir !== root) {
-    if (existsSync19(join15(dir, ".git"))) return;
+    if (existsSync20(join15(dir, ".git"))) return;
     const parent = join15(dir, "..");
     if (parent === dir) break;
     dir = parent;
@@ -11491,7 +11621,7 @@ ${commitOutput.trim()}`;
 };
 
 // src/tools/builtin/notebook-edit.ts
-import { readFileSync as readFileSync15, existsSync as existsSync20 } from "fs";
+import { readFileSync as readFileSync15, existsSync as existsSync21 } from "fs";
 import { writeFile } from "fs/promises";
 import { resolve as resolve8, extname as extname2 } from "path";
 var notebookEditTool = {
@@ -11546,7 +11676,7 @@ var notebookEditTool = {
     if (extname2(absPath).toLowerCase() !== ".ipynb") {
       throw new ToolError("notebook_edit", "path must point to a .ipynb file");
     }
-    if (!existsSync20(absPath)) {
+    if (!existsSync21(absPath)) {
       throw new ToolError("notebook_edit", `Notebook not found: ${filePath}`);
     }
     const raw = readFileSync15(absPath, "utf-8");
@@ -11966,7 +12096,7 @@ function estimateToolDefinitionTokens(def) {
 
 // src/tools/registry.ts
 import { pathToFileURL } from "url";
-import { existsSync as existsSync21, mkdirSync as mkdirSync10, readdirSync as readdirSync9 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync10, readdirSync as readdirSync9 } from "fs";
 import { join as join16 } from "path";
 var ToolRegistry = class {
   tools = /* @__PURE__ */ new Map();
@@ -12128,7 +12258,7 @@ var ToolRegistry = class {
    * Returns the number of successfully loaded plugins.
    */
   async loadPlugins(pluginsDir, allowPlugins = false) {
-    if (!existsSync21(pluginsDir)) {
+    if (!existsSync22(pluginsDir)) {
       try {
         mkdirSync10(pluginsDir, { recursive: true });
       } catch {
@@ -12705,12 +12835,12 @@ var McpManager = class {
 };
 
 // src/skills/manager.ts
-import { existsSync as existsSync22, readdirSync as readdirSync10, mkdirSync as mkdirSync11, statSync as statSync8 } from "fs";
+import { existsSync as existsSync23, readdirSync as readdirSync10, mkdirSync as mkdirSync11, statSync as statSync8 } from "fs";
 import { join as join17 } from "path";
 
