jinzd-ai-cli 0.4.306 → 0.4.308

package/dist/electron-server.js

@@ -1,8 +1,8 @@
 import {
   hasSemanticIndex,
   semanticSearch
-} from "./chunk-KBDKKHXB.js";
-import "./chunk-OAXLMF3U.js";
+} from "./chunk-O6CGOVD4.js";
+import "./chunk-3YVNDYOY.js";
 import {
   buildChatIndex,
   clearChatIndex,
@@ -15,17 +15,22 @@ import {
   searchCandidates,
   searchChatMemory,
   updateSessionInIndex
-} from "./chunk-I4GQRMFV.js";
+} from "./chunk-M6YV5KSS.js";
 import "./chunk-JV5N65KN.js";
 import {
-  fileCheckpoints
-} from "./chunk-SKET65WZ.js";
+  MAX_SNAPSHOT_TOTAL_BYTES,
+  assertReadablePath,
+  canonicalPath,
+  fileCheckpoints,
+  isCredentialVault,
+  readSnapshot
+} from "./chunk-FVXNEZEW.js";
 import {
   indexProject
-} from "./chunk-UFW4S3RU.js";
+} from "./chunk-RVMCY6DP.js";
 import {
   loadIndex
-} from "./chunk-45UVJXFQ.js";
+} from "./chunk-W2UOVGRC.js";
 import {
   addMemoryEntry,
   backupMemoryStore,
@@ -50,23 +55,39 @@ import {
   touchMemoryReferences,
   updateMemoryApproval,
   updateMemoryEntry
-} from "./chunk-WZWRA7R2.js";
+} from "./chunk-7OHXFTZO.js";
 import {
   DEFAULT_PATTERNS,
   redactJson,
   scanString
 } from "./chunk-FSC6KEWU.js";
 import {
+  atomicWriteFile,
   atomicWriteFileSync
-} from "./chunk-6BUTA5VW.js";
+} from "./chunk-2XMUCC42.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
   getGitRoot
 } from "./chunk-CGLYJRFA.js";
 import {
-  runTestsTool
-} from "./chunk-NLB7JZSO.js";
+  IS_WINDOWS,
+  WIN_UTF8_PREAMBLE,
+  currentAbortSignal,
+  decodeWindowsBuffer,
+  killProcessTree,
+  looksLikeGbkMojibake,
+  recoverGbkMojibake,
+  runTestsTool,
+  shellInvocation
+} from "./chunk-WVEIUSXE.js";
+import {
+  getCurrentSessionKey,
+  getExecutionConfigDir,
+  runWithExecutionContext,
+  runWithSessionKey,
+  scopedState
+} from "./chunk-QMFMST2T.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
   APP_NAME,
@@ -101,7 +122,65 @@ import {
   SUBAGENT_MAX_ROUNDS_LIMIT,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-JDT6UG6R.js";
+} from "./chunk-2DYQDLLF.js";
+
+// src/web/access.ts
+import { randomBytes, timingSafeEqual } from "crypto";
+import { networkInterfaces } from "os";
+function equalToken(a, b) {
+  if (typeof a !== "string" || a.length > 4096) return false;
+  const left = Buffer.from(a), right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+var WebAccess = class {
+  constructor(host, externalOrigin) {
+    this.externalOrigin = externalOrigin;
+    if (!["0.0.0.0", "::"].includes(host)) this.hosts.add(host.includes(":") ? `[${host}]` : host.toLowerCase());
+    else for (const interfaces of Object.values(networkInterfaces())) for (const entry of interfaces ?? []) {
+      this.hosts.add(entry.address.includes(":") ? `[${entry.address}]` : entry.address);
+    }
+    if (externalOrigin && new URL(externalOrigin).origin !== externalOrigin) throw new Error("External origin must be an exact http(s) origin");
+    if (externalOrigin && !/^https?:\/\//.test(externalOrigin)) throw new Error("External origin must use HTTP(S)");
+  }
+  externalOrigin;
+  localToken = randomBytes(32).toString("base64url");
+  hosts = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+  accepts(req) {
+    const host = req.headers.host;
+    if (!host) return false;
+    try {
+      const url = new URL(`http://${host}`);
+      const internal = this.hosts.has(url.hostname.toLowerCase()) && Number(url.port || 80) === req.socket.localPort;
+      const external = this.externalOrigin && new URL(this.externalOrigin).host === host;
+      if (!internal && !external) return false;
+      const origin = req.headers.origin;
+      return !origin || origin === (external ? this.externalOrigin : `http://${host}`);
+    } catch {
+      return false;
+    }
+  }
+};
+var AuthRateLimiter = class {
+  ips = /* @__PURE__ */ new Map();
+  start = 0;
+  count = 0;
+  take(ip) {
+    const now = Date.now();
+    if (now - this.start >= 6e4) {
+      this.start = now;
+      this.count = 0;
+    }
+    if (++this.count > 120) return false;
+    for (const [key, value] of this.ips) if (now - value.start >= 6e4) this.ips.delete(key);
+    let bucket = this.ips.get(ip);
+    if (!bucket) {
+      if (this.ips.size >= 2048) return false;
+      bucket = { start: now, count: 0 };
+      this.ips.set(ip, bucket);
+    }
+    return ++bucket.count <= 30;
+  }
+};
 
 // src/web/server.ts
 import express from "express";
@@ -125,9 +204,9 @@ function imageValidationError(images) {
 }
 
 // src/web/server.ts
-import { join as join28, dirname as dirname11, resolve as resolve12, relative as relative6, sep as sep5, extname as extname3, resolve as resolvePath } from "path";
-import { existsSync as existsSync32, readFileSync as readFileSync25, readdirSync as readdirSync15, statSync as statSync16, realpathSync as realpathSync3, createReadStream } from "fs";
-import { networkInterfaces } from "os";
+import { join as join25, dirname as dirname11, resolve as resolve12, relative as relative6, sep as sep5, extname as extname3, resolve as resolvePath } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync22, readdirSync as readdirSync15, statSync as statSync16, realpathSync as realpathSync3, createReadStream } from "fs";
+import { networkInterfaces as networkInterfaces2 } from "os";
 
 // src/config/config-manager.ts
 import { readFileSync, existsSync, mkdirSync } from "fs";
@@ -650,8 +729,8 @@ ${err}`
     return changed;
   }
   save() {
-    mkdirSync(this.configDir, { recursive: true });
-    atomicWriteFileSync(this.configPath, JSON.stringify(this.config, null, 2));
+    mkdirSync(this.configDir, { recursive: true, mode: 448 });
+    atomicWriteFileSync(this.configPath, JSON.stringify(this.config, null, 2), { mode: 384 });
   }
   getApiKey(providerId) {
     const envKey = EnvLoader.getApiKey(providerId);
@@ -1293,6 +1372,7 @@ function getDangerLevel(toolName, args) {
   }
   if (toolName === "bash") {
     const cmd = String(args["command"] ?? "");
+    if (/\bgit\s+(?:clean\b|reset\s+--hard\b|push\b[^\n]*(?:--force\b|\s-f\b))/i.test(cmd)) return "destructive";
     if (/\brm\s+[^\n]*(?:-\w*[rRfF]\w*|--recursive|--force)\b/.test(cmd)) return "destructive";
     if (/\brm\s+\S/.test(cmd)) return "destructive";
     if (/\brmdir\b|\bformat\b|\bmkfs\b|\bdd\s+if=|\bshred\b|\bfdisk\b|\bparted\b/.test(cmd)) return "destructive";
@@ -1308,8 +1388,10 @@ function getDangerLevel(toolName, args) {
     if (/\bSet-Content\b|\bOut-File\b|\bAdd-Content\b|\bCopy-Item\b|\bMove-Item\b|\bSet-ItemProperty\b|\bNew-ItemProperty\b/i.test(cmd)) return "write";
     if (/\b(python3?|node|deno|bun|perl|ruby|php|bash|sh|zsh|pwsh|powershell)(\.exe)?\b[^\n]*?\s-(?:Command|EncodedCommand|c|e|p|r)\b/i.test(cmd)) return "write";
     if (/\bcmd(\.exe)?\s+\/[ck]\b/i.test(cmd)) return "write";
-    return "safe";
+    if (!/[;&|`$<>\n\r(){}]/.test(cmd) && (/^(?:pwd|ls|cat|head|tail|wc|Get-ChildItem|Get-Location|Get-Content)(?:\s+[\w ./\\:*?=,@'"-]+)?\s*$/i.test(cmd.trim()) || /^echo(?:\s+[\w .,'"-]+)?\s*$/.test(cmd.trim()) || /^(?:node|python3?)\s+(?:-v|--version)\s*$/.test(cmd.trim()) || /^git\s+(?:status|log)(?:\s+(?:--short|--porcelain|--oneline|-\d+))*\s*$/.test(cmd.trim()))) return "safe";
+    return "write";
   }
+  if (toolName === "run_tests") return "write";
   if (toolName === "write_file") return "write";
   if (toolName === "edit_file") return "write";
   if (toolName === "save_last_response") return "write";
@@ -1324,7 +1406,7 @@ function getDangerLevel(toolName, args) {
   if (toolName === "git_commit") return "write";
   if (toolName === "git_status" || toolName === "git_diff" || toolName === "git_log") return "safe";
   if (toolName === "notebook_edit") return "write";
-  if (toolName === "read_file" || toolName === "list_dir" || toolName === "grep_files" || toolName === "glob_files" || toolName === "web_fetch" || toolName === "save_memory" || toolName === "ask_user" || toolName === "write_todos" || toolName === "google_search" || toolName === "spawn_agent" || toolName === "run_tests") return "safe";
+  if (toolName === "read_file" || toolName === "list_dir" || toolName === "grep_files" || toolName === "glob_files" || toolName === "web_fetch" || toolName === "save_memory" || toolName === "ask_user" || toolName === "write_todos" || toolName === "google_search" || toolName === "spawn_agent") return "safe";
   return "write";
 }
 function schemaToJsonSchema(schema) {
@@ -4678,7 +4760,7 @@ function clearModelCache(configDir, providerId) {
   delete cache.providers[providerId];
   saveModelCache(configDir, cache);
 }
-function normalizeLiveModels(models, fetchedAt, source = "live") {
+function normalizeLiveModels(models, fetchedAt, source2 = "live") {
   const seen = /* @__PURE__ */ new Set();
   const normalized = [];
   for (const model of models) {
@@ -4690,7 +4772,7 @@ function normalizeLiveModels(models, fetchedAt, source = "live") {
       contextWindow: model.contextWindow || LIVE_DEFAULT_CONTEXT,
       supportsStreaming: model.supportsStreaming ?? true,
       ...model.supportsThinking !== void 0 ? { supportsThinking: model.supportsThinking } : {},
-      source,
+      source: source2,
       available: true,
       metadataUnknown: model.metadataUnknown ?? !model.contextWindow,
       ...fetchedAt ? { fetchedAt } : {}
@@ -5463,26 +5545,33 @@ var SessionManager = class {
   }
   /** P1-PERF-03: `force` 跳过脏检查（用于进程退出、fork 等必须落盘场景） */
   async save(force = false) {
-    if (!this._current) return;
-    if (this._current.messages.length === 0) return;
-    if (!force && !this._current.dirty) return;
+    const session = this._current;
+    if (!session) return;
+    if (session.messages.length === 0) return;
+    if (!force && !session.dirty) return;
     mkdirSync3(this.historyDir, { recursive: true });
-    const filePath = join4(this.historyDir, `${this._current.id}.json`);
-    const raw = this._current.toJSON();
+    const filePath = join4(this.historyDir, `${session.id}.json`);
+    const raw = session.toJSON();
     const opts = this.redactOptionsForSave();
     const { value: payload, hits } = redactJson(raw, opts);
     this.lastRedactionHits = hits.length;
-    atomicWriteFileSync(filePath, JSON.stringify(payload, null, 2));
-    this._current.dirty = false;
+    const serialized = JSON.stringify(payload, null, 2);
+    session.dirty = false;
+    try {
+      await atomicWriteFile(filePath, serialized, { mode: 384 });
+    } catch (error) {
+      session.dirty = true;
+      throw error;
+    }
     try {
       updateSessionInIndex(this.historyDir, {
-        id: this._current.id,
-        provider: this._current.provider,
-        model: this._current.model,
-        title: this._current.title,
-        messageCount: this._current.messages.length,
-        created: this._current.created,
-        updated: this._current.updated
+        id: session.id,
+        provider: session.provider,
+        model: session.model,
+        title: session.title,
+        messageCount: session.messages.length,
+        created: session.created,
+        updated: session.updated
       }, filePath);
     } catch {
     }
@@ -5633,16 +5722,22 @@ var SessionManager = class {
 };
 
 // src/tools/builtin/bash.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync6, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
-import { platform as platform3 } from "os";
+import { platform as platform2 } from "os";
 import { resolve } from "path";
 
 // src/tools/undo-stack.ts
-import { readFileSync as readFileSync5, writeFileSync, unlinkSync as unlinkSync3, rmdirSync, existsSync as existsSync5 } from "fs";
+import { writeFileSync, unlinkSync as unlinkSync3, rmdirSync, existsSync as existsSync5 } from "fs";
 var MAX_UNDO_DEPTH = 20;
 var UndoStack = class {
-  stack = [];
+  stateKey = /* @__PURE__ */ Symbol("stack");
+  get stack() {
+    return scopedState(this.stateKey, () => ({ items: [] })).items;
+  }
+  set stack(items) {
+    scopedState(this.stateKey, () => ({ items: [] })).items = items;
+  }
   /**
    * 在执行文件写入操作之前调用，保存当前状态。
    * @param filePath 将要被写入的文件路径
@@ -5651,11 +5746,7 @@ var UndoStack = class {
   push(filePath, description) {
     let previousContent = null;
     if (existsSync5(filePath)) {
-      try {
-        previousContent = readFileSync5(filePath, "utf-8");
-      } catch {
-        return;
-      }
+      previousContent = readSnapshot(filePath);
     }
     this.pushEntry({
       filePath,
@@ -5692,7 +5783,7 @@ var UndoStack = class {
   /** 内部统一入栈方法，含溢出裁剪 */
   pushEntry(entry) {
     this.stack.push(entry);
-    if (this.stack.length > MAX_UNDO_DEPTH) {
+    while (this.stack.length > MAX_UNDO_DEPTH || this.stack.reduce((n, e) => n + Buffer.byteLength(e.previousContent ?? ""), 0) > MAX_SNAPSHOT_TOTAL_BYTES) {
       this.stack.shift();
     }
   }
@@ -5753,186 +5844,17 @@ var UndoStack = class {
 };
 var undoStack = new UndoStack();
 
-// src/core/interrupt.ts
-var controller = new AbortController();
-function currentAbortSignal() {
-  return controller.signal;
-}
-
-// src/tools/session-context.ts
-import { AsyncLocalStorage } from "async_hooks";
-var als = new AsyncLocalStorage();
-var DEFAULT_SESSION_KEY = "__default__";
-function getCurrentSessionKey() {
-  const ctx = als.getStore();
-  if (!ctx || !ctx.sessionKey) return DEFAULT_SESSION_KEY;
-  return ctx.sessionKey;
-}
-function runWithSessionKey(sessionKey, fn) {
-  const key = sessionKey && sessionKey.length > 0 ? sessionKey : DEFAULT_SESSION_KEY;
-  return als.run({ sessionKey: key }, fn);
-}
-
-// src/tools/win-shell.ts
-import { platform } from "os";
-import { spawn } from "child_process";
-var IS_WINDOWS = platform() === "win32";
-var WIN_UTF8_PREAMBLE = "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; $OutputEncoding = [System.Text.Encoding]::UTF8; ";
-function shellInvocation(command) {
-  if (IS_WINDOWS) {
-    return {
-      shell: "powershell.exe",
-      args: ["-NoProfile", "-NonInteractive", "-Command", WIN_UTF8_PREAMBLE + command]
-    };
-  }
-  return { shell: process.env["SHELL"] ?? "/bin/bash", args: ["-c", command] };
-}
-function decodeWindowsBuffer(buf) {
-  const utf8 = buf.toString("utf-8");
-  if (!utf8.includes("\uFFFD")) return utf8;
-  try {
-    return new TextDecoder("gbk").decode(buf);
-  } catch {
-    return utf8;
-  }
-}
-var GBK_MOJIBAKE_FINGERPRINTS = [
-  "\uFFFD",
-  "\u9215",
-  "\u951B",
-  "\u9983",
-  "\u9241",
-  "\u6D93",
-  "\u935B",
-  "\u9428",
-  "\u7EFE",
-  "\u95AB",
-  "\u9593",
-  "\u95BF",
-  "\u68E3",
-  "\u95B4",
-  "\u5A11",
-  "\u95B8",
-  "\u95BB",
-  "\u7F01",
-  "\u95C1"
-];
-var gbkReverse = null;
-function gbkReverseMap() {
-  if (gbkReverse) return gbkReverse;
-  const map = /* @__PURE__ */ new Map();
-  try {
-    const dec = new TextDecoder("gbk");
-    for (let hi = 129; hi <= 254; hi++) {
-      for (let lo = 64; lo <= 254; lo++) {
-        if (lo === 127) continue;
-        const ch = dec.decode(new Uint8Array([hi, lo]));
-        if (ch.length === 1 && ch !== "\uFFFD" && !map.has(ch)) map.set(ch, [hi, lo]);
-      }
-    }
-  } catch {
-  }
-  gbkReverse = map;
-  return map;
-}
-function decodeRunAsChinese(bytes) {
-  for (let start = 0; start <= 2 && start < bytes.length; start++) {
-    for (let end = 0; end <= 2 && bytes.length - end > start; end++) {
-      const slice = bytes.slice(start, bytes.length - end);
-      if (slice.length < 6) continue;
-      try {
-        const out = new TextDecoder("utf-8", { fatal: true }).decode(new Uint8Array(slice));
-        if (/[一-鿿]/.test(out)) return out;
-      } catch {
-      }
-    }
-  }
-  return null;
-}
-function recoverGbkMojibake(text) {
-  if (!text) return null;
-  const map = gbkReverseMap();
-  if (map.size === 0) return null;
-  let run = [];
-  let best = null;
-  const flush2 = () => {
-    if (run.length >= 4) {
-      const bytes = [];
-      for (const p of run) bytes.push(p[0], p[1]);
-      const out = decodeRunAsChinese(bytes);
-      if (out && (!best || out.length > best.length)) best = out;
-    }
-    run = [];
-  };
-  for (const ch of text) {
-    const pair = ch.codePointAt(0) < 128 ? void 0 : map.get(ch);
-    if (pair) run.push(pair);
-    else flush2();
-  }
-  flush2();
-  return best;
-}
-function looksLikeGbkMojibake(text) {
-  if (recoverGbkMojibake(text) !== null) return true;
-  let hits = 0;
-  for (const ch of GBK_MOJIBAKE_FINGERPRINTS) {
-    if (text.includes(ch) && ++hits >= 2) return true;
-  }
-  return false;
-}
-function killProcessTree(proc) {
-  if (proc.killed || proc.exitCode !== null) return;
-  if (IS_WINDOWS && proc.pid) {
-    try {
-      const tk = spawn("taskkill", ["/PID", String(proc.pid), "/T", "/F"], {
-        windowsHide: true,
-        stdio: "ignore"
-      });
-      tk.on("exit", () => {
-        try {
-          proc.kill();
-        } catch {
-        }
-      });
-      tk.on("error", () => {
-        try {
-          proc.kill();
-        } catch {
-        }
-      });
-    } catch {
-      try {
-        proc.kill();
-      } catch {
-      }
-    }
-    return;
-  }
-  try {
-    proc.kill("SIGTERM");
-  } catch {
-  }
-  setTimeout(() => {
-    if (!proc.killed && proc.exitCode === null) {
-      try {
-        proc.kill("SIGKILL");
-      } catch {
-      }
-    }
-  }, 500).unref();
-}
-
 // src/tools/shell-pool.ts
-import { spawn as spawn2 } from "child_process";
-import { platform as platform2 } from "os";
-var IS_WINDOWS2 = platform2() === "win32";
+import { spawn } from "child_process";
+import { platform } from "os";
+var IS_WINDOWS2 = platform() === "win32";
 var SHELL = IS_WINDOWS2 ? "powershell.exe" : process.env["SHELL"] ?? "/bin/bash";
 var pool = /* @__PURE__ */ new Map();
 var IDLE_EVICT_MS = 5 * 6e4;
 var evictionTimer = null;
 function spawnShell(cwd) {
   const shellArgs = IS_WINDOWS2 ? ["-NoProfile", "-NonInteractive", "-Command", "-"] : ["-s"];
-  const proc = spawn2(SHELL, shellArgs, {
+  const proc = spawn(SHELL, shellArgs, {
     cwd,
     windowsHide: true,
     stdio: ["pipe", "pipe", "pipe"]
@@ -6123,7 +6045,7 @@ function cleanupPoolSession(sessionKey) {
 }
 
