jinzd-ai-cli 0.4.304 → 0.4.306

package/dist/{server-EZ5ULLDP.js → server-DBHLVQVP.js}

@@ -3,8 +3,8 @@ import {
   DiscussionOrchestrator,
   getPreset,
   resolveRoleProviders
-} from "./chunk-23SJVOQD.js";
-import "./chunk-VOIOUJXI.js";
+} from "./chunk-72AR23R2.js";
+import "./chunk-C2Z77RTU.js";
 import {
   AuthManager,
   TOKEN_EXPIRY_MS
@@ -81,7 +81,7 @@ import {
   skillHistoryNote,
   snapshotFile,
   stripRoutingTags
-} from "./chunk-F3EJ4MIP.js";
+} from "./chunk-AYLK4EGA.js";
 import {
   CNY_PER_USD,
   CostTracker,
@@ -92,6 +92,7 @@ import {
   setCostCurrency
 } from "./chunk-YKJO3SI4.js";
 import {
+  DEFAULT_MAX_TOOL_OUTPUT_CHARS,
   ToolExecutor,
   ToolRegistry,
   askUserContext,
@@ -105,6 +106,7 @@ import {
   estimateTokens,
   formatPermissionProfileWarning,
   gateMessages,
+  getMaxOutputChars,
   getPreferredAgentName,
   getRecentlyDeniedAutoActions,
   googleSearchContext,
@@ -120,13 +122,11 @@ import {
   resolveWriteFileArgs,
   runSafePhases,
   runWithSessionKey,
-  setContextWindow,
-  setMaxOutputCap,
   setPreferredAgentName,
   spawnAgentContext,
   truncateOutput,
   undoStack
-} from "./chunk-2PLYXL4P.js";
+} from "./chunk-VLDB2SVN.js";
 import {
   buildReviewPrompt,
   buildSecurityReviewPrompt
@@ -153,11 +153,11 @@ import {
   restoreMemoryEntries,
   updateMemoryApproval,
   updateMemoryEntry
-} from "./chunk-7L7T46PI.js";
-import "./chunk-4DEMGCK4.js";
-import "./chunk-UUSRWSSX.js";
-import "./chunk-CKH4KQ4E.js";
-import "./chunk-BXP6YZ2P.js";
+} from "./chunk-LAP7TPPK.js";
+import "./chunk-LF67HWWR.js";
+import "./chunk-XJOK5353.js";
+import "./chunk-WQ3OMEC4.js";
+import "./chunk-NRSYBKWA.js";
 import "./chunk-KHYD3WXE.js";
 import "./chunk-5C76XDDF.js";
 import {
@@ -172,7 +172,7 @@ import {
   buildDoctorReport,
   formatDoctorReport,
   loadContextFiles
-} from "./chunk-OECPGCHP.js";
+} from "./chunk-JFNBJHR6.js";
 import {
   describePlugin,
   getActivePluginAssets,
@@ -187,14 +187,14 @@ import {
   runTool,
   setPluginEnabled,
   trustPlugin
-} from "./chunk-I2WJ44D3.js";
+} from "./chunk-7SSCSSC6.js";
 import "./chunk-RS7SKYTS.js";
 import {
   ProviderRegistry
 } from "./chunk-VXEF2SWG.js";
 import {
   ConfigManager
-} from "./chunk-XIMM47EG.js";
+} from "./chunk-OC2XHG5L.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   TEE_FINAL_USER_NUDGE,
@@ -225,7 +225,7 @@ import {
   maskConfigSecrets
 } from "./chunk-XNFIYS7G.js";
 import "./chunk-4BKXL7SM.js";
-import "./chunk-BSBGPDCX.js";
+import "./chunk-W6PLV3EY.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
   AUTHOR,
@@ -241,12 +241,30 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-RHCRE6XE.js";
+} from "./chunk-T6WQEQI4.js";
 
 // src/web/server.ts
 import express from "express";
 import { createServer } from "http";
 import { WebSocketServer } from "ws";
+
+// src/web/chat-limits.ts
+var MAX_CHAT_BYTES = 16 * 1024 * 1024;
+var MAX_IMAGE_BYTES = 10 * 1024 * 1024;
+var MAX_IMAGE_BASE64_CHARS = Math.ceil(MAX_IMAGE_BYTES / 3) * 4;
+var IMAGE_MIMES = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/gif", "image/webp", "image/svg+xml"]);
+function imageValidationError(images) {
+  if (images === void 0) return;
+  if (!Array.isArray(images)) return "Images must be an array.";
+  for (const image of images) {
+    if (!image || typeof image.data !== "string" || !IMAGE_MIMES.has(image.mime)) {
+      return "Unsupported image format. Use PNG, JPEG, GIF, WebP or SVG.";
+    }
+    if (image.data.length > MAX_IMAGE_BASE64_CHARS) return "Image too large (maximum 10 MiB before base64 encoding).";
+  }
+}
+
+// src/web/server.ts
 import { join as join2, dirname as dirname3, resolve as resolve3, relative, sep as sep2, extname, resolve as resolvePath } from "path";
