jinzd-ai-cli 0.4.306 → 0.4.308

package/dist/{chunk-VLDB2SVN.js → chunk-TPTFV3Y6.js}

@@ -2,7 +2,7 @@
 import {
   loadChatIndex,
   searchChatMemory
-} from "./chunk-GHWZVPUV.js";
+} from "./chunk-6JHACXB3.js";
 import {
   addMemoryEntry,
   findSimilarMemory,
@@ -11,17 +11,17 @@ import {
   searchPersistentMemories,
   touchMemoryReferences,
   updateMemoryEntry
-} from "./chunk-LAP7TPPK.js";
+} from "./chunk-LR3TGZWQ.js";
 import {
   indexProject
-} from "./chunk-LF67HWWR.js";
+} from "./chunk-RWRZVQCB.js";
 import {
   hasSemanticIndex,
   semanticSearch
-} from "./chunk-XJOK5353.js";
+} from "./chunk-B3MPYI4E.js";
 import {
   loadIndex
-} from "./chunk-WQ3OMEC4.js";
+} from "./chunk-M6HLYG33.js";
 import {
   theme
 } from "./chunk-5C76XDDF.js";
@@ -30,13 +30,13 @@ import {
   runHook,
   runLifecycleHooks,
   runTool
-} from "./chunk-7SSCSSC6.js";
+} from "./chunk-3537CQ5M.js";
 import {
   buildTruncatedArgumentsError,
   getDangerLevel,
   isFileWriteTool,
   runLeanAgentLoop
-} from "./chunk-MI4SFZGX.js";
+} from "./chunk-RMEJR3AW.js";
 import {
   EnvLoader,
   NetworkError,
@@ -44,13 +44,26 @@ import {
 } from "./chunk-TU3L3PW7.js";
 import {
   atomicWriteFileSync
-} from "./chunk-IW3Q7AE5.js";
+} from "./chunk-BMLQPSHP.js";
 import {
-  fileCheckpoints
-} from "./chunk-4BKXL7SM.js";
+  MAX_SNAPSHOT_TOTAL_BYTES,
+  assertReadablePath,
+  canonicalPath,
+  fileCheckpoints,
+  isCredentialVault,
+  readSnapshot
+} from "./chunk-JJFJWD35.js";
 import {
-  runTestsTool
-} from "./chunk-W6PLV3EY.js";
+  IS_WINDOWS,
+  WIN_UTF8_PREAMBLE,
+  currentAbortSignal,
+  decodeWindowsBuffer,
+  killProcessTree,
+  looksLikeGbkMojibake,
+  recoverGbkMojibake,
+  runTestsTool,
+  shellInvocation
+} from "./chunk-JJNUASMJ.js";
 import {
   CONFIG_DIR_NAME,
   DEFAULT_MAX_TOOL_OUTPUT_CHARS_CAP,
@@ -59,170 +72,25 @@ import {
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-T6WQEQI4.js";
+} from "./chunk-2MNUMLN4.js";
+import {
+  getCurrentSessionKey,
+  getExecutionConfigDir,
+  runWithSessionKey,
+  scopedState
+} from "./chunk-SXIJLSVF.js";
 
 // src/tools/shell-pool.ts
-import { spawn as spawn2 } from "child_process";
-import { platform as platform2 } from "os";
-
-// src/tools/win-shell.ts
-import { platform } from "os";
 import { spawn } from "child_process";
-var IS_WINDOWS = platform() === "win32";
-var WIN_UTF8_PREAMBLE = "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; $OutputEncoding = [System.Text.Encoding]::UTF8; ";
-function shellInvocation(command) {
-  if (IS_WINDOWS) {
-    return {
-      shell: "powershell.exe",
-      args: ["-NoProfile", "-NonInteractive", "-Command", WIN_UTF8_PREAMBLE + command]
-    };
-  }
-  return { shell: process.env["SHELL"] ?? "/bin/bash", args: ["-c", command] };
-}
-function decodeWindowsBuffer(buf) {
-  const utf8 = buf.toString("utf-8");
-  if (!utf8.includes("\uFFFD")) return utf8;
-  try {
-    return new TextDecoder("gbk").decode(buf);
-  } catch {
-    return utf8;
-  }
-}
-var GBK_MOJIBAKE_FINGERPRINTS = [
-  "\uFFFD",
-  "\u9215",
-  "\u951B",
-  "\u9983",
-  "\u9241",
-  "\u6D93",
-  "\u935B",
-  "\u9428",
-  "\u7EFE",
-  "\u95AB",
-  "\u9593",
-  "\u95BF",
-  "\u68E3",
-  "\u95B4",
-  "\u5A11",
-  "\u95B8",
-  "\u95BB",
-  "\u7F01",
-  "\u95C1"
-];
-var gbkReverse = null;
-function gbkReverseMap() {
-  if (gbkReverse) return gbkReverse;
-  const map = /* @__PURE__ */ new Map();
-  try {
-    const dec = new TextDecoder("gbk");
-    for (let hi = 129; hi <= 254; hi++) {
-      for (let lo = 64; lo <= 254; lo++) {
-        if (lo === 127) continue;
-        const ch = dec.decode(new Uint8Array([hi, lo]));
-        if (ch.length === 1 && ch !== "\uFFFD" && !map.has(ch)) map.set(ch, [hi, lo]);
-      }
-    }
-  } catch {
-  }
-  gbkReverse = map;
-  return map;
-}
-function decodeRunAsChinese(bytes) {
-  for (let start = 0; start <= 2 && start < bytes.length; start++) {
-    for (let end = 0; end <= 2 && bytes.length - end > start; end++) {
-      const slice = bytes.slice(start, bytes.length - end);
-      if (slice.length < 6) continue;
-      try {
-        const out = new TextDecoder("utf-8", { fatal: true }).decode(new Uint8Array(slice));
-        if (/[一-鿿]/.test(out)) return out;
-      } catch {
-      }
-    }
-  }
-  return null;
-}
-function recoverGbkMojibake(text) {
-  if (!text) return null;
-  const map = gbkReverseMap();
-  if (map.size === 0) return null;
-  let run = [];
-  let best = null;
-  const flush = () => {
-    if (run.length >= 4) {
-      const bytes = [];
-      for (const p of run) bytes.push(p[0], p[1]);
-      const out = decodeRunAsChinese(bytes);
-      if (out && (!best || out.length > best.length)) best = out;
-    }
-    run = [];
-  };
-  for (const ch of text) {
-    const pair = ch.codePointAt(0) < 128 ? void 0 : map.get(ch);
-    if (pair) run.push(pair);
-    else flush();
-  }
-  flush();
-  return best;
-}
-function looksLikeGbkMojibake(text) {
-  if (recoverGbkMojibake(text) !== null) return true;
-  let hits = 0;
-  for (const ch of GBK_MOJIBAKE_FINGERPRINTS) {
-    if (text.includes(ch) && ++hits >= 2) return true;
-  }
-  return false;
-}
-function killProcessTree(proc) {
-  if (proc.killed || proc.exitCode !== null) return;
-  if (IS_WINDOWS && proc.pid) {
-    try {
-      const tk = spawn("taskkill", ["/PID", String(proc.pid), "/T", "/F"], {
-        windowsHide: true,
-        stdio: "ignore"
-      });
-      tk.on("exit", () => {
-        try {
-          proc.kill();
-        } catch {
-        }
-      });
-      tk.on("error", () => {
-        try {
-          proc.kill();
-        } catch {
-        }
-      });
-    } catch {
-      try {
-        proc.kill();
-      } catch {
-      }
-    }
-    return;
-  }
-  try {
-    proc.kill("SIGTERM");
-  } catch {
-  }
-  setTimeout(() => {
-    if (!proc.killed && proc.exitCode === null) {
-      try {
-        proc.kill("SIGKILL");
-      } catch {
-      }
-    }
-  }, 500).unref();
-}
-
-// src/tools/shell-pool.ts
-var IS_WINDOWS2 = platform2() === "win32";
+import { platform } from "os";
+var IS_WINDOWS2 = platform() === "win32";
 var SHELL = IS_WINDOWS2 ? "powershell.exe" : process.env["SHELL"] ?? "/bin/bash";
 var pool = /* @__PURE__ */ new Map();
 var IDLE_EVICT_MS = 5 * 6e4;
 var evictionTimer = null;
 function spawnShell(cwd) {
   const shellArgs = IS_WINDOWS2 ? ["-NoProfile", "-NonInteractive", "-Command", "-"] : ["-s"];
-  const proc = spawn2(SHELL, shellArgs, {
+  const proc = spawn(SHELL, shellArgs, {
     cwd,
     windowsHide: true,
     stdio: ["pipe", "pipe", "pipe"]
@@ -433,16 +301,22 @@ function isToolCapableProvider(provider) {
 }
 
