jinzd-ai-cli 0.4.306 → 0.4.308

package/dist/{chunk-3RDJEYF7.js → chunk-BGZN4K7Q.js}

@@ -2,7 +2,7 @@
 import {
   evaluateCiGate,
   normalizeCiThresholds
-} from "./chunk-K5SDDTN7.js";
+} from "./chunk-NLK45GUS.js";
 import {
   buildReviewPrompt,
   buildSecurityReviewPrompt,
@@ -13,13 +13,13 @@ import {
 } from "./chunk-6YZEZFX5.js";
 import {
   ProviderRegistry
-} from "./chunk-VXEF2SWG.js";
+} from "./chunk-WT252ZDV.js";
 import {
   ConfigManager
-} from "./chunk-OC2XHG5L.js";
+} from "./chunk-YBZM7PHI.js";
 import {
   VERSION
-} from "./chunk-T6WQEQI4.js";
+} from "./chunk-2MNUMLN4.js";
 
 // src/cli/ci.ts
 import { execFileSync } from "child_process";

package/dist/chunk-BMLQPSHP.js

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+
+// src/core/atomic-write.ts
+import fs from "fs";
+import { randomUUID } from "crypto";
+import { setTimeout as delay } from "timers/promises";
+function modeFor(target, options) {
+  if (options.mode !== void 0) return options.mode;
+  try {
+    return fs.statSync(target).mode & 511;
+  } catch {
+    return 384;
+  }
+}
+function atomicWriteFileSync(target, data, options = {}) {
+  const tmp = `${target}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    fs.writeFileSync(tmp, data, { flag: "wx", mode: modeFor(target, options) });
+    fs.renameSync(tmp, target);
+  } finally {
+    try {
+      fs.unlinkSync(tmp);
+    } catch {
+    }
+  }
+}
+var pending = /* @__PURE__ */ new Map();
+async function atomicWriteFile(target, data, options = {}) {
+  const previous = pending.get(target) ?? Promise.resolve();
+  const operation = previous.catch(() => {
+  }).then(async () => {
+    const tmp = `${target}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+      let mode = options.mode ?? 384;
+      if (options.mode === void 0) {
+        try {
+          mode = (await fs.promises.stat(target)).mode & 511;
+        } catch {
+        }
+      }
+      await fs.promises.writeFile(tmp, data, { flag: "wx", mode });
+      for (let attempt = 0; ; attempt++) {
+        try {
+          await fs.promises.rename(tmp, target);
+          break;
+        } catch (error) {
+          if (attempt >= 10 || !["EPERM", "EBUSY", "EACCES"].includes(error.code ?? "")) throw error;
+          await delay(5 * (attempt + 1));
+        }
+      }
+    } finally {
+      try {
+        await fs.promises.unlink(tmp);
+      } catch {
+      }
+    }
+  });
+  pending.set(target, operation);
+  try {
+    await operation;
+  } finally {
+    if (pending.get(target) === operation) pending.delete(target);
+  }
+}
+
+export {
+  atomicWriteFileSync,
+  atomicWriteFile
+};

package/dist/{chunk-NRSYBKWA.js → chunk-C7CKDFJS.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-KHYD3WXE.js";
 import {
   atomicWriteFileSync
-} from "./chunk-IW3Q7AE5.js";
+} from "./chunk-BMLQPSHP.js";
 
 // src/symbols/vector-store.ts
 import fs from "fs";

package/dist/{chunk-JFNBJHR6.js → chunk-E2PNXNKI.js}

@@ -8,13 +8,13 @@ import {
   listHooks,
   listInstalledPlugins,
   resetStats
-} from "./chunk-7SSCSSC6.js";
+} from "./chunk-3537CQ5M.js";
 import {
   ProviderRegistry
-} from "./chunk-VXEF2SWG.js";
+} from "./chunk-WT252ZDV.js";
 import {
   ConfigManager
-} from "./chunk-OC2XHG5L.js";
+} from "./chunk-YBZM7PHI.js";
 import {
   getGitRoot
 } from "./chunk-HOSJZMQS.js";
@@ -26,7 +26,7 @@ import {
   MCP_PROJECT_CONFIG_NAME,
   MEMORY_FILE_NAME,
   VERSION
-} from "./chunk-T6WQEQI4.js";
+} from "./chunk-2MNUMLN4.js";
 
