jinzd-ai-cli 0.4.262 → 0.4.264

package/README.md

@@ -172,10 +172,11 @@ AI autonomously invokes these 30 tools during conversations:
 | `edit_file` | write | Precise string replacement with fuzzy matching hints + `replaceAll` mode |
 | `list_dir` | safe | List directory contents |
 | `grep_files` | safe | Regex search across files |
-| `glob_files` | safe | Match files by glob pattern |
-| `web_fetch` | safe | Fetch web pages as Markdown (SSRF-protected) |
-| `google_search` | safe | Google Custom Search API |
-| `run_interactive` | safe | Run interactive programs with stdin input |
+| `glob_files` | safe | Match files by glob pattern |
+| `web_fetch` | safe | Fetch web pages as Markdown (SSRF-protected) |
+| `web_search` | safe | Keyless Bing/Google web search with weak-result fallback |
+| `google_search` | safe | Google Custom Search API |
+| `run_interactive` | write | Run interactive programs with stdin input; arbitrary executables require confirmation |
 | `run_tests` | safe | Auto-detect and run project tests (JUnit XML parsing) |
 | `spawn_agent` | safe | Delegate subtasks to named isolated agents (`agent`: explorer/worker/reviewer/security/tester) |
 | `ask_user` | safe | Pause and ask the user a question |
@@ -192,10 +193,11 @@ AI autonomously invokes these 30 tools during conversations:
 | `notebook_edit` | write | Edit Jupyter notebook cells (add/edit/delete/move) |
 | `find_symbol` | safe | Locate symbol definitions via persistent tree-sitter index (TS/JS/TSX/Python/Go/Rust/Java/C++) |
 | `get_outline` | safe | Enumerate all top-level declarations in one source file |
-| `find_references` | safe | Search indexed files for references to a symbol name |
-| `search_code` | safe | Semantic (meaning-based) code search via local sentence embeddings — bilingual, "grep by meaning" |
+| `find_references` | safe | Search indexed files for references to a symbol name |
+| `search_code` | safe | Semantic (meaning-based) code search via local sentence embeddings — bilingual, "grep by meaning" |
+| `recall_memory` | safe | Semantically recall relevant excerpts from earlier chat sessions |
 
-**Safety levels**: `safe` = auto-execute, `write` = diff preview + confirmation, `destructive` = prominent warning + confirmation.
+**Safety levels**: `safe` = auto-execute, `write` = confirmation required (file-editing tools also show a diff preview), `destructive` = prominent warning + confirmation.
 
 ## Key REPL Commands
 
@@ -527,7 +529,7 @@ npm run test:watch    # Watch mode
 
 Offline tests cover authentication, sessions, tool types and danger levels, permissions, output truncation, diff rendering, edit-file similarity, error hierarchy, config management, env loading, provider registry, web-fetch, grep-files, Hub, dev-state, token estimation, tool registry budgets, parallel tool execution, cost tracking, and session tool history.
 
-## Releasing (Version Bump → npm Publish → GitHub Push)
+## Releasing (Version Bump → Git Tag → Trusted npm Publish)
 
 > **For contributors and AI agents: the entire release is driven by [`scripts/release.mjs`](scripts/release.mjs). Never manually bump the version or run `npm publish` yourself** — a hand-publish of `0.4.207` shipped a version that reported the wrong number and forced a corrective re-release (`0.4.208`). The script's guards exist precisely to stop that.
 
@@ -535,7 +537,7 @@ Offline tests cover authentication, sessions, tool types and danger levels, perm
 
 - You are on the `main` branch and the changes to ship are already in the working tree.
 - `npx tsc --noEmit` is clean and `npm test` is green (the script enforces both and rolls the bump back on failure).
-- You are logged into npm as the package owner (`npm whoami`).
+- npm Trusted Publishing is configured for `jinzd-ai-cli` and `.github/workflows/release.yml`.
 - You have push access to the GitHub remote.
 