 // src/tools/builtin/bash.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync2, readdirSync, statSync } from "fs";
-import { platform as platform3 } from "os";
+import { platform as platform2 } from "os";
 import { resolve } from "path";
 
 // src/tools/undo-stack.ts
-import { readFileSync, writeFileSync, unlinkSync, rmdirSync, existsSync } from "fs";
+import { writeFileSync, unlinkSync, rmdirSync, existsSync } from "fs";
 var MAX_UNDO_DEPTH = 20;
 var UndoStack = class {
-  stack = [];
+  stateKey = /* @__PURE__ */ Symbol("stack");
+  get stack() {
+    return scopedState(this.stateKey, () => ({ items: [] })).items;
+  }
+  set stack(items) {
+    scopedState(this.stateKey, () => ({ items: [] })).items = items;
+  }
   /**
    * 在执行文件写入操作之前调用，保存当前状态。
    * @param filePath 将要被写入的文件路径
@@ -451,11 +325,7 @@ var UndoStack = class {
   push(filePath, description) {
     let previousContent = null;
     if (existsSync(filePath)) {
-      try {
-        previousContent = readFileSync(filePath, "utf-8");
-      } catch {
-        return;
-      }
+      previousContent = readSnapshot(filePath);
     }
     this.pushEntry({
       filePath,
@@ -492,7 +362,7 @@ var UndoStack = class {
   /** 内部统一入栈方法，含溢出裁剪 */
   pushEntry(entry) {
     this.stack.push(entry);
-    if (this.stack.length > MAX_UNDO_DEPTH) {
+    while (this.stack.length > MAX_UNDO_DEPTH || this.stack.reduce((n, e) => n + Buffer.byteLength(e.previousContent ?? ""), 0) > MAX_SNAPSHOT_TOTAL_BYTES) {
       this.stack.shift();
     }
   }
@@ -553,42 +423,8 @@ var UndoStack = class {
 };
 var undoStack = new UndoStack();
 
-// src/core/interrupt.ts
-var controller = new AbortController();
-var interrupted = false;
-function currentAbortSignal() {
-  return controller.signal;
-}
-function isInterrupted() {
-  return interrupted;
-}
-function requestInterrupt() {
-  interrupted = true;
-  if (!controller.signal.aborted) {
-    controller.abort(new DOMException("User interrupted (Ctrl+C)", "AbortError"));
-  }
-}
-function resetInterrupt() {
-  controller = new AbortController();
-  interrupted = false;
-}
-
-// src/tools/session-context.ts
-import { AsyncLocalStorage } from "async_hooks";
-var als = new AsyncLocalStorage();
-var DEFAULT_SESSION_KEY = "__default__";
-function getCurrentSessionKey() {
-  const ctx = als.getStore();
-  if (!ctx || !ctx.sessionKey) return DEFAULT_SESSION_KEY;
-  return ctx.sessionKey;
-}
-function runWithSessionKey(sessionKey, fn) {
-  const key = sessionKey && sessionKey.length > 0 ? sessionKey : DEFAULT_SESSION_KEY;
-  return als.run({ sessionKey: key }, fn);
-}
-
 // src/tools/builtin/bash.ts
-var IS_WINDOWS3 = platform3() === "win32";
+var IS_WINDOWS3 = platform2() === "win32";
 var SHELL2 = IS_WINDOWS3 ? "powershell.exe" : process.env["SHELL"] ?? "/bin/bash";
 var cwdBySession = /* @__PURE__ */ new Map();
 function getCwd() {
@@ -618,7 +454,8 @@ Important rules:
 4. To delete directories, use Remove-Item -Recurse (the system will automatically optimize to a more reliable method).
 5. IMPORTANT: On Windows, "curl" is an alias for Invoke-WebRequest and does NOT support curl flags like -s, -X, -H. Use Invoke-RestMethod instead for HTTP requests. Example: Invoke-RestMethod -Uri "http://localhost:3000/api/health" -Method Get
 6. NEVER run long-running / never-exiting commands through bash \u2014 they block until timeout. This includes starting an Android emulator (emulator -avd X), streaming logs (adb logcat), and dev servers (node server.js, npm run dev, metro / react-native start). Use the 'task_create' tool to run these in the background, then poll status with short bash calls (e.g. adb shell getprop sys.boot_completed).
-7. CRITICAL \u2014 this is PowerShell, NOT bash: \\ is NOT an escape character. Writing \\" inside a double-quoted string CLOSES the string and silently splits your command into fragments \u2014 it often still exits 0 with no output, so it looks like it worked when it did not. To escape a quote use \`" or "". For anything with nested quoting (especially ssh + psql -c "SELECT ..."), do NOT try to escape your way out: write the payload to a file with the 'write_file' tool, 'scp' it to the host, and run it with a single level of quoting (e.g. ssh host "psql -d db -f /tmp/x.sql").` : `Execute commands in ${SHELL2}.
+7. CRITICAL \u2014 this is PowerShell, NOT bash: \\ is NOT an escape character. Writing \\" inside a double-quoted string CLOSES the string and silently splits your command into fragments \u2014 it often still exits 0 with no output, so it looks like it worked when it did not. To escape a quote use \`" or "". For anything with nested quoting (especially ssh + psql -c "SELECT ..."), do NOT try to escape your way out: write the payload to a file with the 'write_file' tool, 'scp' it to the host, and run it with a single level of quoting (e.g. ssh host "psql -d db -f /tmp/x.sql").
+8. CRITICAL \u2014 running a program by its full path: a quoted string at the START of a statement is parsed as a string EXPRESSION, not a command. "C:\\path\\python.exe" -c "print(1)" is a SYNTAX ERROR. Put the call operator '&' in front: & "C:\\path\\python.exe" -c "print(1)" \u2014 or $py = "C:\\path\\python.exe"; & $py -c "print(1)". This applies to any quoted path used as a command, anywhere a statement starts (including after ';').` : `Execute commands in ${SHELL2}.
 Important rules:
 1. Each bash call runs in an independent subprocess; cd commands do not persist. To run in a specific directory, use the cwd parameter, or combine commands: e.g. "cd mydir && ls" or "mkdir -p mydir && touch mydir/file.txt".
 2. If a command fails (returns an error or non-zero exit code), stop immediately, report the error to the user, and do not retry the same or similar commands.
@@ -873,6 +710,116 @@ function detectPowerShellBackslashQuote(command) {
   }
   return false;
 }
+var PS_OPERATOR_WORDS = /* @__PURE__ */ new Set([
+  "eq",
+  "ne",
+  "gt",
+  "ge",
+  "lt",
+  "le",
+  "ceq",
+  "cne",
+  "cgt",
+  "cge",
+  "clt",
+  "cle",
+  "ieq",
+  "ine",
+  "igt",
+  "ige",
+  "ilt",
+  "ile",
+  "like",
+  "notlike",
+  "match",
+  "notmatch",
+  "clike",
+  "cnotlike",
+  "cmatch",
+  "cnotmatch",
+  "ilike",
+  "inotlike",
+  "imatch",
+  "inotmatch",
+  "contains",
+  "notcontains",
+  "ccontains",
+  "cnotcontains",
+  "icontains",
+  "inotcontains",
+  "in",
+  "notin",
+  "cin",
+  "cnotin",
+  "iin",
+  "inotin",
+  "is",
+  "isnot",
+  "as",
+  "and",
+  "or",
+  "not",
+  "xor",
+  "band",
+  "bor",
+  "bnot",
+  "bxor",
+  "shl",
+  "shr",
+  "join",
+  "split",
+  "replace",
+  "csplit",
+  "creplace",
+  "isplit",
+  "ireplace",
+  "f"
+]);
+function detectMissingCallOperator(command) {
+  if (!IS_WINDOWS3) return false;
+  let atStatementStart = true;
+  let afterCallOperator = false;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (ch === " " || ch === "	") continue;
+    if (ch === ";" || ch === "\n" || ch === "{" || ch === "(" || ch === "|" || ch === "&") {
+      if (ch === "&") {
+        const next = command.slice(i + 1).replace(/^[ \t]+/, "");
+        afterCallOperator = !next.startsWith("&");
+      } else {
+        afterCallOperator = false;
+      }
+      atStatementStart = true;
+      continue;
+    }
+    if (ch === "." && atStatementStart) {
+      afterCallOperator = true;
+      continue;
+    }
+    if ((ch === '"' || ch === "'") && atStatementStart && !afterCallOperator) {
+      const quote = ch;
+      let j = i + 1;
+      while (j < command.length && command[j] !== quote) j++;
+      if (j >= command.length) return false;
+      const rest = command.slice(j + 1);
+      const m = /^[ \t]+(\S+)/.exec(rest);
+      if (m) {
+        const token = m[1];
+        if (/^[-]/.test(token)) {
+          const word = token.slice(1).toLowerCase();
+          if (PS_OPERATOR_WORDS.has(word)) return false;
+          return true;
+        }
+        if (/^[+*%=<>|;)}\]]/.test(token)) return false;
+        return true;
+      }
+      return false;
+    }
+    atStatementStart = false;
+    afterCallOperator = false;
+  }
+  return false;
+}
 var BACKSLASH_QUOTE_SILENT_WARNING = `
 