 // src/skills/types.ts
 import { readFileSync as readFileSync16 } from "fs";
-import { basename as basename6 } from "path";
+import { basename as basename7 } from "path";
 function parseSimpleYaml(yaml) {
   const result = {};
   for (const line of yaml.split("\n")) {
@@ -12739,7 +12869,7 @@ function parseSkillFile(filePath) {
   if (!frontmatterMatch) {
     return {
       meta: {
-        name: basename6(filePath, ".md"),
+        name: basename7(filePath, ".md"),
         description: ""
       },
       content: raw.trim(),
@@ -12750,7 +12880,7 @@ function parseSkillFile(filePath) {
   const parsed = parseSimpleYaml(yaml);
   return {
     meta: {
-      name: parsed["name"] ?? basename6(filePath, ".md"),
+      name: parsed["name"] ?? basename7(filePath, ".md"),
       description: parsed["description"] ?? "",
       tools: parsed["tools"] ? parseYamlArray(parsed["tools"]) : void 0
     },
@@ -12779,7 +12909,7 @@ var SkillManager = class {
     return this.skills.size;
   }
   loadSkillDir(dir, createIfMissing) {
-    if (!existsSync22(dir)) {
+    if (!existsSync23(dir)) {
       if (createIfMissing) {
         try {
           mkdirSync11(dir, { recursive: true });
@@ -12803,7 +12933,7 @@ var SkillManager = class {
         try {
           if (statSync8(fullPath).isDirectory()) {
             const skillMd = join17(fullPath, "SKILL.md");
-            if (existsSync22(skillMd)) filePath = skillMd;
+            if (existsSync23(skillMd)) filePath = skillMd;
             else continue;
           } else {
             continue;
@@ -12862,7 +12992,7 @@ var SkillManager = class {
 // src/web/tool-executor-web.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { tmpdir as tmpdir2 } from "os";
-import { existsSync as existsSync23, readFileSync as readFileSync17 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync17 } from "fs";
 var ToolExecutorWeb = class _ToolExecutorWeb {
   constructor(registry, ws) {
     this.registry = registry;
@@ -13001,7 +13131,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
     if (call.name === "write_file") {
       const filePath = String(call.arguments["path"] ?? "");
       const newContent = String(call.arguments["content"] ?? "");
-      if (filePath && existsSync23(filePath)) {
+      if (filePath && existsSync24(filePath)) {
         try {
           const old = readFileSync17(filePath, "utf-8");
           return renderDiff(old, newContent, { filePath });
@@ -13159,12 +13289,13 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
         return { callId: call.id, content: message, isError: true };
       }
     }
-    if (networkPermission?.action === "confirm" && dangerLevel === "safe") {
+    const requiresHardConfirmation = permission.action === "confirm" && permission.hardBoundary === true;
+    if ((networkPermission?.action === "confirm" || requiresHardConfirmation) && dangerLevel === "safe") {
       this.sendToolCallStart(call);
       toolCallStarted = true;
       const confirmed = await this.confirm(call, "write");
       if (!confirmed) {
-        const rejectionMsg = `[User cancelled] The user declined network access for ${call.name}. Do not retry without asking.`;
+        const rejectionMsg = `[User cancelled] The user declined permission for ${call.name}. Do not retry without asking.`;
         this.sendToolCallResult(call, rejectionMsg, true);
         return { callId: call.id, content: rejectionMsg, isError: true };
       }
@@ -13181,7 +13312,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
         this.sendToolCallResult(call, rejectionMsg, true);
         return { callId: call.id, content: rejectionMsg, isError: true };
       }
-      if (classification.decision === "auto-approve") {
+      if (classification.decision === "auto-approve" && !requiresHardConfirmation) {
         this.send({ type: "info", message: `\u26A1 Auto-approved (/auto: ${classification.ruleId})` });
         try {
           const rawContent = await runTool(tool, call.arguments, call.name);
@@ -13199,7 +13330,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
         }
       }
     }
-    if (this.sessionAutoApprove && dangerLevel === "write") {
+    if (this.sessionAutoApprove && dangerLevel === "write" && !requiresHardConfirmation) {
       try {
         const rawContent = await runTool(tool, call.arguments, call.name);
         const content = truncateOutput(rawContent, call.name);
@@ -13306,7 +13437,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
 };
 
 // src/repl/dev-state.ts
-import { existsSync as existsSync24, readFileSync as readFileSync18, unlinkSync as unlinkSync5, mkdirSync as mkdirSync12 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync18, unlinkSync as unlinkSync5, mkdirSync as mkdirSync12 } from "fs";
 import { join as join18 } from "path";
 import { homedir as homedir7 } from "os";
 function getDevStatePath() {
@@ -13314,7 +13445,7 @@ function getDevStatePath() {
 }
 function loadDevState() {
   const path3 = getDevStatePath();
-  if (!existsSync24(path3)) return null;
+  if (!existsSync25(path3)) return null;
   const content = readFileSync18(path3, "utf-8").trim();
   return content || null;
 }
@@ -13572,8 +13703,8 @@ function autoTrimSessionIfNeeded(session, sizeLimit = SESSION_SIZE_LIMIT) {
 }
 
 // src/core/context-files.ts
-import { existsSync as existsSync25, readFileSync as readFileSync19 } from "fs";
-import { join as join19, relative as relative3, resolve as resolve9 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync19 } from "fs";
+import { join as join19, relative as relative4, resolve as resolve9 } from "path";
 function uniqueNonEmpty(values) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -13589,14 +13720,14 @@ function buildContextFileCandidates(fallbackFilenames = []) {
   return uniqueNonEmpty([...CONTEXT_FILE_CANDIDATES, ...fallbackFilenames]);
 }
 function displayPath(filePath, cwd) {
-  const rel = relative3(cwd, filePath);
+  const rel = relative4(cwd, filePath);
   if (rel && !rel.startsWith("..") && !rel.startsWith("/") && !rel.startsWith("\\")) {
     return rel;
   }
   return filePath;
 }
 function isInsideOrEqual(parent, child) {
-  const rel = relative3(resolve9(parent), resolve9(child));
+  const rel = relative4(resolve9(parent), resolve9(child));
   return rel === "" || !!rel && !rel.startsWith("..") && !rel.startsWith("/") && !rel.startsWith("\\");
 }
 function readContextFile(level, filePath, cwd, maxBytes) {
@@ -13651,7 +13782,7 @@ function findFirstContextFile(level, dir, cwd, candidates, maxBytes) {
   const skipped = [];
   for (const candidate of candidates) {
     const filePath = join19(dir, candidate);
-    if (!existsSync25(filePath)) continue;
+    if (!existsSync26(filePath)) continue;
     const result = readContextFile(level, filePath, cwd, maxBytes);
     if (result.skipped) skipped.push(result.skipped);
     if (result.layer) return { layer: result.layer, skipped };
@@ -13678,7 +13809,7 @@ function loadContextFiles(options) {
       });
       return { layers: [], mergedContent: "", skipped, totalChars: 0, totalBytes: 0, maxBytes, candidates };
     }
-    if (!existsSync25(filePath)) {
+    if (!existsSync26(filePath)) {
       skipped.push({
         level: "single",
         filePath,
@@ -13729,11 +13860,11 @@ function loadContextFiles(options) {
 }
 