 **Step 1 — Write the milestone entry FIRST (Guard A).** Add a one-line entry to the `## 最近里程碑` section of [`CLAUDE.md`](CLAUDE.md) that contains the exact full-width-parenthesis marker `（vX.Y.Z）` for the target version. The script refuses to start without it. (Full narrative goes in `CHANGELOG.md`; this section is just the index line.)
@@ -562,10 +564,10 @@ node scripts/release.mjs patch -m "..." --dry-run
 5. `npm test` must pass (rolls the bump back on failure).
 6. Prints the exact file list entering the release commit and blocks if any looks sensitive (`.env`, `*.pem`, `*.key`, `secret`, …). Override consciously with `--allow-sensitive`.
 7. `git add -A` + commit `"<title> (vX.Y.Z)"` (message passed via argv, not shell-interpolated).
-8. `npm publish` (the build runs automatically via `prepublishOnly`), then re-queries the registry to confirm the new version is live.
-9. `git push` to `main`.
-
-**Optional flags:** `--dry-run` · `--skip-tests` · `--no-publish` · `--no-push` · `--allow-sensitive`.
+8. Creates an annotated `vX.Y.Z` release tag.
+9. Pushes `main` and the tag. The pinned GitHub Actions workflow verifies the project and publishes to npm through OIDC, without a long-lived npm token.
+
+**Optional flags:** `--dry-run` · `--skip-tests` · `--no-tag` · `--no-push` · `--allow-sensitive`. The old `--no-publish` flag remains an alias for `--no-tag`.
 
 ## Documentation
 
@@ -575,7 +577,10 @@ node scripts/release.mjs patch -m "..." --dry-run
 - [`docs/MIGRATION.md`](docs/MIGRATION.md) — Migration guide from Claude Code, Codex, Claude Desktop, and Cursor
 - [`docs/RECIPES.md`](docs/RECIPES.md) — Practical recipes by scenario
 - [`docs/SECURITY.md`](docs/SECURITY.md) — **Security model, deployment checklist, audit history.** Read before exposing `aicli web` to a network.
-- [`CHANGELOG.md`](CHANGELOG.md) — Per-version change log
+- [`CHANGELOG.md`](CHANGELOG.md) — Per-version change log
+- [`CONTRIBUTING.md`](CONTRIBUTING.md) · [`SUPPORT.md`](SUPPORT.md) · [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md) — Community guides
+- [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md) — Licenses for vendored browser assets
+- [`docs/OPEN_SOURCE_CHECKLIST.md`](docs/OPEN_SOURCE_CHECKLIST.md) — Repository-owner launch checklist
 - [Chinese README](README.zh-CN.md) — 中文说明文档
 
 ## License

package/README.zh-CN.md

@@ -160,10 +160,11 @@ AI 在对话中可自主调用 30 个工具：
 | `edit_file` | 写入 | 精确字符串替换，模糊匹配提示 + `replaceAll` 全局替换模式 |
 | `list_dir` | 安全 | 列出目录内容 |
 | `grep_files` | 安全 | 正则搜索文件内容 |
-| `glob_files` | 安全 | 按 glob 模式匹配文件 |
-| `web_fetch` | 安全 | 抓取网页转 Markdown（防 SSRF） |
-| `google_search` | 安全 | Google 自定义搜索 |
-| `run_interactive` | 安全 | 运行交互式程序并输入 |
+| `glob_files` | 安全 | 按 glob 模式匹配文件 |
+| `web_fetch` | 安全 | 抓取网页转 Markdown（防 SSRF） |
+| `web_search` | 安全 | 无需 Key 的 Bing/Google 网页搜索，弱结果自动降级 |
+| `google_search` | 安全 | Google 自定义搜索 |
+| `run_interactive` | 写入 | 运行交互式程序并输入；任意可执行程序均需确认 |
 | `run_tests` | 安全 | 自动检测并运行测试（JUnit XML 解析） |
 | `spawn_agent` | 安全 | 委派子任务给命名隔离 agent（`agent`: explorer/worker/reviewer/security/tester） |
 | `ask_user` | 安全 | 暂停并向用户提问 |
@@ -180,10 +181,11 @@ AI 在对话中可自主调用 30 个工具：
 | `notebook_edit` | 写入 | 编辑 Jupyter notebook 单元格（增/改/删/移动） |
 | `find_symbol` | 安全 | 按名称精确查找函数/类/方法定义（C1，tree-sitter 索引） |
 | `get_outline` | 安全 | 获取文件的符号大纲（类 → 方法树）（C1） |
-| `find_references` | 安全 | 查找符号的所有引用（C1） |
-| `search_code` | 安全 | 语义代码搜索（C2，自然语言查询，中英文均可） |
+| `find_references` | 安全 | 查找符号的所有引用（C1） |
+| `search_code` | 安全 | 语义代码搜索（C2，自然语言查询，中英文均可） |
+| `recall_memory` | 安全 | 从历史聊天会话中语义召回相关片段 |
 