 \u26A0 WARNING: this command contains \\" inside a double-quoted string, but PowerShell does NOT treat \\ as an escape \u2014 that quote CLOSED the string and the command was split into fragments. It exited 0 with no output because the outer program (e.g. ssh) still ran, but it very likely did NOT run what you intended. Do NOT assume this succeeded.
@@ -953,6 +900,11 @@ function buildErrorHint(command, stderr) {
       `Hint: PowerShell does NOT treat \\ as an escape character \u2014 the \\" in this command closed the double-quoted string and split the command into fragments. Escape quotes with \`" or "" instead. Better: avoid nested quoting entirely \u2014 write the payload to a file with 'write_file', 'scp' it over, and run it with one level of quoting (e.g. ssh host "psql -d <db> -f /tmp/x.sql").`
     );
   }
+  if (detectMissingCallOperator(command) && /(ParserError|UnexpectedToken|Unexpected token|意外的标记|运算符后面提供|必须在)/i.test(stderr)) {
+    hints.push(
+      `Hint: in PowerShell a quoted string at the START of a statement is parsed as a string EXPRESSION, not as a command \u2014 so "C:\\path\\python.exe" -c "..." is a syntax error, not a quoting problem. Do NOT retry by removing the quotes, dropping the argument, or re-quoting it differently; all of those fail the same way. Fix: put the call operator '&' in front \u2014 \`& "C:\\path\\python.exe" -c "..."\` \u2014 or assign the path to a variable first (\`$py = "C:\\path\\python.exe"; & $py -c "..."\`).`
+    );
+  }
   return hints.length > 0 ? hints.map((h) => `\u{1F4A1} ${h}`).join("\n\n") : null;
 }
 function detectBlockingCommand(command) {
@@ -1055,7 +1007,7 @@ function pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, cwd) {
 function runShell(command, opts) {
   return new Promise((resolvePromise) => {
     const shellArgs = IS_WINDOWS3 ? ["-NoProfile", "-NonInteractive", "-Command", WIN_UTF8_PREAMBLE + command] : ["-c", command];
-    const child = spawn3(SHELL2, shellArgs, {
+    const child = spawn2(SHELL2, shellArgs, {
       cwd: opts.cwd,
       env: opts.env,
       windowsHide: true,
@@ -1134,16 +1086,16 @@ function updateCwdFromCommand(command, baseCwd) {
 }
 
 // src/tools/builtin/read-file.ts
-import { readFileSync as readFileSync2, existsSync as existsSync3, statSync as statSync2, readdirSync as readdirSync2 } from "fs";
+import { readFileSync, existsSync as existsSync3, statSync as statSync2, readdirSync as readdirSync2 } from "fs";
 import { execFileSync } from "child_process";
 import { extname, resolve as resolve2, basename, sep, dirname } from "path";
 import { homedir } from "os";
 
 // src/tools/builtin/notebook-utils.ts
-function cellSourceToString(source) {
-  if (!source) return "";
-  if (Array.isArray(source)) return source.join("");
-  return source;
+function cellSourceToString(source2) {
+  if (!source2) return "";
+  if (Array.isArray(source2)) return source2.join("");
+  return source2;
 }
 function stringToCellSource(content) {
   if (content.length === 0) return [];
@@ -1198,16 +1150,16 @@ function renderNotebookAsText(nb, filePath) {
   nb.cells.forEach((cell, idx) => {
     const cellNum = idx + 1;
     const type = cell.cell_type;
-    const source = cellSourceToString(cell.source);
+    const source2 = cellSourceToString(cell.source);
     if (type === "markdown") {
       lines.push(`## Cell ${cellNum} [markdown]`);
-      lines.push(source);
+      lines.push(source2);
       lines.push("");
     } else if (type === "code") {
       const execLabel = cell.execution_count != null ? ` (execution #${cell.execution_count})` : "";
       lines.push(`## Cell ${cellNum} [code${execLabel}]`);
       lines.push("```" + language);
-      lines.push(source);
+      lines.push(source2);
       lines.push("```");
       const outputText = extractOutputText(cell.outputs);
       if (outputText) {
@@ -1219,7 +1171,7 @@ function renderNotebookAsText(nb, filePath) {
       lines.push("");
     } else if (type === "raw") {
       lines.push(`## Cell ${cellNum} [raw]`);
-      lines.push(source);
+      lines.push(source2);
       lines.push("");
     }
   });
@@ -1244,6 +1196,7 @@ function createCell(cellType, content) {
 // src/tools/builtin/read-file.ts
 var MAX_FILE_BYTES = 10 * 1024 * 1024;
 function getHardRefusal(normalizedPath) {
+  if (isCredentialVault(normalizedPath)) return "[Refused] Credential vault files cannot be read by tools.";
   const home2 = homedir();
   const p = normalizedPath.toLowerCase();
   const base = basename(normalizedPath).toLowerCase();
@@ -1418,7 +1371,7 @@ var readFileTool = {
     const offsetLine = typeof rawOffset === "number" && Number.isFinite(rawOffset) && rawOffset > 0 ? Math.floor(rawOffset) : void 0;
     const limitLines = typeof rawLimit === "number" && Number.isFinite(rawLimit) && rawLimit > 0 ? Math.floor(rawLimit) : void 0;
     if (!filePath) throw new ToolError("read_file", "path is required");
-    const normalizedPath = resolve2(filePath);
+    const normalizedPath = canonicalPath(filePath);
     const refusal = getHardRefusal(normalizedPath);
     if (refusal) return refusal;
     if (!existsSync3(normalizedPath)) {
@@ -1485,7 +1438,7 @@ Suggestion: read existing text versions (.md / .txt) in the project, or install
     }
     if (ext === ".ipynb") {
       try {
-        const raw = readFileSync2(normalizedPath, "utf-8");
+        const raw = readFileSync(normalizedPath, "utf-8");
         const nb = parseNotebook(raw);
         return renderNotebookAsText(nb, filePath);
       } catch (err) {
@@ -1503,8 +1456,8 @@ Do NOT claim you inspected this image \u2014 you have not seen it.`;
       return `[Binary file: ${filePath} (${ext})]
 This is a binary file and cannot be read as text. If there is a text version (.md / .txt) in the project, please read that instead.`;
     }
-    const { readFile: readFile2 } = await import("fs/promises");
-    const buf = size > 1048576 ? await readFile2(normalizedPath) : readFileSync2(normalizedPath);
+    const { readFile } = await import("fs/promises");
+    const buf = size > 1048576 ? await readFile(normalizedPath) : readFileSync(normalizedPath);
     if (encoding === "base64") {
       return `[File: ${filePath} | base64]
 
@@ -1542,12 +1495,12 @@ ${content}`;
 };
 
 // src/tools/builtin/write-file.ts
-import { appendFileSync, mkdirSync, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
+import { appendFileSync, mkdirSync, readFileSync as readFileSync3, statSync as statSync3 } from "fs";
 import { dirname as dirname3 } from "path";
 
 // src/tools/executor.ts
 import chalk2 from "chalk";
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync2 } from "fs";
 import { tmpdir } from "os";
 