 // src/tools/builtin/bash.ts
-var IS_WINDOWS3 = platform3() === "win32";
+var IS_WINDOWS3 = platform2() === "win32";
 var SHELL2 = IS_WINDOWS3 ? "powershell.exe" : process.env["SHELL"] ?? "/bin/bash";
 var cwdBySession = /* @__PURE__ */ new Map();
 function getCwd() {
@@ -6153,7 +6075,8 @@ Important rules:
 4. To delete directories, use Remove-Item -Recurse (the system will automatically optimize to a more reliable method).
 5. IMPORTANT: On Windows, "curl" is an alias for Invoke-WebRequest and does NOT support curl flags like -s, -X, -H. Use Invoke-RestMethod instead for HTTP requests. Example: Invoke-RestMethod -Uri "http://localhost:3000/api/health" -Method Get
 6. NEVER run long-running / never-exiting commands through bash \u2014 they block until timeout. This includes starting an Android emulator (emulator -avd X), streaming logs (adb logcat), and dev servers (node server.js, npm run dev, metro / react-native start). Use the 'task_create' tool to run these in the background, then poll status with short bash calls (e.g. adb shell getprop sys.boot_completed).
-7. CRITICAL \u2014 this is PowerShell, NOT bash: \\ is NOT an escape character. Writing \\" inside a double-quoted string CLOSES the string and silently splits your command into fragments \u2014 it often still exits 0 with no output, so it looks like it worked when it did not. To escape a quote use \`" or "". For anything with nested quoting (especially ssh + psql -c "SELECT ..."), do NOT try to escape your way out: write the payload to a file with the 'write_file' tool, 'scp' it to the host, and run it with a single level of quoting (e.g. ssh host "psql -d db -f /tmp/x.sql").` : `Execute commands in ${SHELL2}.
+7. CRITICAL \u2014 this is PowerShell, NOT bash: \\ is NOT an escape character. Writing \\" inside a double-quoted string CLOSES the string and silently splits your command into fragments \u2014 it often still exits 0 with no output, so it looks like it worked when it did not. To escape a quote use \`" or "". For anything with nested quoting (especially ssh + psql -c "SELECT ..."), do NOT try to escape your way out: write the payload to a file with the 'write_file' tool, 'scp' it to the host, and run it with a single level of quoting (e.g. ssh host "psql -d db -f /tmp/x.sql").
+8. CRITICAL \u2014 running a program by its full path: a quoted string at the START of a statement is parsed as a string EXPRESSION, not a command. "C:\\path\\python.exe" -c "print(1)" is a SYNTAX ERROR. Put the call operator '&' in front: & "C:\\path\\python.exe" -c "print(1)" \u2014 or $py = "C:\\path\\python.exe"; & $py -c "print(1)". This applies to any quoted path used as a command, anywhere a statement starts (including after ';').` : `Execute commands in ${SHELL2}.
 Important rules:
 1. Each bash call runs in an independent subprocess; cd commands do not persist. To run in a specific directory, use the cwd parameter, or combine commands: e.g. "cd mydir && ls" or "mkdir -p mydir && touch mydir/file.txt".
 2. If a command fails (returns an error or non-zero exit code), stop immediately, report the error to the user, and do not retry the same or similar commands.
@@ -6408,6 +6331,116 @@ function detectPowerShellBackslashQuote(command) {
   }
   return false;
 }
+var PS_OPERATOR_WORDS = /* @__PURE__ */ new Set([
+  "eq",
+  "ne",
+  "gt",
+  "ge",
+  "lt",
+  "le",
+  "ceq",
+  "cne",
+  "cgt",
+  "cge",
+  "clt",
+  "cle",
+  "ieq",
+  "ine",
+  "igt",
+  "ige",
+  "ilt",
+  "ile",
+  "like",
+  "notlike",
+  "match",
+  "notmatch",
+  "clike",
+  "cnotlike",
+  "cmatch",
+  "cnotmatch",
+  "ilike",
+  "inotlike",
+  "imatch",
+  "inotmatch",
+  "contains",
+  "notcontains",
+  "ccontains",
+  "cnotcontains",
+  "icontains",
+  "inotcontains",
+  "in",
+  "notin",
+  "cin",
+  "cnotin",
+  "iin",
+  "inotin",
+  "is",
+  "isnot",
+  "as",
+  "and",
+  "or",
+  "not",
+  "xor",
+  "band",
+  "bor",
+  "bnot",
+  "bxor",
+  "shl",
+  "shr",
+  "join",
+  "split",
+  "replace",
+  "csplit",
+  "creplace",
+  "isplit",
+  "ireplace",
+  "f"
+]);
+function detectMissingCallOperator(command) {
+  if (!IS_WINDOWS3) return false;
+  let atStatementStart = true;
+  let afterCallOperator = false;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (ch === " " || ch === "	") continue;
+    if (ch === ";" || ch === "\n" || ch === "{" || ch === "(" || ch === "|" || ch === "&") {
+      if (ch === "&") {
+        const next = command.slice(i + 1).replace(/^[ \t]+/, "");
+        afterCallOperator = !next.startsWith("&");
+      } else {
+        afterCallOperator = false;
+      }
+      atStatementStart = true;
+      continue;
+    }
+    if (ch === "." && atStatementStart) {
+      afterCallOperator = true;
+      continue;
+    }
+    if ((ch === '"' || ch === "'") && atStatementStart && !afterCallOperator) {
+      const quote = ch;
+      let j = i + 1;
+      while (j < command.length && command[j] !== quote) j++;
+      if (j >= command.length) return false;
+      const rest = command.slice(j + 1);
+      const m = /^[ \t]+(\S+)/.exec(rest);
+      if (m) {
+        const token = m[1];
+        if (/^[-]/.test(token)) {
+          const word = token.slice(1).toLowerCase();
+          if (PS_OPERATOR_WORDS.has(word)) return false;
+          return true;
+        }
+        if (/^[+*%=<>|;)}\]]/.test(token)) return false;
+        return true;
+      }
+      return false;
+    }
+    atStatementStart = false;
+    afterCallOperator = false;
+  }
+  return false;
+}
 var BACKSLASH_QUOTE_SILENT_WARNING = `
 
 \u26A0 WARNING: this command contains \\" inside a double-quoted string, but PowerShell does NOT treat \\ as an escape \u2014 that quote CLOSED the string and the command was split into fragments. It exited 0 with no output because the outer program (e.g. ssh) still ran, but it very likely did NOT run what you intended. Do NOT assume this succeeded.
@@ -6488,6 +6521,11 @@ function buildErrorHint(command, stderr) {
       `Hint: PowerShell does NOT treat \\ as an escape character \u2014 the \\" in this command closed the double-quoted string and split the command into fragments. Escape quotes with \`" or "" instead. Better: avoid nested quoting entirely \u2014 write the payload to a file with 'write_file', 'scp' it over, and run it with one level of quoting (e.g. ssh host "psql -d <db> -f /tmp/x.sql").`
     );
   }
+  if (detectMissingCallOperator(command) && /(ParserError|UnexpectedToken|Unexpected token|意外的标记|运算符后面提供|必须在)/i.test(stderr)) {
+    hints.push(
+      `Hint: in PowerShell a quoted string at the START of a statement is parsed as a string EXPRESSION, not as a command \u2014 so "C:\\path\\python.exe" -c "..." is a syntax error, not a quoting problem. Do NOT retry by removing the quotes, dropping the argument, or re-quoting it differently; all of those fail the same way. Fix: put the call operator '&' in front \u2014 \`& "C:\\path\\python.exe" -c "..."\` \u2014 or assign the path to a variable first (\`$py = "C:\\path\\python.exe"; & $py -c "..."\`).`
+    );
+  }
   return hints.length > 0 ? hints.map((h) => `\u{1F4A1} ${h}`).join("\n\n") : null;
 }
 function detectBlockingCommand(command) {
@@ -6590,7 +6628,7 @@ function pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, cwd) {
 function runShell(command, opts) {
   return new Promise((resolvePromise) => {
     const shellArgs = IS_WINDOWS3 ? ["-NoProfile", "-NonInteractive", "-Command", WIN_UTF8_PREAMBLE + command] : ["-c", command];
-    const child = spawn3(SHELL2, shellArgs, {
+    const child = spawn2(SHELL2, shellArgs, {
       cwd: opts.cwd,
       env: opts.env,
       windowsHide: true,
@@ -6669,16 +6707,16 @@ function updateCwdFromCommand(command, baseCwd) {
 }
 
 // src/tools/builtin/read-file.ts
-import { readFileSync as readFileSync6, existsSync as existsSync7, statSync as statSync3, readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync5, existsSync as existsSync7, statSync as statSync3, readdirSync as readdirSync3 } from "fs";
 import { execFileSync } from "child_process";
 import { extname, resolve as resolve2, basename, sep, dirname as dirname2 } from "path";
 import { homedir as homedir2 } from "os";
 
 // src/tools/builtin/notebook-utils.ts
-function cellSourceToString(source) {
-  if (!source) return "";
-  if (Array.isArray(source)) return source.join("");
-  return source;
+function cellSourceToString(source2) {
+  if (!source2) return "";
+  if (Array.isArray(source2)) return source2.join("");
+  return source2;
 }
 function stringToCellSource(content) {
   if (content.length === 0) return [];
@@ -6733,16 +6771,16 @@ function renderNotebookAsText(nb, filePath) {
   nb.cells.forEach((cell, idx) => {
     const cellNum = idx + 1;
     const type = cell.cell_type;
-    const source = cellSourceToString(cell.source);
+    const source2 = cellSourceToString(cell.source);
     if (type === "markdown") {
       lines.push(`## Cell ${cellNum} [markdown]`);
-      lines.push(source);
+      lines.push(source2);
       lines.push("");
     } else if (type === "code") {
       const execLabel = cell.execution_count != null ? ` (execution #${cell.execution_count})` : "";
       lines.push(`## Cell ${cellNum} [code${execLabel}]`);
       lines.push("```" + language);
-      lines.push(source);
+      lines.push(source2);
       lines.push("```");
       const outputText = extractOutputText(cell.outputs);
       if (outputText) {
@@ -6754,7 +6792,7 @@ function renderNotebookAsText(nb, filePath) {
       lines.push("");
     } else if (type === "raw") {
       lines.push(`## Cell ${cellNum} [raw]`);
-      lines.push(source);
+      lines.push(source2);
       lines.push("");
     }
   });
@@ -6779,6 +6817,7 @@ function createCell(cellType, content) {
 // src/tools/builtin/read-file.ts
 var MAX_FILE_BYTES = 10 * 1024 * 1024;
 function getHardRefusal(normalizedPath) {
+  if (isCredentialVault(normalizedPath)) return "[Refused] Credential vault files cannot be read by tools.";
   const home2 = homedir2();
   const p = normalizedPath.toLowerCase();
   const base = basename(normalizedPath).toLowerCase();
@@ -6953,7 +6992,7 @@ var readFileTool = {
     const offsetLine = typeof rawOffset === "number" && Number.isFinite(rawOffset) && rawOffset > 0 ? Math.floor(rawOffset) : void 0;
     const limitLines = typeof rawLimit === "number" && Number.isFinite(rawLimit) && rawLimit > 0 ? Math.floor(rawLimit) : void 0;
     if (!filePath) throw new ToolError("read_file", "path is required");
-    const normalizedPath = resolve2(filePath);
+    const normalizedPath = canonicalPath(filePath);
     const refusal = getHardRefusal(normalizedPath);
     if (refusal) return refusal;
     if (!existsSync7(normalizedPath)) {
@@ -7020,7 +7059,7 @@ Suggestion: read existing text versions (.md / .txt) in the project, or install
     }
     if (ext === ".ipynb") {
       try {
-        const raw = readFileSync6(normalizedPath, "utf-8");
+        const raw = readFileSync5(normalizedPath, "utf-8");
         const nb = parseNotebook(raw);
         return renderNotebookAsText(nb, filePath);
       } catch (err) {
@@ -7038,8 +7077,8 @@ Do NOT claim you inspected this image \u2014 you have not seen it.`;
       return `[Binary file: ${filePath} (${ext})]
 This is a binary file and cannot be read as text. If there is a text version (.md / .txt) in the project, please read that instead.`;
     }
-    const { readFile: readFile2 } = await import("fs/promises");
-    const buf = size > 1048576 ? await readFile2(normalizedPath) : readFileSync6(normalizedPath);
+    const { readFile } = await import("fs/promises");
+    const buf = size > 1048576 ? await readFile(normalizedPath) : readFileSync5(normalizedPath);
     if (encoding === "base64") {
       return `[File: ${filePath} | base64]
 
@@ -7077,12 +7116,12 @@ ${content}`;
 };
 
 // src/tools/builtin/write-file.ts
-import { appendFileSync, mkdirSync as mkdirSync6, readFileSync as readFileSync10, statSync as statSync4 } from "fs";
+import { appendFileSync, mkdirSync as mkdirSync6, readFileSync as readFileSync8, statSync as statSync4 } from "fs";
 import { dirname as dirname5 } from "path";
 
 // src/tools/executor.ts
 import chalk3 from "chalk";
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
 import { tmpdir } from "os";
 
 // src/core/readline-internal.ts
@@ -7322,7 +7361,7 @@ function simpleDiff(oldLines, newLines) {
 // src/tools/hooks.ts
 import { execSync } from "child_process";
 import { createHash } from "crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync6 } from "fs";
 import { join as join5 } from "path";
 var TRUST_FILE = "hooks-trust.json";
 var DEFAULT_TIMEOUT_MS = 5e3;
@@ -7338,7 +7377,7 @@ function loadHookTrustStore(configDir) {
   const file = hookTrustPath(configDir);
   if (!existsSync8(file)) return { records: [] };
   try {
-    const parsed = JSON.parse(readFileSync7(file, "utf-8"));
+    const parsed = JSON.parse(readFileSync6(file, "utf-8"));
     return { records: Array.isArray(parsed.records) ? parsed.records : [] };
   } catch {
     return { records: [] };
@@ -7352,9 +7391,9 @@ function hashHook(event, command) {
   return createHash("sha256").update(`${event}
 ${command}`, "utf-8").digest("hex");
 }
-function isTrusted(source, event, hash, store) {
-  if (source === "user" || source === "managed") return true;
-  return store.records.some((r) => r.source === source && r.event === event && r.hash === hash);
+function isTrusted(source2, event, hash, store) {
+  if (source2 === "user" || source2 === "managed") return true;
+  return store.records.some((r) => r.source === source2 && r.event === event && r.hash === hash);
 }
 function listHooks(config, configDir) {
   if (!config || config.enabled === false) return [];
@@ -7362,15 +7401,15 @@ function listHooks(config, configDir) {
   const out = [];
   const push = (event, hook, index) => {
     if (!hook.command) return;
-    const source = hook.source ?? "user";
+    const source2 = hook.source ?? "user";
     const hash = hashHook(event, hook.command);
     out.push({
       id: `${event}:${index}`,
       event,
       command: hook.command,
-      source,
+      source: source2,
       hash,
-      trusted: isTrusted(source, event, hash, store),
+      trusted: isTrusted(source2, event, hash, store),
       disabled: hook.disabled === true,
       description: hook.description
     });
@@ -7446,15 +7485,15 @@ function runLifecycleHooks(config, event, payload, opts) {
   for (let i = 0; i < hooks.length; i++) {
     const hook = hooks[i];
     if (!hook.command || hook.disabled) continue;
-    const source = hook.source ?? "user";
+    const source2 = hook.source ?? "user";
     const hash = hashHook(event, hook.command);
     const descriptor = {
       id: `${event}:${i}`,
       event,
       command: hook.command,
-      source,
+      source: source2,
       hash,
-      trusted: isTrusted(source, event, hash, store),
+      trusted: isTrusted(source2, event, hash, store),
       disabled: false,
       description: hook.description
     };
@@ -7603,7 +7642,8 @@ var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
   "recall_memory"
 ]);
 function normalizePathForPermission(value) {
-  return value.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+  const normalized = value.replace(/\\/g, "/").replace(/\/+$/, "");
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
 }
 function canonicalizeWithNearestParent(value) {
   const missing = [];
@@ -7691,7 +7731,7 @@ function profileHardDecision(profileName, toolName, args, dangerLevel, ctx) {
         return { action: "deny", reason: "file write target is outside workspace/temp roots", profileName, hardBoundary: true };
       }
     }
-    if (toolName === "bash" || toolName === "run_interactive" || toolName === "task_create") {
+    if (toolName === "bash" || toolName === "run_interactive" || toolName === "task_create" || toolName === "run_tests") {
       return {
         action: "confirm",
         reason: "shell/process writes cannot be proven to stay inside workspace/temp roots",
@@ -7793,9 +7833,9 @@ function checkNetworkPolicy(toolName, args, policy) {
   if (!policy?.enabled) return null;
   let action = networkToolAction(toolName, policy);
   let reason = "network access requires confirmation";
-  if (toolName === "bash") {
+  if (["bash", "run_tests", "run_interactive", "task_create"].includes(toolName)) {
     const command = String(args["command"] ?? "");
-    if (!isShellNetworkCommand(command)) return null;
+    if (toolName === "bash" && !isShellNetworkCommand(command) && dangerIsReadOnly(command)) return null;
     action = policy.tools?.shell ?? policy.defaultAction ?? "confirm";
     reason = "shell command may access the network";
   }
@@ -7831,6 +7871,9 @@ function checkNetworkPolicy(toolName, args, policy) {
   if (!permissionAction) return null;
   return { action: permissionAction, reason, profileName: "networkPolicy" };
 }
+function dangerIsReadOnly(command) {
+  return /^(?:pwd|echo [\w .-]+|git status(?: --short)?)$/.test(command.trim());
+}
 