-**安全级别**：`安全` = 自动执行，`写入` = diff 预览 + 确认，`破坏性` = 醒目警告 + 确认。
+**安全级别**：`安全` = 自动执行，`写入` = 需要确认（文件编辑工具还会显示 diff 预览），`破坏性` = 醒目警告 + 确认。
 
 ### 文档深入阅读
 
@@ -483,7 +485,7 @@ npm run test:watch    # 监听模式
 
 离线测试覆盖：认证、会话、工具类型与危险级别、权限、输出截断、diff 渲染、edit-file 相似度、错误层级、配置管理、环境变量、Provider 注册、web-fetch、grep-files、Hub、开发状态、Token 估算、工具注册表预算、并行工具执行、费用追踪和会话工具历史。
 
-## 发布（版本提升 → npm 发布 → 推送 GitHub）
+## 发布（版本提升 → Git Tag → npm 可信发布）
 
 > **给贡献者与 AI 模型：整个发布流程一律走 [`scripts/release.mjs`](scripts/release.mjs)，切勿手动 bump 版本号或自己跑 `npm publish`。** 曾经手工 publish 的 `0.4.207` 装上后 `--version` 报错版本号，被迫补发 `0.4.208` 对齐——脚本的四道守卫就是为拦住这类事故而存在。
 
@@ -491,7 +493,7 @@ npm run test:watch    # 监听模式
 
 - 当前在 `main` 分支，待发布的改动已在工作区。
 - `npx tsc --noEmit` 零错误、`npm test` 全绿（脚本会强制校验，失败自动回滚版本号）。
-- 已登录 npm 且是包的 owner（`npm whoami`）。
+- 已为 `jinzd-ai-cli` 和 `.github/workflows/release.yml` 配置 npm Trusted Publishing。
 - 有 GitHub 远端推送权限。
 
 **第 1 步 —— 先写里程碑条目（Guard A）。** 在 [`CLAUDE.md`](CLAUDE.md) 的 `## 最近里程碑` 一节加一行，条目中必须含目标版本的**全角括号**标记 `（vX.Y.Z）`，否则脚本拒绝启动。（完整叙事写进 `CHANGELOG.md`，本节只留一行式索引。）
@@ -518,14 +520,17 @@ node scripts/release.mjs patch -m "..." --dry-run
 5. `npm test` 必须全绿（失败则回滚版本号）。
 6. 打印进入发布 commit 的完整文件清单，若含疑似敏感文件（`.env`、`*.pem`、`*.key`、`secret`…）直接拦下，确认无误加 `--allow-sensitive`。
 7. `git add -A` + commit `"<标题> (vX.Y.Z)"`（消息走 argv 传参，不经 shell 拼接）。
-8. `npm publish`（build 经 `prepublishOnly` 自动跑），再回查 registry 确认新版本已上线。
-9. `git push` 推送 `main`。
-
-**可选 flag：** `--dry-run` · `--skip-tests` · `--no-publish` · `--no-push` · `--allow-sensitive`。
-
-## 文档
+8. 创建带注释的 `vX.Y.Z` release tag。
+9. 推送 `main` 和 tag；固定到完整 SHA 的 GitHub Actions 工作流会完成验证，并通过 OIDC 发布到 npm，无需长期 npm token。
+
+**可选 flag：** `--dry-run` · `--skip-tests` · `--no-tag` · `--no-push` · `--allow-sensitive`。旧的 `--no-publish` 仍作为 `--no-tag` 的兼容别名。
 