 // src/core/readline-internal.ts
@@ -1890,7 +1843,8 @@ var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
   "recall_memory"
 ]);
 function normalizePathForPermission(value) {
-  return value.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+  const normalized = value.replace(/\\/g, "/").replace(/\/+$/, "");
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
 }
 function canonicalizeWithNearestParent(value) {
   const missing = [];
@@ -1978,7 +1932,7 @@ function profileHardDecision(profileName, toolName, args, dangerLevel, ctx) {
         return { action: "deny", reason: "file write target is outside workspace/temp roots", profileName, hardBoundary: true };
       }
     }
-    if (toolName === "bash" || toolName === "run_interactive" || toolName === "task_create") {
+    if (toolName === "bash" || toolName === "run_interactive" || toolName === "task_create" || toolName === "run_tests") {
       return {
         action: "confirm",
         reason: "shell/process writes cannot be proven to stay inside workspace/temp roots",
@@ -2080,9 +2034,9 @@ function checkNetworkPolicy(toolName, args, policy) {
   if (!policy?.enabled) return null;
   let action = networkToolAction(toolName, policy);
   let reason = "network access requires confirmation";
-  if (toolName === "bash") {
+  if (["bash", "run_tests", "run_interactive", "task_create"].includes(toolName)) {
     const command = String(args["command"] ?? "");
-    if (!isShellNetworkCommand(command)) return null;
+    if (toolName === "bash" && !isShellNetworkCommand(command) && dangerIsReadOnly(command)) return null;
     action = policy.tools?.shell ?? policy.defaultAction ?? "confirm";
     reason = "shell command may access the network";
   }
@@ -2118,6 +2072,9 @@ function checkNetworkPolicy(toolName, args, policy) {
   if (!permissionAction) return null;
   return { action: permissionAction, reason, profileName: "networkPolicy" };
 }
+function dangerIsReadOnly(command) {
+  return /^(?:pwd|echo [\w .-]+|git status(?: --short)?)$/.test(command.trim());
+}
 
 // src/tools/truncate.ts
 var DEFAULT_MAX_TOOL_OUTPUT_CHARS = 12e3;
@@ -2227,8 +2184,7 @@ function truncateOutput(content, toolName, maxChars) {
 }
 
 // src/tools/action-classifier.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
-import { isAbsolute as isAbsolute2, join, resolve as resolve4 } from "path";
+import { isAbsolute as isAbsolute2, resolve as resolve4 } from "path";
 var RECENT_DENIED_LIMIT = 50;
 var recentlyDenied = [];
 function recordRecentlyDeniedAutoAction(call, classification) {
@@ -2248,7 +2204,8 @@ function clearRecentlyDeniedAutoActions() {
   recentlyDenied.splice(0, recentlyDenied.length);
 }
 function normalizePath(value) {
-  return value.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+  const normalized = canonicalPath(value).replace(/\\/g, "/").replace(/\/+$/, "");
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
 }
 function isInside(root, target) {
   const absoluteRoot = resolve4(root);
@@ -2261,56 +2218,6 @@ function getPathArg(call) {
   const raw = call.arguments.path ?? call.arguments.filePath ?? call.arguments.outputPath ?? call.arguments.file;
   return typeof raw === "string" && raw.trim() ? raw.trim() : null;
 }
-function splitShellWords(command) {
-  const out = [];
-  const re = /"([^"]*)"|'([^']*)'|([^\s]+)/g;
-  let m;
-  while (m = re.exec(command)) out.push(m[1] ?? m[2] ?? m[3] ?? "");
-  return out.filter(Boolean);
-}
-function readPackageManifest(root) {
-  const p = join(root, "package.json");
-  if (!existsSync5(p)) return null;
-  try {
-    return JSON.parse(readFileSync3(p, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function manifestHasDependency(root, name) {
-  const manifest = readPackageManifest(root);
-  if (!manifest) return false;
-  for (const key of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
-    const deps = manifest[key];
-    if (deps && typeof deps === "object" && Object.prototype.hasOwnProperty.call(deps, name)) return true;
-  }
-  return false;
-}
-function lockfileMentions(root, name) {
-  for (const file of ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"]) {
-    const p = join(root, file);
-    if (!existsSync5(p)) continue;
-    try {
-      if (readFileSync3(p, "utf-8").includes(name)) return true;
-    } catch {
-    }
-  }
-  return false;
-}
-function getInstallPackages(command) {
-  const words = splitShellWords(command);
-  const cmd = words[0]?.toLowerCase();
-  const sub = words[1]?.toLowerCase();
-  if (!cmd || !sub) return [];
-  const isInstall = cmd === "npm" && (sub === "install" || sub === "i" || sub === "add") || (cmd === "pnpm" || cmd === "yarn") && (sub === "add" || sub === "install");
-  if (!isInstall) return [];
-  return words.slice(2).filter((w) => !w.startsWith("-")).filter((w) => w !== "." && w !== "./").map((w) => w.replace(/^@([^/]+)\/([^@]+)(?:@.+)?$/, "@$1/$2").replace(/^([^@]+)@.+$/, "$1"));
-}
-function isPlainGitPush(command) {
-  if (!/^\s*git\s+push\b/i.test(command)) return false;
-  if (/--force|-f\b|\+[^\s]+/i.test(command)) return false;
-  return !/[;&|`$<>\n\r]/.test(command);
-}
 function hasSecretExfiltrationShape(command) {
   return /(?:\.env|config\.json|id_rsa|id_ed25519|AWS_SECRET|AICLI_API_KEY|OPENAI_API_KEY|ANTHROPIC_API_KEY)/i.test(command) && /\b(curl|wget|scp|rsync|nc|netcat|Invoke-WebRequest|Invoke-RestMethod)\b/i.test(command);
 }
@@ -2332,7 +2239,7 @@ var RuleBasedActionClassifier = class {
     }
     return { decision: "confirm", reason: "destructive actions require confirmation", ruleId: "auto.destructive-confirm", confidence: "high" };
   }
-  classifyShell(call, dangerLevel, ctx) {
+  classifyShell(call, dangerLevel, _ctx) {
     const command = String(call.arguments.command ?? "");
     if (/\bcurl\b[^\n|;&]*\|\s*(?:sudo\s+)?(?:bash|sh|zsh)\b/i.test(command)) {
       return { decision: "deny", reason: "curl pipe shell execution is blocked in auto mode", ruleId: "deny.curl-pipe-shell", confidence: "high" };
@@ -2358,18 +2265,7 @@ var RuleBasedActionClassifier = class {
     if (/\b(npx|pnpm\s+dlx|yarn\s+dlx)\s+(claude|codex|aider|cursor-agent|gemini)\b/i.test(command)) {
       return { decision: "confirm", reason: "third-party agent loop requires confirmation", ruleId: "confirm.third-party-agent", confidence: "high" };
     }
-    if (isPlainGitPush(command)) {
-      return { decision: "auto-approve", reason: "plain git push without force", ruleId: "auto.git-push", confidence: "high" };
-    }
-    const pkgs = getInstallPackages(command);
-    if (pkgs.length > 0) {
-      const allDeclared = pkgs.every((p) => manifestHasDependency(ctx.workspaceRoot, p) || lockfileMentions(ctx.workspaceRoot, p));
-      return allDeclared ? { decision: "auto-approve", reason: "installing dependencies already declared in manifest/lockfile", ruleId: "auto.declared-dependency-install", confidence: "medium" } : { decision: "confirm", reason: "dependency install includes undeclared packages", ruleId: "confirm.undeclared-dependency-install", confidence: "medium" };
-    }
-    if (/\b(curl|wget|Invoke-WebRequest|Invoke-RestMethod)\b/i.test(command) && !/[>|;&`$]/.test(command)) {
-      return { decision: "auto-approve", reason: "read-only HTTP shell command", ruleId: "auto.readonly-http-shell", confidence: "medium" };
-    }
-    if (dangerLevel === "safe") {
+    if (dangerLevel === "safe" && getDangerLevel(call.name, call.arguments) === "safe") {
       return { decision: "auto-approve", reason: "safe shell action", ruleId: "auto.safe-shell", confidence: "medium" };
     }
     return { decision: "confirm", reason: "shell action is not proven low-risk", ruleId: "confirm.shell-default", confidence: "medium" };
@@ -2838,10 +2734,10 @@ var ToolExecutor = class {
     if (call.name === "write_file") {
       const { path: filePath, content: chunk, append } = resolveWriteFileArgs(call.arguments);
       if (!filePath) return;
-      if (existsSync6(filePath)) {
+      if (existsSync5(filePath)) {
         let oldContent;
         try {
-          oldContent = readFileSync4(filePath, "utf-8");
+          oldContent = readFileSync2(filePath, "utf-8");
         } catch {
           return;
         }
@@ -2865,7 +2761,7 @@ var ToolExecutor = class {
       }
     } else if (call.name === "edit_file") {
       const filePath = String(call.arguments["path"] ?? "");
-      if (!filePath || !existsSync6(filePath)) return;
+      if (!filePath || !existsSync5(filePath)) return;
       const oldStr = call.arguments["old_str"];
       const newStr = call.arguments["new_str"];
       if (oldStr !== void 0) {
@@ -2892,7 +2788,7 @@ var ToolExecutor = class {
         const to = Number(call.arguments["delete_to_line"] ?? from);
         let fileContent;
         try {
-          fileContent = readFileSync4(filePath, "utf-8");
+          fileContent = readFileSync2(filePath, "utf-8");
         } catch {
           return;
         }
@@ -2988,7 +2884,12 @@ import { resolve as resolve5, sep as sep2, basename as basename3 } from "path";
 import { homedir as homedir2 } from "os";
 var home = homedir2();
 function norm(p) {
-  const abs = resolve5(p);
+  let abs;
+  try {
+    abs = canonicalPath(p);
+  } catch {
+    abs = resolve5(p);
+  }
   return process.platform === "win32" ? abs.toLowerCase() : abs;
 }
 function homeRel(p) {
@@ -3002,6 +2903,7 @@ function homeRel(p) {
 }
 function classifyWritePath(path3) {
   if (!path3) return { sensitive: false };
+  if (isCredentialVault(path3)) return { sensitive: true, reason: "credential vault" };
   const abs = norm(path3);
   const base = basename3(abs);
   const rel = homeRel(path3);
@@ -3084,7 +2986,7 @@ function countTextLines(text) {
 