 // src/tools/truncate.ts
 var DEFAULT_MAX_TOOL_OUTPUT_CHARS = 12e3;
@@ -8057,8 +8100,7 @@ function getTopUsedTools(limit = 5) {
 }
 
 // src/tools/action-classifier.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
-import { isAbsolute as isAbsolute2, join as join7, resolve as resolve4 } from "path";
+import { isAbsolute as isAbsolute2, resolve as resolve4 } from "path";
 var RECENT_DENIED_LIMIT = 50;
 var recentlyDenied = [];
 function recordRecentlyDeniedAutoAction(call, classification) {
@@ -8078,7 +8120,8 @@ function clearRecentlyDeniedAutoActions() {
   recentlyDenied.splice(0, recentlyDenied.length);
 }
 function normalizePath(value) {
-  return value.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+  const normalized = canonicalPath(value).replace(/\\/g, "/").replace(/\/+$/, "");
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
 }
 function isInside(root, target) {
   const absoluteRoot = resolve4(root);
@@ -8091,56 +8134,6 @@ function getPathArg(call) {
   const raw = call.arguments.path ?? call.arguments.filePath ?? call.arguments.outputPath ?? call.arguments.file;
   return typeof raw === "string" && raw.trim() ? raw.trim() : null;
 }
-function splitShellWords(command) {
-  const out = [];
-  const re = /"([^"]*)"|'([^']*)'|([^\s]+)/g;
-  let m;
-  while (m = re.exec(command)) out.push(m[1] ?? m[2] ?? m[3] ?? "");
-  return out.filter(Boolean);
-}
-function readPackageManifest(root) {
-  const p = join7(root, "package.json");
-  if (!existsSync10(p)) return null;
-  try {
-    return JSON.parse(readFileSync8(p, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function manifestHasDependency(root, name) {
-  const manifest = readPackageManifest(root);
-  if (!manifest) return false;
-  for (const key of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
-    const deps = manifest[key];
-    if (deps && typeof deps === "object" && Object.prototype.hasOwnProperty.call(deps, name)) return true;
-  }
-  return false;
-}
-function lockfileMentions(root, name) {
-  for (const file of ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"]) {
-    const p = join7(root, file);
-    if (!existsSync10(p)) continue;
-    try {
-      if (readFileSync8(p, "utf-8").includes(name)) return true;
-    } catch {
-    }
-  }
-  return false;
-}
-function getInstallPackages(command) {
-  const words = splitShellWords(command);
-  const cmd = words[0]?.toLowerCase();
-  const sub = words[1]?.toLowerCase();
-  if (!cmd || !sub) return [];
-  const isInstall = cmd === "npm" && (sub === "install" || sub === "i" || sub === "add") || (cmd === "pnpm" || cmd === "yarn") && (sub === "add" || sub === "install");
-  if (!isInstall) return [];
-  return words.slice(2).filter((w) => !w.startsWith("-")).filter((w) => w !== "." && w !== "./").map((w) => w.replace(/^@([^/]+)\/([^@]+)(?:@.+)?$/, "@$1/$2").replace(/^([^@]+)@.+$/, "$1"));
-}
-function isPlainGitPush(command) {
-  if (!/^\s*git\s+push\b/i.test(command)) return false;
-  if (/--force|-f\b|\+[^\s]+/i.test(command)) return false;
-  return !/[;&|`$<>\n\r]/.test(command);
-}
 function hasSecretExfiltrationShape(command) {
   return /(?:\.env|config\.json|id_rsa|id_ed25519|AWS_SECRET|AICLI_API_KEY|OPENAI_API_KEY|ANTHROPIC_API_KEY)/i.test(command) && /\b(curl|wget|scp|rsync|nc|netcat|Invoke-WebRequest|Invoke-RestMethod)\b/i.test(command);
 }
@@ -8162,7 +8155,7 @@ var RuleBasedActionClassifier = class {
     }
     return { decision: "confirm", reason: "destructive actions require confirmation", ruleId: "auto.destructive-confirm", confidence: "high" };
   }
-  classifyShell(call, dangerLevel, ctx) {
+  classifyShell(call, dangerLevel, _ctx) {
     const command = String(call.arguments.command ?? "");
     if (/\bcurl\b[^\n|;&]*\|\s*(?:sudo\s+)?(?:bash|sh|zsh)\b/i.test(command)) {
       return { decision: "deny", reason: "curl pipe shell execution is blocked in auto mode", ruleId: "deny.curl-pipe-shell", confidence: "high" };
@@ -8188,18 +8181,7 @@ var RuleBasedActionClassifier = class {
     if (/\b(npx|pnpm\s+dlx|yarn\s+dlx)\s+(claude|codex|aider|cursor-agent|gemini)\b/i.test(command)) {
       return { decision: "confirm", reason: "third-party agent loop requires confirmation", ruleId: "confirm.third-party-agent", confidence: "high" };
     }
-    if (isPlainGitPush(command)) {
-      return { decision: "auto-approve", reason: "plain git push without force", ruleId: "auto.git-push", confidence: "high" };
-    }
-    const pkgs = getInstallPackages(command);
-    if (pkgs.length > 0) {
-      const allDeclared = pkgs.every((p) => manifestHasDependency(ctx.workspaceRoot, p) || lockfileMentions(ctx.workspaceRoot, p));
-      return allDeclared ? { decision: "auto-approve", reason: "installing dependencies already declared in manifest/lockfile", ruleId: "auto.declared-dependency-install", confidence: "medium" } : { decision: "confirm", reason: "dependency install includes undeclared packages", ruleId: "confirm.undeclared-dependency-install", confidence: "medium" };
-    }
-    if (/\b(curl|wget|Invoke-WebRequest|Invoke-RestMethod)\b/i.test(command) && !/[>|;&`$]/.test(command)) {
-      return { decision: "auto-approve", reason: "read-only HTTP shell command", ruleId: "auto.readonly-http-shell", confidence: "medium" };
-    }
-    if (dangerLevel === "safe") {
+    if (dangerLevel === "safe" && getDangerLevel(call.name, call.arguments) === "safe") {
       return { decision: "auto-approve", reason: "safe shell action", ruleId: "auto.safe-shell", confidence: "medium" };
     }
     return { decision: "confirm", reason: "shell action is not proven low-risk", ruleId: "confirm.shell-default", confidence: "medium" };
@@ -8668,10 +8650,10 @@ var ToolExecutor = class {
     if (call.name === "write_file") {
       const { path: filePath, content: chunk, append } = resolveWriteFileArgs(call.arguments);
       if (!filePath) return;
-      if (existsSync11(filePath)) {
+      if (existsSync10(filePath)) {
         let oldContent;
         try {
-          oldContent = readFileSync9(filePath, "utf-8");
+          oldContent = readFileSync7(filePath, "utf-8");
         } catch {
           return;
         }
@@ -8695,7 +8677,7 @@ var ToolExecutor = class {
       }
     } else if (call.name === "edit_file") {
       const filePath = String(call.arguments["path"] ?? "");
-      if (!filePath || !existsSync11(filePath)) return;
+      if (!filePath || !existsSync10(filePath)) return;
       const oldStr = call.arguments["old_str"];
       const newStr = call.arguments["new_str"];
       if (oldStr !== void 0) {
@@ -8722,7 +8704,7 @@ var ToolExecutor = class {
         const to = Number(call.arguments["delete_to_line"] ?? from);
         let fileContent;
         try {
-          fileContent = readFileSync9(filePath, "utf-8");
+          fileContent = readFileSync7(filePath, "utf-8");
         } catch {
           return;
         }
@@ -8818,7 +8800,12 @@ import { resolve as resolve5, sep as sep2, basename as basename3 } from "path";
 import { homedir as homedir4 } from "os";
 var home = homedir4();
 function norm(p) {
-  const abs = resolve5(p);
+  let abs;
+  try {
+    abs = canonicalPath(p);
+  } catch {
+    abs = resolve5(p);
+  }
   return process.platform === "win32" ? abs.toLowerCase() : abs;
 }
 function homeRel(p) {
@@ -8832,6 +8819,7 @@ function homeRel(p) {
 }
 function classifyWritePath(path3) {
   if (!path3) return { sensitive: false };
+  if (isCredentialVault(path3)) return { sensitive: true, reason: "credential vault" };
   const abs = norm(path3);
   const base = basename3(abs);
   const rel = homeRel(path3);
@@ -8914,7 +8902,7 @@ function countTextLines(text) {
 
 // src/tools/builtin/write-file.ts
 function countFileLines(filePath) {
-  return countTextLines(readFileSync10(filePath, "utf-8"));
+  return countTextLines(readFileSync8(filePath, "utf-8"));
 }
 var writeFileTool = {
   definition: {
@@ -8978,7 +8966,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
     const mode = appendMode ? "appended" : "written";
     void (async () => {
       try {
-        const { updateFile } = await import("./indexer-FPKY7LCT.js");
+        const { updateFile } = await import("./indexer-VRXDZ74A.js");
         await updateFile(process.cwd(), filePath);
       } catch {
       }
@@ -8997,7 +8985,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
 };
 
 // src/tools/builtin/edit-file.ts
-import { readFileSync as readFileSync11, existsSync as existsSync12 } from "fs";
+import { readFileSync as readFileSync9, existsSync as existsSync11 } from "fs";
 
 // src/tools/builtin/patch-apply.ts
 function parseUnifiedDiff(patch) {
@@ -9365,7 +9353,7 @@ Note: Path can be absolute or relative to cwd.`,
     const filePath = String(args["path"] ?? args["file"] ?? "");
     const encoding = args["encoding"] ?? "utf-8";
     if (!filePath) throw new ToolError("edit_file", "path is required");
-    if (!existsSync12(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
+    if (!existsSync11(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
     const verdict = classifyWritePath(filePath);
     if (verdict.sensitive && subAgentGuard.active) {
       throw new ToolError(
@@ -9373,7 +9361,7 @@ Note: Path can be absolute or relative to cwd.`,
         `Refused: sub-agents cannot edit sensitive paths \u2014 ${verdict.reason}. If this is genuinely needed, ask the parent agent to perform the edit so the user can approve it.`
       );
     }
-    const original = readFileSync11(filePath, encoding);
+    const original = readFileSync9(filePath, encoding);
     if (args["patch"] !== void 0) {
       const patchText = String(args["patch"] ?? "");
       const stopOnError = args["stop_on_error"] !== false;
@@ -9550,8 +9538,8 @@ function truncatePreview(str, maxLen = 80) {
 }
 
 // src/tools/builtin/list-dir.ts
-import { readdirSync as readdirSync4, statSync as statSync5, existsSync as existsSync13 } from "fs";
-import { join as join8, basename as basename4 } from "path";
+import { readdirSync as readdirSync4, statSync as statSync5, existsSync as existsSync12 } from "fs";
+import { join as join7, basename as basename4 } from "path";
 var listDirTool = {
   definition: {
     name: "list_dir",
@@ -9573,7 +9561,7 @@ var listDirTool = {
   async execute(args) {
     const dirPath = String(args["path"] ?? process.cwd());
     const recursive = Boolean(args["recursive"] ?? false);
-    if (!existsSync13(dirPath)) {
+    if (!existsSync12(dirPath)) {
       const targetName = basename4(dirPath).toLowerCase();
       const cwd = process.cwd();
       const suggestions = [];
@@ -9631,11 +9619,11 @@ function listRecursive(basePath, indent, recursive, lines) {
     if (entry.isDirectory()) {
       lines.push(`${indent}\u{1F4C1} ${entry.name}/`);
       if (recursive) {
-        listRecursive(join8(basePath, entry.name), indent + "  ", true, lines);
+        listRecursive(join7(basePath, entry.name), indent + "  ", true, lines);
       }
     } else {
       try {
-        const stat = statSync5(join8(basePath, entry.name));
+        const stat = statSync5(join7(basePath, entry.name));
         const size = formatSize(stat.size);
         lines.push(`${indent}\u{1F4C4} ${entry.name}  (${size})`);
       } catch {
@@ -9650,10 +9638,77 @@ function formatSize(bytes) {
   return `${(bytes / 1024 / 1024).toFixed(1)}MB`;
 }
 