 // src/diagnostics/doctor-report.ts
 import { existsSync as existsSync3, statSync as statSync2 } from "fs";

package/dist/chunk-FVXNEZEW.js

@@ -0,0 +1,161 @@
+import {
+  getExecutionConfigDir,
+  scopedState
+} from "./chunk-QMFMST2T.js";
+
+// src/security/file-access.ts
+import { existsSync, realpathSync, openSync, readSync, closeSync, statSync } from "fs";
+import { basename, dirname, resolve, join } from "path";
+import { homedir } from "os";
+function canonicalPath(value) {
+  let cursor = resolve(value);
+  const missing = [];
+  while (!existsSync(cursor)) {
+    const parent = dirname(cursor);
+    if (parent === cursor) throw new Error("Cannot resolve path");
+    missing.unshift(basename(cursor));
+    cursor = parent;
+  }
+  return resolve(realpathSync(cursor), ...missing);
+}
+function isCredentialVault(value) {
+  const normalize = (p) => process.platform === "win32" ? p.toLowerCase() : p;
+  const target = normalize(canonicalPath(value));
+  const hostRoot = normalize(canonicalPath(join(homedir(), ".aicli")));
+  if (basename(target) === "config.json" && normalize(dirname(dirname(dirname(target)))) === hostRoot && basename(dirname(dirname(target))) === "users") return true;
+  return [getExecutionConfigDir(), join(homedir(), ".aicli")].some((root) => ["config.json", "users.json"].some((file) => {
+    const vault = canonicalPath(join(root, file));
+    if (target === normalize(vault)) return true;
+    try {
+      const a = statSync(target), b = statSync(vault);
+      return a.ino !== 0 && a.dev === b.dev && a.ino === b.ino;
+    } catch {
+      return false;
+    }
+  }));
+}
+function assertReadablePath(value) {
+  if (isCredentialVault(value)) throw new Error("[Refused] Credential vault files cannot be read by tools. Use aicli config or an external editor.");
+}
+var MAX_SNAPSHOT_BYTES = 2 * 1024 * 1024;
+var MAX_SNAPSHOT_TOTAL_BYTES = 16 * 1024 * 1024;
+function readSnapshot(value) {
+  const fd = openSync(value, "r");
+  try {
+    const buffer = Buffer.alloc(MAX_SNAPSHOT_BYTES + 1);
+    let bytes = 0;
+    while (bytes < buffer.length) {
+      const n = readSync(fd, buffer, bytes, buffer.length - bytes, null);
+      if (!n) break;
+      bytes += n;
+    }
+    if (bytes > MAX_SNAPSHOT_BYTES) throw new Error("File exceeds 2 MiB snapshot limit; edit refused because a complete undo snapshot cannot be kept.");
+    return buffer.subarray(0, bytes).toString("utf8");
+  } finally {
+    closeSync(fd);
+  }
+}
+
+// src/tools/file-checkpoint.ts
+import { existsSync as existsSync2, writeFileSync, unlinkSync } from "fs";
+var MAX_SNAPSHOTS = 200;
+var FileCheckpointStore = class {
+  stateKey = /* @__PURE__ */ Symbol("snapshots");
+  get snapshots() {
+    return scopedState(this.stateKey, () => ({ items: [] })).items;
+  }
+  set snapshots(items) {
+    scopedState(this.stateKey, () => ({ items: [] })).items = items;
+  }