 // src/tools/builtin/write-file.ts
 function countFileLines(filePath) {
-  return countTextLines(readFileSync5(filePath, "utf-8"));
+  return countTextLines(readFileSync3(filePath, "utf-8"));
 }
 var writeFileTool = {
   definition: {
@@ -3148,7 +3050,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
     const mode = appendMode ? "appended" : "written";
     void (async () => {
       try {
-        const { updateFile } = await import("./indexer-P3FPRTPJ.js");
+        const { updateFile } = await import("./indexer-GKIWSSRP.js");
         await updateFile(process.cwd(), filePath);
       } catch {
       }
@@ -3167,7 +3069,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
 };
 
 // src/tools/builtin/edit-file.ts
-import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
+import { readFileSync as readFileSync4, existsSync as existsSync6 } from "fs";
 
 // src/tools/builtin/patch-apply.ts
 function parseUnifiedDiff(patch) {
@@ -3535,7 +3437,7 @@ Note: Path can be absolute or relative to cwd.`,
     const filePath = String(args["path"] ?? args["file"] ?? "");
     const encoding = args["encoding"] ?? "utf-8";
     if (!filePath) throw new ToolError("edit_file", "path is required");
-    if (!existsSync7(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
+    if (!existsSync6(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
     const verdict = classifyWritePath(filePath);
     if (verdict.sensitive && subAgentGuard.active) {
       throw new ToolError(
@@ -3543,7 +3445,7 @@ Note: Path can be absolute or relative to cwd.`,
         `Refused: sub-agents cannot edit sensitive paths \u2014 ${verdict.reason}. If this is genuinely needed, ask the parent agent to perform the edit so the user can approve it.`
       );
     }
-    const original = readFileSync6(filePath, encoding);
+    const original = readFileSync4(filePath, encoding);
     if (args["patch"] !== void 0) {
       const patchText = String(args["patch"] ?? "");
       const stopOnError = args["stop_on_error"] !== false;
@@ -3720,8 +3622,8 @@ function truncatePreview(str, maxLen = 80) {
 }
 
 // src/tools/builtin/list-dir.ts
-import { readdirSync as readdirSync3, statSync as statSync4, existsSync as existsSync8 } from "fs";
-import { join as join2, basename as basename4 } from "path";
+import { readdirSync as readdirSync3, statSync as statSync4, existsSync as existsSync7 } from "fs";
+import { join, basename as basename4 } from "path";
 var listDirTool = {
   definition: {
     name: "list_dir",
@@ -3743,7 +3645,7 @@ var listDirTool = {
   async execute(args) {
     const dirPath = String(args["path"] ?? process.cwd());
     const recursive = Boolean(args["recursive"] ?? false);
-    if (!existsSync8(dirPath)) {
+    if (!existsSync7(dirPath)) {
       const targetName = basename4(dirPath).toLowerCase();
       const cwd = process.cwd();
       const suggestions = [];
@@ -3801,11 +3703,11 @@ function listRecursive(basePath, indent, recursive, lines) {
     if (entry.isDirectory()) {
       lines.push(`${indent}\u{1F4C1} ${entry.name}/`);
       if (recursive) {
-        listRecursive(join2(basePath, entry.name), indent + "  ", true, lines);
+        listRecursive(join(basePath, entry.name), indent + "  ", true, lines);
       }
     } else {
       try {
-        const stat = statSync4(join2(basePath, entry.name));
+        const stat = statSync4(join(basePath, entry.name));
         const size = formatSize(stat.size);
         lines.push(`${indent}\u{1F4C4} ${entry.name}  (${size})`);
       } catch {
@@ -3820,10 +3722,77 @@ function formatSize(bytes) {
   return `${(bytes / 1024 / 1024).toFixed(1)}MB`;
 }
 