-- [English README](README.md) — English documentation
+## 文档
+
+- [English README](README.md) — English documentation
+- [贡献指南](CONTRIBUTING.md) · [支持指南](SUPPORT.md) · [行为准则](CODE_OF_CONDUCT.md)
+- [第三方许可证声明](THIRD_PARTY_NOTICES.md)
+- [开源前检查清单](docs/OPEN_SOURCE_CHECKLIST.md)
 
 ## License
 

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,88 @@
+# Third-Party Notices
+
+ai-cli includes the following vendored browser assets. Their licenses apply to those components; the rest of ai-cli is licensed under the repository's MIT license.
+
+| Component | Vendored files | Version | License | Upstream |
+|---|---|---:|---|---|
+| Tailwind CSS Play CDN | `src/web/client/vendor/tailwind.js` | 3.4.17 | MIT | https://github.com/tailwindlabs/tailwindcss |
+| daisyUI | `src/web/client/vendor/daisyui-full.min.css` | 4.12.23 | MIT | https://github.com/saadeghi/daisyui |
+| highlight.js and GitHub themes | `highlight.min.js`, `github.min.css`, `github-dark.min.css` | 11.9.0 | BSD-3-Clause | https://github.com/highlightjs/highlight.js |
+| marked | `src/web/client/vendor/marked.min.js` | 15.0.12 | MIT | https://github.com/markedjs/marked |
+
+When replacing a vendored asset, update this file and preserve its upstream license header.
+
+## MIT-licensed components
+
+Tailwind CSS:
+
+Copyright (c) Tailwind Labs, Inc.
+
+daisyUI:
+
+Copyright (c) 2020 Pouya Saadeghi
+
+Marked:
+
+Copyright (c) 2018+, MarkedJS (https://github.com/markedjs/)
+Copyright (c) 2011-2018, Christopher Jeffrey (https://github.com/chjj/)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notices and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## Markdown notice included by Marked
+
+Copyright © 2004, John Gruber
+http://daringfireball.net/
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+- Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+- Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+- Neither the name “Markdown” nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+This software is provided by the copyright holders and contributors “as is” and any express or implied warranties, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall the copyright owner or contributors be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage.
+
+## highlight.js — BSD 3-Clause License
+
+Copyright (c) 2006, Ivan Sagalaev.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+- Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+- Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+- Neither the name of the copyright holder nor the names of its contributors
+  may be used to endorse or promote products derived from this software
+  without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.

package/dist/{batch-2B7UUX27.js → batch-Q22M55UP.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   ConfigManager
-} from "./chunk-MTIS7H6V.js";
+} from "./chunk-IAIUXBB5.js";
 import "./chunk-TU3L3PW7.js";
-import "./chunk-KWYJFLXY.js";
+import "./chunk-JVUYKO4V.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-XZNRZGG2.js → chunk-3OBY7WSS.js}

@@ -1159,6 +1159,7 @@ async function runLeanAgentLoop(opts) {
           maxTokens: opts.chatParams?.maxTokens,
           timeout: opts.chatParams?.timeout,
           thinking: opts.chatParams?.thinking,
+          thinkingEffort: opts.chatParams?.thinkingEffort,
           ...extraMessages.length > 0 ? { _extraMessages: extraMessages } : {}
         },
         opts.toolDefsForRound(round)

package/dist/{chunk-ZQZEBPAQ.js → chunk-4T4KHPRD.js}

@@ -1,5 +1,5 @@
 // src/core/constants.ts
-var VERSION = "0.4.262";
+var VERSION = "0.4.264";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-D6DHS5GL.js → chunk-53SOOMYG.js}

