jinzd-ai-cli 0.4.246 → 0.4.248

package/dist/electron-server.js

@@ -7,13 +7,13 @@ import {
   searchCandidates,
   searchChatMemory,
   updateSessionInIndex
-} from "./chunk-NV63EYFL.js";
+} from "./chunk-ZWEZNKDW.js";
 import {
   fileCheckpoints
 } from "./chunk-SKET65WZ.js";
 import {
   indexProject
-} from "./chunk-BNERFXVO.js";
+} from "./chunk-QCG6UU2S.js";
 import {
   addMemoryEntry,
   clearMemoryEntries,
@@ -34,14 +34,14 @@ import {
   touchMemoryReferences,
   updateMemoryApproval,
   updateMemoryEntry
-} from "./chunk-CJ3BPLHZ.js";
+} from "./chunk-GS5XW5UJ.js";
 import {
   redactJson,
   scanString
 } from "./chunk-YVTASHS5.js";
 import {
   runTestsTool
-} from "./chunk-USJF35NB.js";
+} from "./chunk-U3QWCBRG.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
   APP_NAME,
@@ -73,7 +73,7 @@ import {
   SUBAGENT_MAX_ROUNDS_LIMIT,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-LZGPGPA6.js";
+} from "./chunk-PNFQDFHK.js";
 import {
   hasSemanticIndex,
   semanticSearch
@@ -91,8 +91,8 @@ import {
 import express from "express";
 import { createServer } from "http";
 import { WebSocketServer } from "ws";
-import { join as join27, dirname as dirname10, resolve as resolve12, relative as relative6, sep as sep4 } from "path";
-import { existsSync as existsSync31, readFileSync as readFileSync24, readdirSync as readdirSync16, statSync as statSync14, realpathSync as realpathSync3 } from "fs";
+import { join as join25, dirname as dirname10, resolve as resolve10, relative as relative6, sep as sep4 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync23, readdirSync as readdirSync15, statSync as statSync13, realpathSync as realpathSync3 } from "fs";
 import { networkInterfaces } from "os";
 
 // src/config/config-manager.ts
@@ -2982,7 +2982,6 @@ var OpenAICompatibleProvider = class extends BaseProvider {
       const message = firstChoice.message;
       const finishReason = firstChoice.finish_reason;
       const usage = toUsage(response.usage);
-      const contentStr = typeof message.content === "string" ? message.content : "";
       const hasToolCalls = !!(message.tool_calls && message.tool_calls.length > 0);
       const reasoningContent = message.reasoning_content;
       if (message.tool_calls && message.tool_calls.length > 0) {
@@ -3407,6 +3406,7 @@ var KimiProvider = class _KimiProvider extends OpenAICompatibleProvider {
    * 其他值会收到 400 "invalid temperature: only 1 is allowed for this model"。
    */
   static TEMP_1_MODELS = /* @__PURE__ */ new Set([
+    "kimi-k3",
     "kimi-k2.6",
     "kimi-k2.5",
     "kimi-k2-thinking",
@@ -3433,6 +3433,18 @@ var KimiProvider = class _KimiProvider extends OpenAICompatibleProvider {
     requiresApiKey: true,
     baseUrl: this.defaultBaseUrl,
     models: [
+      // Kimi K3（2026-07 旗舰，1M 上下文，多步推理 + 原生 vision）。
+      // 官方文档核实（platform.kimi.ai/docs/guide/kimi-k3-quickstart）：
+      //   - contextWindow 1M（1048576）；code 就是 `kimi-k3`（UI 名 "K3 · Max" ≠ API code）
+      //   - temperature 固定 1.0（已并入 TEMP_1_MODELS）
+      //   - vision 走 base64 / ms://file-id（不收公网 URL）——本版未接图片输入路径，仅文本/工具
+      // 默认仍保持 kimi-k2.6（K3 输出 $15/MTok 偏贵，按需 /model kimi-k3）。
+      {
+        id: "kimi-k3",
+        displayName: "Kimi K3",
+        contextWindow: 1048576,
+        supportsStreaming: true
+      },
       // Kimi K2.6 / K2.5 系列（最新一代，推荐）
       {
         id: "kimi-k2.6",
@@ -4996,7 +5008,7 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
   const markerStart = `AICLI_MARKER_START:${id}`;
   const markerEnd = `AICLI_MARKER_END:${id}`;
   const wrappedCmd = IS_WINDOWS2 ? `${WIN_UTF8_PREAMBLE} echo "${markerStart}"; ${command}; echo "${markerEnd}:0"` : `echo "${markerStart}"; ${command}; echo "${markerEnd}:$?"`;
-  return new Promise((resolve13) => {
+  return new Promise((resolve11) => {
     let stdout = "";
     let stderr = "";
     let timedOut = false;
@@ -5008,11 +5020,11 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
       stdout += IS_WINDOWS2 ? decodeWindowsBuffer(chunk) : chunk.toString("utf-8");
       if (!resolved && stdout.includes(markerEndPattern)) {
         const endLine = stdout.split("\n").find((l) => l.includes(markerEndPattern));
-        const exitCode = endLine ? parseEndMarker(endLine, markerEndPattern) : null;
+        const exitCode = endLine ? parseEndMarker(endLine) : null;
         stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
         resolved = true;
         cleanup();
-        resolve13({ stdout, stderr, exitCode, timedOut, aborted });
+        resolve11({ stdout, stderr, exitCode, timedOut, aborted });
       }
     };
     const onErr = (chunk) => {
@@ -5027,7 +5039,7 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
       resolved = true;
       stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
       cleanup();
-      resolve13({ stdout, stderr, exitCode: null, timedOut, aborted });
+      resolve11({ stdout, stderr, exitCode: null, timedOut, aborted });
       killProcessTree(proc);
       pool.delete(sessionKey);
     }, timeout);
@@ -5037,7 +5049,7 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