 // src/web/session-handler.ts
-import { mkdirSync as mkdirSync16, createWriteStream as createWriteStream3 } from "fs";
+import { mkdirSync as mkdirSync15, createWriteStream as createWriteStream2 } from "fs";
 import { join as join26, dirname as dirname10 } from "path";
 
 // src/repl/commands/project-init.ts
-import { existsSync as existsSync26, readFileSync as readFileSync20, readdirSync as readdirSync11, statSync as statSync9 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync20, readdirSync as readdirSync11, statSync as statSync9 } from "fs";
 import { join as join20 } from "path";
 var SCAN_SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
@@ -13817,7 +13948,7 @@ function scanProject(cwd) {
     configFiles: [],
     directoryStructure: ""
   };
-  const check = (file) => existsSync26(join20(cwd, file));
+  const check = (file) => existsSync27(join20(cwd, file));
   const configCandidates = [
     "package.json",
     "tsconfig.json",
@@ -14619,8 +14750,8 @@ async function handlePlan(args, ctx) {
 }
 
 // src/web/commands/_shared.ts
-import { existsSync as existsSync29, readFileSync as readFileSync22, writeFileSync as writeFileSync3, mkdirSync as mkdirSync14, readdirSync as readdirSync13, statSync as statSync12, createWriteStream } from "fs";
-import { join as join24, resolve as resolve10, dirname as dirname8 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync22, writeFileSync as writeFileSync3, mkdirSync as mkdirSync14, readdirSync as readdirSync13, statSync as statSync12, createWriteStream } from "fs";
+import { join as join24, resolve as resolve10, dirname as dirname9 } from "path";
 
 // src/cli/review-prompts.ts
 function buildReviewPrompt(diff, gitContextStr, detailed) {
@@ -14692,13 +14823,13 @@ function readGitDiff(options = {}) {
 }
 
 // src/diagnostics/doctor-report.ts
-import { existsSync as existsSync28, statSync as statSync11 } from "fs";
+import { existsSync as existsSync29, statSync as statSync11 } from "fs";
 import { join as join23 } from "path";
 import { arch as arch2, platform as platform7, release as release2 } from "os";
 
 // src/diagnostics/crash-log.ts
 import {
-  existsSync as existsSync27,
+  existsSync as existsSync28,
   mkdirSync as mkdirSync13,
   readdirSync as readdirSync12,
   readFileSync as readFileSync21,
@@ -14719,7 +14850,7 @@ function truncate(s, n) {
 }
 function listRecentCrashes(limit = 10, configDir) {
   const dir = getLogsDir(configDir);
-  if (!existsSync27(dir)) return [];
+  if (!existsSync28(dir)) return [];
   const files = [];
   let names;
   try {
@@ -14752,7 +14883,7 @@ function listRecentCrashes(limit = 10, configDir) {
 }
 function getConfigDirUsage(configDir) {
   const base = configDir ?? join22(homedir8(), CONFIG_DIR_NAME);
-  if (!existsSync27(base)) return { totalBytes: 0, entries: [] };
+  if (!existsSync28(base)) return { totalBytes: 0, entries: [] };
   const entries = [];
   let total = 0;
   let names;
@@ -14787,7 +14918,7 @@ function dirSize(path3) {
 
