jinzd-ai-cli 0.4.271 → 0.4.273

package/dist/{batch-FPDT2USZ.js → batch-LOW3GM26.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   ConfigManager
-} from "./chunk-PMRU2CAF.js";
+} from "./chunk-T65VFCID.js";
 import "./chunk-TU3L3PW7.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";
-import "./chunk-FT3WS5PG.js";
+import "./chunk-EDAUDILT.js";
 
 // src/cli/batch.ts
 import Anthropic from "@anthropic-ai/sdk";

package/dist/{chat-index-7MMTGQNA.js → chat-index-2D5GK2DB.js}

@@ -6,10 +6,10 @@ import {
   getChatIndexStatus,
   loadChatIndex,
   searchChatMemory
-} from "./chunk-6RPGQ5CG.js";
+} from "./chunk-GHWZVPUV.js";
 import "./chunk-KHYD3WXE.js";
 import "./chunk-NYNSYLFY.js";
-import "./chunk-B5TYJO7V.js";
+import "./chunk-3FEZSLGI.js";
 import "./chunk-IW3Q7AE5.js";
 export {
   buildChatIndex,

package/dist/{chat-index-Q6BKWWAM.js → chat-index-TDU3S2MG.js}

@@ -5,8 +5,8 @@ import {
   getChatIndexStatus,
   loadChatIndex,
   searchChatMemory
-} from "./chunk-ZWEZNKDW.js";
-import "./chunk-YVTASHS5.js";
+} from "./chunk-YOVHMQEJ.js";
+import "./chunk-FSC6KEWU.js";
 import "./chunk-JV5N65KN.js";
 import "./chunk-6BUTA5VW.js";
 export {

package/dist/{chunk-B5TYJO7V.js → chunk-3FEZSLGI.js}

@@ -12,11 +12,16 @@ var DEFAULT_PATTERNS = [
   { kind: "db-uri-password", regex: /(\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^:\s]+:)([^@\s]+)(@)/gi },
   // Anthropic API keys
   { kind: "anthropic-key", regex: /(sk-ant-[a-zA-Z0-9_-]{90,})/g },
-  // L6 (v0.4.108): Zhipu / GLM API keys — `<24+ hex/base64-ish>.<32+>`
-  // Two segments separated by a dot, each safely identifiable by length
-  // and char class. Conservative on the lower bound so we don't eat
-  // version strings like `1.0.0` or filenames.
-  { kind: "zhipu-key", regex: /\b([a-zA-Z0-9]{24,}\.[a-zA-Z0-9]{32,})\b/g },
+  // Zhipu / GLM API keys — 真实格式是 `<32 hex>.<16 alnum>`。
+  //
+  // v0.4.108 的原始规则写的是 `<24+>.<32+>`，第二段下界取成了 32——**它从来没有
+  // 匹配上过任何一个真实的智谱密钥**。2026-08-16 在东叔的 session 历史里实测到明文
+  // 泄漏（同一份 config dump 里 deepseek / gemini / openai 都被正确打码，唯独智谱漏网），
+  // 逐字量过密钥形状后才发现下界错了。
+  //
+  // 现在按真实形状收紧：第一段恰好 32 位十六进制，第二段 16–64 位字母数字。
+  // 这比原来更严格，因此不会新增误伤——`<md5>.jpeg` 这类文件名第二段太短，不匹配。
+  { kind: "zhipu-key", regex: /\b([a-fA-F0-9]{32}\.[a-zA-Z0-9]{16,64})\b/g },
   // OpenAI / generic sk- keys — requires length ≥32 to avoid eating short identifiers
   { kind: "openai-key", regex: /(sk-(?:proj-)?[a-zA-Z0-9_-]{32,})/g },
   // GitHub personal access tokens
@@ -48,6 +53,46 @@ var MAX_REDACT_INPUT = 512e3;
 function render(placeholder, kind) {
   return placeholder.replace("{kind}", kind);
 }
+function redactApiKeyMaps(input, placeholder, hits) {
+  const blockStart = /"api[_-]?keys"\s*:\s*\{/gi;
+  let out = "";
+  let cursor = 0;
+  let m;
+  while ((m = blockStart.exec(input)) !== null) {
+    const openIdx = m.index + m[0].length - 1;
+    let depth = 0;
+    let close = -1;
+    for (let i = openIdx; i < input.length; i++) {
+      const ch = input[i];
+      if (ch === "{") depth++;
+      else if (ch === "}") {
+        depth--;
+        if (depth === 0) {
+          close = i;
+          break;
+        }
+      }
+    }
+    if (close < 0) break;
+    const block = input.slice(openIdx, close + 1);
+    const redactedBlock = block.replace(
+      /("[^"\n]{1,64}"\s*:\s*")([^"\n]{8,})(?=")/g,
+      (_full, prefix, secret, offset) => {
+        hits.push({
+          kind: "api-key-map",
+          start: openIdx + offset + prefix.length,
+          length: secret.length,
+          secret
+        });
+        return `${prefix}${render(placeholder, "api-key-map")}`;
+      }
+    );
+    out += input.slice(cursor, openIdx) + redactedBlock;
+    cursor = close + 1;
+    blockStart.lastIndex = close + 1;
+  }
+  return cursor === 0 ? input : out + input.slice(cursor);
+}
 function redactString(input, options) {
   if (!options.enabled || !input) return { redacted: input, hits: [] };
   if (input.length > MAX_REDACT_INPUT) return { redacted: input, hits: [] };
@@ -68,8 +113,8 @@ function redactString(input, options) {
       }
     })
   ];
-  let redacted = input;
   const hits = [];
+  let redacted = redactApiKeyMaps(input, placeholder, hits);
   for (const { kind, regex } of patterns) {
     const rx = new RegExp(regex.source, regex.flags);
     const captureCount = new RegExp(rx.source + "|").exec("").length - 1;