+  /**
+   * 在文件写入前调用，保存当前文件内容。
+   * 同一 messageIndex 下同一文件只记录首次快照。
+   */
+  snapshot(filePath, messageIndex) {
+    const exists = this.snapshots.some(
+      (s) => s.filePath === filePath && s.messageIndex === messageIndex
+    );
+    if (exists) return;
+    let content = null;
+    if (existsSync2(filePath)) {
+      content = readSnapshot(filePath);
+    }
+    this.snapshots.push({
+      filePath,
+      content,
+      messageIndex,
+      timestamp: Date.now()
+    });
+    while (this.snapshots.length > MAX_SNAPSHOTS || this.snapshots.reduce((n, e) => n + Buffer.byteLength(e.content ?? ""), 0) > MAX_SNAPSHOT_TOTAL_BYTES) {
+      this.snapshots.shift();
+    }
+  }
+  /**
+   * 恢复所有在指定消息索引之后被修改的文件到该索引时的状态。
+   * @returns 恢复和删除的文件数量
+   */
+  restoreToMessageIndex(targetIndex) {
+    const modifiedAfter = this.snapshots.filter((s) => s.messageIndex > targetIndex);
+    const uniqueFiles = [...new Set(modifiedAfter.map((s) => s.filePath))];
+    let restored = 0;
+    let deleted = 0;
+    const files = [];
+    for (const filePath of uniqueFiles) {
+      const beforeSnapshots = this.snapshots.filter((s) => s.filePath === filePath && s.messageIndex <= targetIndex).sort((a, b) => b.messageIndex - a.messageIndex);
+      const restoreTo = beforeSnapshots[0];
+      try {
+        if (restoreTo) {
+          if (restoreTo.content === null) {
+            if (existsSync2(filePath)) {
+              unlinkSync(filePath);
+              deleted++;
+              files.push(filePath);
+            }
+          } else {
+            writeFileSync(filePath, restoreTo.content, "utf-8");
+            restored++;
+            files.push(filePath);
+          }
+        } else {
+          const earliest = this.snapshots.filter((s) => s.filePath === filePath).sort((a, b) => a.messageIndex - b.messageIndex)[0];
+          if (earliest && earliest.content === null) {
+            if (existsSync2(filePath)) {
+              unlinkSync(filePath);
+              deleted++;
+              files.push(filePath);
+            }
+          } else if (earliest) {
+            writeFileSync(filePath, earliest.content, "utf-8");
+            restored++;
+            files.push(filePath);
+          }
+        }
+      } catch {
+      }
+    }
+    this.snapshots = this.snapshots.filter((s) => s.messageIndex <= targetIndex);
+    return { restored, deleted, files };
+  }
+  /** 获取所有快照（供调试/显示） */
+  getSnapshots() {
+    return this.snapshots;
+  }
+  /** 获取有快照的消息索引列表（去重排序） */
+  getMessageIndices() {
+    return [...new Set(this.snapshots.map((s) => s.messageIndex))].sort((a, b) => a - b);
+  }
+  /** 清空所有快照（新会话/清除时调用） */
+  clear() {
+    this.snapshots = [];
+  }
+};
+var fileCheckpoints = new FileCheckpointStore();
+
+export {
+  canonicalPath,
+  isCredentialVault,
+  assertReadablePath,
+  MAX_SNAPSHOT_TOTAL_BYTES,
+  readSnapshot,
+  fileCheckpoints
+};