 import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync as readdirSync2, statSync as statSync2, realpathSync, createReadStream } from "fs";
 import { networkInterfaces } from "os";
@@ -254,6 +272,27 @@ import { networkInterfaces } from "os";
 // src/web/tool-executor-web.ts
 import { randomUUID } from "crypto";
 import { tmpdir } from "os";
+
+// src/web/socket-send.ts
+var MAX_PENDING_OUTPUT_BYTES = 16 * 1024 * 1024;
+var stalled = /* @__PURE__ */ new WeakSet();
+function sendSocketMessage(ws, message) {
+  if (ws.readyState !== ws.OPEN || stalled.has(ws)) return false;
+  const data = JSON.stringify(message);
+  if ((ws.bufferedAmount || 0) + Buffer.byteLength(data) > MAX_PENDING_OUTPUT_BYTES) {
+    stalled.add(ws);
+    ws.close(1013, "Output backlog exceeded; reconnect to reload session");
+    const timer = setTimeout(() => {
+      if (ws.readyState !== ws.CLOSED) ws.terminate();
+    }, 1e3);
+    timer.unref();
+    return false;
+  }
+  ws.send(data);
+  return true;
+}
+
+// src/web/tool-executor-web.ts
 import { existsSync, readFileSync } from "fs";
 var ToolExecutorWeb = class _ToolExecutorWeb {
   constructor(registry, ws) {
@@ -283,6 +322,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
   // 5 minutes
   /** Publicly readable by SessionHandler to check if confirm is active */
   confirming = false;
+  maxOutputChars = DEFAULT_MAX_TOOL_OUTPUT_CHARS;
   /** Session-level auto-approve toggle (/yolo command) */
   sessionAutoApprove = false;
   /** Session-level Auto Mode: rule-based low-risk auto approval. */
@@ -365,9 +405,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
     this.confirming = false;
   }
   send(msg) {
-    if (this.ws.readyState === this.ws.OPEN) {
-      this.ws.send(JSON.stringify(msg));
-    }
+    sendSocketMessage(this.ws, msg);
   }
   sendToolCallStart(call) {
     const dangerLevel = getDangerLevel(call.name, call.arguments);
@@ -560,7 +598,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
     if (!toolCallStarted) this.sendToolCallStart(call);
     try {
       const rawContent = await runTool(tool, call.arguments, call.name);
-      const content = truncateOutput(rawContent, call.name);
+      const content = truncateOutput(rawContent, call.name, this.maxOutputChars);
       this.sendToolCallResult(call, rawContent, false);
       runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
       runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
@@ -625,7 +663,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
         }
         try {
           const rawContent = await runTool(tool, call.arguments, call.name);
-          const content = truncateOutput(rawContent, call.name);
+          const content = truncateOutput(rawContent, call.name, this.maxOutputChars);
           this.sendToolCallResult(call, rawContent, false);
           results[i] = { callId: call.id, content, isError: false };
         } catch (err) {
@@ -701,11 +739,11 @@ import { mkdirSync as mkdirSync2, createWriteStream as createWriteStream2 } from
 import { dirname as dirname2 } from "path";
 
 // src/web/commands/provider-commands.ts
-function syncSessionProvider(ctx) {
+async function syncSessionProvider(ctx) {
   const session = ctx.sessions.current;
   if (!session) return;
   session.updateProvider(ctx.currentProvider, ctx.currentModel);
-  ctx.saveIfNeeded();
+  await ctx.saveIfNeeded();
 }
 async function handleProvider(args, ctx) {
   const id = args[0];
@@ -748,7 +786,7 @@ async function handleProvider(args, ctx) {
   ctx.currentProvider = outcome.providerId;
   ctx.currentModel = outcome.model;
   ctx.updateContextWindow();
-  syncSessionProvider(ctx);