package/dist/{chunk-BFPF3JF2.js → chunk-4FIDMC2K.js}

@@ -5,11 +5,11 @@ import {
 import {
   estimateTokens,
   truncateForPersist
-} from "./chunk-V26ZMB3D.js";
+} from "./chunk-R4YGDJPL.js";
 import {
   isMemoryExpired,
   isMemoryStale
-} from "./chunk-4UNRDXZV.js";
+} from "./chunk-Z3UXZ5EI.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";
@@ -23,7 +23,7 @@ import {
   MCP_PROTOCOL_VERSION,
   MCP_TOOL_PREFIX,
   VERSION
-} from "./chunk-FT3WS5PG.js";
+} from "./chunk-EDAUDILT.js";
 
 // src/mcp/client.ts
 import { spawn } from "child_process";

package/dist/{chunk-OBULDJSU.js → chunk-CGDYO52A.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-NYNSYLFY.js";
 import {
   redactJson
-} from "./chunk-B5TYJO7V.js";
+} from "./chunk-3FEZSLGI.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-FT3WS5PG.js → chunk-EDAUDILT.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/core/constants.ts
-var VERSION = "0.4.271";
+var VERSION = "0.4.273";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-PDRAOFGI.js → chunk-FHXLAJJG.js}

@@ -5,7 +5,7 @@ import {
 import {
   CONFIG_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-FT3WS5PG.js";
+} from "./chunk-EDAUDILT.js";
 
 // src/diagnostics/tool-stats.ts
 import { existsSync, readFileSync, mkdirSync } from "fs";

package/dist/{chunk-RNDHIERN.js → chunk-FN7DE4HA.js}

@@ -2,7 +2,7 @@
 import {
   evaluateCiGate,
   normalizeCiThresholds
-} from "./chunk-2RN4T4XD.js";
+} from "./chunk-ZWCQQZT5.js";
 import {
   buildReviewPrompt,
   buildSecurityReviewPrompt,
@@ -16,10 +16,10 @@ import {
 } from "./chunk-AUEX6RNY.js";
 import {
   ConfigManager
-} from "./chunk-PMRU2CAF.js";
+} from "./chunk-T65VFCID.js";
 import {
   VERSION
-} from "./chunk-FT3WS5PG.js";
+} from "./chunk-EDAUDILT.js";
 
 // src/cli/ci.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-RLAUMACS.js → chunk-FNLWPYP5.js}

@@ -1,6 +1,6 @@
 import {
   TEST_TIMEOUT
-} from "./chunk-5JFRM47R.js";
+} from "./chunk-LEK5WGKV.js";
 