+// src/tools/regex-search.ts
+import { Worker } from "worker_threads";
+var source = String.raw`
+const { parentPort, workerData: d } = require('node:worker_threads');
+const fs = require('node:fs');
+let re;
+try { re = new RegExp(d.pattern, d.ignoreCase ? 'i' : ''); }
+catch { re = new RegExp(d.pattern.replace(/[.*+?^$()|[\]\\]/g, '\\$&'), d.ignoreCase ? 'i' : ''); }
+const results = [];
+for (const f of d.files) {
+  if (results.length >= d.maxResults) break;
+  let fd;
+  try {
+    fd = fs.openSync(f.fullPath, 'r');
+    const buf = Buffer.alloc(1000001);
+    let size = 0;
+    while (size < buf.length) { const n = fs.readSync(fd, buf, size, buf.length - size, null); if (!n) break; size += n; }
+    if (size > 1000000 || buf.subarray(0, Math.min(size,512)).includes(0)) continue;
+    const lines = buf.subarray(0,size).toString('utf8').split('\n');
+    for (let i=0; i<lines.length && results.length<d.maxResults; i++) {
+      if (!re.test(lines[i])) continue;
+      const match = { file:f.relPath.replace(/\\/g,'/'), lineNumber:i+1, lineText:lines[i].slice(0,10000) };
+      if (d.context) {
+        match.contextBefore=[]; match.contextAfter=[];
+        for(let j=Math.max(0,i-d.context);j<i;j++) match.contextBefore.push([j+1,lines[j].slice(0,10000)]);
+        for(let j=i+1;j<=Math.min(lines.length-1,i+d.context);j++) match.contextAfter.push([j+1,lines[j].slice(0,10000)]);
+      }
+      results.push(match);
+    }
+  } catch {} finally { if (fd !== undefined) fs.closeSync(fd); }
+}
+parentPort.postMessage(results);
+`;
+var active = 0;
+async function searchInWorker(files, pattern, ignoreCase, context, maxResults) {
+  const signal = currentAbortSignal();
+  if (signal.aborted) throw new Error("Search cancelled");
+  if (active >= 4) throw new Error("Search capacity reached; wait for another search to finish");
+  active++;
+  let worker;
+  try {
+    return await new Promise((resolve7, reject) => {
+      worker = new Worker(source, { eval: true, workerData: { files, pattern, ignoreCase, context, maxResults }, resourceLimits: { maxOldGenerationSizeMb: 64 } });
+      let settled = false;
+      const finish = (error, results) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        signal.removeEventListener("abort", abort);
+        if (error) reject(error);
+        else resolve7(results ?? []);
+      };
+      const timer = setTimeout(() => finish(new Error("Search exceeded 2 second CPU/time budget; simplify the pattern or narrow the path")), 2e3);
+      const abort = () => finish(new Error("Search cancelled"));
+      signal.addEventListener("abort", abort, { once: true });
+      if (signal.aborted) abort();
+      worker.once("message", (results) => finish(void 0, results));
+      worker.once("error", (error) => finish(error));
+      worker.once("exit", (code) => {
+        if (!settled) finish(new Error(`Search worker exited (${code})`));
+      });
+    });
+  } finally {
+    if (worker) await worker.terminate();
+    active--;
+  }
+}
+
 // src/tools/builtin/grep-files.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync7, statSync as statSync5, existsSync as existsSync9 } from "fs";
-import { readFile } from "fs/promises";
-import { join as join3, relative } from "path";
+import { readdirSync as readdirSync4, statSync as statSync5, existsSync as existsSync8 } from "fs";
+import { join as join2, relative } from "path";
 var grepFilesTool = {
   definition: {
     name: "grep_files",
@@ -3871,43 +3840,24 @@ Supports regex. Automatically skips node_modules, dist, .git directories.`,
     const rootPath = String(args["path"] ?? process.cwd());
     const filePattern = args["file_pattern"] ? String(args["file_pattern"]) : void 0;
     const ignoreCase = Boolean(args["ignore_case"] ?? false);
-    const contextLines = Math.max(0, Number(args["context_lines"] ?? 0));
-    const maxResults = Math.max(1, Number(args["max_results"] ?? 50));
+    const contextLines = Math.min(10, Math.max(0, Number(args["context_lines"]) || 0));
+    const maxResults = Math.min(200, Math.max(1, Number(args["max_results"]) || 50));
     if (!pattern) throw new ToolError("grep_files", "pattern is required");
-    if (!existsSync9(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
+    if (!existsSync8(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
     const MAX_PATTERN_LENGTH = 1e3;
-    if (pattern.length > MAX_PATTERN_LENGTH) {
+    if (pattern.length > MAX_PATTERN_LENGTH || (filePattern?.length ?? 0) > MAX_PATTERN_LENGTH) {
       throw new ToolError("grep_files", `Pattern too long (${pattern.length} chars, max ${MAX_PATTERN_LENGTH}). Use a shorter pattern.`);
     }
-    let regex;
-    try {
-      regex = new RegExp(pattern, ignoreCase ? "gi" : "g");
-    } catch {
-      const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      regex = new RegExp(escaped, ignoreCase ? "gi" : "g");
-    }
-    const results = [];
-    const stat = statSync5(rootPath);
-    if (stat.isFile()) {
-      searchInFile(rootPath, rootPath, regex, contextLines, maxResults, results);
-    } else {
-      const filePaths = collectFilePaths(rootPath, filePattern, maxResults);
-      const BATCH_SIZE = 16;
-      for (let i = 0; i < filePaths.length && results.length < maxResults; i += BATCH_SIZE) {
-        const batch = filePaths.slice(i, i + BATCH_SIZE);
-        const batchResults = await Promise.all(
-          batch.map(
-            ({ fullPath, relPath }) => searchInFileAsync(fullPath, relPath, regex, contextLines, maxResults - results.length)
-          )
-        );
-        for (const br of batchResults) {
-          for (const r of br) {
-            if (results.length >= maxResults) break;
-            results.push(r);
-          }
-        }
+    assertReadablePath(rootPath);
+    const paths = statSync5(rootPath).isFile() ? [{ fullPath: rootPath, relPath: rootPath }] : collectFilePaths(rootPath, filePattern, maxResults);
+    const files = paths.filter((f) => {
+      try {
+        return !isCredentialVault(f.fullPath);
+      } catch {
+        return false;
       }
-    }
+    });
+    const results = await searchInWorker(files, pattern, ignoreCase, contextLines, maxResults);
     if (results.length === 0) {
       return `No matches found for pattern: ${pattern}
 Searched in: ${rootPath}${filePattern ? `
@@ -3947,8 +3897,23 @@ File filter: ${filePattern}` : ""}`;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "dist-cjs", "release", ".next", "__pycache__", ".cache", "coverage", ".nyc_output"]);
 var BINARY_EXTS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".ico", ".woff", ".woff2", ".ttf", ".eot", ".otf", ".mp3", ".mp4", ".wav", ".zip", ".tar", ".gz", ".rar", ".7z", ".exe", ".dll", ".so", ".dylib", ".pdf", ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx"]);
 function matchesFilePattern(filename, pattern) {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`, "i").test(filename);
+  filename = filename.toLowerCase();
+  pattern = pattern.toLowerCase();
+  let i = 0, j = 0, star = -1, restart = 0;
+  while (i < filename.length) {
+    if (pattern[j] === filename[i]) {
+      i++;
+      j++;
+    } else if (pattern[j] === "*") {
+      star = j++;
+      restart = i;
+    } else if (star >= 0) {
+      j = star + 1;
+      i = ++restart;
+    } else return false;
+  }
+  while (pattern[j] === "*") j++;
+  return j === pattern.length;
 }
 function isBinary(filename) {
   const ext = filename.slice(filename.lastIndexOf(".")).toLowerCase();
@@ -3956,8 +3921,9 @@ function isBinary(filename) {
 }
 function collectFilePaths(rootPath, filePattern, maxFiles) {
   const paths = [];
-  function walk(dirPath) {
-    if (paths.length >= maxFiles) return;
+  let visited = 0;
+  function walk(dirPath, depth = 0) {
+    if (paths.length >= maxFiles || depth > 20 || visited >= 2e4) return;
     let entries;
     try {
       entries = readdirSync4(dirPath, { withFileTypes: true });
@@ -3965,14 +3931,14 @@ function collectFilePaths(rootPath, filePattern, maxFiles) {
       return;
     }
     for (const entry of entries) {
-      if (paths.length >= maxFiles) return;
+      if (paths.length >= maxFiles || ++visited > 2e4) return;
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name) || entry.name.startsWith(".")) continue;
-        walk(join3(dirPath, entry.name));
+        walk(join2(dirPath, entry.name), depth + 1);
       } else if (entry.isFile()) {
         if (isBinary(entry.name)) continue;
         if (filePattern && !matchesFilePattern(entry.name, filePattern)) continue;
-        const fullPath = join3(dirPath, entry.name);
+        const fullPath = join2(dirPath, entry.name);
         try {
           if (statSync5(fullPath).size > 1e6) continue;
         } catch {
@@ -3985,81 +3951,10 @@ function collectFilePaths(rootPath, filePattern, maxFiles) {
   walk(rootPath);
   return paths;
 }
-async function searchInFileAsync(fullPath, displayPath, regex, contextLines, maxResults) {
-  let content;
-  try {
-    content = await readFile(fullPath, "utf-8");
-  } catch {
-    return [];
-  }
-  const results = [];
-  const lines = content.split("\n");
-  regex.lastIndex = 0;
-  for (let i = 0; i < lines.length && results.length < maxResults; i++) {
-    regex.lastIndex = 0;
-    if (regex.test(lines[i])) {
-      const match = {
-        file: displayPath.replace(/\\/g, "/"),
-        lineNumber: i + 1,
-        lineText: lines[i]
-      };
-      if (contextLines > 0) {
-        match.contextBefore = [];
-        for (let j = Math.max(0, i - contextLines); j < i; j++) {
-          match.contextBefore.push([j + 1, lines[j]]);
-        }
-        match.contextAfter = [];
-        for (let j = i + 1; j <= Math.min(lines.length - 1, i + contextLines); j++) {
-          match.contextAfter.push([j + 1, lines[j]]);
-        }
-      }
-      results.push(match);
-    }
-  }
-  return results;
-}
-function searchInFile(fullPath, displayPath, regex, contextLines, maxResults, results) {
-  try {
-    const stat = statSync5(fullPath);
-    if (stat.size > 1e6) return;
-  } catch {
-    return;
-  }
-  let content;
-  try {
-    content = readFileSync7(fullPath, "utf-8");
-  } catch {
-    return;
-  }
-  const lines = content.split("\n");
-  regex.lastIndex = 0;
-  for (let i = 0; i < lines.length; i++) {
-    if (results.length >= maxResults) return;
-    regex.lastIndex = 0;
-    if (regex.test(lines[i])) {
-      const result = {
-        file: displayPath,
-        lineNumber: i + 1,
-        lineText: lines[i].trimEnd()
-      };
-      if (contextLines > 0) {
-        result.contextBefore = [];
-        result.contextAfter = [];
-        for (let c = Math.max(0, i - contextLines); c < i; c++) {
-          result.contextBefore.push([c + 1, lines[c].trimEnd()]);
-        }
-        for (let c = i + 1; c <= Math.min(lines.length - 1, i + contextLines); c++) {
-          result.contextAfter.push([c + 1, lines[c].trimEnd()]);
-        }
-      }
-      results.push(result);
-    }
-  }
-}
 