 // src/diagnostics/doctor-report.ts
 function checkFile(label, path3) {
-  const exists = existsSync28(path3);
+  const exists = existsSync29(path3);
   let sizeBytes = null;
   if (exists) {
     try {
@@ -14885,7 +15016,7 @@ function buildDoctorReport(options) {
     mcp: {
       enabled: config.get("mcpEnabled"),
       configured: Object.keys(mcpServers).length,
-      projectConfigExists: existsSync28(join23(projectRoot, MCP_PROJECT_CONFIG_NAME)),
+      projectConfigExists: existsSync29(join23(projectRoot, MCP_PROJECT_CONFIG_NAME)),
       statuses: options.mcpStatuses ?? []
     },
     recentCrashes: listRecentCrashes(5, configDir),
@@ -15755,7 +15886,7 @@ ${activated.meta.description || ""}` });
 async function handleCommands(_args, ctx) {
   const configDir = ctx.config.getConfigDir();
   const commandsDir = join24(configDir, CUSTOM_COMMANDS_DIR_NAME);
-  if (!existsSync29(commandsDir)) {
+  if (!existsSync30(commandsDir)) {
     ctx.send({ type: "info", message: `No custom commands directory.
 Create: ${commandsDir}/ with .md files.` });
     return;
@@ -15855,7 +15986,7 @@ async function handleSecurityReview(args, ctx) {
 async function handleTest(args, ctx) {
   ctx.send({ type: "info", message: "\u{1F9EA} Running tests..." });
   try {
-    const { executeTests } = await import("./run-tests-QR2PYR2P.js");
+    const { executeTests } = await import("./run-tests-DI6WEYHX.js");
     const argStr = args.join(" ").trim();
     let testArgs = {};
     if (argStr) {
@@ -15885,7 +16016,7 @@ async function handleDiff(args, ctx) {
   let modifiedFiles = 0;
   const diffLines2 = [];
   for (const [filePath, { earliest }] of fileMap) {
-    const currentContent = existsSync29(filePath) ? (() => {
+    const currentContent = existsSync30(filePath) ? (() => {
       try {
         return readFileSync22(filePath, "utf-8");
       } catch {
@@ -15924,7 +16055,7 @@ async function handleInit(args, ctx) {
   const cwd = process.cwd();
   const targetPath = join24(cwd, "AICLI.md");
   const force = args.includes("--force");
-  if (existsSync29(targetPath) && !force) {
+  if (existsSync30(targetPath) && !force) {
     ctx.send({ type: "info", message: `AICLI.md already exists at ${targetPath}
 Use /init --force to overwrite.` });
     return;
@@ -16108,7 +16239,7 @@ Use /add-dir remove to clear.` : "No directories added.\nUsage: /add-dir <path>
     return;
   }
   const dirPath = resolve10(sub);
-  if (!existsSync29(dirPath)) {
+  if (!existsSync30(dirPath)) {
     ctx.send({ type: "error", message: `Directory not found: ${dirPath}` });
     return;
   }
@@ -17183,7 +17314,7 @@ Try: /compact to reduce context, /clear to reset, or switch to a larger-context
           this.send({ type: "response_done", content, usage });
           if (pendingTeeSave && isCleanDocumentBody(content)) {
             try {
-              mkdirSync16(dirname10(pendingTeeSave), { recursive: true });
+              mkdirSync15(dirname10(pendingTeeSave), { recursive: true });
               const bodyToSave = stripOuterCodeFence(content);
               atomicWriteFileSync(pendingTeeSave, bodyToSave);
               undoStack.push(pendingTeeSave, `save_last_response (deferred): ${pendingTeeSave}`);
@@ -17359,8 +17490,8 @@ ${summaryContent}`,
     let isError = false;
     let summary;
     try {
-      mkdirSync16(dirname10(saveToFile), { recursive: true });
-      fileStream = createWriteStream3(saveToFile);
+      mkdirSync15(dirname10(saveToFile), { recursive: true });
+      fileStream = createWriteStream2(saveToFile);
       const teeSystemPrompt = stripToolCallReminder(systemPrompt ?? "") + CONTENT_ONLY_STREAM_REMINDER;
       const teeExtraMessages = extraMessages.length > 0 ? [...extraMessages, { role: "user", content: TEE_FINAL_USER_NUDGE }] : [{ role: "user", content: TEE_FINAL_USER_NUDGE }];
       const chatRequest = {
@@ -17934,8 +18065,8 @@ async function setupProxy(configProxy) {
 }
 