       resolved = true;
       cleanup();
       stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
-      resolve13({ stdout, stderr, exitCode: null, timedOut, aborted });
+      resolve11({ stdout, stderr, exitCode: null, timedOut, aborted });
       killProcessTree(proc);
       pool.delete(sessionKey);
     };
@@ -5052,7 +5064,7 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
       stderr += `
 [pool error] ${err.message}`;
       cleanup();
-      resolve13({ stdout, stderr, exitCode: null, timedOut, aborted });
+      resolve11({ stdout, stderr, exitCode: null, timedOut, aborted });
       pool.delete(sessionKey);
     };
     proc.on("error", onError);
@@ -5065,7 +5077,7 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
     }
     try {
       proc.stdin?.write(wrappedCmd + "\n");
-    } catch (err) {
+    } catch {
       if (!resolved) {
         cleanup();
         pool.delete(sessionKey);
@@ -5073,7 +5085,7 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
     }
   });
 }
-function parseEndMarker(line, markerEndPattern) {
+function parseEndMarker(line) {
   const idx = line.lastIndexOf(":");
   if (idx < 0) return null;
   const code = line.slice(idx + 1).trim();
@@ -7210,7 +7222,7 @@ var ToolExecutor = class {
       };
     }
     if (permission.action === "auto-approve" && networkPermission?.action !== "confirm") {
-      this.printToolCall(call);
+      if (!toolCallAlreadyPrinted) this.printToolCall(call);
       try {
         const rawContent = await runTool(tool, call.arguments, call.name);
         const content = truncateOutput(rawContent, call.name);
@@ -7441,7 +7453,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(prompt);
     this.confirming = true;
-    return new Promise((resolve13) => {
+    return new Promise((resolve11) => {
       let completed = false;
       const cleanup = (result) => {
         if (completed) return;
@@ -7451,7 +7463,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve13(result);
+        resolve11(result);
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -7625,7 +7637,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(color("Proceed? [y/N] (type y + Enter to confirm) "));
     this.confirming = true;
-    return new Promise((resolve13) => {
+    return new Promise((resolve11) => {
       let completed = false;
       const cleanup = (answer) => {
         if (completed) return;
@@ -7635,7 +7647,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve13(answer === "y");
+        resolve11(answer === "y");
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -7816,7 +7828,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
     const mode = appendMode ? "appended" : "written";
     void (async () => {
       try {
-        const { updateFile } = await import("./indexer-4WWS3VIL.js");
+        const { updateFile } = await import("./indexer-M2LJGTY2.js");
         await updateFile(process.cwd(), filePath);
       } catch {
       }
@@ -8884,7 +8896,7 @@ var runInteractiveTool = {
       PYTHONDONTWRITEBYTECODE: "1"
     };
     const prefixWarnings = [argsTypeWarning, stdinTypeWarning].filter(Boolean).join("");
-    return new Promise((resolve13) => {
+    return new Promise((resolve11) => {
       const child = spawn4(executable, cmdArgs.map(String), {
         cwd: process.cwd(),
         env,
@@ -8917,22 +8929,22 @@ var runInteractiveTool = {
       setTimeout(writeNextLine, 400);
       const timer = setTimeout(() => {
         child.kill();
-        resolve13(`${prefixWarnings}[Timeout after ${timeout}ms]
+        resolve11(`${prefixWarnings}[Timeout after ${timeout}ms]
 ${buildOutput(stdout, stderr)}`);
       }, timeout);
       child.on("close", (code) => {
         clearTimeout(timer);
         const output = buildOutput(stdout, stderr);
         if (code !== 0 && code !== null) {
-          resolve13(`${prefixWarnings}Exit code ${code}:
+          resolve11(`${prefixWarnings}Exit code ${code}:
 ${output}`);
         } else {
-          resolve13(`${prefixWarnings}${output || "(no output)"}`);
+          resolve11(`${prefixWarnings}${output || "(no output)"}`);
         }
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve13(
+        resolve11(
           `${prefixWarnings}Failed to start process "${executable}": ${err.message}
 Hint: On Windows, use the full path to the executable, e.g.:
   C:\\Users\\Jinzd\\anaconda3\\envs\\python312\\python.exe`
@@ -9235,7 +9247,7 @@ var webFetchTool = {
     } else {
       const title = extractTitle(rawHtml);
       const desc = extractDescription(rawHtml);
-      let body = htmlToText(rawHtml);
+      const body = htmlToText(rawHtml);
       const header = [
         title ? `# ${title}` : "",
         desc ? `> ${desc}` : "",
@@ -9754,7 +9766,7 @@ function promptUser(rl, question) {
   console.log();
   console.log(chalk4.cyan("\u2753 ") + chalk4.bold(question));
   process.stdout.write(chalk4.cyan("> "));
-  return new Promise((resolve13) => {
+  return new Promise((resolve11) => {
     let completed = false;
     const cleanup = (answer) => {