package/dist/{chunk-YKJO3SI4.js → chunk-G6DVGQ4I.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-RS7SKYTS.js";
 import {
   atomicWriteFileSync
-} from "./chunk-IW3Q7AE5.js";
+} from "./chunk-BMLQPSHP.js";
 
 // src/core/pricing.ts
 var CNY_PER_USD = 6.9;

package/dist/{chunk-AYLK4EGA.js → chunk-HC33C4U3.js}

@@ -2,7 +2,7 @@
 import {
   computeCost,
   formatCost
-} from "./chunk-YKJO3SI4.js";
+} from "./chunk-G6DVGQ4I.js";
 import {
   clearRecentlyDeniedAutoActions,
   estimateTokens,
@@ -16,7 +16,7 @@ import {
   setPreferredAgentName,
   truncateForPersist,
   undoStack
-} from "./chunk-VLDB2SVN.js";
+} from "./chunk-TPTFV3Y6.js";
 import {
   buildReviewPrompt,
   buildSecurityReviewPrompt
@@ -26,7 +26,7 @@ import {
   clearChatIndex,
   getChatIndexStatus,
   searchChatMemory
-} from "./chunk-GHWZVPUV.js";
+} from "./chunk-6JHACXB3.js";
 import {
   addMemoryEntry,
   backupMemoryStore,
@@ -51,13 +51,13 @@ import {
   touchMemoryReferences,
   updateMemoryApproval,
   updateMemoryEntry
-} from "./chunk-LAP7TPPK.js";
+} from "./chunk-LR3TGZWQ.js";
 import {
   theme
 } from "./chunk-5C76XDDF.js";
 import {
   getContentText
-} from "./chunk-IUVDZVZ4.js";
+} from "./chunk-AXTLYOA7.js";
 import {
   DEFAULT_PATTERNS,
   scanString
@@ -65,7 +65,7 @@ import {
 import {
   buildDoctorReport,
   formatDoctorReport
-} from "./chunk-JFNBJHR6.js";
+} from "./chunk-E2PNXNKI.js";
 import {
   describePlugin,
   getActivePluginAssets,
@@ -80,24 +80,24 @@ import {
   trustHook,
   trustPlugin,
   untrustHook
-} from "./chunk-7SSCSSC6.js";
+} from "./chunk-3537CQ5M.js";
 import {
   isCleanDocumentBody,
   stripOuterCodeFence
-} from "./chunk-MI4SFZGX.js";
+} from "./chunk-RMEJR3AW.js";
 import {
   formatGitContextForPrompt,
   getGitContext
 } from "./chunk-HOSJZMQS.js";
 import {
   atomicWriteFileSync
-} from "./chunk-IW3Q7AE5.js";
+} from "./chunk-BMLQPSHP.js";
 import {
   applyConfigCommand
 } from "./chunk-XNFIYS7G.js";
 import {
   fileCheckpoints
-} from "./chunk-4BKXL7SM.js";
+} from "./chunk-JJFJWD35.js";
 import {
   APP_NAME,
   CONFIG_DIR_NAME,
@@ -109,7 +109,7 @@ import {
   MCP_TOOL_PREFIX,
   REPO_URL,
   VERSION
-} from "./chunk-T6WQEQI4.js";
+} from "./chunk-2MNUMLN4.js";
 
 // src/skills/manager.ts
 import { existsSync, readdirSync, mkdirSync, statSync } from "fs";
@@ -2426,8 +2426,8 @@ No tools match "${filter}".
           const { join: join6 } = await import("path");
           const { existsSync: existsSync6 } = await import("fs");
           const { getGitRoot } = await import("./git-context-EXOEHQSF.js");
-          const { MCP_PROJECT_CONFIG_NAME } = await import("./constants-CPNWIUGZ.js");
-          const { approveProject, hashMcpFile } = await import("./project-trust-NKYHL3VZ.js");
+          const { MCP_PROJECT_CONFIG_NAME } = await import("./constants-BLDBI7IG.js");
+          const { approveProject, hashMcpFile } = await import("./project-trust-KGG2BWKC.js");
           const cwd = process.cwd();
           const projectRoot = getGitRoot(cwd) ?? cwd;
           const mcpPath = join6(projectRoot, MCP_PROJECT_CONFIG_NAME);
@@ -3534,7 +3534,7 @@ function createReviewCommands() {
       usage: "/test [command|filter]",
       async execute(args, ctx) {
         try {
-          const { executeTests } = await import("./run-tests-BAMLVLO6.js");
+          const { executeTests } = await import("./run-tests-GHY4BYDE.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -3900,9 +3900,9 @@ function createMemoryCommands() {
       async execute(args, ctx) {
         const sub = (args[0] ?? "status").toLowerCase();
         const root = process.cwd();
-        const { loadIndex, clearIndex } = await import("./store-CMSSWZF7.js");
-        const { indexProject } = await import("./indexer-P3FPRTPJ.js");
-        const { loadVectorStore, clearVectorStore } = await import("./vector-store-PWIOQFTP.js");
+        const { loadIndex, clearIndex } = await import("./store-76VVFDXM.js");
+        const { indexProject } = await import("./indexer-GKIWSSRP.js");
+        const { loadVectorStore, clearVectorStore } = await import("./vector-store-V6UGEYWK.js");
         if (sub === "status") {
           const idx = loadIndex(root);
           const vec = loadVectorStore(root);
@@ -3962,7 +3962,7 @@ function createMemoryCommands() {
           }
           console.log(theme.dim(`  Building semantic index for ${idx.symbolCount} symbols\u2026`));
           console.log(theme.dim("  (First run downloads ~117 MB embedding model to ~/.aicli/models/)"));
-          const { rebuildSemanticIndex } = await import("./semantic-7GM5M4MU.js");
+          const { rebuildSemanticIndex } = await import("./semantic-N227CLSC.js");
           try {
             const stats = await rebuildSemanticIndex(root, {
               onProgress: (done, total) => {