+  await syncSessionProvider(ctx);
   ctx.send({ type: "info", message: outcome.message });
   ctx.sendStatus();
 }
@@ -802,7 +840,7 @@ async function handleModel(args, ctx) {
   }
   ctx.currentModel = outcome.model;
   ctx.updateContextWindow();
-  syncSessionProvider(ctx);
+  await syncSessionProvider(ctx);
   ctx.send({
     type: "info",
     message: outcome.warning ? `${outcome.message} \u2014 ${outcome.warning}` : outcome.message
@@ -908,7 +946,7 @@ async function handleClear(_args, ctx) {
   const prior = ctx.sessions.current;
   const priorId = prior?.id ?? null;
   const priorCount = prior?.messages.length ?? 0;
-  ctx.saveIfNeeded();
+  await ctx.saveIfNeeded();
   const created = ctx.sessions.createSession(ctx.currentProvider, ctx.currentModel);
   ctx.unsavedSessions.set(created.id, created);
   ctx.resetWebSessionUsage();
@@ -930,7 +968,7 @@ Cache:  write=${cacheCreate} read=${cacheRead}` : "";
 Cost:   ${formatCost(cost)}` : "";
   let memoryLine = "";
   try {
-    const { countPendingMemories: countPendingMemories2 } = await import("./persistent-memory-SHG3CJCP.js");
+    const { countPendingMemories: countPendingMemories2 } = await import("./persistent-memory-6XYYOMSC.js");
     const pending = countPendingMemories2(ctx.config.getConfigDir());
     if (pending > 0) memoryLine = `
 Memory: \u26A0 ${pending} pending approval \u2014 see the Memory panel or /memory`;
@@ -946,8 +984,13 @@ Tokens: in=${ctx.sessionTokenUsage.inputTokens} out=${ctx.sessionTokenUsage.outp
 }
 async function handleSession(args, ctx) {
   const sub = args[0];
+  if (sub === "save") {
+    await ctx.saveIfNeeded();
+    if (!ctx.sessions.current?.dirty) ctx.send({ type: "info", message: "Session saved." });
+    return;
+  }
   if (sub === "new") {
-    ctx.saveIfNeeded();
+    await ctx.saveIfNeeded();
     const created = ctx.sessions.createSession(ctx.currentProvider, ctx.currentModel);
     ctx.unsavedSessions.set(created.id, created);
     ctx.resetWebSessionUsage();
@@ -958,7 +1001,7 @@ async function handleSession(args, ctx) {
   }
   if (sub === "load" && args[1]) {
     const targetId = args[1];
-    ctx.saveIfNeeded();
+    await ctx.saveIfNeeded();
     const cachedExact = ctx.unsavedSessions.get(targetId);
     const cached = cachedExact ?? [...ctx.unsavedSessions.values()].find((s) => s.id.startsWith(targetId));
     if (cached) {
@@ -1854,7 +1897,7 @@ async function handleTest(args, ctx) {
       const isCommand = argStr.includes(" ") || /^(mvn|gradle|npm|pytest|cargo|go)\b/.test(argStr);
       testArgs = isCommand ? { command: argStr } : { filter: argStr };
     }
-    const runTests = ctx.runTests ?? (await import("./run-tests-HV37CM5U.js")).executeTests;
+    const runTests = ctx.runTests ?? (await import("./run-tests-BAMLVLO6.js")).executeTests;
     const report = await runTests(testArgs);
     ctx.send({ type: "info", message: report });
   } catch (err) {
@@ -2031,9 +2074,9 @@ async function handleContext(_args, ctx) {
 async function handleIndex(args, ctx) {
   const sub = (args[0] ?? "status").toLowerCase();
   const root = process.cwd();
-  const { loadIndex, clearIndex } = await import("./store-MWNHVGJT.js");
-  const { indexProject } = await import("./indexer-TNDWGFRI.js");
-  const { loadVectorStore, clearVectorStore } = await import("./vector-store-BBDXB5IQ.js");
+  const { loadIndex, clearIndex } = await import("./store-CMSSWZF7.js");
+  const { indexProject } = await import("./indexer-P3FPRTPJ.js");
+  const { loadVectorStore, clearVectorStore } = await import("./vector-store-PWIOQFTP.js");
   if (sub === "status") {
     const idx = loadIndex(root);
     const vec = loadVectorStore(root);