+// src/tools/regex-search.ts
+import { Worker } from "worker_threads";
+var source = String.raw`
+const { parentPort, workerData: d } = require('node:worker_threads');
+const fs = require('node:fs');
+let re;
+try { re = new RegExp(d.pattern, d.ignoreCase ? 'i' : ''); }
+catch { re = new RegExp(d.pattern.replace(/[.*+?^$()|[\]\\]/g, '\\$&'), d.ignoreCase ? 'i' : ''); }
+const results = [];
+for (const f of d.files) {
+  if (results.length >= d.maxResults) break;
+  let fd;
+  try {
+    fd = fs.openSync(f.fullPath, 'r');
+    const buf = Buffer.alloc(1000001);
+    let size = 0;
+    while (size < buf.length) { const n = fs.readSync(fd, buf, size, buf.length - size, null); if (!n) break; size += n; }
+    if (size > 1000000 || buf.subarray(0, Math.min(size,512)).includes(0)) continue;
+    const lines = buf.subarray(0,size).toString('utf8').split('\n');
+    for (let i=0; i<lines.length && results.length<d.maxResults; i++) {
+      if (!re.test(lines[i])) continue;
+      const match = { file:f.relPath.replace(/\\/g,'/'), lineNumber:i+1, lineText:lines[i].slice(0,10000) };
+      if (d.context) {
+        match.contextBefore=[]; match.contextAfter=[];
+        for(let j=Math.max(0,i-d.context);j<i;j++) match.contextBefore.push([j+1,lines[j].slice(0,10000)]);
+        for(let j=i+1;j<=Math.min(lines.length-1,i+d.context);j++) match.contextAfter.push([j+1,lines[j].slice(0,10000)]);
+      }
+      results.push(match);
+    }
+  } catch {} finally { if (fd !== undefined) fs.closeSync(fd); }
+}
+parentPort.postMessage(results);
+`;
+var active = 0;
+async function searchInWorker(files, pattern, ignoreCase, context, maxResults) {
+  const signal = currentAbortSignal();
+  if (signal.aborted) throw new Error("Search cancelled");
+  if (active >= 4) throw new Error("Search capacity reached; wait for another search to finish");
+  active++;
+  let worker;
+  try {
+    return await new Promise((resolve13, reject) => {
+      worker = new Worker(source, { eval: true, workerData: { files, pattern, ignoreCase, context, maxResults }, resourceLimits: { maxOldGenerationSizeMb: 64 } });
+      let settled = false;
+      const finish = (error, results) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        signal.removeEventListener("abort", abort);
+        if (error) reject(error);
+        else resolve13(results ?? []);
+      };
+      const timer = setTimeout(() => finish(new Error("Search exceeded 2 second CPU/time budget; simplify the pattern or narrow the path")), 2e3);
+      const abort = () => finish(new Error("Search cancelled"));
+      signal.addEventListener("abort", abort, { once: true });
+      if (signal.aborted) abort();
+      worker.once("message", (results) => finish(void 0, results));
+      worker.once("error", (error) => finish(error));
+      worker.once("exit", (code) => {
+        if (!settled) finish(new Error(`Search worker exited (${code})`));
+      });
+    });
+  } finally {
+    if (worker) await worker.terminate();
+    active--;
+  }
+}
+
 // src/tools/builtin/grep-files.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync6, existsSync as existsSync14 } from "fs";
-import { readFile } from "fs/promises";
-import { join as join9, relative } from "path";
+import { readdirSync as readdirSync5, statSync as statSync6, existsSync as existsSync13 } from "fs";
+import { join as join8, relative } from "path";
 var grepFilesTool = {
   definition: {
     name: "grep_files",
@@ -9701,43 +9756,24 @@ Supports regex. Automatically skips node_modules, dist, .git directories.`,
     const rootPath = String(args["path"] ?? process.cwd());
     const filePattern = args["file_pattern"] ? String(args["file_pattern"]) : void 0;
     const ignoreCase = Boolean(args["ignore_case"] ?? false);
-    const contextLines = Math.max(0, Number(args["context_lines"] ?? 0));
-    const maxResults = Math.max(1, Number(args["max_results"] ?? 50));
+    const contextLines = Math.min(10, Math.max(0, Number(args["context_lines"]) || 0));
+    const maxResults = Math.min(200, Math.max(1, Number(args["max_results"]) || 50));
     if (!pattern) throw new ToolError("grep_files", "pattern is required");
-    if (!existsSync14(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
+    if (!existsSync13(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
     const MAX_PATTERN_LENGTH = 1e3;
-    if (pattern.length > MAX_PATTERN_LENGTH) {
+    if (pattern.length > MAX_PATTERN_LENGTH || (filePattern?.length ?? 0) > MAX_PATTERN_LENGTH) {
       throw new ToolError("grep_files", `Pattern too long (${pattern.length} chars, max ${MAX_PATTERN_LENGTH}). Use a shorter pattern.`);
     }
-    let regex;
-    try {
-      regex = new RegExp(pattern, ignoreCase ? "gi" : "g");
-    } catch {
-      const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      regex = new RegExp(escaped, ignoreCase ? "gi" : "g");
-    }
-    const results = [];
-    const stat = statSync6(rootPath);
-    if (stat.isFile()) {
-      searchInFile(rootPath, rootPath, regex, contextLines, maxResults, results);
-    } else {
-      const filePaths = collectFilePaths(rootPath, filePattern, maxResults);
-      const BATCH_SIZE = 16;
-      for (let i = 0; i < filePaths.length && results.length < maxResults; i += BATCH_SIZE) {
-        const batch = filePaths.slice(i, i + BATCH_SIZE);
-        const batchResults = await Promise.all(
-          batch.map(
-            ({ fullPath, relPath }) => searchInFileAsync(fullPath, relPath, regex, contextLines, maxResults - results.length)
-          )
-        );
-        for (const br of batchResults) {
-          for (const r of br) {
-            if (results.length >= maxResults) break;
-            results.push(r);
-          }
-        }
+    assertReadablePath(rootPath);
+    const paths = statSync6(rootPath).isFile() ? [{ fullPath: rootPath, relPath: rootPath }] : collectFilePaths(rootPath, filePattern, maxResults);
+    const files = paths.filter((f) => {
+      try {
+        return !isCredentialVault(f.fullPath);
+      } catch {
+        return false;
       }
-    }
+    });
+    const results = await searchInWorker(files, pattern, ignoreCase, contextLines, maxResults);
     if (results.length === 0) {
       return `No matches found for pattern: ${pattern}
 Searched in: ${rootPath}${filePattern ? `
@@ -9777,8 +9813,23 @@ File filter: ${filePattern}` : ""}`;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "dist-cjs", "release", ".next", "__pycache__", ".cache", "coverage", ".nyc_output"]);
 var BINARY_EXTS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".ico", ".woff", ".woff2", ".ttf", ".eot", ".otf", ".mp3", ".mp4", ".wav", ".zip", ".tar", ".gz", ".rar", ".7z", ".exe", ".dll", ".so", ".dylib", ".pdf", ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx"]);
 function matchesFilePattern(filename, pattern) {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`, "i").test(filename);
+  filename = filename.toLowerCase();
+  pattern = pattern.toLowerCase();
+  let i = 0, j = 0, star = -1, restart = 0;
+  while (i < filename.length) {
+    if (pattern[j] === filename[i]) {
+      i++;
+      j++;
+    } else if (pattern[j] === "*") {
+      star = j++;
+      restart = i;
+    } else if (star >= 0) {
+      j = star + 1;
+      i = ++restart;
+    } else return false;
+  }
+  while (pattern[j] === "*") j++;
+  return j === pattern.length;
 }
 function isBinary(filename) {
   const ext = filename.slice(filename.lastIndexOf(".")).toLowerCase();
@@ -9786,8 +9837,9 @@ function isBinary(filename) {
 }
 function collectFilePaths(rootPath, filePattern, maxFiles) {
   const paths = [];
-  function walk(dirPath) {
-    if (paths.length >= maxFiles) return;
+  let visited = 0;
+  function walk(dirPath, depth = 0) {
+    if (paths.length >= maxFiles || depth > 20 || visited >= 2e4) return;
     let entries;
     try {
       entries = readdirSync5(dirPath, { withFileTypes: true });
@@ -9795,14 +9847,14 @@ function collectFilePaths(rootPath, filePattern, maxFiles) {
       return;
     }
     for (const entry of entries) {
-      if (paths.length >= maxFiles) return;
+      if (paths.length >= maxFiles || ++visited > 2e4) return;
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name) || entry.name.startsWith(".")) continue;
-        walk(join9(dirPath, entry.name));
+        walk(join8(dirPath, entry.name), depth + 1);
       } else if (entry.isFile()) {
         if (isBinary(entry.name)) continue;
         if (filePattern && !matchesFilePattern(entry.name, filePattern)) continue;
-        const fullPath = join9(dirPath, entry.name);
+        const fullPath = join8(dirPath, entry.name);
         try {
           if (statSync6(fullPath).size > 1e6) continue;
         } catch {
@@ -9815,81 +9867,10 @@ function collectFilePaths(rootPath, filePattern, maxFiles) {
   walk(rootPath);
   return paths;
 }
-async function searchInFileAsync(fullPath, displayPath2, regex, contextLines, maxResults) {
-  let content;
-  try {
-    content = await readFile(fullPath, "utf-8");
-  } catch {
-    return [];
-  }
-  const results = [];
-  const lines = content.split("\n");
-  regex.lastIndex = 0;
-  for (let i = 0; i < lines.length && results.length < maxResults; i++) {
-    regex.lastIndex = 0;
-    if (regex.test(lines[i])) {
-      const match = {
-        file: displayPath2.replace(/\\/g, "/"),
-        lineNumber: i + 1,
-        lineText: lines[i]
-      };
-      if (contextLines > 0) {
-        match.contextBefore = [];
-        for (let j = Math.max(0, i - contextLines); j < i; j++) {
-          match.contextBefore.push([j + 1, lines[j]]);
-        }
-        match.contextAfter = [];
-        for (let j = i + 1; j <= Math.min(lines.length - 1, i + contextLines); j++) {
-          match.contextAfter.push([j + 1, lines[j]]);
-        }
-      }
-      results.push(match);
-    }
-  }
-  return results;
-}
-function searchInFile(fullPath, displayPath2, regex, contextLines, maxResults, results) {
-  try {
-    const stat = statSync6(fullPath);
-    if (stat.size > 1e6) return;
-  } catch {
-    return;
-  }
-  let content;
-  try {
-    content = readFileSync12(fullPath, "utf-8");
-  } catch {
-    return;
-  }
-  const lines = content.split("\n");
-  regex.lastIndex = 0;
-  for (let i = 0; i < lines.length; i++) {
-    if (results.length >= maxResults) return;
-    regex.lastIndex = 0;
-    if (regex.test(lines[i])) {
-      const result = {
-        file: displayPath2,
-        lineNumber: i + 1,
-        lineText: lines[i].trimEnd()
-      };
-      if (contextLines > 0) {
-        result.contextBefore = [];
-        result.contextAfter = [];
-        for (let c = Math.max(0, i - contextLines); c < i; c++) {
-          result.contextBefore.push([c + 1, lines[c].trimEnd()]);
-        }
-        for (let c = i + 1; c <= Math.min(lines.length - 1, i + contextLines); c++) {
-          result.contextAfter.push([c + 1, lines[c].trimEnd()]);
-        }
-      }
-      results.push(result);
-    }
-  }
-}
 
 // src/tools/builtin/glob-files.ts
-import { readdirSync as readdirSync6, statSync as statSync7, existsSync as existsSync15 } from "fs";
-import { join as join10, relative as relative2, basename as basename5 } from "path";
+import { readdirSync as readdirSync6, statSync as statSync7, existsSync as existsSync14 } from "fs";
+import { join as join9, relative as relative2, basename as basename5 } from "path";
 var globFilesTool = {
   definition: {
     name: "glob_files",
@@ -9922,7 +9903,7 @@ Results sorted by most recent modification time. Automatically skips node_module
     const rootPath = String(args["path"] ?? process.cwd());
     const maxResults = Math.max(1, Number(args["max_results"] ?? 100));
     if (!pattern) throw new ToolError("glob_files", "pattern is required");
-    if (!existsSync15(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
+    if (!existsSync14(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
     const regex = globToRegex(pattern);
     const matches2 = [];
     collectMatchingFiles(rootPath, rootPath, regex, matches2, maxResults);
@@ -9999,7 +9980,7 @@ function collectMatchingFiles(dirPath, rootPath, regex, results, maxResults) {
   }
   for (const entry of entries) {
     if (results.length >= maxResults) break;
-    const fullPath = join10(dirPath, entry.name);
+    const fullPath = join9(dirPath, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRS2.has(entry.name) || entry.name.startsWith(".")) continue;
       collectMatchingFiles(fullPath, rootPath, regex, results, maxResults);
@@ -10018,9 +9999,9 @@ function collectMatchingFiles(dirPath, rootPath, regex, results, maxResults) {
 }
 
 // src/tools/builtin/run-interactive.ts
-import { spawn as spawn4 } from "child_process";
-import { platform as platform4 } from "os";
-var IS_WINDOWS4 = platform4() === "win32";
+import { spawn as spawn3 } from "child_process";
+import { platform as platform3 } from "os";
+var IS_WINDOWS4 = platform3() === "win32";
 var runInteractiveTool = {
   definition: {
     name: "run_interactive",
@@ -10082,7 +10063,7 @@ var runInteractiveTool = {
     };
     const prefixWarnings = [argsTypeWarning, stdinTypeWarning].filter(Boolean).join("");
     return new Promise((resolve13) => {
-      const child = spawn4(executable, cmdArgs.map(String), {
+      const child = spawn3(executable, cmdArgs.map(String), {
         cwd: process.cwd(),
         env,
         stdio: ["pipe", "pipe", "pipe"]
@@ -10352,8 +10333,8 @@ var webFetchTool = {
       if (e.message.startsWith("Blocked:")) throw e;
       throw new NetworkError(`Invalid URL: "${url}"`);
     }
-    const controller2 = new AbortController();
-    const timeoutId = setTimeout(() => controller2.abort(), 2e4);
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 2e4);
     let rawHtml;
     let finalUrl;
     let contentType;
@@ -10374,7 +10355,7 @@ var webFetchTool = {
         }
         await resolveAndCheck(parsedHop.hostname);
         const r = await fetch(currentUrl, {
-          signal: controller2.signal,
+          signal: controller.signal,
           headers: FETCH_HEADERS,
           redirect: "manual",
           // 手动控制重定向
@@ -10737,8 +10718,8 @@ function parseGoogleResults(html, maxResults) {
   return results;
 }
 async function fetchHtml(url) {
-  const controller2 = new AbortController();
-  const timer = setTimeout(() => controller2.abort(), REQUEST_TIMEOUT_MS);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
   try {
     const res = await fetch(url, {
       method: "GET",
@@ -10747,7 +10728,7 @@ async function fetchHtml(url) {
         "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9",
         "Accept-Language": "en-US,en;q=0.9,zh-CN;q=0.8"
       },
-      signal: controller2.signal
+      signal: controller.signal
     });
     if (!res.ok) {
       throw new NetworkError(`HTTP ${res.status} ${res.statusText}`, res.status);
@@ -10841,10 +10822,8 @@ Any of these triggers means use save_last_response, NOT write_file:
 };
 
 // src/tools/builtin/save-memory.ts
-import { join as join11 } from "path";
-import { homedir as homedir5 } from "os";
 function getConfigDir() {
-  return join11(homedir5(), CONFIG_DIR_NAME);
+  return getExecutionConfigDir();
 }
 function parseSensitivity(value) {
   return value === "low" || value === "medium" || value === "high" ? value : void 0;
@@ -11108,15 +11087,15 @@ var googleSearchTool = {
     url.searchParams.set("cx", cx);
     url.searchParams.set("q", query);
     url.searchParams.set("num", String(numResults));
-    const controller2 = new AbortController();
-    const timeout = setTimeout(() => controller2.abort(), REQUEST_TIMEOUT_MS2);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS2);
     try {
       const response = await fetch(url.toString(), {
         method: "GET",
         headers: {
           "Accept": "application/json"
         },
-        signal: controller2.signal
+        signal: controller.signal
       });
       if (!response.ok) {
         const errorBody = await response.text().catch(() => "");
@@ -11200,13 +11179,13 @@ function isToolCapableProvider(provider) {
 }
 
 // src/agents/agent-config.ts
-import { existsSync as existsSync17, readdirSync as readdirSync8, readFileSync as readFileSync14 } from "fs";
-import { join as join13 } from "path";
-import { homedir as homedir6 } from "os";
+import { existsSync as existsSync16, readdirSync as readdirSync8, readFileSync as readFileSync11 } from "fs";
+import { join as join11 } from "path";
+import { homedir as homedir5 } from "os";
 
 // src/plugins/plugin-manager.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readdirSync as readdirSync7, readFileSync as readFileSync13, realpathSync as realpathSync2, cpSync, rmSync, statSync as statSync8 } from "fs";
-import { basename as basename6, dirname as dirname7, join as join12, relative as relative3, resolve as resolve6, sep as sep3 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync8, readdirSync as readdirSync7, readFileSync as readFileSync10, realpathSync as realpathSync2, cpSync, rmSync, statSync as statSync8 } from "fs";
+import { basename as basename6, dirname as dirname7, join as join10, relative as relative3, resolve as resolve6, sep as sep3 } from "path";
 import { createHash as createHash2 } from "crypto";
 import { z as z2 } from "zod";
 var MANIFEST_RELATIVE = ".aicli-plugin/plugin.json";
@@ -11266,19 +11245,19 @@ var PluginManifestSchema = z2.object({
   permissionHints: z2.array(z2.string()).default([])
 }).strict();
 function pluginRoot(configDir) {
-  return join12(configDir, PLUGINS_DIR_NAME);
+  return join10(configDir, PLUGINS_DIR_NAME);
 }
 function pluginManifestPath(pluginDir) {
-  return join12(pluginDir, MANIFEST_RELATIVE);
+  return join10(pluginDir, MANIFEST_RELATIVE);
 }
 function statePath(configDir) {
-  return join12(pluginRoot(configDir), STATE_FILE);
+  return join10(pluginRoot(configDir), STATE_FILE);
 }
 function loadState(configDir) {
   const file = statePath(configDir);
-  if (!existsSync16(file)) return { version: 2, plugins: [] };
+  if (!existsSync15(file)) return { version: 2, plugins: [] };
   try {
-    const parsed = JSON.parse(readFileSync13(file, "utf-8"));
+    const parsed = JSON.parse(readFileSync10(file, "utf-8"));
     const rawPlugins = Array.isArray(parsed.plugins) ? parsed.plugins : [];
     return { version: 2, plugins: rawPlugins.map((p) => migrateEntry(p)) };
   } catch {
@@ -11336,7 +11315,7 @@ function extractCommandPaths(command, pluginDir) {
     try {
       const abs = resolve6(resolvedDir, ref);
       if (!abs.startsWith(resolvedDir + sep3)) continue;
-      if (existsSync16(abs)) {
+      if (existsSync15(abs)) {
         const real = realpathSync2(abs);
         if (!real.startsWith(resolvedDir + sep3)) continue;
         valid.push(relative3(resolvedDir, real));
@@ -11368,8 +11347,8 @@ function hashPluginContent(pluginDir, manifest) {
   }
   const sorted = [...assetRels].sort();
   const hasher = createHash2("sha256");
-  const manifestPath = join12(resolvedDir, MANIFEST_RELATIVE);
-  hasher.update(normalizeForHash(readFileSync13(manifestPath)));
+  const manifestPath = join10(resolvedDir, MANIFEST_RELATIVE);
+  hasher.update(normalizeForHash(readFileSync10(manifestPath)));
   for (const rel of sorted) {
     const abs = resolve6(resolvedDir, rel);
     if (!abs.startsWith(resolvedDir + sep3)) {
@@ -11389,7 +11368,7 @@ function hashPluginContent(pluginDir, manifest) {
     if (!realPath.startsWith(resolvedDir + sep3)) {
       throw new Error(`plugin asset symlink escapes plugin dir: ${rel} \u2192 ${realPath}`);
     }
-    hasher.update(normalizeForHash(readFileSync13(abs)));
+    hasher.update(normalizeForHash(readFileSync10(abs)));
   }
   return hasher.digest("hex");
 }
@@ -11397,22 +11376,22 @@ function effectiveHash(entry) {
   return entry.contentHash ?? entry.hash ?? "";
 }
 function readPluginManifest(manifestPath) {
-  return PluginManifestSchema.parse(JSON.parse(readFileSync13(manifestPath, "utf-8")));
+  return PluginManifestSchema.parse(JSON.parse(readFileSync10(manifestPath, "utf-8")));
 }
 function findPluginSourceDir(inputPath) {
   const abs = resolve6(inputPath);
   const direct = statSync8(abs).isDirectory() ? abs : dirname7(abs);
-  if (existsSync16(pluginManifestPath(direct))) return direct;
-  const nested = join12(direct, ".aicli-plugin");
-  if (existsSync16(join12(nested, "plugin.json"))) return direct;
+  if (existsSync15(pluginManifestPath(direct))) return direct;
+  const nested = join10(direct, ".aicli-plugin");
+  if (existsSync15(join10(nested, "plugin.json"))) return direct;
   throw new Error(`plugin manifest not found: ${MANIFEST_RELATIVE}`);
 }
 function installPlugin(configDir, inputPath) {
   const sourceDir = findPluginSourceDir(inputPath);
   const manifest = readPluginManifest(pluginManifestPath(sourceDir));
-  const targetDir = join12(pluginRoot(configDir), manifest.name);
+  const targetDir = join10(pluginRoot(configDir), manifest.name);
   mkdirSync8(pluginRoot(configDir), { recursive: true });
-  if (existsSync16(targetDir)) rmSync(targetDir, { recursive: true, force: true });
+  if (existsSync15(targetDir)) rmSync(targetDir, { recursive: true, force: true });
   cpSync(sourceDir, targetDir, { recursive: true });
   const manifestPath = pluginManifestPath(targetDir);
   const contentHash = hashPluginContent(targetDir, manifest);
@@ -11470,18 +11449,18 @@ function getInstalledPlugin(configDir, name) {
 }
 function listInstalledPlugins(configDir) {
   const root = pluginRoot(configDir);
-  if (!existsSync16(root)) return [];
+  if (!existsSync15(root)) return [];
   const state2 = loadState(configDir);
   const out = [];
   for (const entry of readdirSync7(root)) {
-    const dir = join12(root, entry);
+    const dir = join10(root, entry);
     try {
       if (!statSync8(dir).isDirectory()) continue;
     } catch {
       continue;
     }
     const manifestPath = pluginManifestPath(dir);
-    if (!existsSync16(manifestPath)) continue;
+    if (!existsSync15(manifestPath)) continue;
     try {
       const manifest = readPluginManifest(manifestPath);
       const contentHash = hashPluginContent(dir, manifest);
@@ -11521,7 +11500,7 @@ function uniqueDirs(plugin, rels) {
   for (const rel of rels) {
     const abs = resolve6(plugin.dir, rel);
     if (!abs.startsWith(resolve6(plugin.dir))) continue;
-    if (existsSync16(abs)) dirs.add(statSync8(abs).isDirectory() ? abs : dirname7(abs));
+    if (existsSync15(abs)) dirs.add(statSync8(abs).isDirectory() ? abs : dirname7(abs));
   }
   return [...dirs];
 }
@@ -11661,13 +11640,13 @@ function normalizeName(name) {
 function isStringArray(value) {
   return Array.isArray(value) && value.every((item) => typeof item === "string");
 }
-function parseAgentConfig(raw, source, path3) {
+function parseAgentConfig(raw, source2, path3) {
   if (!raw || typeof raw !== "object") return null;
   const obj = raw;
   if (typeof obj.name !== "string" || obj.name.trim() === "") return null;
   const cfg = {
     name: obj.name.trim(),
-    source,
+    source: source2,
     path: path3
   };
   if (typeof obj.description === "string") cfg.description = obj.description;
@@ -11683,15 +11662,15 @@ function parseAgentConfig(raw, source, path3) {
   if (typeof obj.contextPolicy === "string") cfg.contextPolicy = obj.contextPolicy;
   return cfg;
 }
-function loadAgentDir(dir, source) {
-  if (!existsSync17(dir)) return [];
+function loadAgentDir(dir, source2) {
+  if (!existsSync16(dir)) return [];
   const out = [];
   for (const file of readdirSync8(dir)) {
     if (!file.endsWith(".json")) continue;
-    const path3 = join13(dir, file);
+    const path3 = join11(dir, file);
     try {
-      const parsed = JSON.parse(readFileSync14(path3, "utf-8"));
-      const cfg = parseAgentConfig(parsed, source, path3);
+      const parsed = JSON.parse(readFileSync11(path3, "utf-8"));
+      const cfg = parseAgentConfig(parsed, source2, path3);
       if (cfg) out.push(cfg);
     } catch {
     }
@@ -11700,8 +11679,8 @@ function loadAgentDir(dir, source) {
 }
 function getAgentDirs(configDir, cwd = process.cwd()) {
   return {
-    user: join13(configDir ?? join13(homedir6(), CONFIG_DIR_NAME), "agents"),
-    project: join13(cwd, CONFIG_DIR_NAME, "agents")
+    user: join11(configDir ?? join11(homedir5(), CONFIG_DIR_NAME), "agents"),
+    project: join11(cwd, CONFIG_DIR_NAME, "agents")
   };
 }
 function listAgentConfigs(configDir, cwd = process.cwd()) {
@@ -12204,9 +12183,8 @@ var spawnAgentTool = {
 };
 