 // src/tools/builtin/glob-files.ts
-import { readdirSync as readdirSync5, statSync as statSync6, existsSync as existsSync10 } from "fs";
-import { join as join4, relative as relative2, basename as basename5 } from "path";
+import { readdirSync as readdirSync5, statSync as statSync6, existsSync as existsSync9 } from "fs";
+import { join as join3, relative as relative2, basename as basename5 } from "path";
 var globFilesTool = {
   definition: {
     name: "glob_files",
@@ -4092,7 +3987,7 @@ Results sorted by most recent modification time. Automatically skips node_module
     const rootPath = String(args["path"] ?? process.cwd());
     const maxResults = Math.max(1, Number(args["max_results"] ?? 100));
     if (!pattern) throw new ToolError("glob_files", "pattern is required");
-    if (!existsSync10(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
+    if (!existsSync9(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
     const regex = globToRegex(pattern);
     const matches = [];
     collectMatchingFiles(rootPath, rootPath, regex, matches, maxResults);
@@ -4169,7 +4064,7 @@ function collectMatchingFiles(dirPath, rootPath, regex, results, maxResults) {
   }
   for (const entry of entries) {
     if (results.length >= maxResults) break;
-    const fullPath = join4(dirPath, entry.name);
+    const fullPath = join3(dirPath, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRS2.has(entry.name) || entry.name.startsWith(".")) continue;
       collectMatchingFiles(fullPath, rootPath, regex, results, maxResults);
@@ -4188,9 +4083,9 @@ function collectMatchingFiles(dirPath, rootPath, regex, results, maxResults) {
 }
 
 // src/tools/builtin/run-interactive.ts
-import { spawn as spawn4 } from "child_process";
-import { platform as platform4 } from "os";
-var IS_WINDOWS4 = platform4() === "win32";
+import { spawn as spawn3 } from "child_process";
+import { platform as platform3 } from "os";
+var IS_WINDOWS4 = platform3() === "win32";
 var runInteractiveTool = {
   definition: {
     name: "run_interactive",
@@ -4252,7 +4147,7 @@ var runInteractiveTool = {
     };
     const prefixWarnings = [argsTypeWarning, stdinTypeWarning].filter(Boolean).join("");
     return new Promise((resolve7) => {
-      const child = spawn4(executable, cmdArgs.map(String), {
+      const child = spawn3(executable, cmdArgs.map(String), {
         cwd: process.cwd(),
         env,
         stdio: ["pipe", "pipe", "pipe"]
@@ -4522,8 +4417,8 @@ var webFetchTool = {
       if (e.message.startsWith("Blocked:")) throw e;
       throw new NetworkError(`Invalid URL: "${url}"`);
     }
-    const controller2 = new AbortController();
-    const timeoutId = setTimeout(() => controller2.abort(), 2e4);
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 2e4);
     let rawHtml;
     let finalUrl;
     let contentType;
@@ -4544,7 +4439,7 @@ var webFetchTool = {
         }
         await resolveAndCheck(parsedHop.hostname);
         const r = await fetch(currentUrl, {
-          signal: controller2.signal,
+          signal: controller.signal,
           headers: FETCH_HEADERS,
           redirect: "manual",
           // 手动控制重定向
@@ -4907,8 +4802,8 @@ function parseGoogleResults(html, maxResults) {
   return results;
 }
 async function fetchHtml(url) {
-  const controller2 = new AbortController();
-  const timer = setTimeout(() => controller2.abort(), REQUEST_TIMEOUT_MS);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
   try {
     const res = await fetch(url, {
       method: "GET",
@@ -4917,7 +4812,7 @@ async function fetchHtml(url) {
         "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9",
         "Accept-Language": "en-US,en;q=0.9,zh-CN;q=0.8"
       },
-      signal: controller2.signal
+      signal: controller.signal
     });
     if (!res.ok) {
       throw new NetworkError(`HTTP ${res.status} ${res.statusText}`, res.status);
@@ -5011,10 +4906,8 @@ Any of these triggers means use save_last_response, NOT write_file:
 };
 
 // src/tools/builtin/save-memory.ts
-import { join as join5 } from "path";
-import { homedir as homedir3 } from "os";
 function getConfigDir() {
-  return join5(homedir3(), CONFIG_DIR_NAME);
+  return getExecutionConfigDir();
 }
 function parseSensitivity(value) {
   return value === "low" || value === "medium" || value === "high" ? value : void 0;
@@ -5278,15 +5171,15 @@ var googleSearchTool = {
     url.searchParams.set("cx", cx);
     url.searchParams.set("q", query);
     url.searchParams.set("num", String(numResults));
-    const controller2 = new AbortController();
-    const timeout = setTimeout(() => controller2.abort(), REQUEST_TIMEOUT_MS2);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS2);
     try {
       const response = await fetch(url.toString(), {
         method: "GET",
         headers: {
           "Accept": "application/json"
         },
-        signal: controller2.signal
+        signal: controller.signal
       });
       if (!response.ok) {
         const errorBody = await response.text().catch(() => "");
@@ -5363,9 +5256,9 @@ function formatResults2(query, data, _requested) {
 }
 
 // src/agents/agent-config.ts
-import { existsSync as existsSync11, readdirSync as readdirSync6, readFileSync as readFileSync8 } from "fs";
-import { join as join6 } from "path";
-import { homedir as homedir4 } from "os";
+import { existsSync as existsSync10, readdirSync as readdirSync6, readFileSync as readFileSync5 } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir3 } from "os";
 var READ_ONLY_TOOLS2 = /* @__PURE__ */ new Set([
   "read_file",
   "list_dir",
@@ -5436,13 +5329,13 @@ function normalizeName(name) {
 function isStringArray(value) {
   return Array.isArray(value) && value.every((item) => typeof item === "string");
 }
-function parseAgentConfig(raw, source, path3) {
+function parseAgentConfig(raw, source2, path3) {
   if (!raw || typeof raw !== "object") return null;
   const obj = raw;
   if (typeof obj.name !== "string" || obj.name.trim() === "") return null;
   const cfg = {
     name: obj.name.trim(),
-    source,
+    source: source2,
     path: path3
   };
   if (typeof obj.description === "string") cfg.description = obj.description;
@@ -5458,15 +5351,15 @@ function parseAgentConfig(raw, source, path3) {
   if (typeof obj.contextPolicy === "string") cfg.contextPolicy = obj.contextPolicy;
   return cfg;
 }
-function loadAgentDir(dir, source) {
-  if (!existsSync11(dir)) return [];
+function loadAgentDir(dir, source2) {
+  if (!existsSync10(dir)) return [];
   const out = [];
   for (const file of readdirSync6(dir)) {
     if (!file.endsWith(".json")) continue;
-    const path3 = join6(dir, file);
+    const path3 = join4(dir, file);
     try {
-      const parsed = JSON.parse(readFileSync8(path3, "utf-8"));
-      const cfg = parseAgentConfig(parsed, source, path3);
+      const parsed = JSON.parse(readFileSync5(path3, "utf-8"));
+      const cfg = parseAgentConfig(parsed, source2, path3);
       if (cfg) out.push(cfg);
     } catch {
     }
@@ -5475,8 +5368,8 @@ function loadAgentDir(dir, source) {
 }
 function getAgentDirs(configDir, cwd = process.cwd()) {
   return {
-    user: join6(configDir ?? join6(homedir4(), CONFIG_DIR_NAME), "agents"),
-    project: join6(cwd, CONFIG_DIR_NAME, "agents")
+    user: join4(configDir ?? join4(homedir3(), CONFIG_DIR_NAME), "agents"),
+    project: join4(cwd, CONFIG_DIR_NAME, "agents")
   };
 }
 function listAgentConfigs(configDir, cwd = process.cwd()) {
@@ -5979,9 +5872,8 @@ var spawnAgentTool = {
 };
 