@@ -7,7 +7,7 @@ import {
   searchPersistentMemories,
   touchMemoryReferences,
   updateMemoryEntry
-} from "./chunk-KMS3LBO3.js";
+} from "./chunk-K7HQLXXQ.js";
 import {
   indexProject
 } from "./chunk-GLSR2NR3.js";
@@ -23,13 +23,13 @@ import {
   runHook,
   runLifecycleHooks,
   runTool
-} from "./chunk-JEJHNVA2.js";
+} from "./chunk-U4XQIP7Z.js";
 import {
   buildTruncatedArgumentsError,
   getDangerLevel,
   isFileWriteTool,
   runLeanAgentLoop
-} from "./chunk-XZNRZGG2.js";
+} from "./chunk-3OBY7WSS.js";
 import {
   EnvLoader,
   NetworkError,
@@ -40,14 +40,14 @@ import {
 } from "./chunk-4BKXL7SM.js";
 import {
   runTestsTool
-} from "./chunk-HPDI4F5F.js";
+} from "./chunk-QCZFHQHY.js";
 import {
   CONFIG_DIR_NAME,
   DEFAULT_MAX_TOOL_OUTPUT_CHARS_CAP,
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-KWYJFLXY.js";
+} from "./chunk-JVUYKO4V.js";
 import {
   loadChatIndex,
   searchChatMemory
@@ -5677,7 +5677,8 @@ async function runSubAgent(task, maxRounds, agentIndex, ctx, agent) {
         temperature: ctx.modelParams.temperature,
         maxTokens: ctx.modelParams.maxTokens,
         timeout: ctx.modelParams.timeout,
-        thinking: ctx.modelParams.thinking
+        thinking: ctx.modelParams.thinking,
+        thinkingEffort: ctx.modelParams.thinkingEffort
       },
       executeTools: (calls) => subExecutor.executeAll(calls),
       systemPromptForRound: () => subSystemPrompt,

package/dist/{chunk-FWBSGBB7.js → chunk-BMSBFK7J.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   ProviderRegistry
-} from "./chunk-25HFWCM3.js";
+} from "./chunk-TL5MD5XU.js";
 import {
   ConfigManager
-} from "./chunk-MTIS7H6V.js";
+} from "./chunk-IAIUXBB5.js";
 import {
   getActivePluginAssets,
   getPendingHookTrust,
@@ -14,7 +14,7 @@ import {
   listHooks,
   listInstalledPlugins,
   resetStats
-} from "./chunk-JEJHNVA2.js";
+} from "./chunk-U4XQIP7Z.js";
 import {
   getGitRoot
 } from "./chunk-HOSJZMQS.js";
@@ -26,7 +26,7 @@ import {
   MCP_PROJECT_CONFIG_NAME,
   MEMORY_FILE_NAME,
   VERSION
-} from "./chunk-KWYJFLXY.js";
+} from "./chunk-JVUYKO4V.js";
 
 // src/diagnostics/doctor-report.ts
 import { existsSync as existsSync3, statSync as statSync2 } from "fs";

package/dist/{chunk-2XPJRRBB.js → chunk-DYONT23T.js}

@@ -2,7 +2,7 @@
 import {
   evaluateCiGate,
   normalizeCiThresholds
-} from "./chunk-WAAFA32V.js";
+} from "./chunk-UGJIRJ4H.js";
 import {
   buildReviewPrompt,
   buildSecurityReviewPrompt,
@@ -10,13 +10,13 @@ import {
 } from "./chunk-HLWUDRBO.js";
 import {
   ProviderRegistry
-} from "./chunk-25HFWCM3.js";
+} from "./chunk-TL5MD5XU.js";
 import {
   ConfigManager
-} from "./chunk-MTIS7H6V.js";
+} from "./chunk-IAIUXBB5.js";
 import {
   VERSION
-} from "./chunk-KWYJFLXY.js";
+} from "./chunk-JVUYKO4V.js";
 
 // src/cli/ci.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-MTIS7H6V.js → chunk-IAIUXBB5.js}

@@ -8,7 +8,7 @@ import {
   CONFIG_FILE_NAME,
   HISTORY_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-KWYJFLXY.js";
+} from "./chunk-JVUYKO4V.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";
@@ -46,6 +46,8 @@ var ModelParamsSchema = z.object({
   timeout: z.number().int().positive().optional(),
   /** 是否启用深度思考（thinking）模式，Claude Sonnet/Opus、GLM-5 等 */
   thinking: z.boolean().optional(),
+  /** DeepSeek V4 reasoning effort. */
+  thinkingEffort: z.enum(["low", "high", "max"]).optional(),
   /** thinking 模式的 token 预算（最小 1024，仅 Claude Extended Thinking 使用） */
   thinkingBudget: z.number().int().min(1024).optional()
 });