 // src/tools/builtin/task-manager.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { randomUUID } from "crypto";
-import { platform as platform5 } from "os";
 var MAX_OUTPUT_CHARS = 1e4;
 var MAX_OUTPUT_BYTES = 64 * 1024;
 var MAX_TASKS = 20;
@@ -12225,14 +12203,16 @@ function decodeField(chunks) {
 }
 function appendOutput(task, field, chunk) {
   const chunks = field === "stdout" ? task._stdoutChunks : task._stderrChunks;
-  chunks.push(chunk);
+  chunks.push(chunk.length > MAX_OUTPUT_BYTES ? chunk.subarray(-MAX_OUTPUT_BYTES) : chunk);
   capChunks(chunks);
   task[field] = decodeField(chunks);
 }
 function createTask(command, description) {
+  if ([...tasks.values()].filter((t) => t._active && t.owner === getExecutionConfigDir()).length >= 10) throw new Error("Background task limit reached (10 running per user).");
+  if ([...tasks.values()].filter((t) => t._active).length >= MAX_TASKS) throw new Error("Background task limit reached (20 running). Stop a task before creating another.");
   if (tasks.size >= MAX_TASKS) {
     for (const [id2, t] of tasks) {
-      if (t.status !== "running") {
+      if (!t._active) {
         tasks.delete(id2);
         break;
       }
@@ -12240,16 +12220,19 @@ function createTask(command, description) {
   }
   const id = randomUUID().slice(0, 8);
   const { shell, args } = shellInvocation(command);
-  const proc = spawn5(shell, args, {
+  const proc = spawn4(shell, args, {
     stdio: ["ignore", "pipe", "pipe"],
-    detached: false,
+    detached: process.platform !== "win32",
+    windowsHide: true,
     env: { ...process.env, PYTHONUTF8: "1", PYTHONIOENCODING: "utf-8" }
   });
   const task = {
     id,
+    owner: getExecutionConfigDir(),
     command,
     description,
     process: proc,
+    _active: true,
     startTime: Date.now(),
     endTime: null,
     status: "running",
@@ -12262,11 +12245,13 @@ function createTask(command, description) {
   proc.stdout?.on("data", (chunk) => appendOutput(task, "stdout", chunk));
   proc.stderr?.on("data", (chunk) => appendOutput(task, "stderr", chunk));
   proc.on("close", (code) => {
+    task._active = false;
     task.endTime = Date.now();
     task.exitCode = code;
-    task.status = code === 0 ? "completed" : "failed";
+    if (task.status !== "stopped") task.status = code === 0 ? "completed" : "failed";
   });
   proc.on("error", (err) => {
+    task._active = false;
     task.endTime = Date.now();
     task.status = "failed";
     task.stderr += `
@@ -12276,43 +12261,20 @@ Process error: ${err.message}`;
   return task;
 }
 function listTasks() {
-  return [...tasks.values()].map(
-    ({ process: _p, _stdoutChunks: _o, _stderrChunks: _e, ...rest }) => rest
+  return [...tasks.values()].filter((t) => t.owner === getExecutionConfigDir()).map(
+    ({ process: _p, _stdoutChunks: _o, _stderrChunks: _e, _active: _a, ...rest }) => rest
   );
 }
 function getTaskOutput(id) {
   const task = tasks.get(id);
-  if (!task) return null;
+  if (!task || task.owner !== getExecutionConfigDir()) return null;
   return { stdout: task.stdout, stderr: task.stderr, status: task.status };
 }
 function stopTask(id) {
   const task = tasks.get(id);
-  if (!task || task.status !== "running") return false;
+  if (!task || task.owner !== getExecutionConfigDir() || task.status !== "running") return false;
   try {
-    const proc = task.process;
-    if (platform5() === "win32" && proc.pid) {
-      try {
-        spawn5("taskkill", ["/PID", String(proc.pid), "/T", "/F"], {
-          windowsHide: true,
-          stdio: "ignore"
-        });
-      } catch {
-      }
-      try {
-        proc.kill();
-      } catch {
-      }
-    } else {
-      proc.kill("SIGTERM");
-      setTimeout(() => {
-        if (proc.exitCode === null && proc.signalCode === null) {
-          try {
-            proc.kill("SIGKILL");
-          } catch {
-          }
-        }
-      }, 3e3).unref();
-    }
+    killProcessTree(task.process, true);
     task.status = "stopped";
     task.endTime = Date.now();
     return true;
@@ -12420,14 +12382,14 @@ var taskStopTool = {
 
 // src/tools/builtin/git-tools.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync18 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync17 } from "fs";
+import { join as join12 } from "path";
 function assertGitRepo(cwd) {
   let dir = cwd;
   const root = dir.split(/[\\/]/)[0] + (dir.includes("\\") ? "\\" : "/");
   while (dir && dir !== root) {
-    if (existsSync18(join14(dir, ".git"))) return;
-    const parent = join14(dir, "..");
+    if (existsSync17(join12(dir, ".git"))) return;
+    const parent = join12(dir, "..");
     if (parent === dir) break;
     dir = parent;
   }
@@ -12692,7 +12654,7 @@ ${commitOutput.trim()}`;
 };
 
 // src/tools/builtin/notebook-edit.ts
-import { readFileSync as readFileSync15, existsSync as existsSync19 } from "fs";
+import { readFileSync as readFileSync12, existsSync as existsSync18 } from "fs";
 import { writeFile } from "fs/promises";
 import { resolve as resolve7, extname as extname2 } from "path";
 var notebookEditTool = {
@@ -12747,10 +12709,10 @@ var notebookEditTool = {
     if (extname2(absPath).toLowerCase() !== ".ipynb") {
       throw new ToolError("notebook_edit", "path must point to a .ipynb file");
     }
-    if (!existsSync19(absPath)) {
+    if (!existsSync18(absPath)) {
       throw new ToolError("notebook_edit", `Notebook not found: ${filePath}`);
     }
-    const raw = readFileSync15(absPath, "utf-8");
+    const raw = readFileSync12(absPath, "utf-8");
     const nb = parseNotebook(raw);
     const cellIdx0 = cellIndexRaw - 1;
     undoStack.push(absPath, `notebook_edit (${action}): ${filePath}`);
@@ -13076,8 +13038,6 @@ ${lines.join("\n")}`;
 };
 
 // src/tools/builtin/recall-memory.ts
-import { join as join15 } from "path";
-import { homedir as homedir7 } from "os";
 function formatHit(h, i) {
   const ts = h.chunk.timestamp.slice(0, 16).replace("T", " ");
   const title = h.chunk.sessionTitle ? ` \xB7 ${h.chunk.sessionTitle}` : "";
@@ -13127,7 +13087,7 @@ var recallMemoryTool = {
     const excludeCurrent = Boolean(args["excludeCurrentSession"]);
     const currentId = args["currentSessionId"] ? String(args["currentSessionId"]) : void 0;
     const minScore = args["minScore"] !== void 0 ? Number(args["minScore"]) : 0.25;
-    const configDir = join15(homedir7(), CONFIG_DIR_NAME);
+    const configDir = getExecutionConfigDir();
     let persistentSection = "";
     try {
       const persistentHits = searchPersistentMemories(configDir, query, process.cwd(), 3);
@@ -13181,8 +13141,8 @@ function estimateToolDefinitionTokens(def) {
 
 // src/tools/registry.ts
 import { pathToFileURL } from "url";
-import { existsSync as existsSync20, mkdirSync as mkdirSync9, readdirSync as readdirSync9 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync9, readdirSync as readdirSync9 } from "fs";
+import { join as join13 } from "path";
 var ToolRegistry = class {
   tools = /* @__PURE__ */ new Map();
   pluginToolNames = /* @__PURE__ */ new Set();
@@ -13343,7 +13303,7 @@ var ToolRegistry = class {
    * Returns the number of successfully loaded plugins.
    */
   async loadPlugins(pluginsDir, allowPlugins = false) {
-    if (!existsSync20(pluginsDir)) {
+    if (!existsSync19(pluginsDir)) {
       try {
         mkdirSync9(pluginsDir, { recursive: true });
       } catch {
@@ -13369,12 +13329,12 @@ var ToolRegistry = class {
     process.stderr.write(
       `
 [plugins] \u26A0 Loading ${files.length} plugin(s) with FULL system privileges:
-` + files.map((f) => `  + ${join16(pluginsDir, f)}`).join("\n") + "\n\n"
+` + files.map((f) => `  + ${join13(pluginsDir, f)}`).join("\n") + "\n\n"
     );
     let loaded = 0;
     for (const file of files) {
       try {
-        const fileUrl = pathToFileURL(join16(pluginsDir, file)).href;
+        const fileUrl = pathToFileURL(join13(pluginsDir, file)).href;
         const mod = await import(fileUrl);
         const tool = mod.tool ?? mod.default?.tool ?? mod.default;
         if (!tool || typeof tool.execute !== "function" || !tool.definition?.name) {
@@ -13402,7 +13362,7 @@ var ToolRegistry = class {
 };
 
 // src/mcp/client.ts
-import { spawn as spawn6 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 var McpClient = class {
   serverId;
   config;
@@ -13440,7 +13400,7 @@ var McpClient = class {
   async connect() {
     const timeout = this.config.timeout ?? MCP_CONNECT_TIMEOUT;
     try {
-      this.process = spawn6(this.config.command, this.config.args ?? [], {
+      this.process = spawn5(this.config.command, this.config.args ?? [], {
         stdio: ["pipe", "pipe", "pipe"],
         env: { ...process.env, ...this.config.env },
         // Windows 上 npx 等是 .cmd 脚本，需要 shell 模式
@@ -13919,11 +13879,11 @@ var McpManager = class {
 };
 
 // src/skills/manager.ts
-import { existsSync as existsSync21, readdirSync as readdirSync10, mkdirSync as mkdirSync10, statSync as statSync9 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync20, readdirSync as readdirSync10, mkdirSync as mkdirSync10, statSync as statSync9 } from "fs";
+import { join as join14 } from "path";
 
 // src/skills/types.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { basename as basename7 } from "path";
 function parseSimpleYaml(yaml) {
   const result = {};
@@ -13945,7 +13905,7 @@ function parseYamlArray(value) {
 function parseSkillFile(filePath) {
   let raw;
   try {
-    raw = readFileSync16(filePath, "utf-8");
+    raw = readFileSync13(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -13993,7 +13953,7 @@ var SkillManager = class {
     return this.skills.size;
   }
   loadSkillDir(dir, createIfMissing) {
-    if (!existsSync21(dir)) {
+    if (!existsSync20(dir)) {
       if (createIfMissing) {
         try {
           mkdirSync10(dir, { recursive: true });
@@ -14010,14 +13970,14 @@ var SkillManager = class {
     }
     for (const entry of entries) {
       let filePath;
-      const fullPath = join17(dir, entry);
+      const fullPath = join14(dir, entry);
       if (entry.endsWith(".md")) {
         filePath = fullPath;
       } else {
         try {
           if (statSync9(fullPath).isDirectory()) {
-            const skillMd = join17(fullPath, "SKILL.md");
-            if (existsSync21(skillMd)) filePath = skillMd;
+            const skillMd = join14(fullPath, "SKILL.md");
+            if (existsSync20(skillMd)) filePath = skillMd;
             else continue;
           } else {
             continue;
@@ -14130,7 +14090,7 @@ function sendSocketMessage(ws, message) {
 }
 
 // src/web/tool-executor-web.ts
-import { existsSync as existsSync22, readFileSync as readFileSync17 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync14 } from "fs";
 var ToolExecutorWeb = class _ToolExecutorWeb {
   constructor(registry, ws) {
     this.registry = registry;
@@ -14277,9 +14237,9 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
   getDiffPreview(call) {
     if (call.name === "write_file") {
       const { path: filePath, content: chunk, append } = resolveWriteFileArgs(call.arguments);
-      if (filePath && existsSync22(filePath)) {
+      if (filePath && existsSync21(filePath)) {
         try {
-          const old = readFileSync17(filePath, "utf-8");
+          const old = readFileSync14(filePath, "utf-8");
           return renderDiff(old, append ? old + chunk : chunk, { filePath });
         } catch {
         }
@@ -14515,16 +14475,16 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
 };
 
 // src/repl/dev-state.ts
-import { existsSync as existsSync23, readFileSync as readFileSync18, unlinkSync as unlinkSync5, mkdirSync as mkdirSync11 } from "fs";
-import { join as join18 } from "path";
-import { homedir as homedir8 } from "os";
+import { existsSync as existsSync22, readFileSync as readFileSync15, unlinkSync as unlinkSync5, mkdirSync as mkdirSync11 } from "fs";
+import { join as join15 } from "path";
+import { homedir as homedir6 } from "os";
 function getDevStatePath() {
-  return join18(homedir8(), CONFIG_DIR_NAME, DEV_STATE_FILE_NAME);
+  return join15(homedir6(), CONFIG_DIR_NAME, DEV_STATE_FILE_NAME);
 }
 function loadDevState() {
   const path3 = getDevStatePath();
-  if (!existsSync23(path3)) return null;
-  const content = readFileSync18(path3, "utf-8").trim();
+  if (!existsSync22(path3)) return null;
+  const content = readFileSync15(path3, "utf-8").trim();
   return content || null;
 }
 
@@ -14894,8 +14854,8 @@ var checkpointDeletedMessage = (name) => `\u2713 Deleted checkpoint "${name}"`;
 var checkpointNotFoundMessage = (name) => `Checkpoint "${name}" not found.`;
 
 // src/core/context-files.ts
-import { existsSync as existsSync24, readFileSync as readFileSync19 } from "fs";
-import { join as join19, relative as relative4, resolve as resolve8 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync16 } from "fs";
+import { join as join16, relative as relative4, resolve as resolve8 } from "path";
 function uniqueNonEmpty(values) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -14925,7 +14885,7 @@ function readContextFile(level, filePath, cwd, maxBytes) {
   const name = filePath.split(/[\\/]/).pop() ?? filePath;
   const shown = displayPath(filePath, cwd);
   try {
-    const raw = readFileSync19(filePath);
+    const raw = readFileSync16(filePath);
     const byteCount = raw.byteLength;
     if (byteCount === 0) {
       return {
@@ -14972,8 +14932,8 @@ function readContextFile(level, filePath, cwd, maxBytes) {
 function findFirstContextFile(level, dir, cwd, candidates, maxBytes) {
   const skipped = [];
   for (const candidate of candidates) {
-    const filePath = join19(dir, candidate);
-    if (!existsSync24(filePath)) continue;
+    const filePath = join16(dir, candidate);
+    if (!existsSync23(filePath)) continue;
     const result = readContextFile(level, filePath, cwd, maxBytes);
     if (result.skipped) skipped.push(result.skipped);
     if (result.layer) return { layer: result.layer, skipped };
@@ -15000,7 +14960,7 @@ function loadContextFiles(options) {
       });
       return { layers: [], mergedContent: "", skipped, totalChars: 0, totalBytes: 0, maxBytes, candidates };
     }
-    if (!existsSync24(filePath)) {
+    if (!existsSync23(filePath)) {
       skipped.push({
         level: "single",
         filePath,
@@ -15113,8 +15073,8 @@ import { mkdirSync as mkdirSync15, createWriteStream as createWriteStream2 } fro
 import { dirname as dirname10 } from "path";
 
 // src/repl/commands/project-init.ts
-import { existsSync as existsSync25, readFileSync as readFileSync20, readdirSync as readdirSync11, statSync as statSync11 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync17, readdirSync as readdirSync11, statSync as statSync11 } from "fs";
+import { join as join17 } from "path";
 var SCAN_SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -15158,11 +15118,11 @@ function scanDirTree(dir, maxDepth = 2, maxEntries = 80) {
     const sorted = filtered.sort((a, b) => {
       let aIsDir = false, bIsDir = false;
       try {
-        aIsDir = statSync11(join20(d, a)).isDirectory();
+        aIsDir = statSync11(join17(d, a)).isDirectory();
       } catch {
       }
       try {
-        bIsDir = statSync11(join20(d, b)).isDirectory();
+        bIsDir = statSync11(join17(d, b)).isDirectory();
       } catch {
       }
       if (aIsDir !== bIsDir) return aIsDir ? -1 : 1;
@@ -15170,7 +15130,7 @@ function scanDirTree(dir, maxDepth = 2, maxEntries = 80) {
     });
     for (let i = 0; i < sorted.length && count < maxEntries; i++) {
       const name = sorted[i];
-      const fullPath = join20(d, name);
+      const fullPath = join17(d, name);
       const isLast = i === sorted.length - 1;
       const connector = isLast ? "+-- " : "|-- ";
       let isDir;
@@ -15197,7 +15157,7 @@ function scanProject(cwd) {
     configFiles: [],
     directoryStructure: ""
   };
-  const check = (file) => existsSync25(join20(cwd, file));
+  const check = (file) => existsSync24(join17(cwd, file));
   const configCandidates = [
     "package.json",
     "tsconfig.json",
@@ -15224,7 +15184,7 @@ function scanProject(cwd) {
     info.type = "node";
     info.language = check("tsconfig.json") ? "TypeScript" : "JavaScript";
     try {
-      const pkg = JSON.parse(readFileSync20(join20(cwd, "package.json"), "utf-8"));
+      const pkg = JSON.parse(readFileSync17(join17(cwd, "package.json"), "utf-8"));
       const scripts = pkg.scripts ?? {};
       info.buildCommand = scripts.build ? "npm run build" : void 0;
       info.testCommand = scripts.test ? "npm test" : void 0;
@@ -15992,7 +15952,7 @@ function resolveRoleProviders(roles, lookup, defaultProvider, defaultModel, avai
 }
 