 // src/web/auth.ts
-import { existsSync as existsSync32, readFileSync as readFileSync25, writeFileSync as writeFileSync6, mkdirSync as mkdirSync17, readdirSync as readdirSync16, copyFileSync } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync32, readFileSync as readFileSync24, writeFileSync as writeFileSync5, mkdirSync as mkdirSync16, readdirSync as readdirSync15, copyFileSync } from "fs";
+import { isAbsolute as isAbsolute3, join as join27, relative as relative5 } from "path";
 import { createHmac, randomBytes, timingSafeEqual, pbkdf2Sync } from "crypto";
 var USERS_FILE = "users.json";
 var TOKEN_EXPIRY_HOURS = 24;
@@ -17981,7 +18112,7 @@ var AuthManager = class {
     const passwordHash = this.hashPassword(password, salt);
     const dataDir = join27(USERS_DIR, username);
     const fullDataDir = join27(this.baseDir, dataDir);
-    mkdirSync17(join27(fullDataDir, "history"), { recursive: true });
+    mkdirSync16(join27(fullDataDir, "history"), { recursive: true });
     const user = {
       username,
       passwordHash,
@@ -18135,23 +18266,23 @@ var AuthManager = class {
     const globalConfig = join27(this.baseDir, "config.json");
     if (existsSync32(globalConfig)) {
       try {
-        const content = readFileSync25(globalConfig, "utf-8");
-        writeFileSync6(join27(userDir, "config.json"), content, "utf-8");
+        const content = readFileSync24(globalConfig, "utf-8");
+        writeFileSync5(join27(userDir, "config.json"), content, "utf-8");
       } catch {
       }
     }
     const globalMemory = join27(this.baseDir, "memory.md");
     if (existsSync32(globalMemory)) {
       try {
-        const content = readFileSync25(globalMemory, "utf-8");
-        writeFileSync6(join27(userDir, "memory.md"), content, "utf-8");
+        const content = readFileSync24(globalMemory, "utf-8");
+        writeFileSync5(join27(userDir, "memory.md"), content, "utf-8");
       } catch {
       }
     }
     const globalHistory = join27(this.baseDir, "history");
     if (existsSync32(globalHistory)) {
       try {
-        const files = readdirSync16(globalHistory).filter((f) => f.endsWith(".json"));
+        const files = readdirSync15(globalHistory).filter((f) => f.endsWith(".json"));
         const userHistory = join27(userDir, "history");
         for (const f of files) {
           try {
@@ -18168,8 +18299,17 @@ var AuthManager = class {
   loadOrCreate() {
     if (existsSync32(this.usersFile)) {
       try {
-        return JSON.parse(readFileSync25(this.usersFile, "utf-8"));
-      } catch {
+        const parsed = JSON.parse(readFileSync24(this.usersFile, "utf-8"));
+        if (!this.isValidUsersDB(parsed)) {
+          throw new Error("database structure is invalid");
+        }
+        return parsed;
+      } catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new Error(
+          `Authentication database is unreadable or corrupt: ${this.usersFile} (${detail}). Refusing to start without authentication; restore or remove the file explicitly.`,
+          { cause: err }
+        );
       }
     }
     const db = {
@@ -18180,11 +18320,32 @@ var AuthManager = class {
     this.saveDB(db);
     return db;
   }
+  isValidUsersDB(value) {
+    if (!value || typeof value !== "object") return false;
+    const db = value;
+    if (db.version !== 1 || typeof db.secret !== "string" || db.secret.length < 32 || !Array.isArray(db.users)) {
+      return false;
+    }
+    const usernames = /* @__PURE__ */ new Set();
+    for (const user of db.users) {
+      if (!user || typeof user !== "object") return false;
+      const record = user;
+      if (typeof record.username !== "string" || !/^[a-z0-9_-]{2,32}$/.test(record.username) || usernames.has(record.username) || typeof record.passwordHash !== "string" || record.passwordHash.length === 0 || typeof record.salt !== "string" || record.salt.length === 0 || typeof record.createdAt !== "string" || typeof record.dataDir !== "string" || record.dataDir.length === 0 || isAbsolute3(record.dataDir)) {
+        return false;
+      }
+      const dataDirFromBase = relative5(this.baseDir, join27(this.baseDir, record.dataDir));
+      if (dataDirFromBase.startsWith("..") || isAbsolute3(dataDirFromBase)) return false;
+      if (record.hashVersion !== void 0 && record.hashVersion !== 1 && record.hashVersion !== 2) return false;
+      if (record.tokensRevokedBefore !== void 0 && !Number.isFinite(record.tokensRevokedBefore)) return false;