 // src/tools/builtin/task-manager.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { randomUUID } from "crypto";
-import { platform as platform5 } from "os";
 var MAX_OUTPUT_CHARS = 1e4;
 var MAX_OUTPUT_BYTES = 64 * 1024;
 var MAX_TASKS = 20;
@@ -6000,14 +5892,16 @@ function decodeField(chunks) {
 }
 function appendOutput(task, field, chunk) {
   const chunks = field === "stdout" ? task._stdoutChunks : task._stderrChunks;
-  chunks.push(chunk);
+  chunks.push(chunk.length > MAX_OUTPUT_BYTES ? chunk.subarray(-MAX_OUTPUT_BYTES) : chunk);
   capChunks(chunks);
   task[field] = decodeField(chunks);
 }
 function createTask(command, description) {
+  if ([...tasks.values()].filter((t) => t._active && t.owner === getExecutionConfigDir()).length >= 10) throw new Error("Background task limit reached (10 running per user).");
+  if ([...tasks.values()].filter((t) => t._active).length >= MAX_TASKS) throw new Error("Background task limit reached (20 running). Stop a task before creating another.");
   if (tasks.size >= MAX_TASKS) {
     for (const [id2, t] of tasks) {
-      if (t.status !== "running") {
+      if (!t._active) {
         tasks.delete(id2);
         break;
       }
@@ -6015,16 +5909,19 @@ function createTask(command, description) {
   }
   const id = randomUUID().slice(0, 8);
   const { shell, args } = shellInvocation(command);
-  const proc = spawn5(shell, args, {
+  const proc = spawn4(shell, args, {
     stdio: ["ignore", "pipe", "pipe"],
-    detached: false,
+    detached: process.platform !== "win32",
+    windowsHide: true,
     env: { ...process.env, PYTHONUTF8: "1", PYTHONIOENCODING: "utf-8" }
   });
   const task = {
     id,
+    owner: getExecutionConfigDir(),
     command,
     description,
     process: proc,
+    _active: true,
     startTime: Date.now(),
     endTime: null,
     status: "running",
@@ -6037,11 +5934,13 @@ function createTask(command, description) {
   proc.stdout?.on("data", (chunk) => appendOutput(task, "stdout", chunk));
   proc.stderr?.on("data", (chunk) => appendOutput(task, "stderr", chunk));
   proc.on("close", (code) => {
+    task._active = false;
     task.endTime = Date.now();
     task.exitCode = code;
-    task.status = code === 0 ? "completed" : "failed";
+    if (task.status !== "stopped") task.status = code === 0 ? "completed" : "failed";
   });
   proc.on("error", (err) => {
+    task._active = false;
     task.endTime = Date.now();
     task.status = "failed";
     task.stderr += `
@@ -6051,43 +5950,20 @@ Process error: ${err.message}`;
   return task;
 }
 function listTasks() {
-  return [...tasks.values()].map(
-    ({ process: _p, _stdoutChunks: _o, _stderrChunks: _e, ...rest }) => rest
+  return [...tasks.values()].filter((t) => t.owner === getExecutionConfigDir()).map(
+    ({ process: _p, _stdoutChunks: _o, _stderrChunks: _e, _active: _a, ...rest }) => rest
   );
 }
 function getTaskOutput(id) {
   const task = tasks.get(id);
-  if (!task) return null;
+  if (!task || task.owner !== getExecutionConfigDir()) return null;
   return { stdout: task.stdout, stderr: task.stderr, status: task.status };
 }
 function stopTask(id) {
   const task = tasks.get(id);
-  if (!task || task.status !== "running") return false;
+  if (!task || task.owner !== getExecutionConfigDir() || task.status !== "running") return false;
   try {
-    const proc = task.process;
-    if (platform5() === "win32" && proc.pid) {
-      try {
-        spawn5("taskkill", ["/PID", String(proc.pid), "/T", "/F"], {
-          windowsHide: true,
-          stdio: "ignore"
-        });
-      } catch {
-      }
-      try {
-        proc.kill();
-      } catch {
-      }
-    } else {
-      proc.kill("SIGTERM");
-      setTimeout(() => {
-        if (proc.exitCode === null && proc.signalCode === null) {
-          try {
-            proc.kill("SIGKILL");
-          } catch {
-          }
-        }
-      }, 3e3).unref();
-    }
+    killProcessTree(task.process, true);
     task.status = "stopped";
     task.endTime = Date.now();
     return true;
@@ -6195,14 +6071,14 @@ var taskStopTool = {
 
 // src/tools/builtin/git-tools.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync12 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { join as join5 } from "path";
 function assertGitRepo(cwd) {
   let dir = cwd;
   const root = dir.split(/[\\/]/)[0] + (dir.includes("\\") ? "\\" : "/");
   while (dir && dir !== root) {
-    if (existsSync12(join7(dir, ".git"))) return;
-    const parent = join7(dir, "..");
+    if (existsSync11(join5(dir, ".git"))) return;
+    const parent = join5(dir, "..");
     if (parent === dir) break;
     dir = parent;
   }
@@ -6467,7 +6343,7 @@ ${commitOutput.trim()}`;
 };
 
 // src/tools/builtin/notebook-edit.ts
-import { readFileSync as readFileSync9, existsSync as existsSync13 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync12 } from "fs";
 import { writeFile } from "fs/promises";
 import { resolve as resolve6, extname as extname2 } from "path";
 var notebookEditTool = {
@@ -6522,10 +6398,10 @@ var notebookEditTool = {
     if (extname2(absPath).toLowerCase() !== ".ipynb") {
       throw new ToolError("notebook_edit", "path must point to a .ipynb file");
     }
-    if (!existsSync13(absPath)) {
+    if (!existsSync12(absPath)) {
       throw new ToolError("notebook_edit", `Notebook not found: ${filePath}`);
     }
-    const raw = readFileSync9(absPath, "utf-8");
+    const raw = readFileSync6(absPath, "utf-8");
     const nb = parseNotebook(raw);
     const cellIdx0 = cellIndexRaw - 1;
     undoStack.push(absPath, `notebook_edit (${action}): ${filePath}`);
@@ -6851,8 +6727,6 @@ ${lines.join("\n")}`;
 };
 
 // src/tools/builtin/recall-memory.ts
-import { join as join8 } from "path";
-import { homedir as homedir5 } from "os";
 function formatHit(h, i) {
   const ts = h.chunk.timestamp.slice(0, 16).replace("T", " ");
   const title = h.chunk.sessionTitle ? ` \xB7 ${h.chunk.sessionTitle}` : "";
@@ -6902,7 +6776,7 @@ var recallMemoryTool = {
     const excludeCurrent = Boolean(args["excludeCurrentSession"]);
     const currentId = args["currentSessionId"] ? String(args["currentSessionId"]) : void 0;
     const minScore = args["minScore"] !== void 0 ? Number(args["minScore"]) : 0.25;
-    const configDir = join8(homedir5(), CONFIG_DIR_NAME);
+    const configDir = getExecutionConfigDir();
     let persistentSection = "";
     try {
       const persistentHits = searchPersistentMemories(configDir, query, process.cwd(), 3);
@@ -6956,8 +6830,8 @@ function estimateToolDefinitionTokens(def) {
 
 // src/tools/registry.ts
 import { pathToFileURL } from "url";
-import { existsSync as existsSync14, mkdirSync as mkdirSync3, readdirSync as readdirSync7 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync3, readdirSync as readdirSync7 } from "fs";
+import { join as join6 } from "path";
 var ToolRegistry = class {
   tools = /* @__PURE__ */ new Map();
   pluginToolNames = /* @__PURE__ */ new Set();
@@ -7118,7 +6992,7 @@ var ToolRegistry = class {
    * Returns the number of successfully loaded plugins.
    */
   async loadPlugins(pluginsDir, allowPlugins = false) {
-    if (!existsSync14(pluginsDir)) {
+    if (!existsSync13(pluginsDir)) {
       try {
         mkdirSync3(pluginsDir, { recursive: true });
       } catch {
@@ -7144,12 +7018,12 @@ var ToolRegistry = class {
     process.stderr.write(
       `
 [plugins] \u26A0 Loading ${files.length} plugin(s) with FULL system privileges:
-` + files.map((f) => `  + ${join9(pluginsDir, f)}`).join("\n") + "\n\n"
+` + files.map((f) => `  + ${join6(pluginsDir, f)}`).join("\n") + "\n\n"
     );
     let loaded = 0;
     for (const file of files) {
       try {
-        const fileUrl = pathToFileURL(join9(pluginsDir, file)).href;
+        const fileUrl = pathToFileURL(join6(pluginsDir, file)).href;
         const mod = await import(fileUrl);
         const tool = mod.tool ?? mod.default?.tool ?? mod.default;
         if (!tool || typeof tool.execute !== "function" || !tool.definition?.name) {
@@ -7190,10 +7064,6 @@ export {
   requestAgentStop,
   setPreferredAgentName,
   getPreferredAgentName,
-  isInterrupted,
-  requestInterrupt,
-  resetInterrupt,
-  runWithSessionKey,
   clearBashSession,
   rlInternal,
   groupCallsByPhase,