@@ -2056,6 +2099,7 @@ async function handleIndex(args, ctx) {
   } else if (sub === "rebuild") {
     ctx.send({ type: "info", message: `Indexing ${root}\u2026` });
     const { stats } = await indexProject(root, { force: true });
+    if (stats.incomplete) ctx.send({ type: "info", message: "Partial index: scan limit or unreadable files reached. Unscanned entries were retained." });
     ctx.send({
       type: "info",
       message: `\u2713 Indexed ${stats.filesParsed} files (${stats.symbols} symbols) in ${stats.durationMs}ms`
@@ -2082,7 +2126,7 @@ async function handleIndex(args, ctx) {
       message: `Building semantic index for ${idx.symbolCount} symbols\u2026 (first run downloads ~117 MB model)`
     });
     try {
-      const { rebuildSemanticIndex } = await import("./semantic-HLAE2O4F.js");
+      const { rebuildSemanticIndex } = await import("./semantic-7GM5M4MU.js");
       const stats = await rebuildSemanticIndex(root);
       const first = stats.modelFirstLoadMs ? ` (model load+first batch ${stats.modelFirstLoadMs}ms)` : "";
       ctx.send({
@@ -2129,7 +2173,7 @@ async function handleMemory(args, ctx) {
   }
   if (intent.kind === "status") {
     const { getChatIndexStatus } = await import("./chat-index-2D5GK2DB.js");
-    const { listMemoryEntries: listMemoryEntries2, isMemoryExpired: isMemoryExpired2, formatMemoryForPrompt: formatMemoryForPrompt2 } = await import("./persistent-memory-SHG3CJCP.js");
+    const { listMemoryEntries: listMemoryEntries2, isMemoryExpired: isMemoryExpired2, formatMemoryForPrompt: formatMemoryForPrompt2 } = await import("./persistent-memory-6XYYOMSC.js");
     const memories = listMemoryEntries2(configDir, { includeExpired: true, includeRejected: true });
     const injected = formatMemoryForPrompt2(configDir, process.cwd(), ctx.config.get("memory")?.maxChars);
     const view = buildMemoryStatusView({
@@ -2152,7 +2196,7 @@ async function handleMemory(args, ctx) {
     return;
   }
   if (intent.kind === "recall") {
-    const { searchPersistentMemories, touchMemoryReferences } = await import("./persistent-memory-SHG3CJCP.js");
+    const { searchPersistentMemories, touchMemoryReferences } = await import("./persistent-memory-6XYYOMSC.js");
     const { searchChatMemory } = await import("./chat-index-2D5GK2DB.js");
     const persistentHits = searchPersistentMemories(configDir, intent.query, process.cwd(), 3);
     if (persistentHits.length > 0) {
@@ -2273,7 +2317,7 @@ async function handleMemory(args, ctx) {
     ctx.handleMemoryManage(intent.action, args[1], intent.action === "expire" ? args[2] : void 0);
   } else if (intent.kind === "export") {
     if (args[1] === "md") {
-      const { exportMemoryEntries: exportMemoryEntries2 } = await import("./persistent-memory-SHG3CJCP.js");
+      const { exportMemoryEntries: exportMemoryEntries2 } = await import("./persistent-memory-6XYYOMSC.js");
       ctx.send({
         type: "export_data",
         format: "md",
@@ -2692,7 +2736,7 @@ var webCommandHandlers = {
   search: handleSearch,
   undo: handleUndo
 };
-var SessionHandler = class {
+var SessionHandler = class _SessionHandler {
   ws;
   config;
   costTracker;
@@ -2743,6 +2787,7 @@ var SessionHandler = class {
   abortController = null;
   userInterjection = null;
   processing = false;
+  disconnected = false;
   /** P4: active hub discussion orchestrator (web room), if any. */
   hubOrchestrator = null;
   /** P4b: pending between-rounds human-steer prompts (requestId → resolver). */
@@ -2769,9 +2814,13 @@ var SessionHandler = class {
    * 会话一旦保存到磁盘（有消息后），会从此 Map 中移除。
    */
   unsavedSessions = /* @__PURE__ */ new Map();
+  // Failed saves survive a socket reconnect, scoped to the owning config directory.