 // src/tools/builtin/run-tests.ts
 import { execSync, spawnSync } from "child_process";

package/dist/{chunk-YVTASHS5.js → chunk-FSC6KEWU.js}

@@ -10,11 +10,16 @@ var DEFAULT_PATTERNS = [
   { kind: "db-uri-password", regex: /(\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^:\s]+:)([^@\s]+)(@)/gi },
   // Anthropic API keys
   { kind: "anthropic-key", regex: /(sk-ant-[a-zA-Z0-9_-]{90,})/g },
-  // L6 (v0.4.108): Zhipu / GLM API keys — `<24+ hex/base64-ish>.<32+>`
-  // Two segments separated by a dot, each safely identifiable by length
-  // and char class. Conservative on the lower bound so we don't eat
-  // version strings like `1.0.0` or filenames.
-  { kind: "zhipu-key", regex: /\b([a-zA-Z0-9]{24,}\.[a-zA-Z0-9]{32,})\b/g },
+  // Zhipu / GLM API keys — 真实格式是 `<32 hex>.<16 alnum>`。
+  //
+  // v0.4.108 的原始规则写的是 `<24+>.<32+>`，第二段下界取成了 32——**它从来没有
+  // 匹配上过任何一个真实的智谱密钥**。2026-08-16 在东叔的 session 历史里实测到明文
+  // 泄漏（同一份 config dump 里 deepseek / gemini / openai 都被正确打码，唯独智谱漏网），
+  // 逐字量过密钥形状后才发现下界错了。
+  //
+  // 现在按真实形状收紧：第一段恰好 32 位十六进制，第二段 16–64 位字母数字。
+  // 这比原来更严格，因此不会新增误伤——`<md5>.jpeg` 这类文件名第二段太短，不匹配。
+  { kind: "zhipu-key", regex: /\b([a-fA-F0-9]{32}\.[a-zA-Z0-9]{16,64})\b/g },
   // OpenAI / generic sk- keys — requires length ≥32 to avoid eating short identifiers
   { kind: "openai-key", regex: /(sk-(?:proj-)?[a-zA-Z0-9_-]{32,})/g },
   // GitHub personal access tokens
@@ -46,6 +51,46 @@ var MAX_REDACT_INPUT = 512e3;
 function render(placeholder, kind) {
   return placeholder.replace("{kind}", kind);
 }
+function redactApiKeyMaps(input, placeholder, hits) {
+  const blockStart = /"api[_-]?keys"\s*:\s*\{/gi;
+  let out = "";
+  let cursor = 0;
+  let m;
+  while ((m = blockStart.exec(input)) !== null) {
+    const openIdx = m.index + m[0].length - 1;
+    let depth = 0;
+    let close = -1;
+    for (let i = openIdx; i < input.length; i++) {
+      const ch = input[i];
+      if (ch === "{") depth++;
+      else if (ch === "}") {
+        depth--;
+        if (depth === 0) {
+          close = i;
+          break;
+        }
+      }
+    }
+    if (close < 0) break;
+    const block = input.slice(openIdx, close + 1);
+    const redactedBlock = block.replace(
+      /("[^"\n]{1,64}"\s*:\s*")([^"\n]{8,})(?=")/g,
+      (_full, prefix, secret, offset) => {
+        hits.push({
+          kind: "api-key-map",
+          start: openIdx + offset + prefix.length,
+          length: secret.length,
+          secret
+        });
+        return `${prefix}${render(placeholder, "api-key-map")}`;
+      }
+    );
+    out += input.slice(cursor, openIdx) + redactedBlock;
+    cursor = close + 1;
+    blockStart.lastIndex = close + 1;
+  }
+  return cursor === 0 ? input : out + input.slice(cursor);
+}
 function redactString(input, options) {
   if (!options.enabled || !input) return { redacted: input, hits: [] };
   if (input.length > MAX_REDACT_INPUT) return { redacted: input, hits: [] };
@@ -66,8 +111,8 @@ function redactString(input, options) {
       }
     })
   ];
-  let redacted = input;
   const hits = [];
+  let redacted = redactApiKeyMaps(input, placeholder, hits);
   for (const { kind, regex } of patterns) {
     const rx = new RegExp(regex.source, regex.flags);
     const captureCount = new RegExp(rx.source + "|").exec("").length - 1;

package/dist/{chunk-6RPGQ5CG.js → chunk-GHWZVPUV.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-NYNSYLFY.js";
 import {
   redactString
-} from "./chunk-B5TYJO7V.js";
+} from "./chunk-3FEZSLGI.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-5JFRM47R.js → chunk-LEK5WGKV.js}

