jinzd-ai-cli 0.4.253 → 0.4.255

package/dist/{server-VOIG5VKM.js → server-PMEZ3HDO.js}

@@ -23,7 +23,7 @@ import {
   scanDirTree,
   scanProject,
   setupProxy
-} from "./chunk-P5JUXUBS.js";
+} from "./chunk-2UZ23L5P.js";
 import {
   computeCost,
   formatCost,
@@ -63,7 +63,7 @@ import {
   spawnAgentContext,
   truncateOutput,
   undoStack
-} from "./chunk-BZNTSGLQ.js";
+} from "./chunk-PSP4W2MG.js";
 import {
   addMemoryEntry,
   clearMemoryEntries,
@@ -77,7 +77,7 @@ import {
   parseWritableScope,
   updateMemoryApproval,
   updateMemoryEntry
-} from "./chunk-USG3ASQ2.js";
+} from "./chunk-X2V76VPG.js";
 import "./chunk-GLSR2NR3.js";
 import "./chunk-UUSRWSSX.js";
 import "./chunk-CKH4KQ4E.js";
@@ -90,13 +90,13 @@ import {
   buildDoctorReport,
   formatDoctorReport,
   loadContextFiles
-} from "./chunk-SC6FMQLH.js";
+} from "./chunk-3WKUKMBG.js";
 import {
   ProviderRegistry
 } from "./chunk-ZRBGH245.js";
 import {
   ConfigManager
-} from "./chunk-OWCEONX7.js";
+} from "./chunk-IRSNREEO.js";
 import {
   describePlugin,
   getActivePluginAssets,
@@ -111,7 +111,7 @@ import {
   runTool,
   setPluginEnabled,
   trustPlugin
-} from "./chunk-Q4KBR2SG.js";
+} from "./chunk-FOC2YWOF.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   TEE_FINAL_USER_NUDGE,
@@ -136,7 +136,7 @@ import {
   getGitRoot
 } from "./chunk-HOSJZMQS.js";
 import "./chunk-4BKXL7SM.js";
-import "./chunk-ABMMKA5S.js";
+import "./chunk-U6OV523Y.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
   AUTHOR,
@@ -152,7 +152,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-M2QHKPRA.js";
+} from "./chunk-SVWIUNOA.js";
 import "./chunk-6RPGQ5CG.js";
 import "./chunk-KHYD3WXE.js";
 import "./chunk-NYNSYLFY.js";
@@ -813,7 +813,7 @@ Cache:  write=${cacheCreate} read=${cacheRead}` : "";
 Cost:   ${formatCost(cost)}` : "";
   let memoryLine = "";
   try {
-    const { countPendingMemories } = await import("./persistent-memory-HQKE5X7Z.js");
+    const { countPendingMemories } = await import("./persistent-memory-DMN76UB5.js");
     const pending = countPendingMemories(ctx.config.getConfigDir());
     if (pending > 0) memoryLine = `
 Memory: \u26A0 ${pending} pending approval \u2014 see the Memory panel or /memory`;
@@ -1622,7 +1622,7 @@ async function handleSecurityReview(args, ctx) {
 async function handleTest(args, ctx) {
   ctx.send({ type: "info", message: "\u{1F9EA} Running tests..." });
   try {
-    const { executeTests } = await import("./run-tests-RSYTYFZF.js");
+    const { executeTests } = await import("./run-tests-ADZQ2JWI.js");
     const argStr = args.join(" ").trim();
     let testArgs = {};
     if (argStr) {
@@ -1886,7 +1886,7 @@ async function handleMemory(args, ctx) {
     ctx.handleMemoryManage(sub, args[1], sub === "expire" ? args[2] : void 0);
   } else if (sub === "export") {
     if (args[1] === "md") {
-      const { exportMemoryEntries: exportMemoryEntries2 } = await import("./persistent-memory-HQKE5X7Z.js");
+      const { exportMemoryEntries: exportMemoryEntries2 } = await import("./persistent-memory-DMN76UB5.js");
       ctx.send({
         type: "export_data",
         format: "md",