package/dist/chunk-JJFJWD35.js

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+import {
+  getExecutionConfigDir,
+  scopedState
+} from "./chunk-SXIJLSVF.js";
+
+// src/security/file-access.ts
+import { existsSync, realpathSync, openSync, readSync, closeSync, statSync } from "fs";
+import { basename, dirname, resolve, join } from "path";
+import { homedir } from "os";
+function canonicalPath(value) {
+  let cursor = resolve(value);
+  const missing = [];
+  while (!existsSync(cursor)) {
+    const parent = dirname(cursor);
+    if (parent === cursor) throw new Error("Cannot resolve path");
+    missing.unshift(basename(cursor));
+    cursor = parent;
+  }
+  return resolve(realpathSync(cursor), ...missing);
+}
+function isCredentialVault(value) {
+  const normalize = (p) => process.platform === "win32" ? p.toLowerCase() : p;
+  const target = normalize(canonicalPath(value));
+  const hostRoot = normalize(canonicalPath(join(homedir(), ".aicli")));
+  if (basename(target) === "config.json" && normalize(dirname(dirname(dirname(target)))) === hostRoot && basename(dirname(dirname(target))) === "users") return true;
+  return [getExecutionConfigDir(), join(homedir(), ".aicli")].some((root) => ["config.json", "users.json"].some((file) => {
+    const vault = canonicalPath(join(root, file));
+    if (target === normalize(vault)) return true;
+    try {
+      const a = statSync(target), b = statSync(vault);
+      return a.ino !== 0 && a.dev === b.dev && a.ino === b.ino;
+    } catch {
+      return false;
+    }
+  }));
+}
+function assertReadablePath(value) {
+  if (isCredentialVault(value)) throw new Error("[Refused] Credential vault files cannot be read by tools. Use aicli config or an external editor.");
+}
+var MAX_SNAPSHOT_BYTES = 2 * 1024 * 1024;
+var MAX_SNAPSHOT_TOTAL_BYTES = 16 * 1024 * 1024;
+function readSnapshot(value) {
+  const fd = openSync(value, "r");
+  try {
+    const buffer = Buffer.alloc(MAX_SNAPSHOT_BYTES + 1);
+    let bytes = 0;
+    while (bytes < buffer.length) {
+      const n = readSync(fd, buffer, bytes, buffer.length - bytes, null);
+      if (!n) break;
+      bytes += n;
+    }
+    if (bytes > MAX_SNAPSHOT_BYTES) throw new Error("File exceeds 2 MiB snapshot limit; edit refused because a complete undo snapshot cannot be kept.");
+    return buffer.subarray(0, bytes).toString("utf8");
+  } finally {
+    closeSync(fd);
+  }
+}
+
+// src/tools/file-checkpoint.ts
+import { existsSync as existsSync2, writeFileSync, unlinkSync } from "fs";
+var MAX_SNAPSHOTS = 200;
+var FileCheckpointStore = class {
+  stateKey = /* @__PURE__ */ Symbol("snapshots");
+  get snapshots() {
+    return scopedState(this.stateKey, () => ({ items: [] })).items;
+  }
+  set snapshots(items) {
+    scopedState(this.stateKey, () => ({ items: [] })).items = items;
+  }
+  /**
+   * 在文件写入前调用，保存当前文件内容。