+  static recovery = /* @__PURE__ */ new Map();
+  static acceptedChats = /* @__PURE__ */ new Map();
   constructor(ws, shared) {
     this.ws = ws;
     this.config = shared.config;
+    this.unsavedSessions = new Map(_SessionHandler.recovery.get(this.config.getConfigDir()));
     this.costTracker = shared.costTracker;
     this.providers = shared.providers;
     this.sessions = shared.sessions;
@@ -2839,9 +2888,7 @@ var SessionHandler = class {
    * 接口之间的任何漂移（少一个成员、签名改了）都会当场编译失败，而不是等到运行时。
    */
   send(msg) {
-    if (this.ws.readyState === this.ws.OPEN) {
-      this.ws.send(JSON.stringify(msg));
-    }
+    sendSocketMessage(this.ws, msg);
   }
   sendStatus() {
     const providerList = this.providers.listAvailable().map((p) => ({
@@ -2895,6 +2942,7 @@ var SessionHandler = class {
     });
   }
   async handleMessage(raw) {
+    if (this.disconnected) return;
     let msg;
     try {
       msg = JSON.parse(raw);
@@ -2903,8 +2951,33 @@ var SessionHandler = class {
       return;
     }
     switch (msg.type) {
-      case "chat":
+      case "chat": {
+        if (msg.messageId) {
+          if (typeof msg.messageId !== "string" || msg.messageId.length > 200) throw new Error("Invalid message ID");
+          const scope = this.config.getConfigDir();
+          const accepted = _SessionHandler.acceptedChats.get(scope) ?? /* @__PURE__ */ new Map();
+          const prior = accepted.get(msg.messageId);
+          if (prior) {
+            this.send({ type: "chat_ack", messageId: msg.messageId, accepted: true, duplicate: true, sessionId: prior });
+            return;
+          }
+          if (this.processing || typeof msg.content !== "string") {
+            this.send({ type: "chat_ack", messageId: msg.messageId, accepted: false, error: "A request is already running, or the message is invalid. Your draft was kept." });
+            return;
+          }
+          const imageError = imageValidationError(msg.images);
+          if (imageError) {
+            this.send({ type: "chat_ack", messageId: msg.messageId, accepted: false, error: imageError });
+            return;
+          }
+          this.ensureSession();
+          accepted.set(msg.messageId, this.sessions.current.id);
+          while (accepted.size > 1e3) accepted.delete(accepted.keys().next().value);
+          _SessionHandler.acceptedChats.set(scope, accepted);
+          this.send({ type: "chat_ack", messageId: msg.messageId, accepted: true, sessionId: this.sessions.current.id });
+        }
         return this.handleChat(msg.content, msg.images);
+      }
       case "command":
         return this.handleCommand(msg.name, msg.args);
       case "confirm_response":
@@ -2946,7 +3019,7 @@ var SessionHandler = class {
       case "hub_start":
         return this.handleHubStart(msg);
       case "hub_abort":
-        this.hubOrchestrator?.abort();
+        this.cancelHub();
         return;
       case "hub_steer": {
         const resolve4 = this.pendingHubReview.get(msg.requestId);
@@ -2961,7 +3034,10 @@ var SessionHandler = class {
         return;
     }
   }
-  onDisconnect() {
+  onDisconnect(closeSocket = true) {
+    if (this.disconnected) return;
+    this.disconnected = true;
+    if (closeSocket && this.ws.readyState === this.ws.OPEN) this.ws.close(1001, "Connection closed; reconnect to restore session");
     runLifecycleHooks(mergePluginHooks(this.config.get("hooks") ?? void 0, this.config.getConfigDir()), "Stop", { sessionId: this.sessions.current?.id }, { configDir: this.config.getConfigDir() });
     this.toolExecutor.cancelAll();