package/dist/{task-orchestrator-PLP3INNN.js → task-orchestrator-KLCN25OY.js}

@@ -3,15 +3,15 @@ import {
   ToolRegistry,
   googleSearchContext,
   truncateOutput
-} from "./chunk-BZNTSGLQ.js";
-import "./chunk-USG3ASQ2.js";
+} from "./chunk-PSP4W2MG.js";
+import "./chunk-X2V76VPG.js";
 import "./chunk-GLSR2NR3.js";
 import "./chunk-UUSRWSSX.js";
 import "./chunk-CKH4KQ4E.js";
 import "./chunk-BXP6YZ2P.js";
 import {
   runTool
-} from "./chunk-Q4KBR2SG.js";
+} from "./chunk-FOC2YWOF.js";
 import {
   getDangerLevel,
   runLeanAgentLoop
@@ -19,10 +19,10 @@ import {
 import "./chunk-5ULLIOVC.js";
 import "./chunk-HOSJZMQS.js";
 import "./chunk-4BKXL7SM.js";
-import "./chunk-ABMMKA5S.js";
+import "./chunk-U6OV523Y.js";
 import {
   SUBAGENT_ALLOWED_TOOLS
-} from "./chunk-M2QHKPRA.js";
+} from "./chunk-SVWIUNOA.js";
 import "./chunk-6RPGQ5CG.js";
 import "./chunk-KHYD3WXE.js";
 import "./chunk-NYNSYLFY.js";

package/dist/{usage-3EQUVK37.js → usage-MNMRX5OE.js}

@@ -8,9 +8,9 @@ import {
 } from "./chunk-GUOLPI33.js";
 import {
   ConfigManager
-} from "./chunk-OWCEONX7.js";
+} from "./chunk-IRSNREEO.js";
 import "./chunk-5ULLIOVC.js";
-import "./chunk-M2QHKPRA.js";
+import "./chunk-SVWIUNOA.js";
 import "./chunk-IW3Q7AE5.js";
 
 // src/cli/usage.ts

package/dist/web/client/api.js

@@ -0,0 +1,41 @@
+export async function fetchSessionReplay(sessionId) {
+  const resp = await fetch('/api/sessions/' + encodeURIComponent(sessionId) + '/replay', {
+    credentials: 'same-origin',
+  });
+  const data = await resp.json().catch(() => ({}));
+  if (!resp.ok) {
+    throw new Error(data.error || String(resp.status));
+  }
+  return data.session;
+}
+
+export async function submitAuth(mode, username, password) {
+  const path = mode === 'register' ? '/api/auth/register' : '/api/auth/login';
+  const resp = await fetch(path, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    credentials: 'same-origin',
+    body: JSON.stringify({ username, password }),
+  });
+  const data = await resp.json().catch(() => ({}));
+  return { ok: resp.ok, status: resp.status, data };
+}
+
+export async function logoutAuth() {
+  await fetch('/api/auth/logout', { method: 'POST', credentials: 'same-origin' });
+}
+
+export async function fetchStatus() {
+  const resp = await fetch('/api/status');
+  return resp.json();
+}
+
+export async function registerFirstUser(username, password) {
+  const resp = await fetch('/api/auth/register', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    credentials: 'same-origin',
+    body: JSON.stringify({ username, password }),
+  });
+  return resp.json();
+}

package/dist/web/client/app.js

@@ -8,6 +8,7 @@
  */
 
 import { escapeHtml, formatToolArgs, formatDuration, sanitizeHtml } from './util.js';
+import { fetchSessionReplay, fetchStatus, logoutAuth, registerFirstUser, submitAuth } from './api.js';
 