 // src/hub/persist.ts
-import { join as join21 } from "path";
+import { join as join18 } from "path";
 function discussionToMessages(state2) {
   const out = [];
   const t0 = state2.messages[0]?.timestamp ?? /* @__PURE__ */ new Date();
@@ -16030,7 +15990,7 @@ async function persistDiscussion(state2, config, defaultProvider, defaultModel)
   session.title = `[Hub] ${state2.topic.slice(0, 48)}`.replace(/\n/g, " ");
   session.titleAiGenerated = true;
   await sm.save();
-  return { id: session.id, path: join21(config.getHistoryDir(), `${session.id}.json`) };
+  return { id: session.id, path: join18(config.getHistoryDir(), `${session.id}.json`) };
 }
 
 // src/core/think-command.ts
@@ -16151,10 +16111,10 @@ var PLAN_MODE_TOOL_HINT = [
   "read_file \xB7 list_dir \xB7 grep_files \xB7 glob_files",
   "web_fetch \xB7 google_search \xB7 ask_user \xB7 write_todos"
 ];
-function applyPlanCommand(sub, active) {
-  const key = (sub ?? "enter").toLowerCase() === "toggle" ? active ? "exit" : "enter" : (sub ?? "enter").toLowerCase();
+function applyPlanCommand(sub, active2) {
+  const key = (sub ?? "enter").toLowerCase() === "toggle" ? active2 ? "exit" : "enter" : (sub ?? "enter").toLowerCase();
   if (key === "enter") {
-    if (active) {
+    if (active2) {
       return {
         planMode: true,
         changed: false,
@@ -16177,7 +16137,7 @@ function applyPlanCommand(sub, active) {
     };
   }
   if (key === "execute") {
-    if (!active) {
+    if (!active2) {
       return { planMode: false, changed: false, status: "not-active", summary: "Not in Plan Mode. Enter first with /plan", details: [] };
     }
     return {
@@ -16189,22 +16149,22 @@ function applyPlanCommand(sub, active) {
     };
   }
   if (key === "exit" || key === "cancel") {
-    if (!active) {
+    if (!active2) {
       return { planMode: false, changed: false, status: "not-active", summary: "Not in Plan Mode.", details: [] };
     }
     return { planMode: false, changed: true, status: "cancelled", summary: "Plan Mode cancelled. Returning to normal mode.", details: [] };
   }
   if (key === "status" || key === "show") {
     return {
-      planMode: active,
+      planMode: active2,
       changed: false,
       status: "status",
-      summary: `Plan Mode: ${active ? "ACTIVE \u{1F4CB}" : "inactive"}`,
-      details: active ? ["Tools restricted to read-only set.", "Use /plan execute to start executing, or /plan exit to cancel."] : []
+      summary: `Plan Mode: ${active2 ? "ACTIVE \u{1F4CB}" : "inactive"}`,
+      details: active2 ? ["Tools restricted to read-only set.", "Use /plan execute to start executing, or /plan exit to cancel."] : []
     };
   }
   return {
-    planMode: active,
+    planMode: active2,
     changed: false,
     status: "unknown",
     summary: `Unknown /plan option "${sub}" \u2014 expected execute | exit | status`,
@@ -16476,8 +16436,8 @@ function buildSessionCostReport(input) {
   const cacheHitPct = usage.cacheReadTokens > 0 ? Math.round(usage.cacheReadTokens / (usage.cacheReadTokens + usage.inputTokens) * 100) : null;
   return { hasUsage: true, totalTokens, cacheHitPct, cost, costSource, savings };
 }
-function costSourceNote(source) {
-  switch (source) {
+function costSourceNote(source2) {
+  switch (source2) {
     case "accrued-partial":
       return "(partial \u2014 some turns had unknown pricing)";
     case "estimated":
@@ -16488,8 +16448,8 @@ function costSourceNote(source) {
 }
 
 // src/web/commands/_shared.ts
-import { existsSync as existsSync28, readFileSync as readFileSync22, writeFileSync as writeFileSync3, mkdirSync as mkdirSync13, readdirSync as readdirSync13, statSync as statSync14, createWriteStream } from "fs";
-import { join as join24, resolve as resolve9, dirname as dirname8 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync19, writeFileSync as writeFileSync3, mkdirSync as mkdirSync13, readdirSync as readdirSync13, statSync as statSync14, createWriteStream } from "fs";
+import { join as join21, resolve as resolve9, dirname as dirname8 } from "path";
 
 // src/cli/review-prompts.ts
 function buildReviewPrompt(diff, gitContextStr, detailed) {
@@ -16561,34 +16521,34 @@ function readGitDiff(options = {}) {
 }
 
 // src/diagnostics/doctor-report.ts
-import { existsSync as existsSync27, statSync as statSync13 } from "fs";
-import { join as join23 } from "path";
-import { arch as arch2, platform as platform7, release as release2 } from "os";
+import { existsSync as existsSync26, statSync as statSync13 } from "fs";
+import { join as join20 } from "path";
+import { arch as arch2, platform as platform5, release as release2 } from "os";
 
 // src/diagnostics/crash-log.ts
 import {
-  existsSync as existsSync26,
+  existsSync as existsSync25,
   mkdirSync as mkdirSync12,
   readdirSync as readdirSync12,
-  readFileSync as readFileSync21,
+  readFileSync as readFileSync18,
   statSync as statSync12,
   unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync2
 } from "fs";
-import { join as join22 } from "path";
-import { homedir as homedir9, platform as platform6, release, arch } from "os";
+import { join as join19 } from "path";
+import { homedir as homedir7, platform as platform4, release, arch } from "os";
 var LOGS_DIR_NAME = "logs";
 var CRASH_LOG_PREFIX = "crash-";
 function getLogsDir(configDir) {
-  const base = configDir ?? join22(homedir9(), CONFIG_DIR_NAME);
-  return join22(base, LOGS_DIR_NAME);
+  const base = configDir ?? join19(homedir7(), CONFIG_DIR_NAME);
+  return join19(base, LOGS_DIR_NAME);
 }
 function truncate(s, n) {
   return s.length <= n ? s : s.slice(0, n) + "\u2026";
 }
 function listRecentCrashes(limit = 10, configDir) {
   const dir = getLogsDir(configDir);
-  if (!existsSync26(dir)) return [];
+  if (!existsSync25(dir)) return [];
   const files = [];
   let names;
   try {
@@ -16598,10 +16558,10 @@ function listRecentCrashes(limit = 10, configDir) {
   }
   for (const name of names) {
     if (!name.startsWith(CRASH_LOG_PREFIX) || !name.endsWith(".log")) continue;
-    const full = join22(dir, name);
+    const full = join19(dir, name);
     try {
       const st = statSync12(full);
-      const head = readFileSync21(full, "utf-8").split("\n").slice(0, 20);
+      const head = readFileSync18(full, "utf-8").split("\n").slice(0, 20);
       const tsLine = head.find((l) => l.startsWith("timestamp:"));
       const kindLine = head.find((l) => l.startsWith("kind:"));
       const msgIdx = head.findIndex((l) => l.trim() === "## message");
@@ -16620,8 +16580,8 @@ function listRecentCrashes(limit = 10, configDir) {
   return files.slice(0, limit);
 }
 function getConfigDirUsage(configDir) {
-  const base = configDir ?? join22(homedir9(), CONFIG_DIR_NAME);
-  if (!existsSync26(base)) return { totalBytes: 0, entries: [] };
+  const base = configDir ?? join19(homedir7(), CONFIG_DIR_NAME);
+  if (!existsSync25(base)) return { totalBytes: 0, entries: [] };
   const entries = [];
   let total = 0;
   let names;
@@ -16631,7 +16591,7 @@ function getConfigDirUsage(configDir) {
     return { totalBytes: 0, entries: [] };
   }
   for (const name of names) {
-    const full = join22(base, name);
+    const full = join19(base, name);
     const bytes = dirSize(full);
     entries.push({ name, bytes });
     total += bytes;
@@ -16646,7 +16606,7 @@ function dirSize(path3) {
     if (!st.isDirectory()) return 0;
     let sum = 0;
     for (const name of readdirSync12(path3)) {
-      sum += dirSize(join22(path3, name));
+      sum += dirSize(join19(path3, name));
     }
     return sum;
   } catch {
@@ -16656,7 +16616,7 @@ function dirSize(path3) {
 
 // src/diagnostics/doctor-report.ts
 function checkFile(label, path3) {
-  const exists = existsSync27(path3);
+  const exists = existsSync26(path3);
   let sizeBytes = null;
   if (exists) {
     try {
@@ -16693,18 +16653,18 @@ function buildDoctorReport(options) {
     version: VERSION,
     npmCheck: options.npmCheck,
     node: process.version,
-    platform: `${platform7()} ${release2()} (${arch2()})`,
+    platform: `${platform5()} ${release2()} (${arch2()})`,
     cwd,
     projectRoot,
     configDir,
     providers: options.providers.listAll().map((p) => ({ id: p.id, displayName: p.displayName, configured: p.configured })),
     files: [
-      checkFile("config.json", join23(configDir, "config.json")),
-      checkFile("memory.md", join23(configDir, MEMORY_FILE_NAME)),
-      checkFile("memory.jsonl", join23(configDir, "memory.jsonl")),
-      checkFile("dev-state.md", join23(configDir, DEV_STATE_FILE_NAME)),
-      checkFile("hooks-trust.json", join23(configDir, "hooks-trust.json")),
-      checkFile("plugin-state.json", join23(configDir, "plugins", "plugin-state.json"))
+      checkFile("config.json", join20(configDir, "config.json")),
+      checkFile("memory.md", join20(configDir, MEMORY_FILE_NAME)),
+      checkFile("memory.jsonl", join20(configDir, "memory.jsonl")),
+      checkFile("dev-state.md", join20(configDir, DEV_STATE_FILE_NAME)),
+      checkFile("hooks-trust.json", join20(configDir, "hooks-trust.json")),
+      checkFile("plugin-state.json", join20(configDir, "plugins", "plugin-state.json"))
     ],
     context: {
       enabled: contextSetting !== false,
@@ -16739,7 +16699,7 @@ function buildDoctorReport(options) {
       disabled: hooks.filter((h) => h.disabled).length
     },
     plugins: {
-      root: join23(configDir, "plugins"),
+      root: join20(configDir, "plugins"),
       installed: plugins.length,
       active: activeAssets.plugins.length,
       invalid: plugins.filter((p) => !p.valid).length,
@@ -16754,7 +16714,7 @@ function buildDoctorReport(options) {
     mcp: {
       enabled: config.get("mcpEnabled"),
       configured: Object.keys(mcpServers).length,
-      projectConfigExists: existsSync27(join23(projectRoot, MCP_PROJECT_CONFIG_NAME)),
+      projectConfigExists: existsSync26(join20(projectRoot, MCP_PROJECT_CONFIG_NAME)),
       statuses: options.mcpStatuses ?? []
     },
     recentCrashes: listRecentCrashes(5, configDir),
@@ -17276,7 +17236,7 @@ Cache:  write=${cacheCreate} read=${cacheRead}` : "";
 Cost:   ${formatCost(cost)}` : "";
   let memoryLine = "";
   try {
-    const { countPendingMemories: countPendingMemories2 } = await import("./persistent-memory-XZISXRWT.js");
+    const { countPendingMemories: countPendingMemories2 } = await import("./persistent-memory-UNLCXUWH.js");
     const pending = countPendingMemories2(ctx.config.getConfigDir());
     if (pending > 0) memoryLine = `
 Memory: \u26A0 ${pending} pending approval \u2014 see the Memory panel or /memory`;
@@ -17899,7 +17859,7 @@ async function handleRewind(args, ctx) {
     ctx.send({ type: "error", message: intent.message });
     return;
   }
-  const { fileCheckpoints: fileCheckpoints2 } = await import("./file-checkpoint-CGH6OJVI.js");
+  const { fileCheckpoints: fileCheckpoints2 } = await import("./file-checkpoint-64A2AXHE.js");
   if (intent.kind === "list") {
     const rows = buildRewindList(session.messages, fileCheckpoints2.getMessageIndices());
     ctx.send({
@@ -17956,9 +17916,9 @@ function parseAgentCommand(args) {
 function formatAgentList(agents, preferred) {
   const lines = [`Agents (${agents.length})`, ""];
   for (const agent of agents) {
-    const active = agent.name === preferred ? " *" : "  ";
+    const active2 = agent.name === preferred ? " *" : "  ";
     const model = [agent.provider, agent.model].filter(Boolean).join("/") || "inherit";
-    lines.push(`${active} ${agent.name} [${agent.source ?? "builtin"}] \u2014 ${agent.description ?? ""}`);
+    lines.push(`${active2} ${agent.name} [${agent.source ?? "builtin"}] \u2014 ${agent.description ?? ""}`);
     lines.push(
       `    model: ${model} \xB7 permission: ${agent.permissionProfile ?? "workspace-write"} \xB7 maxRounds: ${agent.maxToolRounds ?? "inherit"}`
     );
@@ -18017,7 +17977,7 @@ async function handlePlugin(args, ctx) {
           lines.push("");
         }
         if (pluginTools.length > 0) {
-          const legacyDir = join24(configDir, PLUGINS_DIR_NAME);
+          const legacyDir = join21(configDir, PLUGINS_DIR_NAME);
           lines.push(`**Legacy JS tools** (${pluginTools.length}):`);
           lines.push(`Dir: ${legacyDir}`);
           for (const t of pluginTools) lines.push(`  \u2022 ${t.definition.name} \u2014 ${t.definition.description}`);
@@ -18099,14 +18059,14 @@ async function handleSkill(args, ctx) {
     return;
   }
   const intent = parseSkillCommand(args);
-  const active = ctx.skillManager.getActive();
+  const active2 = ctx.skillManager.getActive();
   if (intent.kind === "list") {
     const skills = ctx.skillManager.listSkills();
     if (skills.length === 0) {
       ctx.send({ type: "info", message: "No skills available. Add .md files to ~/.aicli/skills/" });
     } else {
       const lines = skills.map((s) => {
-        const isActive = active?.meta.name === s.meta.name;
+        const isActive = active2?.meta.name === s.meta.name;
         const marker = isActive ? " \u2705 (active)" : "";
         return `  ${s.meta.name}${marker} \u2014 ${s.meta.description || "(no description)"}`;
       });
@@ -18122,12 +18082,12 @@ ${lines.join("\n")}` });
     return;
   }
   const note = skillHistoryNote(
-    active?.meta.name ?? "(none)",
+    active2?.meta.name ?? "(none)",
     intent.kind === "deactivate" ? "(none)" : intent.name,
     ctx.sessions.current?.messages.length ?? 0
   );
   if (intent.kind === "deactivate") {
-    if (!active) {
+    if (!active2) {
       ctx.send({ type: "info", message: "No skill is currently active." });
       return;
     }
@@ -18138,7 +18098,7 @@ ${note}` : "\u{1F50C} Skill deactivated." });
     ctx.sendStatus();
     return;
   }
-  if (active?.meta.name === intent.name) {
+  if (active2?.meta.name === intent.name) {
     ctx.send({ type: "info", message: `Skill '${intent.name}' is already active.` });
     return;
   }
@@ -18157,8 +18117,8 @@ ${note}` : head });
 }
 async function handleCommands(_args, ctx) {
   const configDir = ctx.config.getConfigDir();
-  const commandsDir = join24(configDir, CUSTOM_COMMANDS_DIR_NAME);
-  if (!existsSync28(commandsDir)) {
+  const commandsDir = join21(configDir, CUSTOM_COMMANDS_DIR_NAME);
+  if (!existsSync27(commandsDir)) {
     ctx.send({ type: "info", message: `No custom commands directory.
 Create: ${commandsDir}/ with .md files.` });
     return;
@@ -18264,7 +18224,7 @@ async function handleTest(args, ctx) {
       const isCommand = argStr.includes(" ") || /^(mvn|gradle|npm|pytest|cargo|go)\b/.test(argStr);
       testArgs = isCommand ? { command: argStr } : { filter: argStr };
     }
-    const runTests = ctx.runTests ?? (await import("./run-tests-UEE3OMLS.js")).executeTests;
+    const runTests = ctx.runTests ?? (await import("./run-tests-KRNMFXAN.js")).executeTests;
     const report = await runTests(testArgs);
     ctx.send({ type: "info", message: report });
   } catch (err) {
@@ -18288,9 +18248,9 @@ async function handleDiff(args, ctx) {
   let modifiedFiles = 0;
   const diffLines2 = [];
   for (const [filePath, { earliest }] of fileMap) {
-    const currentContent = existsSync28(filePath) ? (() => {
+    const currentContent = existsSync27(filePath) ? (() => {
       try {
-        return readFileSync22(filePath, "utf-8");
+        return readFileSync19(filePath, "utf-8");
       } catch {
         return null;
       }
@@ -18325,9 +18285,9 @@ async function handleDiff(args, ctx) {
 }
 async function handleInit(args, ctx) {
   const cwd = process.cwd();
-  const targetPath = join24(cwd, "AICLI.md");
+  const targetPath = join21(cwd, "AICLI.md");
   const force = args.includes("--force");
-  if (existsSync28(targetPath) && !force) {
+  if (existsSync27(targetPath) && !force) {
     ctx.send({ type: "info", message: `AICLI.md already exists at ${targetPath}
 Use /init --force to overwrite.` });
     return;
@@ -18556,9 +18516,9 @@ async function handleContext(_args, ctx) {
 async function handleIndex(args, ctx) {
   const sub = (args[0] ?? "status").toLowerCase();
   const root = process.cwd();
-  const { loadIndex: loadIndex2, clearIndex } = await import("./store-SIKHCUYJ.js");
-  const { indexProject: indexProject2 } = await import("./indexer-FPKY7LCT.js");
-  const { loadVectorStore, clearVectorStore } = await import("./vector-store-JAXWDZYW.js");
+  const { loadIndex: loadIndex2, clearIndex } = await import("./store-2N6PPPBP.js");
+  const { indexProject: indexProject2 } = await import("./indexer-VRXDZ74A.js");
+  const { loadVectorStore, clearVectorStore } = await import("./vector-store-T2DVUMY4.js");
   if (sub === "status") {
     const idx = loadIndex2(root);
     const vec = loadVectorStore(root);
@@ -18608,7 +18568,7 @@ async function handleIndex(args, ctx) {
       message: `Building semantic index for ${idx.symbolCount} symbols\u2026 (first run downloads ~117 MB model)`
     });
     try {
-      const { rebuildSemanticIndex } = await import("./semantic-QOBAXEQ4.js");
+      const { rebuildSemanticIndex } = await import("./semantic-TRQAZSRY.js");
       const stats = await rebuildSemanticIndex(root);
       const first = stats.modelFirstLoadMs ? ` (model load+first batch ${stats.modelFirstLoadMs}ms)` : "";
       ctx.send({
@@ -18639,7 +18599,7 @@ async function handleMemory(args, ctx) {
   if (intent.kind === "rebuild") {
     ctx.send({ type: "info", message: rebuildStartMessage(intent.full) });
     try {
-      const { buildChatIndex: buildChatIndex2 } = await import("./chat-index-DGUOUUQW.js");
+      const { buildChatIndex: buildChatIndex2 } = await import("./chat-index-RLVLQRRC.js");
       const stats = await buildChatIndex2({ full: intent.full });
       ctx.send({ type: "info", message: rebuildDoneMessage(stats) });
     } catch (err) {
@@ -18648,14 +18608,14 @@ async function handleMemory(args, ctx) {
     return;
   }
   if (intent.kind === "index-clear") {
-    const { clearChatIndex: clearChatIndex2 } = await import("./chat-index-DGUOUUQW.js");
+    const { clearChatIndex: clearChatIndex2 } = await import("./chat-index-RLVLQRRC.js");
     clearChatIndex2();
     ctx.send({ type: "info", message: "Chat memory index cleared (persistent memory untouched)." });
     return;
   }
   if (intent.kind === "status") {
-    const { getChatIndexStatus: getChatIndexStatus2 } = await import("./chat-index-DGUOUUQW.js");
-    const { listMemoryEntries: listMemoryEntries2, isMemoryExpired: isMemoryExpired2, formatMemoryForPrompt: formatMemoryForPrompt2 } = await import("./persistent-memory-XZISXRWT.js");
+    const { getChatIndexStatus: getChatIndexStatus2 } = await import("./chat-index-RLVLQRRC.js");
+    const { listMemoryEntries: listMemoryEntries2, isMemoryExpired: isMemoryExpired2, formatMemoryForPrompt: formatMemoryForPrompt2 } = await import("./persistent-memory-UNLCXUWH.js");
     const memories = listMemoryEntries2(configDir, { includeExpired: true, includeRejected: true });
     const injected = formatMemoryForPrompt2(configDir, process.cwd(), ctx.config.get("memory")?.maxChars);
     const view = buildMemoryStatusView({
@@ -18678,8 +18638,8 @@ async function handleMemory(args, ctx) {
     return;
   }
   if (intent.kind === "recall") {
-    const { searchPersistentMemories: searchPersistentMemories2, touchMemoryReferences: touchMemoryReferences2 } = await import("./persistent-memory-XZISXRWT.js");
-    const { searchChatMemory: searchChatMemory2 } = await import("./chat-index-DGUOUUQW.js");
+    const { searchPersistentMemories: searchPersistentMemories2, touchMemoryReferences: touchMemoryReferences2 } = await import("./persistent-memory-UNLCXUWH.js");
+    const { searchChatMemory: searchChatMemory2 } = await import("./chat-index-RLVLQRRC.js");
     const persistentHits = searchPersistentMemories2(configDir, intent.query, process.cwd(), 3);
     if (persistentHits.length > 0) {
       touchMemoryReferences2(configDir, persistentHits.map((h) => h.entry.id));
@@ -18799,7 +18759,7 @@ async function handleMemory(args, ctx) {
     ctx.handleMemoryManage(intent.action, args[1], intent.action === "expire" ? args[2] : void 0);
   } else if (intent.kind === "export") {
     if (args[1] === "md") {
-      const { exportMemoryEntries: exportMemoryEntries2 } = await import("./persistent-memory-XZISXRWT.js");
+      const { exportMemoryEntries: exportMemoryEntries2 } = await import("./persistent-memory-UNLCXUWH.js");
       ctx.send({
         type: "export_data",
         format: "md",
@@ -18837,7 +18797,7 @@ Use /add-dir remove to clear.` : "No directories added.\nUsage: /add-dir <path>
     return;
   }
   const dirPath = resolve9(sub);
-  if (!existsSync28(dirPath)) {
+  if (!existsSync27(dirPath)) {
     ctx.send({ type: "error", message: `Directory not found: ${dirPath}` });
     return;
   }
@@ -19201,7 +19161,7 @@ async function handleAgent(args, ctx) {
 