       if (completed) return;
@@ -9764,7 +9776,7 @@ function promptUser(rl, question) {
       rl.pause();
       rlAny.output = savedOutput;
       askUserContext.prompting = false;
-      resolve13(answer);
+      resolve11(answer);
     };
     const onLine = (line) => {
       cleanup(line);
@@ -12320,7 +12332,7 @@ var McpClient = class {
   // 内部方法：JSON-RPC 通信
   // ══════════════════════════════════════════════════════════════════
   sendRequest(method, params) {
-    return new Promise((resolve13, reject) => {
+    return new Promise((resolve11, reject) => {
       if (!this.process?.stdin?.writable) {
         return reject(new Error(`MCP server [${this.serverId}] stdin not writable`));
       }
@@ -12332,19 +12344,18 @@ var McpClient = class {
         method,
         ...params !== void 0 ? { params } : {}
       };
-      let timer;
       const cleanup = () => {
         this.pendingRequests.delete(id);
         clearTimeout(timer);
       };
-      timer = setTimeout(() => {
+      const timer = setTimeout(() => {
         cleanup();
         reject(new Error(`MCP request [${method}] timed out (internal)`));
       }, MCP_CALL_TIMEOUT * 2);
       this.pendingRequests.set(id, {
         resolve: (result) => {
           cleanup();
-          resolve13(result);
+          resolve11(result);
         },
         reject: (error) => {
           cleanup();
@@ -12421,13 +12432,13 @@ var McpClient = class {
   }
   /** Promise 超时包装 */
   withTimeout(promise, ms, label) {
-    return new Promise((resolve13, reject) => {
+    return new Promise((resolve11, reject) => {
       const timer = setTimeout(() => {
         reject(new Error(`MCP [${this.serverId}] ${label} timed out after ${ms}ms`));
       }, ms);
       promise.then((val) => {
         clearTimeout(timer);
-        resolve13(val);
+        resolve11(val);
       }).catch((err) => {
         clearTimeout(timer);
         reject(err);
@@ -12931,33 +12942,33 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
   }
   /** Resolve a pending confirm from client response */
   resolveConfirm(requestId, approved) {
-    const resolve13 = this.pendingConfirms.get(requestId);
-    if (resolve13) {
+    const resolve11 = this.pendingConfirms.get(requestId);
+    if (resolve11) {
       this.clearPendingTimer(requestId);
       this.pendingConfirms.delete(requestId);
       this.confirming = false;
-      resolve13(approved);
+      resolve11(approved);
     }
   }
   /** Resolve a pending batch confirm from client response */
   resolveBatchConfirm(requestId, decision) {
-    const resolve13 = this.pendingBatchConfirms.get(requestId);
-    if (resolve13) {
+    const resolve11 = this.pendingBatchConfirms.get(requestId);
+    if (resolve11) {
       this.clearPendingTimer(requestId);
       this.pendingBatchConfirms.delete(requestId);
       this.confirming = false;
       if (decision === "all" || decision === "none") {
-        resolve13(decision);
+        resolve11(decision);
       } else {
-        resolve13(new Set(decision));
+        resolve11(new Set(decision));
       }
     }
   }
   /** Cancel all pending confirms (e.g., on disconnect) */
   cancelAll() {
-    for (const resolve13 of this.pendingConfirms.values()) resolve13(false);
+    for (const resolve11 of this.pendingConfirms.values()) resolve11(false);
     this.pendingConfirms.clear();
-    for (const resolve13 of this.pendingBatchConfirms.values()) resolve13("none");
+    for (const resolve11 of this.pendingBatchConfirms.values()) resolve11("none");
     this.pendingBatchConfirms.clear();
     this.confirming = false;
   }
@@ -13033,8 +13044,8 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       diff: this.getDiffPreview(call)
     };
     this.send(msg);
-    return new Promise((resolve13) => {
-      this.pendingConfirms.set(requestId, resolve13);
+    return new Promise((resolve11) => {
+      this.pendingConfirms.set(requestId, resolve11);
       this.pendingTimers.set(requestId, setTimeout(() => {
         if (this.pendingConfirms.has(requestId)) {
           this.resolveConfirm(requestId, false);
@@ -13058,8 +13069,8 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       files
     };
     this.send(msg);
-    return new Promise((resolve13) => {
-      this.pendingBatchConfirms.set(requestId, resolve13);
+    return new Promise((resolve11) => {
+      this.pendingBatchConfirms.set(requestId, resolve11);
       this.pendingTimers.set(requestId, setTimeout(() => {
         if (this.pendingBatchConfirms.has(requestId)) {
           this.resolveBatchConfirm(requestId, "none");
@@ -13169,7 +13180,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
         return { callId: call.id, content: rejectionMsg, isError: true };
       }
     }
-    this.sendToolCallStart(call);
+    if (!toolCallStarted) this.sendToolCallStart(call);
     if (this.sessionAutoMode && networkPermission?.action !== "confirm") {
       const classification = defaultActionClassifier.classify(call, dangerLevel, {
         workspaceRoot: this.workspaceRoot,
@@ -13427,6 +13438,9 @@ var PRICING_TABLE = {