     if (this.abortController) this.abortController.abort();
@@ -2969,18 +3045,24 @@ var SessionHandler = class {
     this.pendingAskUser.clear();
     for (const resolve4 of this.pendingAutoPause.values()) resolve4({ action: "stop" });
     this.pendingAutoPause.clear();
-    this.saveIfNeeded();
+    this.cancelHub();
+    void this.saveIfNeeded();
     if (this._bashSessionKey) clearBashSession(this._bashSessionKey);
   }
+  cancelHub() {
+    this.hubOrchestrator?.abort();
+    for (const resolve4 of this.pendingHubReview.values()) resolve4({ action: "stop" });
+    this.pendingHubReview.clear();
+  }
   /** 根据当前模型 context window 更新工具输出截断上限 */
   updateContextWindow() {
     try {
       const cfgOutputCap = this.config.get("maxToolOutputChars");
-      if (typeof cfgOutputCap === "number" && cfgOutputCap > 0) setMaxOutputCap(cfgOutputCap);
       const provider = this.providers.get(this.currentProvider);
       const modelInfo = provider?.info.models.find((m) => m.id === this.currentModel);
-      if (modelInfo?.contextWindow) setContextWindow(modelInfo.contextWindow);
+      this.toolExecutor.maxOutputChars = getMaxOutputChars(modelInfo?.contextWindow, cfgOutputCap ?? 0);
     } catch {
+      this.toolExecutor.maxOutputChars = DEFAULT_MAX_TOOL_OUTPUT_CHARS;
     }
   }
   /** 获取当前模型的 context window 大小（0 表示未知）*/
@@ -3032,12 +3114,24 @@ var SessionHandler = class {
     return total;
   }
   /** Save session only if it exists and has messages (never persist empty "Untitled" sessions). */
-  saveIfNeeded() {
-    if (this.sessions.current && this.sessions.current.messages.length > 0) {
-      autoTrimSessionIfNeeded(this.sessions.current);
-      const id = this.sessions.current.id;
-      this.sessions.save();
-      this.unsavedSessions.delete(id);
+  async saveIfNeeded() {
+    const session = this.sessions.current;
+    if (!session?.messages.length) return;
+    const scope = this.config.getConfigDir();
+    try {
+      if (session.dirty) autoTrimSessionIfNeeded(session);
+      await this.sessions.save();
+      if (session.dirty) return;
+      this.unsavedSessions.delete(session.id);
+      _SessionHandler.recovery.get(scope)?.delete(session.id);
+    } catch (err) {
+      this.unsavedSessions.set(session.id, session);
+      const recovered = _SessionHandler.recovery.get(scope) ?? /* @__PURE__ */ new Map();
+      recovered.set(session.id, session);
+      _SessionHandler.recovery.set(scope, recovered);
+      const message = `Session ${session.id} was NOT saved: ${err instanceof Error ? err.message : String(err)}. Content is retained in memory; use /session save to retry. Do not stop the server before saving.`;
+      this.send({ type: "info", message });
+      process.stderr.write(message + "\n");
     }
   }
   /** Lazily create a session if none exists yet (deferred from constructor). */
@@ -3162,20 +3256,15 @@ var SessionHandler = class {
         const kinds = [...new Set(secretHits.map((h) => h.kind))].join(", ");
         this.send({ type: "info", message: "Possible secret in prompt (" + kinds + ")." });
       }
-      const ALLOWED_IMAGE_MIMES = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/gif", "image/webp", "image/svg+xml"]);
-      const MAX_IMAGE_SIZE = 10 * 1024 * 1024;
+      const imageError = imageValidationError(images);
+      if (imageError) {
+        this.send({ type: "error", message: imageError });
+        return;
+      }
       let msgContent;
       if (images && images.length > 0) {
         const parts = [];
         for (const img of images) {