package/dist/{chunk-A6JLBNAI.js → chunk-IEYR2BGG.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   truncateForPersist
-} from "./chunk-D6DHS5GL.js";
+} from "./chunk-53SOOMYG.js";
 import {
   APP_NAME,
   CONFIG_DIR_NAME,
@@ -11,7 +11,7 @@ import {
   MCP_PROTOCOL_VERSION,
   MCP_TOOL_PREFIX,
   VERSION
-} from "./chunk-KWYJFLXY.js";
+} from "./chunk-JVUYKO4V.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-KWYJFLXY.js → chunk-JVUYKO4V.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/core/constants.ts
-var VERSION = "0.4.262";
+var VERSION = "0.4.264";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-KMS3LBO3.js → chunk-K7HQLXXQ.js}

@@ -6,7 +6,7 @@ import {
   MEMORY_FILE_NAME,
   MEMORY_MAX_CHARS,
   MEMORY_STORE_FILE_NAME
-} from "./chunk-KWYJFLXY.js";
+} from "./chunk-JVUYKO4V.js";
 import {
   DEFAULT_PATTERNS,
   redactString

package/dist/{chunk-HPDI4F5F.js → chunk-QCZFHQHY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   TEST_TIMEOUT
-} from "./chunk-KWYJFLXY.js";
+} from "./chunk-JVUYKO4V.js";
 
 // src/tools/builtin/run-tests.ts
 import { execSync, spawnSync } from "child_process";

package/dist/{chunk-DQY2DDGS.js → chunk-QG4NG7KJ.js}

@@ -2,7 +2,7 @@
 import {
   computeCost,
   formatCost
-} from "./chunk-EZ6QLHOS.js";
+} from "./chunk-YRD6M5XI.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-BS44XEZ4.js → chunk-TANTNIGP.js}

@@ -1,6 +1,6 @@
 import {
   TEST_TIMEOUT
-} from "./chunk-ZQZEBPAQ.js";
+} from "./chunk-4T4KHPRD.js";
 
 // src/tools/builtin/run-tests.ts
 import { execSync, spawnSync } from "child_process";