   "moonshot-v1-128k": { input: 0.83, output: 0.83 },
   "kimi-k2": { input: 0.6, output: 2.5 },
   "kimi-latest": { input: 0.6, output: 2.5 },
+  // Kimi K3（2026-07 旗舰，1M 上下文）官方定价 platform.kimi.ai/pricing/chat-k3：
+  // 输入 cache-miss $3.00 / cache-hit $0.30，输出 $15.00（/MTok）。
+  "kimi-k3": { input: 3, output: 15, cacheRead: 0.3 },
   // ── Zhipu GLM ─────────────────────────────────────────────────
   "glm-4-plus": { input: 0.7, output: 0.7 },
   "glm-4": { input: 0.14, output: 0.14 },
@@ -13548,7 +13562,7 @@ function autoTrimSessionIfNeeded(session, sizeLimit = SESSION_SIZE_LIMIT) {
   const originalSize = JSON.stringify(session.toJSON()).length;
   if (originalSize <= sizeLimit) return false;
   const snapshotLen = session.messages.length;
-  let working = cloneMessages(session.messages.slice(0, snapshotLen));
+  const working = cloneMessages(session.messages.slice(0, snapshotLen));
   let committedSize = originalSize;
   let anyTrim = false;
   let keepRecent = 10;
@@ -15113,7 +15127,7 @@ Cache:  write=${cacheCreate} read=${cacheRead}` : "";
 Cost:   ${formatCost(cost)}` : "";
   let memoryLine = "";
   try {
-    const { countPendingMemories } = await import("./persistent-memory-EKZ2JF7M.js");
+    const { countPendingMemories } = await import("./persistent-memory-JBWBMA56.js");
     const pending = countPendingMemories(ctx.config.getConfigDir());
     if (pending > 0) memoryLine = `
 Memory: \u26A0 ${pending} pending approval \u2014 see the Memory panel or /memory`;
@@ -15420,7 +15434,7 @@ async function handleBranch(args, ctx) {
     return;
   }
   const sub = args[0]?.toLowerCase();
-  const resolve13 = (ref) => {
+  const resolve11 = (ref) => {
     const r = session.resolveBranchRef(ref);
     if (r.ok) return r.id;
     if (r.reason === "ambiguous") {
@@ -15474,7 +15488,7 @@ async function handleBranch(args, ctx) {
       ctx.send({ type: "error", message: "Usage: /branch switch <id|title>" });
       return;
     }
-    const id = resolve13(ref);
+    const id = resolve11(ref);
     if (!id) return;
     const ok = session.switchBranch(id);
     if (ok) {
@@ -15494,7 +15508,7 @@ async function handleBranch(args, ctx) {
       ctx.send({ type: "error", message: "Usage: /branch delete <id|title>" });
       return;
     }
-    const id = resolve13(ref);
+    const id = resolve11(ref);
     if (!id) return;
     const ok = session.deleteBranch(id);
     if (ok) {
@@ -15513,7 +15527,7 @@ async function handleBranch(args, ctx) {
       ctx.send({ type: "error", message: "Usage: /branch rename <id|title> <new title>" });
       return;
     }
-    const id = resolve13(ref);
+    const id = resolve11(ref);
     if (!id) return;
     const ok = session.renameBranch(id, title);
     if (ok) {
@@ -15531,7 +15545,7 @@ async function handleBranch(args, ctx) {
       ctx.send({ type: "error", message: "Usage: /branch diff <id|title>" });
       return;
     }
-    const id = resolve13(ref);
+    const id = resolve11(ref);
     if (!id) return;
     const d = session.diffBranches(id);
     if (!d) {
@@ -15573,7 +15587,7 @@ async function handleBranch(args, ctx) {
       ctx.send({ type: "error", message: "Usage: /branch cherry-pick <source-id|title> <msg-index>" });
       return;
     }
-    const id = resolve13(ref);
+    const id = resolve11(ref);
     if (!id) return;
     const idx = parseInt(idxStr, 10);
     if (Number.isNaN(idx)) {
@@ -15922,7 +15936,7 @@ async function handleSecurityReview(args, ctx) {
 async function handleTest(args, ctx) {
   ctx.send({ type: "info", message: "\u{1F9EA} Running tests..." });
   try {
-    const { executeTests } = await import("./run-tests-ZKHXKCQB.js");
+    const { executeTests } = await import("./run-tests-NNML2XVV.js");
     const argStr = args.join(" ").trim();
     let testArgs = {};
     if (argStr) {
@@ -16079,7 +16093,7 @@ async function handleIndex(args, ctx) {
   const sub = (args[0] ?? "status").toLowerCase();
   const root = process.cwd();
   const { loadIndex: loadIndex2, clearIndex } = await import("./store-VO37H6LS.js");
-  const { indexProject: indexProject2 } = await import("./indexer-4WWS3VIL.js");
+  const { indexProject: indexProject2 } = await import("./indexer-M2LJGTY2.js");
   const { loadVectorStore, clearVectorStore } = await import("./vector-store-JBAE6PS4.js");
   if (sub === "status") {
     const idx = loadIndex2(root);
@@ -16186,7 +16200,7 @@ async function handleMemory(args, ctx) {
     ctx.handleMemoryManage(sub, args[1], sub === "expire" ? args[2] : void 0);
   } else if (sub === "export") {
     if (args[1] === "md") {
-      const { exportMemoryEntries: exportMemoryEntries2 } = await import("./persistent-memory-EKZ2JF7M.js");
+      const { exportMemoryEntries: exportMemoryEntries2 } = await import("./persistent-memory-JBWBMA56.js");
       ctx.send({
         type: "export_data",
         format: "md",
@@ -16552,6 +16566,15 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
 }
 
 // src/web/session-handler.ts
+var CLI_ONLY_WEB_COMMANDS = /* @__PURE__ */ new Set([
+  "copy",
+  "paste",
+  "exit",
+  "quit",