 // ── State ──────────────────────────────────────────────────────────
 // All cross-cutting mutable state now lives in state.js (P0-4 Phase 1),
@@ -43,8 +44,7 @@ marked.setOptions({
 
 function connect() {
   const protocol = location.protocol === 'https:' ? 'wss:' : 'ws:';
-  // Security: do NOT put token in URL (visible in logs/referrer). Cookie is sent automatically.
-  // For reconnection, also send token as first message in case cookie is blocked.
+  // Security: do NOT put token in URL or WebSocket JSON. Cookie is sent automatically.
   ws = new WebSocket(`${protocol}//${location.host}?tabId=${tabId}`);
 
   ws.onopen = () => {
@@ -52,10 +52,6 @@ function connect() {
     reconnectDelay = 1000; // Reset backoff on success
     connectionStatus.textContent = '🟢 Connected';
     connectionStatus.className = 'status-connected';
-    // Send stored token for auth (in case cookie is not available)
-    if (authToken) {
-      ws.send(JSON.stringify({ type: 'auth', action: 'token', token: authToken }));
-    }
     requestSessionList();
     checkAuthStatus();
     // Start heartbeat ping every 30s
@@ -1155,15 +1151,7 @@ async function openReplay(sessionId) {
   modal.showModal();
 
   try {
-    const headers = {};
-    if (authToken) headers['Authorization'] = 'Bearer ' + authToken;
-    const resp = await fetch('/api/sessions/' + encodeURIComponent(sessionId) + '/replay', { headers });
-    if (!resp.ok) {
-      const body = await resp.json().catch(() => ({}));
-      metaEl.textContent = 'Failed: ' + (body.error || resp.status);
-      return;
-    }
-    const { session } = await resp.json();
+    const session = await fetchSessionReplay(sessionId);
     renderReplay(session, metaEl, usageEl, timelineEl);
   } catch (err) {
     metaEl.textContent = 'Failed to load: ' + (err && err.message ? err.message : err);
@@ -2707,16 +2695,9 @@ export async function handleAuth(event) {
   submitBtn.disabled = true;
 
   try {
-    const path = authMode === 'register' ? '/api/auth/register' : '/api/auth/login';
-    const resp = await fetch(path, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      credentials: 'same-origin', // ensure Set-Cookie is honored
-      body: JSON.stringify({ username, password }),
-    });
-    const data = await resp.json().catch(() => ({}));
-    if (!resp.ok || !data.success) {
-      errorEl.textContent = data.error || `Authentication failed (HTTP ${resp.status})`;
+    const { ok, status, data } = await submitAuth(authMode, username, password);
+    if (!ok || !data.success) {
+      errorEl.textContent = data.error || `Authentication failed (HTTP ${status})`;
       errorEl.classList.remove('hidden');
       submitBtn.disabled = false;
       return;
@@ -2775,7 +2756,7 @@ function updateUserMenu() {
 export async function handleLogout() {
   // M4 fix (v0.4.107): only the server can clear an httpOnly cookie.
   try {
-    await fetch('/api/auth/logout', { method: 'POST', credentials: 'same-origin' });
+    await logoutAuth();
   } catch { /* ignore — close WS anyway */ }
   authToken = '';
   authUsername = '';
@@ -2832,8 +2813,7 @@ export async function handleLogout() {
 
 async function checkAuthStatus() {
   try {
-    const res = await fetch('/api/status');
-    const data = await res.json();
+    const data = await fetchStatus();
     const btn = document.getElementById('btn-enable-auth');
     if (data.auth && !data.auth.enabled && !authUsername) {
       btn.classList.remove('hidden');
@@ -2851,13 +2831,7 @@ export function showEnableAuthDialog() {
 
   // M4 fix (v0.4.107): credentials:'same-origin' lets the httpOnly cookie
   // come back; we no longer touch the token.
-  fetch('/api/auth/register', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    credentials: 'same-origin',
-    body: JSON.stringify({ username, password }),
-  })
-    .then(r => r.json())
+  registerFirstUser(username, password)
     .then(data => {
       if (data.error) {
         alert('Error: ' + data.error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jinzd-ai-cli",
-  "version": "0.4.253",
+  "version": "0.4.255",
   "description": "Cross-platform REPL-style AI CLI with multi-provider support",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,6 +21,7 @@
     "test:providers": "vitest run --config vitest.providers.config.ts tests/integration/provider-smoke.test.ts",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
+    "test:dist": "npm run build && vitest run tests/unit/cli/version-drift.test.ts",
     "lint": "eslint src --max-warnings=0",
     "smoke:dist": "node scripts/smoke-dist.mjs",
     "prepublishOnly": "npm run build",