 // src/repl/commands/utils.ts
 import { execSync as execSync2 } from "child_process";
-import { platform as platform8 } from "os";
+import { platform as platform6 } from "os";
 
 // src/repl/commands/constants.ts
 var SESSION_PAGE_SIZE = 20;
@@ -19214,7 +19174,7 @@ function fmtCtx(tokens) {
   return `${tokens}`;
 }
 function copyToClipboard(text) {
-  const plat = platform8();
+  const plat = platform6();
   if (plat === "win32") {
     execSync2("clip", { input: text, stdio: ["pipe", "ignore", "ignore"] });
   } else if (plat === "darwin") {
@@ -19801,16 +19761,16 @@ No tools match "${filter}".
       usage: "/mcp [reconnect [serverId] | trust-project]",
       async execute(args, ctx) {
         if (args[0] === "trust-project") {
-          const { join: join29 } = await import("path");
-          const { existsSync: existsSync33 } = await import("fs");
+          const { join: join26 } = await import("path");
+          const { existsSync: existsSync32 } = await import("fs");
           const { getGitRoot: getGitRoot2 } = await import("./git-context-VNCA2GU7.js");
-          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-AXBD2EEB.js");
-          const { approveProject, hashMcpFile } = await import("./project-trust-MUG325AW.js");
+          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-FG27DQMS.js");
+          const { approveProject, hashMcpFile } = await import("./project-trust-6CJB5ZMX.js");
           const cwd = process.cwd();
           const projectRoot = getGitRoot2(cwd) ?? cwd;
-          const mcpPath = join29(projectRoot, MCP_PROJECT_CONFIG_NAME2);
+          const mcpPath = join26(projectRoot, MCP_PROJECT_CONFIG_NAME2);
           console.log();
-          if (!existsSync33(mcpPath)) {
+          if (!existsSync32(mcpPath)) {
             console.log(theme.dim(`  No .mcp.json in ${projectRoot}.`));
             console.log();
             return;
@@ -19883,8 +19843,8 @@ No tools match "${filter}".
           const errorStr = s.error ? theme.error(`
       Error: ${s.error}`) : "";
           const serverLabel = s.serverName !== s.serverId ? ` (${s.serverName})` : "";
-          const source = ctx.getMcpServerSource(s.serverId);
-          const sourceTag = source === "project" ? theme.accent(" [project]") : theme.dim(" [global]");
+          const source2 = ctx.getMcpServerSource(s.serverId);
+          const sourceTag = source2 === "project" ? theme.accent(" [project]") : theme.dim(" [global]");
           console.log(`    ${theme.accent(s.serverId)}${theme.dim(serverLabel)}${sourceTag} [${statusBadge}]${toolCountStr}${errorStr}`);
           if (s.connected) {
             const mcpTools = ctx.tools.listMcpTools().filter(
@@ -19912,7 +19872,7 @@ No tools match "${filter}".
         }
         if (!sub || sub === "list") {
           const skills = manager.listSkills();
-          const active = manager.getActive();
+          const active2 = manager.getActive();
           console.log();
           console.log(theme.heading("  \u{1F3AF} Agent Skills"));
           console.log(theme.dim("  " + "\u2500".repeat(50)));
@@ -19922,7 +19882,7 @@ No tools match "${filter}".
             console.log(theme.dim("  Format: YAML frontmatter (name/description/tools) + prompt body"));
           } else {
             for (const s of skills) {
-              const isActive = active?.meta.name === s.meta.name;
+              const isActive = active2?.meta.name === s.meta.name;
               const badge = isActive ? theme.success(" \u2713 active") : "";
               const toolInfo = s.meta.tools ? theme.dim(` [${s.meta.tools.join(", ")}]`) : "";
               console.log(
@@ -20010,7 +19970,7 @@ No tools match "${filter}".
 }
 
 // src/repl/commands/security-commands.ts
-import { platform as platform9 } from "os";
+import { platform as platform7 } from "os";
 import chalk6 from "chalk";
 function createSecurityCommands() {
   return [
@@ -20091,7 +20051,7 @@ ${outcome.summary}
       usage: "/bug [--copy]",
       execute(args, ctx) {
         const doCopy = args.includes("--copy");
-        const os = platform9();
+        const os = platform7();
         const nodeVer = process.version;
         const provider = ctx.getCurrentProvider();
         const model = ctx.getCurrentModel();
@@ -20245,12 +20205,12 @@ ${outcome.summary}
           if (scanAll) {
             const metas = ctx.sessions.listSessions();
             console.log(theme.info(`  Scanning ${metas.length} session(s)\u2026`));
-            const { readFileSync: readFileSync26 } = await import("fs");
-            const { join: join29 } = await import("path");
+            const { readFileSync: readFileSync23 } = await import("fs");
+            const { join: join26 } = await import("path");
             const historyDir = ctx.config.getHistoryDir();
             for (const m of metas) {
               try {
-                const content = readFileSync26(join29(historyDir, `${m.id}.json`), "utf-8");
+                const content = readFileSync23(join26(historyDir, `${m.id}.json`), "utf-8");
                 const hits2 = scanString(content, opts);
                 if (hits2.length) {
                   filesWithHits++;
@@ -20297,8 +20257,8 @@ ${outcome.summary}
 }
 
 // src/repl/commands/review-commands.ts
-import { existsSync as existsSync29, readFileSync as readFileSync23, writeFileSync as writeFileSync4 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync28, readFileSync as readFileSync20, writeFileSync as writeFileSync4 } from "fs";
+import { join as join22 } from "path";
 function createReviewCommands() {
   return [
     {
@@ -20472,11 +20432,11 @@ function createReviewCommands() {
   Branches (${branches.length}):
 `));
           for (const b of branches) {
-            const active = b.id === session.activeBranchId ? theme.success("\u25CF ") : "  ";
+            const active2 = b.id === session.activeBranchId ? theme.success("\u25CF ") : "  ";
             const parent = b.parentBranchId ? theme.dim(` \u2190 ${b.parentBranchId}@${b.parentMessageIndex}`) : "";
             const count = b.id === session.activeBranchId ? session.messages.length : session.getBranchMessages(b.id)?.length ?? 0;
             console.log(
-              `  ${active}${theme.accent(b.id.padEnd(10))} ${b.title.padEnd(20)} ` + theme.dim(`(${count} msgs)`) + parent
+              `  ${active2}${theme.accent(b.id.padEnd(10))} ${b.title.padEnd(20)} ` + theme.dim(`(${count} msgs)`) + parent
             );
           }
           console.log();
@@ -20589,9 +20549,9 @@ function createReviewCommands() {
             ctx.renderer.renderError(`Branch "${id}" not found.`);
             return;
           }
-          const active = session.activeBranchId;
+          const active2 = session.activeBranchId;
           console.log(`
-  ${theme.info("diff")}  ${id} (source) \u2194 ${active} (active)`);
+  ${theme.info("diff")}  ${id} (source) \u2194 ${active2} (active)`);
           console.log(theme.dim(`  Common prefix: ${d.commonPrefix} message(s)`));
           if (d.sourceOnly.length === 0 && d.targetOnly.length === 0) {
             console.log(theme.success("  Branches are identical.\n"));
@@ -20610,7 +20570,7 @@ function createReviewCommands() {
           }
           if (d.targetOnly.length > 0) {
             console.log(theme.dim(`
-  Only in ${active} (active) (${d.targetOnly.length}):`));
+  Only in ${active2} (active) (${d.targetOnly.length}):`));
             d.targetOnly.forEach((m, i) => {
               console.log(`    ${theme.dim(`[${d.commonPrefix + i}]`)} ${m.role}: ${preview(m)}`);
             });
@@ -20657,9 +20617,9 @@ function createReviewCommands() {
       usage: "/init [--force]",
       async execute(args, ctx) {
         const cwd = process.cwd();
-        const targetPath = join25(cwd, "AICLI.md");
+        const targetPath = join22(cwd, "AICLI.md");
         const force = args.includes("--force");
-        if (existsSync29(targetPath) && !force) {
+        if (existsSync28(targetPath) && !force) {
           ctx.renderer.printInfo(`AICLI.md already exists at ${targetPath}`);
           ctx.renderer.printInfo("Use /init --force to overwrite, or edit it manually.");
           return;
@@ -20723,7 +20683,7 @@ function createReviewCommands() {
       usage: "/test [command|filter]",
       async execute(args, ctx) {
         try {
-          const { executeTests } = await import("./run-tests-UEE3OMLS.js");
+          const { executeTests } = await import("./run-tests-KRNMFXAN.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -20758,9 +20718,9 @@ function createReviewCommands() {
         let newFiles = 0;
         let modifiedFiles = 0;
         for (const [filePath, { earliest }] of fileMap) {
-          const currentContent = existsSync29(filePath) ? (() => {
+          const currentContent = existsSync28(filePath) ? (() => {
             try {
-              return readFileSync23(filePath, "utf-8");
+              return readFileSync20(filePath, "utf-8");
             } catch {
               return null;
             }
@@ -20974,9 +20934,9 @@ function createMemoryCommands() {
       async execute(args, ctx) {
         const sub = (args[0] ?? "status").toLowerCase();
         const root = process.cwd();
-        const { loadIndex: loadIndex2, clearIndex } = await import("./store-SIKHCUYJ.js");
-        const { indexProject: indexProject2 } = await import("./indexer-FPKY7LCT.js");
-        const { loadVectorStore, clearVectorStore } = await import("./vector-store-JAXWDZYW.js");
+        const { loadIndex: loadIndex2, clearIndex } = await import("./store-2N6PPPBP.js");
+        const { indexProject: indexProject2 } = await import("./indexer-VRXDZ74A.js");
+        const { loadVectorStore, clearVectorStore } = await import("./vector-store-T2DVUMY4.js");
         if (sub === "status") {
           const idx = loadIndex2(root);
           const vec = loadVectorStore(root);
@@ -21036,7 +20996,7 @@ function createMemoryCommands() {
           }
           console.log(theme.dim(`  Building semantic index for ${idx.symbolCount} symbols\u2026`));
           console.log(theme.dim("  (First run downloads ~117 MB embedding model to ~/.aicli/models/)"));
-          const { rebuildSemanticIndex } = await import("./semantic-QOBAXEQ4.js");
+          const { rebuildSemanticIndex } = await import("./semantic-TRQAZSRY.js");
           try {
             const stats = await rebuildSemanticIndex(root, {
               onProgress: (done, total) => {
@@ -21235,14 +21195,14 @@ ${view.chatHeading}
           console.log(theme.heading("\n\u{1F4DD} Governed Persistent Memory:") + filterNote + "\n" + theme.dim("\u2500".repeat(72)));
           for (const entry of entries) {
             const status = isMemoryExpired(entry) ? "expired" : entry.approved ? "approved" : "pending";
-            const source = [
+            const source2 = [
               entry.source ?? "unknown",
               entry.sourceSession ? `session ${entry.sourceSession.slice(0, 8)}` : "",
               entry.sourceProject ? `project ${entry.sourceProject}` : ""
             ].filter(Boolean).join(" \xB7 ");
             console.log(theme.accent(`  ${entry.id.slice(0, 8)}  ${status}  scope:${entry.scope}  sensitivity:${entry.sensitivity}`));
             const lastRef = entry.lastReferencedAt ? ` \xB7 last-referenced: ${entry.lastReferencedAt.slice(0, 10)}` : "";
-            console.log(theme.dim(`      source: ${source} \xB7 created: ${entry.createdAt.replace("T", " ").slice(0, 19)}${lastRef}${entry.expiresAt ? ` \xB7 expires: ${entry.expiresAt}` : ""}`));
+            console.log(theme.dim(`      source: ${source2} \xB7 created: ${entry.createdAt.replace("T", " ").slice(0, 19)}${lastRef}${entry.expiresAt ? ` \xB7 expires: ${entry.expiresAt}` : ""}`));
             console.log("      " + entry.content.replace(/\n/g, "\n      "));
             console.log();
           }
@@ -21923,16 +21883,16 @@ function createSessionCommands() {
 
 // src/repl/commands/misc-commands.ts
 import { basename as basename9 } from "path";
-import { platform as platform10 } from "os";
+import { platform as platform8 } from "os";
 