+  "snapshot",
+  "hooks",
+  "hook"
+]);
 var webCommandHandlers = {
   provider: handleProvider,
   model: handleModel,
@@ -16789,10 +16812,10 @@ var SessionHandler = class {
         return;
       }
       case "ask_user_response": {
-        const resolve13 = this.pendingAskUser.get(msg.requestId);
-        if (resolve13) {
+        const resolve11 = this.pendingAskUser.get(msg.requestId);
+        if (resolve11) {
           this.pendingAskUser.delete(msg.requestId);
-          resolve13(msg.answer);
+          resolve11(msg.answer);
         }
         return;
       }
@@ -16805,10 +16828,10 @@ var SessionHandler = class {
       case "memory_manage":
         return this.handleMemoryManage(msg.action, msg.id, msg.expiresAt);
       case "auto_pause_response": {
-        const resolve13 = this.pendingAutoPause.get(msg.requestId);
-        if (resolve13) {
+        const resolve11 = this.pendingAutoPause.get(msg.requestId);
+        if (resolve11) {
           this.pendingAutoPause.delete(msg.requestId);
-          resolve13({ action: msg.action, message: msg.message });
+          resolve11({ action: msg.action, message: msg.message });
         }
         return;
       }
@@ -16823,10 +16846,10 @@ var SessionHandler = class {
         this.hubOrchestrator?.abort();
         return;
       case "hub_steer": {
-        const resolve13 = this.pendingHubReview.get(msg.requestId);
-        if (resolve13) {
+        const resolve11 = this.pendingHubReview.get(msg.requestId);
+        if (resolve11) {
           this.pendingHubReview.delete(msg.requestId);
-          resolve13({ action: msg.action, message: msg.message });
+          resolve11({ action: msg.action, message: msg.message });
         }
         return;
       }
@@ -16839,9 +16862,9 @@ var SessionHandler = class {
     runLifecycleHooks(mergePluginHooks(this.config.get("hooks") ?? void 0, this.config.getConfigDir()), "Stop", { sessionId: this.sessions.current?.id }, { configDir: this.config.getConfigDir() });
     this.toolExecutor.cancelAll();
     if (this.abortController) this.abortController.abort();
-    for (const resolve13 of this.pendingAskUser.values()) resolve13(null);
+    for (const resolve11 of this.pendingAskUser.values()) resolve11(null);
     this.pendingAskUser.clear();
-    for (const resolve13 of this.pendingAutoPause.values()) resolve13({ action: "stop" });
+    for (const resolve11 of this.pendingAutoPause.values()) resolve11({ action: "stop" });
     this.pendingAutoPause.clear();
     this.saveIfNeeded();
     if (this._bashSessionKey) clearBashSession(this._bashSessionKey);
@@ -16976,9 +16999,9 @@ var SessionHandler = class {
     this.hubOrchestrator = orchestrator;
     orchestrator.onEvent = (event) => this.send({ type: "hub_event", event });
     if (config.humanSteer) {
-      orchestrator.onRoundReview = ({ round, maxRounds }) => new Promise((resolve13) => {
+      orchestrator.onRoundReview = ({ round, maxRounds }) => new Promise((resolve11) => {
         const requestId = `hubrev_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
-        this.pendingHubReview.set(requestId, resolve13);
+        this.pendingHubReview.set(requestId, resolve11);
         this.send({ type: "hub_review", requestId, round, maxRounds });
       });
     }
@@ -17336,8 +17359,8 @@ Try: /compact to reduce context, /clear to reset, or switch to a larger-context
         onMcpToolUsed: (name) => this.usedMcpToolNames.add(name),
         requestAutoPause: async ({ effectiveRound, maxToolRounds: totalRounds, toolSummary }) => {
           const requestId = `pause_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
-          const pauseResp = await new Promise((resolve13) => {
-            this.pendingAutoPause.set(requestId, resolve13);
+          const pauseResp = await new Promise((resolve11) => {
+            this.pendingAutoPause.set(requestId, resolve11);
             this.send({
               type: "auto_pause_request",
               requestId,
@@ -17516,8 +17539,8 @@ ${summaryContent}`,
         }
         if (chunk.done) break;
       }
-      await new Promise((resolve13, reject) => {
-        fileStream.end((err) => err ? reject(err) : resolve13());
+      await new Promise((resolve11, reject) => {
+        fileStream.end((err) => err ? reject(err) : resolve11());
       });
       const verdict = evaluateTeeContent(fullContent, saveToFile, priorContent);
       if (verdict.kind === "reject") {
@@ -17543,7 +17566,7 @@ ${summaryContent}`,
     } catch (err) {
       if (fileStream) {
         try {
-          await new Promise((resolve13) => fileStream.end(() => resolve13()));
+          await new Promise((resolve11) => fileStream.end(() => resolve11()));
         } catch {
         }
       }
@@ -17591,6 +17614,13 @@ ${summaryContent}`,
   }
   // ── Commands ─────────────────────────────────────────────────────
   async handleCommand(name, args) {
+    if (CLI_ONLY_WEB_COMMANDS.has(name)) {
+      this.send({
+        type: "error",
+        message: `/${name} is only available in the terminal REPL. Run \`aicli\` in a terminal and use /${name} there.`