+      usernames.add(record.username);
+    }
+    return true;
+  }
   save() {
     this.saveDB(this.db);
   }
   saveDB(db) {
-    mkdirSync17(this.baseDir, { recursive: true });
+    mkdirSync16(this.baseDir, { recursive: true });
     atomicWriteFileSync(this.usersFile, JSON.stringify(db, null, 2));
   }
   /** Legacy hash — kept only for migrating old users (v0.2.x) */
@@ -18440,9 +18601,9 @@ async function startWebServer(options = {}) {
     const prefix = req.query.prefix || "";
     const targetDir = join28(cwd, prefix);
     try {
-      const canonicalTarget = realpathSync(resolve13(targetDir));
-      const canonicalCwd = realpathSync(resolve13(cwd));
-      if (!canonicalTarget.startsWith(canonicalCwd + sep3) && canonicalTarget !== canonicalCwd) {
+      const canonicalTarget = realpathSync3(resolve13(targetDir));
+      const canonicalCwd = realpathSync3(resolve13(cwd));
+      if (!canonicalTarget.startsWith(canonicalCwd + sep4) && canonicalTarget !== canonicalCwd) {
         res.json({ files: [] });
         return;
       }
@@ -18452,10 +18613,10 @@ async function startWebServer(options = {}) {
     }
     try {
       const SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "dist-cjs", "release", "__pycache__", ".next", ".nuxt", "coverage", ".cache"]);
-      const entries = readdirSync17(targetDir, { withFileTypes: true });
+      const entries = readdirSync16(targetDir, { withFileTypes: true });
       const files = entries.filter((e) => !SKIP.has(e.name) && !e.name.startsWith(".")).slice(0, 50).map((e) => ({
         name: e.name,
-        path: relative4(cwd, join28(targetDir, e.name)).replace(/\\/g, "/"),
+        path: relative6(cwd, join28(targetDir, e.name)).replace(/\\/g, "/"),
         isDir: e.isDirectory()
       }));
       res.json({ files });
@@ -18501,9 +18662,9 @@ async function startWebServer(options = {}) {
         return;
       }
       try {
-        const canonicalFile = realpathSync(filePath);
-        const canonicalDir = realpathSync(histDir);
-        if (!canonicalFile.startsWith(canonicalDir + sep3)) {
+        const canonicalFile = realpathSync3(filePath);
+        const canonicalDir = realpathSync3(histDir);
+        if (!canonicalFile.startsWith(canonicalDir + sep4)) {
           res.status(404).json({ error: "Session not found" });
           return;
         }
@@ -18511,7 +18672,7 @@ async function startWebServer(options = {}) {
         res.status(404).json({ error: "Session not found" });
         return;
       }
-      const data = JSON.parse(readFileSync26(filePath, "utf-8"));
+      const data = JSON.parse(readFileSync25(filePath, "utf-8"));
       res.json({ session: data });
     } catch (err) {
       res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
@@ -18526,9 +18687,9 @@ async function startWebServer(options = {}) {
     const cwd = process.cwd();
     const fullPath = resolve13(join28(cwd, filePath));
     try {
-      const canonicalFull = realpathSync(fullPath);
-      const canonicalCwd = realpathSync(resolve13(cwd));
-      if (!canonicalFull.startsWith(canonicalCwd + sep3) && canonicalFull !== canonicalCwd) {
+      const canonicalFull = realpathSync3(fullPath);
+      const canonicalCwd = realpathSync3(resolve13(cwd));
+      if (!canonicalFull.startsWith(canonicalCwd + sep4) && canonicalFull !== canonicalCwd) {
         res.json({ error: "Access denied" });
         return;
       }
@@ -18537,12 +18698,12 @@ async function startWebServer(options = {}) {
       return;
     }
     try {
-      const stat = statSync15(fullPath);
+      const stat = statSync14(fullPath);
       if (stat.size > 512 * 1024) {
         res.json({ error: `File too large (${(stat.size / 1024).toFixed(0)} KB, max 512 KB)` });
         return;
       }
-      const content = readFileSync26(fullPath, "utf-8");
+      const content = readFileSync25(fullPath, "utf-8");
       res.json({ content, size: stat.size });
     } catch {
       res.json({ error: "Cannot read file" });
@@ -18807,7 +18968,7 @@ function loadProjectMcpConfig() {
   const configPath = join28(projectRoot, MCP_PROJECT_CONFIG_NAME);
   if (!existsSync33(configPath)) return null;
   try {
-    const raw = JSON.parse(readFileSync26(configPath, "utf-8"));
+    const raw = JSON.parse(readFileSync25(configPath, "utf-8"));
     return raw.mcpServers ?? raw;
   } catch {
     return null;