@@ -1,5 +1,5 @@
 // src/core/constants.ts
-var VERSION = "0.4.271";
+var VERSION = "0.4.273";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-VPXNLE7E.js → chunk-M3NXF4GD.js}

@@ -1,12 +1,12 @@
 import {
   DEFAULT_PATTERNS,
   redactString
-} from "./chunk-YVTASHS5.js";
+} from "./chunk-FSC6KEWU.js";
 import {
   MEMORY_FILE_NAME,
   MEMORY_MAX_CHARS,
   MEMORY_STORE_FILE_NAME
-} from "./chunk-5JFRM47R.js";
+} from "./chunk-LEK5WGKV.js";
 import {
   atomicWriteFileSync
 } from "./chunk-6BUTA5VW.js";

package/dist/{chunk-PG7O7N7D.js → chunk-MTQBSOZW.js}

@@ -8,13 +8,13 @@ import {
   listHooks,
   listInstalledPlugins,
   resetStats
-} from "./chunk-PDRAOFGI.js";
+} from "./chunk-FHXLAJJG.js";
 import {
   ProviderRegistry
 } from "./chunk-AUEX6RNY.js";
 import {
   ConfigManager
-} from "./chunk-PMRU2CAF.js";
+} from "./chunk-T65VFCID.js";
 import {
   getGitRoot
 } from "./chunk-HOSJZMQS.js";
@@ -26,7 +26,7 @@ import {
   MCP_PROJECT_CONFIG_NAME,
   MEMORY_FILE_NAME,
   VERSION
-} from "./chunk-FT3WS5PG.js";
+} from "./chunk-EDAUDILT.js";
 
 // src/diagnostics/doctor-report.ts
 import { existsSync as existsSync3, statSync as statSync2 } from "fs";

package/dist/{chunk-JQXXPTWL.js → chunk-MX75TNE5.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   SessionManager
-} from "./chunk-OBULDJSU.js";
+} from "./chunk-CGDYO52A.js";
 
 // src/hub/persist.ts
 import { join } from "path";

package/dist/{chunk-V26ZMB3D.js → chunk-R4YGDJPL.js}

@@ -2,7 +2,7 @@
 import {
   loadChatIndex,
   searchChatMemory
-} from "./chunk-6RPGQ5CG.js";
+} from "./chunk-GHWZVPUV.js";
 import {
   addMemoryEntry,
   findSimilarMemory,
@@ -11,7 +11,7 @@ import {
   searchPersistentMemories,
   touchMemoryReferences,
   updateMemoryEntry
-} from "./chunk-4UNRDXZV.js";
+} from "./chunk-Z3UXZ5EI.js";
 import {
   indexProject
 } from "./chunk-GLSR2NR3.js";
@@ -30,7 +30,7 @@ import {
   runHook,
   runLifecycleHooks,
   runTool
-} from "./chunk-PDRAOFGI.js";
+} from "./chunk-FHXLAJJG.js";
 import {
   buildTruncatedArgumentsError,
   getDangerLevel,
@@ -50,14 +50,14 @@ import {
 } from "./chunk-4BKXL7SM.js";
 import {
   runTestsTool
-} from "./chunk-OSYK6D4G.js";
+} from "./chunk-WSCZRQDR.js";
 import {
   CONFIG_DIR_NAME,
   DEFAULT_MAX_TOOL_OUTPUT_CHARS_CAP,
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-FT3WS5PG.js";
+} from "./chunk-EDAUDILT.js";
 
 // src/tools/shell-pool.ts
 import { spawn as spawn2 } from "child_process";

package/dist/{chunk-PMRU2CAF.js → chunk-T65VFCID.js}

@@ -11,7 +11,7 @@ import {
   CONFIG_FILE_NAME,
   HISTORY_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-FT3WS5PG.js";
+} from "./chunk-EDAUDILT.js";
 
 // src/config/config-manager.ts
 import { readFileSync, existsSync, mkdirSync } from "fs";

package/dist/{chunk-OSYK6D4G.js → chunk-WSCZRQDR.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   TEST_TIMEOUT
-} from "./chunk-FT3WS5PG.js";
+} from "./chunk-EDAUDILT.js";
 