package/dist/{chunk-25HFWCM3.js → chunk-TL5MD5XU.js}

@@ -3,7 +3,7 @@ import {
   detectsHallucinatedFileOp,
   parseToolCallArguments,
   schemaToJsonSchema
-} from "./chunk-XZNRZGG2.js";
+} from "./chunk-3OBY7WSS.js";
 import {
   AuthError,
   ProviderError,
@@ -1079,6 +1079,14 @@ var OpenAICompatibleProvider = class extends BaseProvider {
     }
     return msgs;
   }
+  /** Provider-specific request fields shared by all four chat paths. */
+  buildChatRequestParams(request) {
+    return {
+      temperature: request.temperature,
+      max_tokens: request.maxTokens,
+      ...request.thinking ? { thinking: { type: "enabled" } } : {}
+    };
+  }
   /**
    * 非流式请求必须把 `request.signal` 交给 SDK —— 否则 Ctrl+C 完全无效。
    *
@@ -1095,10 +1103,8 @@ var OpenAICompatibleProvider = class extends BaseProvider {
       const response = await this.client.chat.completions.create({
         model: request.model,
         messages: this.buildMessages(request),
-        temperature: request.temperature,
-        max_tokens: request.maxTokens,
-        stream: false,
-        ...request.thinking ? { thinking: { type: "enabled" } } : {}
+        ...this.buildChatRequestParams(request),
+        stream: false
       }, {
         timeout: request.timeout ?? this.defaultTimeout,
         signal: request.signal
@@ -1121,12 +1127,10 @@ var OpenAICompatibleProvider = class extends BaseProvider {
       const stream = await this.client.chat.completions.create({
         model: request.model,
         messages: this.buildMessages(request),
-        temperature: request.temperature,
-        max_tokens: request.maxTokens,
+        ...this.buildChatRequestParams(request),
         stream: true,
         // 请求末尾 usage chunk，供 token 统计使用
-        stream_options: { include_usage: true },
-        ...request.thinking ? { thinking: { type: "enabled" } } : {}
+        stream_options: { include_usage: true }
       }, {
         timeout: request.timeout ?? this.defaultTimeout,
         signal: request.signal
@@ -1202,10 +1206,8 @@ var OpenAICompatibleProvider = class extends BaseProvider {
         messages: allMessages,
         tools: openaiTools,
         tool_choice: "auto",
-        temperature: request.temperature,
-        max_tokens: request.maxTokens,
-        stream: false,
-        ...request.thinking ? { thinking: { type: "enabled" } } : {}
+        ...this.buildChatRequestParams(request),
+        stream: false
       }, {
         timeout: request.timeout ?? this.defaultTimeout,
         // 非流式路径同样必须收 signal，否则 Ctrl+C 期间整个请求不可中断（见 chat() 上方注释）
@@ -1303,11 +1305,9 @@ var OpenAICompatibleProvider = class extends BaseProvider {
         messages: allMessages,
         tools: openaiTools,
         tool_choice: "auto",
-        temperature: request.temperature,
-        max_tokens: request.maxTokens,
+        ...this.buildChatRequestParams(request),
         stream: true,
-        stream_options: { include_usage: true },
-        ...request.thinking ? { thinking: { type: "enabled" } } : {}
+        stream_options: { include_usage: true }
       }, {
         timeout: request.timeout ?? this.defaultTimeout,
         signal: request.signal
@@ -1501,6 +1501,18 @@ Rules you MUST follow:
 - The system will detect and reject phantom claims. Each failed detection wastes a round. Be honest.`;
 var DeepSeekProvider = class extends OpenAICompatibleProvider {
   defaultBaseUrl = "https://api.deepseek.com/v1";
+  buildChatRequestParams(request) {
+    const thinkingEnabled = request.thinking === true;
+    return {
+      // DeepSeek ignores sampling controls in thinking mode; omit them to keep the
+      // wire request unambiguous. Explicitly disable thinking otherwise because
+      // V4 defaults it to enabled server-side.
+      temperature: thinkingEnabled ? void 0 : request.temperature,
+      max_tokens: request.maxTokens,
+      thinking: { type: thinkingEnabled ? "enabled" : "disabled" },
+      ...thinkingEnabled ? { reasoning_effort: request.thinkingEffort ?? "high" } : {}
+    };
+  }
   /** 禁用流式工具调用，确保 chatWithTools 覆写（代码块检测）生效 */
   enableStreamingToolCalls = false;
   /**
@@ -1521,14 +1533,14 @@ var DeepSeekProvider = class extends OpenAICompatibleProvider {
       // ── V4 family (2026-04-23+)：1M context，支持 Thinking / Non-Thinking 双模式 ──
       {
         id: "deepseek-v4-pro",
-        displayName: "DeepSeek V4 Pro (1.6T MoE, 49B active)",
+        displayName: "DeepSeek V4 Pro (0813, 1.6T MoE, 49B active)",
         contextWindow: 1048576,
         supportsStreaming: true,
         supportsThinking: true
       },
       {
         id: "deepseek-v4-flash",
-        displayName: "DeepSeek V4 Flash (284B MoE, 13B active)",
+        displayName: "DeepSeek V4 Flash (0731, 284B MoE, 13B active)",
         contextWindow: 1048576,
         supportsStreaming: true,
         supportsThinking: true

package/dist/{chunk-JEJHNVA2.js → chunk-U4XQIP7Z.js}

@@ -2,7 +2,7 @@
 import {
   CONFIG_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-KWYJFLXY.js";
+} from "./chunk-JVUYKO4V.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-WAAFA32V.js → chunk-UGJIRJ4H.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   VERSION
-} from "./chunk-KWYJFLXY.js";
+} from "./chunk-JVUYKO4V.js";
 
 // src/cli/ci-format.ts
 var DEFAULT_CI_THRESHOLDS = {

package/dist/{chunk-JFXKQPKY.js → chunk-UQP2BNQT.js}

@@ -6,7 +6,7 @@ import {
   MEMORY_FILE_NAME,
   MEMORY_MAX_CHARS,
   MEMORY_STORE_FILE_NAME
-} from "./chunk-ZQZEBPAQ.js";
+} from "./chunk-4T4KHPRD.js";
 import {
   atomicWriteFileSync
 } from "./chunk-6BUTA5VW.js";