+      });
+      return;
+    }
     const handler = webCommandHandlers[name];
     if (handler) {
       await handler(args, this);
@@ -17866,7 +17896,7 @@ Backup saved: ${result.backupPath}` : "";
       return;
     }
     try {
-      const { searchChatMemory: searchChatMemory2, loadChatIndex: loadChatIndex2 } = await import("./chat-index-ML5FF5L6.js");
+      const { searchChatMemory: searchChatMemory2, loadChatIndex: loadChatIndex2 } = await import("./chat-index-Q6BKWWAM.js");
       const loaded = loadChatIndex2();
       if (!loaded || loaded.idx.chunks.length === 0) {
         this.send({ type: "memory_hits", query: q, hits: [], indexMissing: true });
@@ -17902,7 +17932,7 @@ Backup saved: ${result.backupPath}` : "";
   }
   async handleMemoryStatus() {
     try {
-      const { getChatIndexStatus } = await import("./chat-index-ML5FF5L6.js");
+      const { getChatIndexStatus } = await import("./chat-index-Q6BKWWAM.js");
       const s = getChatIndexStatus();
       this.send({
         type: "memory_status",
@@ -17927,7 +17957,7 @@ Backup saved: ${result.backupPath}` : "";
         type: "info",
         message: full ? "\u{1F9E0} Rebuilding chat memory index (this may take a while on first run \u2014 ~117 MB embedder)." : "\u{1F9E0} Refreshing chat memory index (incremental)\u2026"
       });
-      const { buildChatIndex } = await import("./chat-index-ML5FF5L6.js");
+      const { buildChatIndex } = await import("./chat-index-Q6BKWWAM.js");
       const stats = await buildChatIndex({
         full,
         onProgress: (p) => {
@@ -18083,8 +18113,8 @@ async function setupProxy(configProxy) {
 }
 
 // src/web/auth.ts
-import { existsSync as existsSync30, readFileSync as readFileSync23, writeFileSync as writeFileSync5, mkdirSync as mkdirSync15, readdirSync as readdirSync15, copyFileSync } from "fs";
-import { isAbsolute as isAbsolute3, join as join26, relative as relative5 } from "path";
+import { existsSync as existsSync29, readFileSync as readFileSync22, writeFileSync as writeFileSync4, mkdirSync as mkdirSync15, readdirSync as readdirSync14, copyFileSync } from "fs";
+import { isAbsolute as isAbsolute3, join as join24, relative as relative5 } from "path";
 import { createHmac, randomBytes, timingSafeEqual, pbkdf2Sync } from "crypto";
 var USERS_FILE = "users.json";
 var TOKEN_EXPIRY_HOURS = 24;
@@ -18099,7 +18129,7 @@ var AuthManager = class {
   db;
   constructor(baseDir) {
     this.baseDir = baseDir;
-    this.usersFile = join26(baseDir, USERS_FILE);
+    this.usersFile = join24(baseDir, USERS_FILE);
     this.db = this.loadOrCreate();
   }
   // ── Public API ─────────────────────────────────────────────────
@@ -18128,9 +18158,9 @@ var AuthManager = class {
     }
     const salt = randomBytes(16).toString("hex");
     const passwordHash = this.hashPassword(password, salt);
-    const dataDir = join26(USERS_DIR, username);
-    const fullDataDir = join26(this.baseDir, dataDir);
-    mkdirSync15(join26(fullDataDir, "history"), { recursive: true });
+    const dataDir = join24(USERS_DIR, username);
+    const fullDataDir = join24(this.baseDir, dataDir);
+    mkdirSync15(join24(fullDataDir, "history"), { recursive: true });
     const user = {
       username,
       passwordHash,
@@ -18245,7 +18275,7 @@ var AuthManager = class {
   getUserDataDir(username) {
     const user = this.db.users.find((u) => u.username === username);
     if (!user) throw new Error(`User not found: ${username}`);
-    return join26(this.baseDir, user.dataDir);
+    return join24(this.baseDir, user.dataDir);
   }
   /** List all usernames */
   listUsers() {
@@ -18281,30 +18311,30 @@ var AuthManager = class {
     const err = this.register(username, password);
     if (err) return err;
     const userDir = this.getUserDataDir(username);
-    const globalConfig = join26(this.baseDir, "config.json");
-    if (existsSync30(globalConfig)) {
+    const globalConfig = join24(this.baseDir, "config.json");
+    if (existsSync29(globalConfig)) {
       try {
-        const content = readFileSync23(globalConfig, "utf-8");
-        writeFileSync5(join26(userDir, "config.json"), content, "utf-8");
+        const content = readFileSync22(globalConfig, "utf-8");
+        writeFileSync4(join24(userDir, "config.json"), content, "utf-8");
       } catch {
       }
     }
-    const globalMemory = join26(this.baseDir, "memory.md");
-    if (existsSync30(globalMemory)) {
+    const globalMemory = join24(this.baseDir, "memory.md");
+    if (existsSync29(globalMemory)) {
       try {
-        const content = readFileSync23(globalMemory, "utf-8");
-        writeFileSync5(join26(userDir, "memory.md"), content, "utf-8");
+        const content = readFileSync22(globalMemory, "utf-8");
+        writeFileSync4(join24(userDir, "memory.md"), content, "utf-8");
       } catch {
       }
     }
-    const globalHistory = join26(this.baseDir, "history");
-    if (existsSync30(globalHistory)) {
+    const globalHistory = join24(this.baseDir, "history");
+    if (existsSync29(globalHistory)) {
       try {