-          if (!ALLOWED_IMAGE_MIMES.has(img.mime)) {
-            this.send({ type: "error", message: `Rejected image: unsupported MIME type "${img.mime}"` });
-            return;
-          }
-          if (img.data && img.data.length > MAX_IMAGE_SIZE) {
-            this.send({ type: "error", message: `Rejected image: too large (${(img.data.length / 1024 / 1024).toFixed(1)} MB, max 10 MB)` });
-            return;
-          }
           parts.push({
             type: "image_url",
             image_url: { url: `data:${img.mime};base64,${img.data}` }
@@ -3229,7 +3318,7 @@ var SessionHandler = class {
       this.send({ type: "error", message });
     } finally {
       this.processing = false;
-      this.saveIfNeeded();
+      await this.saveIfNeeded();
       this.sendStatus();
       this.sendSessionList();
     }
@@ -3746,6 +3835,10 @@ ${summaryContent}`,
   }
   // ── Commands ─────────────────────────────────────────────────────
   async handleCommand(name, args) {
+    if (this.processing && ["session", "clear", "provider", "model", "rewind", "branch", "compact"].includes(name)) {
+      this.send({ type: "info", message: "Stop the current request before changing sessions or conversation settings." });
+      return;
+    }
     const cliOnlyReason = CLI_ONLY_WEB_COMMANDS.get(name);
     if (cliOnlyReason) {
       this.send({
@@ -4374,7 +4467,7 @@ async function startWebServer(options = {}) {
     next();
   });
   const server = createServer(app);
-  const WS_MAX_PAYLOAD = 1 * 1024 * 1024;
+  const WS_MAX_PAYLOAD = MAX_CHAT_BYTES;
   const WS_MSG_RATE_PER_SEC = 30;
   const WS_MSG_BURST = 60;
   const WS_PREAUTH_TIMEOUT_MS = 3e4;
@@ -4447,6 +4540,7 @@ async function startWebServer(options = {}) {
   app.get("/api/status", (_req, res) => {
     res.json({
       version: VERSION,
+      chatLimits: { maxChatBytes: MAX_CHAT_BYTES, maxImageBytes: MAX_IMAGE_BYTES },
       providers: availableProviders.map((p) => ({
         id: p.info.id,
         displayName: p.info.displayName,
@@ -4655,11 +4749,6 @@ async function startWebServer(options = {}) {
     const tabId = params.get("tabId") || `tab-${Date.now()}`;
     const cookies = parseCookie(req.headers.cookie ?? "");
     const token = cookies["aicli_token"] || "";
-    const existing = handlers.get(tabId);
-    if (existing) {
-      existing.onDisconnect();
-      handlers.delete(tabId);
-    }
     let tokens = WS_MSG_BURST;
     let lastRefill = Date.now();
     const takeToken = () => {
@@ -4675,6 +4764,32 @@ async function startWebServer(options = {}) {
     };
     let authenticatedUser = null;
     let handler = null;
+    let handlerKey = "";
+    const attachHandler = (resources) => {
+      if (handler) {
+        handler.onDisconnect(false);
+        if (handlers.get(handlerKey) === handler) handlers.delete(handlerKey);
+      }
+      handlerKey = JSON.stringify([authenticatedUser, tabId]);
+      const existing = handlers.get(handlerKey);
+      existing?.onDisconnect();
+      const attached = new SessionHandler(ws, { ...resources, sessions: new SessionManager(resources.config) });
+      handlers.set(handlerKey, attached);
+      return attached;
+    };
+    let alive = true;
+    ws.on("pong", () => {
+      alive = true;
+    });
+    const heartbeat = setInterval(() => {
+      if (!alive) {
+        ws.terminate();
+        return;
+      }
+      alive = false;
+      if (ws.readyState === ws.OPEN) ws.ping();
+    }, 3e4);
+    heartbeat.unref();
     let preAuthTimer = setTimeout(() => {
       if (!handler && ws.readyState === ws.OPEN) {
         try {