+   * 同一 messageIndex 下同一文件只记录首次快照。
+   */
+  snapshot(filePath, messageIndex) {
+    const exists = this.snapshots.some(
+      (s) => s.filePath === filePath && s.messageIndex === messageIndex
+    );
+    if (exists) return;
+    let content = null;
+    if (existsSync2(filePath)) {
+      content = readSnapshot(filePath);
+    }
+    this.snapshots.push({
+      filePath,
+      content,
+      messageIndex,
+      timestamp: Date.now()
+    });
+    while (this.snapshots.length > MAX_SNAPSHOTS || this.snapshots.reduce((n, e) => n + Buffer.byteLength(e.content ?? ""), 0) > MAX_SNAPSHOT_TOTAL_BYTES) {
+      this.snapshots.shift();
+    }
+  }
+  /**
+   * 恢复所有在指定消息索引之后被修改的文件到该索引时的状态。
+   * @returns 恢复和删除的文件数量
+   */
+  restoreToMessageIndex(targetIndex) {
+    const modifiedAfter = this.snapshots.filter((s) => s.messageIndex > targetIndex);
+    const uniqueFiles = [...new Set(modifiedAfter.map((s) => s.filePath))];
+    let restored = 0;
+    let deleted = 0;
+    const files = [];
+    for (const filePath of uniqueFiles) {
+      const beforeSnapshots = this.snapshots.filter((s) => s.filePath === filePath && s.messageIndex <= targetIndex).sort((a, b) => b.messageIndex - a.messageIndex);
+      const restoreTo = beforeSnapshots[0];
+      try {
+        if (restoreTo) {
+          if (restoreTo.content === null) {
+            if (existsSync2(filePath)) {
+              unlinkSync(filePath);
+              deleted++;
+              files.push(filePath);
+            }
+          } else {
+            writeFileSync(filePath, restoreTo.content, "utf-8");
+            restored++;
+            files.push(filePath);
+          }
+        } else {
+          const earliest = this.snapshots.filter((s) => s.filePath === filePath).sort((a, b) => a.messageIndex - b.messageIndex)[0];
+          if (earliest && earliest.content === null) {
+            if (existsSync2(filePath)) {
+              unlinkSync(filePath);
+              deleted++;
+              files.push(filePath);
+            }
+          } else if (earliest) {
+            writeFileSync(filePath, earliest.content, "utf-8");
+            restored++;
+            files.push(filePath);
+          }
+        }
+      } catch {
+      }
+    }
+    this.snapshots = this.snapshots.filter((s) => s.messageIndex <= targetIndex);
+    return { restored, deleted, files };
+  }
+  /** 获取所有快照（供调试/显示） */
+  getSnapshots() {
+    return this.snapshots;
+  }
+  /** 获取有快照的消息索引列表（去重排序） */
+  getMessageIndices() {
+    return [...new Set(this.snapshots.map((s) => s.messageIndex))].sort((a, b) => a - b);
+  }
+  /** 清空所有快照（新会话/清除时调用） */
+  clear() {
+    this.snapshots = [];
+  }
+};
+var fileCheckpoints = new FileCheckpointStore();
+
+export {
+  canonicalPath,
+  isCredentialVault,
+  assertReadablePath,
+  MAX_SNAPSHOT_TOTAL_BYTES,
+  readSnapshot,
+  fileCheckpoints
+};