-        const files = readdirSync15(globalHistory).filter((f) => f.endsWith(".json"));
-        const userHistory = join26(userDir, "history");
+        const files = readdirSync14(globalHistory).filter((f) => f.endsWith(".json"));
+        const userHistory = join24(userDir, "history");
         for (const f of files) {
           try {
-            copyFileSync(join26(globalHistory, f), join26(userHistory, f));
+            copyFileSync(join24(globalHistory, f), join24(userHistory, f));
           } catch {
           }
         }
@@ -18315,9 +18345,9 @@ var AuthManager = class {
   }
   // ── Private methods ────────────────────────────────────────────
   loadOrCreate() {
-    if (existsSync30(this.usersFile)) {
+    if (existsSync29(this.usersFile)) {
       try {
-        const parsed = JSON.parse(readFileSync23(this.usersFile, "utf-8"));
+        const parsed = JSON.parse(readFileSync22(this.usersFile, "utf-8"));
         if (!this.isValidUsersDB(parsed)) {
           throw new Error("database structure is invalid");
         }
@@ -18351,7 +18381,7 @@ var AuthManager = class {
       if (typeof record.username !== "string" || !/^[a-z0-9_-]{2,32}$/.test(record.username) || usernames.has(record.username) || typeof record.passwordHash !== "string" || record.passwordHash.length === 0 || typeof record.salt !== "string" || record.salt.length === 0 || typeof record.createdAt !== "string" || typeof record.dataDir !== "string" || record.dataDir.length === 0 || isAbsolute3(record.dataDir)) {
         return false;
       }
-      const dataDirFromBase = relative5(this.baseDir, join26(this.baseDir, record.dataDir));
+      const dataDirFromBase = relative5(this.baseDir, join24(this.baseDir, record.dataDir));
       if (dataDirFromBase.startsWith("..") || isAbsolute3(dataDirFromBase)) return false;
       if (record.hashVersion !== void 0 && record.hashVersion !== 1 && record.hashVersion !== 2) return false;
       if (record.tokensRevokedBefore !== void 0 && !Number.isFinite(record.tokensRevokedBefore)) return false;
@@ -18399,7 +18429,7 @@ function getModuleDir() {
     }
   } catch {
   }
-  return resolve12(".");
+  return resolve10(".");
 }
 async function startWebServer(options = {}) {
   const port = options.port ?? 3e3;
@@ -18467,8 +18497,8 @@ async function startWebServer(options = {}) {
     }
   }
   let skillManager = null;
-  const skillsDir = join27(config.getConfigDir(), SKILLS_DIR_NAME);
-  if (existsSync31(skillsDir)) {
+  const skillsDir = join25(config.getConfigDir(), SKILLS_DIR_NAME);
+  if (existsSync30(skillsDir)) {
     skillManager = new SkillManager(skillsDir, config.get("ui").skillSizeWarn);
     skillManager.loadSkills(pluginAssets.skillDirs);
     const count = skillManager.listSkills().length;
@@ -18519,6 +18549,10 @@ async function startWebServer(options = {}) {
     console.log(`   Auth: ${authManager.listUsers().length} user(s) registered`);
   } else {
     console.log(`   Auth: disabled (no users registered)`);
+    if (host === "0.0.0.0" || host === "::") {
+      console.log("   WARNING: Web UI is reachable from the network without authentication.");
+      console.log("            Create a user first for LAN/team use: aicli user create <name>");
+    }
   }
   const requireAuth = (req, res, next) => {
     if (!authManager.isEnabled()) return next();
@@ -18539,18 +18573,18 @@ async function startWebServer(options = {}) {
     next();
   };
   const moduleDir = getModuleDir();
-  let clientDir = join27(moduleDir, "web", "client");
-  if (!existsSync31(clientDir)) {
-    clientDir = join27(moduleDir, "client");
+  let clientDir = join25(moduleDir, "web", "client");
+  if (!existsSync30(clientDir)) {
+    clientDir = join25(moduleDir, "client");
   }
-  if (!existsSync31(clientDir)) {
-    clientDir = join27(moduleDir, "..", "..", "src", "web", "client");
+  if (!existsSync30(clientDir)) {
+    clientDir = join25(moduleDir, "..", "..", "src", "web", "client");
   }
-  if (!existsSync31(clientDir)) {
-    clientDir = join27(process.cwd(), "src", "web", "client");
+  if (!existsSync30(clientDir)) {
+    clientDir = join25(process.cwd(), "src", "web", "client");
   }
   console.log(`   Static files: ${clientDir}`);
-  app.use("/vendor", express.static(join27(clientDir, "vendor"), { maxAge: "1y", immutable: true }));
+  app.use("/vendor", express.static(join25(clientDir, "vendor"), { maxAge: "1y", immutable: true }));
   app.use(express.static(clientDir));
   app.get("/api/status", (_req, res) => {
     res.json({
@@ -18617,10 +18651,10 @@ async function startWebServer(options = {}) {
   app.get("/api/files", requireAuth, (req, res) => {
     const cwd = process.cwd();
     const prefix = req.query.prefix || "";
-    const targetDir = join27(cwd, prefix);
+    const targetDir = join25(cwd, prefix);
     try {
-      const canonicalTarget = realpathSync3(resolve12(targetDir));
-      const canonicalCwd = realpathSync3(resolve12(cwd));
+      const canonicalTarget = realpathSync3(resolve10(targetDir));
+      const canonicalCwd = realpathSync3(resolve10(cwd));