 // src/tools/builtin/run-tests.ts
 import { execSync, spawnSync } from "child_process";

package/dist/{chunk-ZWEZNKDW.js → chunk-YOVHMQEJ.js}

@@ -1,6 +1,6 @@
 import {
   redactString
-} from "./chunk-YVTASHS5.js";
+} from "./chunk-FSC6KEWU.js";
 import {
   EMBEDDING_DIM,
   embed,

package/dist/{chunk-4UNRDXZV.js → chunk-Z3UXZ5EI.js}

@@ -2,7 +2,7 @@
 import {
   DEFAULT_PATTERNS,
   redactString
-} from "./chunk-B5TYJO7V.js";
+} from "./chunk-3FEZSLGI.js";
 import {
   getGitRoot
 } from "./chunk-HOSJZMQS.js";
@@ -13,7 +13,7 @@ import {
   MEMORY_FILE_NAME,
   MEMORY_MAX_CHARS,
   MEMORY_STORE_FILE_NAME
-} from "./chunk-FT3WS5PG.js";
+} from "./chunk-EDAUDILT.js";
 
 // src/memory/persistent-memory.ts
 import { copyFileSync, existsSync, mkdirSync, readFileSync, statSync } from "fs";

package/dist/{chunk-2RN4T4XD.js → chunk-ZWCQQZT5.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   VERSION
-} from "./chunk-FT3WS5PG.js";
+} from "./chunk-EDAUDILT.js";
 
 // src/cli/ci-format.ts
 var DEFAULT_CI_THRESHOLDS = {

package/dist/{ci-VPN5RWCO.js → ci-C5YMQXCS.js}

@@ -3,16 +3,16 @@ import {
   CI_COMMENT_MARKER,
   countSeverity,
   runCi
-} from "./chunk-RNDHIERN.js";
-import "./chunk-2RN4T4XD.js";
+} from "./chunk-FN7DE4HA.js";
+import "./chunk-ZWCQQZT5.js";
 import "./chunk-HLWUDRBO.js";
 import "./chunk-6YZEZFX5.js";
 import "./chunk-AUEX6RNY.js";
-import "./chunk-PMRU2CAF.js";
+import "./chunk-T65VFCID.js";
 import "./chunk-3OBY7WSS.js";
 import "./chunk-TU3L3PW7.js";
 import "./chunk-IW3Q7AE5.js";
-import "./chunk-FT3WS5PG.js";
+import "./chunk-EDAUDILT.js";
 export {
   CI_COMMENT_MARKER,
   countSeverity,

package/dist/{ci-format-GKXVCVME.js → ci-format-R6EMNOGZ.js}

@@ -6,8 +6,8 @@ import {
   formatCiResult,
   formatCiSarif,
   normalizeCiThresholds
-} from "./chunk-2RN4T4XD.js";
-import "./chunk-FT3WS5PG.js";
+} from "./chunk-ZWCQQZT5.js";
+import "./chunk-EDAUDILT.js";
 export {
   DEFAULT_CI_THRESHOLDS,
   detectCiGateSignals,

package/dist/{constants-Y43DJFGV.js → constants-QJCNMBPJ.js}

@@ -38,7 +38,7 @@ import {
   TEST_TIMEOUT,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-FT3WS5PG.js";
+} from "./chunk-EDAUDILT.js";
 export {
   AGENTIC_BEHAVIOR_GUIDELINE,
   APP_NAME,

package/dist/{doctor-cli-RZGZB2TF.js → doctor-cli-5CM2I6OF.js}

@@ -2,15 +2,15 @@
 import {
   formatDoctorReport,
   runDoctorCli
-} from "./chunk-PG7O7N7D.js";
-import "./chunk-PDRAOFGI.js";
+} from "./chunk-MTQBSOZW.js";
+import "./chunk-FHXLAJJG.js";
 import "./chunk-AUEX6RNY.js";
-import "./chunk-PMRU2CAF.js";
+import "./chunk-T65VFCID.js";
 import "./chunk-3OBY7WSS.js";
 import "./chunk-TU3L3PW7.js";
 import "./chunk-HOSJZMQS.js";
 import "./chunk-IW3Q7AE5.js";
-import "./chunk-FT3WS5PG.js";
+import "./chunk-EDAUDILT.js";
 export {
   formatDoctorReport,
   runDoctorCli