@@ -4695,14 +4810,12 @@ async function startWebServer(options = {}) {
     const authRequired = authManager.isEnabled();
     if (!authRequired) {
       console.log(`   \u2713 Tab connected: ${tabId.slice(0, 12)} (no auth) (total: ${handlers.size + 1})`);
-      handler = new SessionHandler(ws, shared);
-      handlers.set(tabId, handler);
+      handler = attachHandler(shared);
       clearPreAuthTimer();
     } else if (authenticatedUser) {
       console.log(`   \u2713 Tab connected: ${tabId.slice(0, 12)} (user: ${authenticatedUser}) (total: ${handlers.size + 1})`);
       const userShared = getUserShared(authenticatedUser);
-      handler = new SessionHandler(ws, userShared);
-      handlers.set(tabId, handler);
+      handler = attachHandler(userShared);
       clearPreAuthTimer();
     } else {
       console.log(`   \u23F3 Tab waiting auth: ${tabId.slice(0, 12)}`);
@@ -4747,8 +4860,7 @@ async function startWebServer(options = {}) {
             authManager.login(username, password);
             authenticatedUser = username;
             const userShared = getUserShared(username);
-            handler = new SessionHandler(ws, userShared);
-            handlers.set(tabId, handler);
+            handler = attachHandler(userShared);
             clearPreAuthTimer();
             console.log(`   \u2713 User registered & connected: ${username} (tab: ${tabId.slice(0, 12)})`);
             ws.send(JSON.stringify({ type: "auth_result", success: true, username }));
@@ -4763,8 +4875,7 @@ async function startWebServer(options = {}) {
             }
             authenticatedUser = verifiedUser;
             const userShared = getUserShared(verifiedUser);
-            handler = new SessionHandler(ws, userShared);
-            handlers.set(tabId, handler);
+            handler = attachHandler(userShared);
             clearPreAuthTimer();
             console.log(`   \u2713 Token auth: ${verifiedUser} (tab: ${tabId.slice(0, 12)})`);
             ws.send(JSON.stringify({ type: "auth_result", success: true, username: verifiedUser }));
@@ -4778,8 +4889,7 @@ async function startWebServer(options = {}) {
             }
             authenticatedUser = username;
             const userShared = getUserShared(username);
-            handler = new SessionHandler(ws, userShared);
-            handlers.set(tabId, handler);
+            handler = attachHandler(userShared);
             clearPreAuthTimer();
             console.log(`   \u2713 User logged in: ${username} (tab: ${tabId.slice(0, 12)})`);
             ws.send(JSON.stringify({ type: "auth_result", success: true, username }));
@@ -4807,10 +4917,11 @@ async function startWebServer(options = {}) {
       }
     });
     ws.on("close", () => {
+      clearInterval(heartbeat);
       clearPreAuthTimer();
-      const wasTracked = handlers.has(tabId);
+      const wasTracked = handlers.get(handlerKey) === handler;
       if (handler) handler.onDisconnect();
-      if (wasTracked) handlers.delete(tabId);
+      if (wasTracked) handlers.delete(handlerKey);
       console.log(`   \u2717 Tab disconnected: ${tabId.slice(0, 12)} (total: ${handlers.size})`);
     });
     ws.on("error", (err) => {

package/dist/{store-MWNHVGJT.js → store-CMSSWZF7.js}

@@ -5,8 +5,9 @@ import {
   loadIndex,
   removeFile,
   saveIndex,
+  symbolFingerprint,
   upsertFileSymbols
-} from "./chunk-CKH4KQ4E.js";
+} from "./chunk-WQ3OMEC4.js";
 import "./chunk-IW3Q7AE5.js";
 export {
   clearIndex,
@@ -14,5 +15,6 @@ export {
   loadIndex,
   removeFile,
   saveIndex,
+  symbolFingerprint,
   upsertFileSymbols
 };