       if (!canonicalTarget.startsWith(canonicalCwd + sep4) && canonicalTarget !== canonicalCwd) {
         res.json({ files: [] });
         return;
@@ -18631,10 +18665,10 @@ async function startWebServer(options = {}) {
     }
     try {
       const SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "dist-cjs", "release", "__pycache__", ".next", ".nuxt", "coverage", ".cache"]);
-      const entries = readdirSync16(targetDir, { withFileTypes: true });
+      const entries = readdirSync15(targetDir, { withFileTypes: true });
       const files = entries.filter((e) => !SKIP.has(e.name) && !e.name.startsWith(".")).slice(0, 50).map((e) => ({
         name: e.name,
-        path: relative6(cwd, join27(targetDir, e.name)).replace(/\\/g, "/"),
+        path: relative6(cwd, join25(targetDir, e.name)).replace(/\\/g, "/"),
         isDir: e.isDirectory()
       }));
       res.json({ files });
@@ -18674,8 +18708,8 @@ async function startWebServer(options = {}) {
     try {
       const authUser = req._authUser;
       const histDir = authUser ? getUserShared(authUser).config.getHistoryDir() : config.getHistoryDir();
-      const filePath = join27(histDir, `${id}.json`);
-      if (!existsSync31(filePath)) {
+      const filePath = join25(histDir, `${id}.json`);
+      if (!existsSync30(filePath)) {
         res.status(404).json({ error: "Session not found" });
         return;
       }
@@ -18690,7 +18724,7 @@ async function startWebServer(options = {}) {
         res.status(404).json({ error: "Session not found" });
         return;
       }
-      const data = JSON.parse(readFileSync24(filePath, "utf-8"));
+      const data = JSON.parse(readFileSync23(filePath, "utf-8"));
       res.json({ session: data });
     } catch (err) {
       res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
@@ -18703,10 +18737,10 @@ async function startWebServer(options = {}) {
       return;
     }
     const cwd = process.cwd();
-    const fullPath = resolve12(join27(cwd, filePath));
+    const fullPath = resolve10(join25(cwd, filePath));
     try {
       const canonicalFull = realpathSync3(fullPath);
-      const canonicalCwd = realpathSync3(resolve12(cwd));
+      const canonicalCwd = realpathSync3(resolve10(cwd));
       if (!canonicalFull.startsWith(canonicalCwd + sep4) && canonicalFull !== canonicalCwd) {
         res.json({ error: "Access denied" });
         return;
@@ -18716,12 +18750,12 @@ async function startWebServer(options = {}) {
       return;
     }
     try {
-      const stat = statSync14(fullPath);
+      const stat = statSync13(fullPath);
       if (stat.size > 512 * 1024) {
         res.json({ error: `File too large (${(stat.size / 1024).toFixed(0)} KB, max 512 KB)` });
         return;
       }
-      const content = readFileSync24(fullPath, "utf-8");
+      const content = readFileSync23(fullPath, "utf-8");
       res.json({ content, size: stat.size });
     } catch {
       res.json({ error: "Cannot read file" });
@@ -18850,7 +18884,7 @@ async function startWebServer(options = {}) {
               ws.send(JSON.stringify({ type: "auth_result", success: false, error: err }));
               return;
             }
-            const newToken = authManager.login(username, password);
+            authManager.login(username, password);
             authenticatedUser = username;
             const userShared = getUserShared(username);
             handler = new SessionHandler(ws, userShared);
@@ -18925,7 +18959,7 @@ async function startWebServer(options = {}) {
   });
   const MAX_PORT_ATTEMPTS = 10;
   let actualPort = port;
-  const result = await new Promise((resolve13, reject) => {
+  const result = await new Promise((resolve11, reject) => {
     const tryListen = (attempt) => {
       server.once("error", (err) => {
         if (err.code === "EADDRINUSE" && attempt < MAX_PORT_ATTEMPTS) {
@@ -18956,7 +18990,7 @@ async function startWebServer(options = {}) {
         }
         console.log(`   Press Ctrl+C to stop
 `);
-        resolve13({ port: actualPort, host, url });
+        resolve11({ port: actualPort, host, url });
       });
     };
     tryListen(1);
@@ -18976,17 +19010,17 @@ function resolveProjectMcpPath() {
   const cwd = process.cwd();
   const gitRoot = getGitRoot(cwd);
   const projectRoot = gitRoot ?? cwd;
-  const configPath = join27(projectRoot, MCP_PROJECT_CONFIG_NAME);
-  return existsSync31(configPath) ? configPath : null;
+  const configPath = join25(projectRoot, MCP_PROJECT_CONFIG_NAME);
+  return existsSync30(configPath) ? configPath : null;
 }
 function loadProjectMcpConfig() {
   const cwd = process.cwd();
   const gitRoot = getGitRoot(cwd);
   const projectRoot = gitRoot ?? cwd;
-  const configPath = join27(projectRoot, MCP_PROJECT_CONFIG_NAME);
-  if (!existsSync31(configPath)) return null;
+  const configPath = join25(projectRoot, MCP_PROJECT_CONFIG_NAME);
+  if (!existsSync30(configPath)) return null;
   try {
-    const raw = JSON.parse(readFileSync24(configPath, "utf-8"));
+    const raw = JSON.parse(readFileSync23(configPath, "utf-8"));
     return raw.mcpServers ?? raw;
   } catch {
     return null;