 // src/repl/clipboard.ts
 import { execSync as execSync3 } from "child_process";
-import { existsSync as existsSync30, statSync as statSync15, unlinkSync as unlinkSync7 } from "fs";
+import { existsSync as existsSync29, statSync as statSync15, unlinkSync as unlinkSync7 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join26 } from "path";
+import { join as join23 } from "path";
 var CLIPBOARD_TIMEOUT = 5e3;
 function readClipboardImage() {
-  const outPath = join26(tmpdir3(), `aicli-paste-${Date.now()}.png`);
+  const outPath = join23(tmpdir3(), `aicli-paste-${Date.now()}.png`);
   try {
     if (process.platform === "win32") {
       _readWin32(outPath);
@@ -21945,7 +21905,7 @@ function readClipboardImage() {
     _cleanup(outPath);
     return null;
   }
-  if (!existsSync30(outPath) || statSync15(outPath).size === 0) {
+  if (!existsSync29(outPath) || statSync15(outPath).size === 0) {
     _cleanup(outPath);
     return null;
   }
@@ -21998,7 +21958,7 @@ function _readLinux(outPath) {
 }
 function _cleanup(path3) {
   try {
-    if (existsSync30(path3)) unlinkSync7(path3);
+    if (existsSync29(path3)) unlinkSync7(path3);
   } catch {
   }
 }
@@ -22245,7 +22205,7 @@ No commands match "${filter}".
           ctx.renderer.printSuccess(`Copied to clipboard (${lines} lines, ${chars} chars)`);
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
-          if (platform10() === "linux" && msg.includes("not found")) {
+          if (platform8() === "linux" && msg.includes("not found")) {
             ctx.renderer.renderError("Clipboard tool not found. Install xclip or xsel: sudo apt install xclip");
           } else {
             ctx.renderer.renderError(`Failed to copy: ${msg}`);
@@ -22840,7 +22800,18 @@ var SessionHandler = class _SessionHandler {
       }))
     });
   }
+  executionState = /* @__PURE__ */ new Map();
+  connectionAbort = new AbortController();
   async handleMessage(raw) {
+    if (this.connectionAbort.signal.aborted && /"type"\s*:\s*"(?:chat|command|hub_start)"/.test(raw)) this.connectionAbort = new AbortController();
+    return runWithExecutionContext({
+      configDir: this.config.getConfigDir(),
+      sessionKey: this._bashSessionKey,
+      state: this.executionState,
+      signal: this.connectionAbort.signal
+    }, () => this.handleMessageScoped(raw));
+  }
+  async handleMessageScoped(raw) {
     if (this.disconnected) return;
     let msg;
     try {
@@ -22851,6 +22822,7 @@ var SessionHandler = class _SessionHandler {
     }
     switch (msg.type) {
       case "chat": {
+        if (this.connectionAbort.signal.aborted) this.connectionAbort = new AbortController();
         if (msg.messageId) {
           if (typeof msg.messageId !== "string" || msg.messageId.length > 200) throw new Error("Invalid message ID");
           const scope = this.config.getConfigDir();
@@ -22911,6 +22883,7 @@ var SessionHandler = class _SessionHandler {
         return;
       }
       case "abort":
+        this.connectionAbort.abort();
         if (this.abortController) {
           this.abortController.abort();
         }
@@ -22934,8 +22907,16 @@ var SessionHandler = class _SessionHandler {
     }
   }
   onDisconnect(closeSocket = true) {
+    runWithExecutionContext({
+      configDir: this.config.getConfigDir(),
+      sessionKey: this._bashSessionKey,
+      state: this.executionState
+    }, () => this.disconnectScoped(closeSocket));
+  }
+  disconnectScoped(closeSocket) {
     if (this.disconnected) return;
     this.disconnected = true;
+    this.connectionAbort.abort();
     if (closeSocket && this.ws.readyState === this.ws.OPEN) this.ws.close(1001, "Connection closed; reconnect to restore session");
     runLifecycleHooks(mergePluginHooks(this.config.get("hooks") ?? void 0, this.config.getConfigDir()), "Stop", { sessionId: this.sessions.current?.id }, { configDir: this.config.getConfigDir() });
     this.toolExecutor.cancelAll();
@@ -23914,20 +23895,20 @@ ${summaryContent}`,
       this.send({ type: "error", message: "Usage: /memory show --stale <days> (positive number)" });
       return;
     }
-    const source = filters.orphaned ? listOrphanedProjectMemories(configDir) : listMemoryEntries(configDir, { includeExpired: true, includeRejected: true });
-    const { entries, applied } = filterMemoryEntries(source, filters);
+    const source2 = filters.orphaned ? listOrphanedProjectMemories(configDir) : listMemoryEntries(configDir, { includeExpired: true, includeRejected: true });
+    const { entries, applied } = filterMemoryEntries(source2, filters);
     const filterNote = applied.length > 0 ? ` (filtered: ${applied.join(", ")})` : "";
     const content = entries.length === 0 ? applied.length > 0 ? `(no entries match [${applied.join(", ")}])` : "(empty \u2014 no persistent memory entries yet)" : `Governed persistent memory${filterNote}
 
 ` + entries.map((entry) => {
       const status = isMemoryExpired(entry) ? "expired" : entry.approved ? "approved" : "pending";
-      const source2 = [
+      const source3 = [
         entry.source ?? "unknown",
         entry.sourceSession ? `session ${entry.sourceSession.slice(0, 8)}` : "",
         entry.sourceProject ? `project ${entry.sourceProject}` : ""
       ].filter(Boolean).join(" \xB7 ");
       return `## ${entry.id.slice(0, 8)} \xB7 ${status} \xB7 scope:${entry.scope} \xB7 sensitivity:${entry.sensitivity}
-Source: ${source2}
+Source: ${source3}
 ${entry.content}`;
     }).join("\n\n");
     this.send({
@@ -24037,7 +24018,7 @@ Backup saved: ${result.backupPath}` : "";
       return;
     }
     try {
-      const { searchChatMemory: searchChatMemory2, loadChatIndex: loadChatIndex2 } = await import("./chat-index-DGUOUUQW.js");
+      const { searchChatMemory: searchChatMemory2, loadChatIndex: loadChatIndex2 } = await import("./chat-index-RLVLQRRC.js");
       const loaded = loadChatIndex2();
       if (!loaded || loaded.idx.chunks.length === 0) {
         this.send({ type: "memory_hits", query: q, hits: [], indexMissing: true });
@@ -24073,7 +24054,7 @@ Backup saved: ${result.backupPath}` : "";
   }
   async handleMemoryStatus() {
     try {
-      const { getChatIndexStatus: getChatIndexStatus2 } = await import("./chat-index-DGUOUUQW.js");
+      const { getChatIndexStatus: getChatIndexStatus2 } = await import("./chat-index-RLVLQRRC.js");
       const s = getChatIndexStatus2();
       this.send({
         type: "memory_status",
@@ -24098,7 +24079,7 @@ Backup saved: ${result.backupPath}` : "";
         type: "info",
         message: full ? "\u{1F9E0} Rebuilding chat memory index (this may take a while on first run \u2014 ~117 MB embedder)." : "\u{1F9E0} Refreshing chat memory index (incremental)\u2026"
       });
-      const { buildChatIndex: buildChatIndex2 } = await import("./chat-index-DGUOUUQW.js");
+      const { buildChatIndex: buildChatIndex2 } = await import("./chat-index-RLVLQRRC.js");
       const stats = await buildChatIndex2({
         full,
         onProgress: (p) => {
@@ -24256,9 +24237,9 @@ async function setupProxy(configProxy) {
 }
 
 // src/web/auth.ts
-import { existsSync as existsSync31, readFileSync as readFileSync24, writeFileSync as writeFileSync6, mkdirSync as mkdirSync16, readdirSync as readdirSync14, copyFileSync } from "fs";
-import { isAbsolute as isAbsolute3, join as join27, relative as relative5 } from "path";
-import { createHmac, randomBytes, timingSafeEqual, pbkdf2Sync } from "crypto";
+import { existsSync as existsSync30, readFileSync as readFileSync21, mkdirSync as mkdirSync16, readdirSync as readdirSync14, openSync, closeSync, unlinkSync as unlinkSync8 } from "fs";
+import { isAbsolute as isAbsolute3, join as join24, relative as relative5 } from "path";
+import { createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2, pbkdf2Sync, pbkdf2 } from "crypto";
 var USERS_FILE = "users.json";
 var TOKEN_EXPIRY_HOURS = 24;
 var TOKEN_EXPIRY_MS = TOKEN_EXPIRY_HOURS * 3600 * 1e3;
@@ -24270,14 +24251,16 @@ var AuthManager = class {
   usersFile;
   baseDir;
   db;
+  loadedRaw;
   constructor(baseDir) {
     this.baseDir = baseDir;
-    this.usersFile = join27(baseDir, USERS_FILE);
+    this.usersFile = join24(baseDir, USERS_FILE);
     this.db = this.loadOrCreate();
   }
   // ── Public API ─────────────────────────────────────────────────
   /** Check if any users exist (first-run detection) */
   hasUsers() {
+    this.refresh();
     return this.db.users.length > 0;
   }
   /** Check if auth is enabled (has users.json with at least 1 user) */
@@ -24286,6 +24269,18 @@ var AuthManager = class {
   }
   /** Register a new user. Returns error string or null on success. */
   register(username, password) {
+    return this.registerPrepared(username, password);
+  }
+  async registerAsync(username, password) {
+    if (typeof username !== "string" || typeof password !== "string" || password.length > 1024) return "Invalid username or password";
+    if (!/^[a-z0-9_-]{2,32}$/i.test(username.trim()) || password.length < 4) return "Invalid username or password";
+    const salt = randomBytes2(16).toString("hex");
+    const hash = await hashPasswordAsync(password, salt);
+    return this.registerPrepared(username, password, { salt, hash });
+  }
+  registerPrepared(username, password, prepared) {
+    this.refresh();
+    if (typeof username !== "string" || typeof password !== "string" || password.length > 1024) return "Invalid username or password";
     username = username.trim().toLowerCase();
     if (!username || username.length < 2 || username.length > 32) {
       return "Username must be 2-32 characters";
@@ -24299,11 +24294,12 @@ var AuthManager = class {
     if (this.db.users.find((u) => u.username === username)) {
       return "Username already exists";
     }
-    const salt = randomBytes(16).toString("hex");
-    const passwordHash = this.hashPassword(password, salt);
-    const dataDir = join27(USERS_DIR, username);
-    const fullDataDir = join27(this.baseDir, dataDir);
-    mkdirSync16(join27(fullDataDir, "history"), { recursive: true });
+    const salt = prepared?.salt ?? randomBytes2(16).toString("hex");
+    const passwordHash = prepared?.hash ?? this.hashPassword(password, salt);
+    const dataDir = join24(USERS_DIR, username);
+    const fullDataDir = join24(this.baseDir, dataDir);
+    mkdirSync16(fullDataDir, { recursive: true, mode: 448 });
+    mkdirSync16(join24(fullDataDir, "history"), { recursive: true, mode: 448 });
     const user = {
       username,
       passwordHash,
@@ -24326,6 +24322,8 @@ var AuthManager = class {
    * resets the counter.
    */
   login(username, password) {
+    this.refresh();
+    if (!validCredentials(username, password)) return null;
     username = username.trim().toLowerCase();
     const lockState = this.getLockState(username);
     if (lockState.locked) return null;
@@ -24338,30 +24336,62 @@ var AuthManager = class {
     const hash = isLegacy ? this.hashPasswordLegacy(password, user.salt) : this.hashPassword(password, user.salt);
     const a = Buffer.from(hash, "utf-8");
     const b = Buffer.from(user.passwordHash, "utf-8");
-    if (a.length !== b.length || !timingSafeEqual(a, b)) {
+    if (a.length !== b.length || !timingSafeEqual2(a, b)) {
       this.recordFailedLogin(username);
       return null;
     }
     if (isLegacy) {
-      const newSalt = randomBytes(16).toString("hex");
+      const newSalt = randomBytes2(16).toString("hex");
       user.passwordHash = this.hashPassword(password, newSalt);
       user.salt = newSalt;
       user.hashVersion = 2;
       this.save();
     }
-    loginAttempts.delete(username);
+    loginAttempts.delete(this.attemptKey(username));
     return this.createToken(username);
   }
   /**
    * Returns current lockout state for a username and lazily expires it.
    * Exposed (read-only) for tests and the `aicli user` CLI status output.
    */
+  async loginAsync(username, password) {
+    this.refresh();
+    if (!validCredentials(username, password)) return null;
+    username = username.trim().toLowerCase();
+    if (this.getLockState(username).locked) return null;
+    const user = this.db.users.find((u) => u.username === username);
+    if (!user) {
+      this.recordFailedLogin(username);
+      return null;
+    }
+    const snapshot = JSON.stringify(user);
+    const legacy = !user.hashVersion || user.hashVersion < 2;
+    const hash = legacy ? this.hashPasswordLegacy(password, user.salt) : await hashPasswordAsync(password, user.salt);
+    const salt = legacy ? randomBytes2(16).toString("hex") : user.salt;
+    const upgraded = legacy ? await hashPasswordAsync(password, salt) : hash;
+    this.refresh();
+    const current = this.db.users.find((u) => u.username === username);
+    if (!current || JSON.stringify(current) !== snapshot || this.getLockState(username).locked) return null;
+    const a = Buffer.from(hash), b = Buffer.from(current.passwordHash);
+    if (a.length !== b.length || !timingSafeEqual2(a, b)) {
+      this.recordFailedLogin(username);
+      return null;
+    }
+    if (legacy) {
+      current.salt = salt;
+      current.passwordHash = upgraded;
+      current.hashVersion = 2;
+      this.save();
+    }
+    loginAttempts.delete(this.attemptKey(username));
+    return this.createToken(username);
+  }
   getLockState(username) {
     username = username.trim().toLowerCase();
-    const state2 = loginAttempts.get(username);
+    const state2 = loginAttempts.get(this.attemptKey(username));
     if (!state2) return { locked: false, remainingMs: 0, fails: 0 };
-    if (state2.lockedUntil > 0 && Date.now() >= state2.lockedUntil) {
-      loginAttempts.delete(username);
+    if (Date.now() >= state2.expiresAt) {
+      loginAttempts.delete(this.attemptKey(username));
       return { locked: false, remainingMs: 0, fails: 0 };
     }
     if (state2.lockedUntil > 0) {
@@ -24369,8 +24399,15 @@ var AuthManager = class {
     }
     return { locked: false, remainingMs: 0, fails: state2.fails };
   }
+  attemptKey(username) {
+    return this.usersFile + "\0" + username;
+  }
   recordFailedLogin(username) {
-    const state2 = loginAttempts.get(username) ?? { fails: 0, lockedUntil: 0 };
+    username = this.attemptKey(username);
+    const now = Date.now();
+    for (const [key, value] of loginAttempts) if (value.expiresAt <= now) loginAttempts.delete(key);
+    if (!loginAttempts.has(username) && loginAttempts.size >= 1e4) loginAttempts.delete(loginAttempts.keys().next().value);
+    const state2 = loginAttempts.get(username) ?? { fails: 0, lockedUntil: 0, expiresAt: now + LOGIN_LOCKOUT_MS };
     state2.fails += 1;
     if (state2.fails >= LOGIN_MAX_FAILS) {
       state2.lockedUntil = Date.now() + LOGIN_LOCKOUT_MS;
@@ -24380,17 +24417,19 @@ var AuthManager = class {
   /** Verify a token. Returns username or null. */
   verifyToken(token) {
     try {
+      this.refresh();
+      if (typeof token !== "string" || token.length > 4096) return null;
       const parts = token.split(".");
       if (parts.length !== 2) return null;
       const [payloadB64, signature] = parts;
       const expectedSig = this.sign(payloadB64);
       const sigBuf = Buffer.from(signature ?? "", "utf-8");
       const expBuf = Buffer.from(expectedSig, "utf-8");
-      if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) return null;
+      if (sigBuf.length !== expBuf.length || !timingSafeEqual2(sigBuf, expBuf)) return null;
       const payload = JSON.parse(
         Buffer.from(payloadB64, "base64url").toString("utf-8")
       );
-      if (Date.now() > payload.exp) return null;
+      if (!Number.isFinite(payload.exp) || Date.now() >= payload.exp) return null;
       const user = this.db.users.find((u) => u.username === payload.username);
       if (!user) return null;
       if (user.tokensRevokedBefore && (!payload.iat || payload.iat < user.tokensRevokedBefore)) {
@@ -24407,6 +24446,7 @@ var AuthManager = class {
    * v0.4.114). Returns true if the user existed.
    */
   logoutAll(username) {
+    this.refresh();
     username = username.trim().toLowerCase();
     const user = this.db.users.find((u) => u.username === username);
     if (!user) return false;
@@ -24416,16 +24456,19 @@ var AuthManager = class {
   }
   /** Get user's data directory (absolute path) */
   getUserDataDir(username) {
+    this.refresh();
     const user = this.db.users.find((u) => u.username === username);
     if (!user) throw new Error(`User not found: ${username}`);
-    return join27(this.baseDir, user.dataDir);
+    return join24(this.baseDir, user.dataDir);
   }
   /** List all usernames */
   listUsers() {
+    this.refresh();
     return this.db.users.map((u) => u.username);
   }
   /** Delete a user. Returns error string or null on success. */
   deleteUser(username) {
+    this.refresh();
     username = username.trim().toLowerCase();
     const idx = this.db.users.findIndex((u) => u.username === username);
     if (idx === -1) return `User '${username}' not found`;
@@ -24435,13 +24478,14 @@ var AuthManager = class {
   }
   /** Reset a user's password. Returns error string or null on success. */
   resetPassword(username, newPassword) {
+    this.refresh();
     username = username.trim().toLowerCase();
     const user = this.db.users.find((u) => u.username === username);
     if (!user) return `User '${username}' not found`;
-    if (!newPassword || newPassword.length < 4) {
+    if (typeof newPassword !== "string" || newPassword.length > 1024 || newPassword.length < 4) {
       return "Password must be at least 4 characters";
     }
-    const salt = randomBytes(16).toString("hex");
+    const salt = randomBytes2(16).toString("hex");
     user.passwordHash = this.hashPassword(newPassword, salt);
     user.salt = salt;
     user.hashVersion = 2;
@@ -24454,30 +24498,30 @@ var AuthManager = class {
     const err = this.register(username, password);
     if (err) return err;
     const userDir = this.getUserDataDir(username);
-    const globalConfig = join27(this.baseDir, "config.json");
-    if (existsSync31(globalConfig)) {
+    const globalConfig = join24(this.baseDir, "config.json");
+    if (existsSync30(globalConfig)) {
       try {
-        const content = readFileSync24(globalConfig, "utf-8");
-        writeFileSync6(join27(userDir, "config.json"), content, "utf-8");
+        const content = readFileSync21(globalConfig, "utf-8");
+        atomicWriteFileSync(join24(userDir, "config.json"), content, { mode: 384 });
       } catch {
       }
     }
-    const globalMemory = join27(this.baseDir, "memory.md");
-    if (existsSync31(globalMemory)) {
+    const globalMemory = join24(this.baseDir, "memory.md");
+    if (existsSync30(globalMemory)) {
       try {
-        const content = readFileSync24(globalMemory, "utf-8");
-        writeFileSync6(join27(userDir, "memory.md"), content, "utf-8");
+        const content = readFileSync21(globalMemory, "utf-8");
+        atomicWriteFileSync(join24(userDir, "memory.md"), content, { mode: 384 });
       } catch {
       }
     }
-    const globalHistory = join27(this.baseDir, "history");
-    if (existsSync31(globalHistory)) {
+    const globalHistory = join24(this.baseDir, "history");
+    if (existsSync30(globalHistory)) {
       try {
         const files = readdirSync14(globalHistory).filter((f) => f.endsWith(".json"));
-        const userHistory = join27(userDir, "history");
+        const userHistory = join24(userDir, "history");
         for (const f of files) {
           try {
-            copyFileSync(join27(globalHistory, f), join27(userHistory, f));
+            atomicWriteFileSync(join24(userHistory, f), readFileSync21(join24(globalHistory, f), "utf8"), { mode: 384 });
           } catch {
           }
         }
@@ -24487,13 +24531,22 @@ var AuthManager = class {
     return null;
   }
   // ── Private methods ────────────────────────────────────────────
+  refresh() {
+    const raw = readFileSync21(this.usersFile, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!this.isValidUsersDB(parsed)) throw new Error("Authentication database is invalid; access refused");
+    this.db = parsed;
+    this.loadedRaw = raw;
+  }
   loadOrCreate() {
-    if (existsSync31(this.usersFile)) {
+    if (existsSync30(this.usersFile)) {
       try {
-        const parsed = JSON.parse(readFileSync24(this.usersFile, "utf-8"));
+        const raw = readFileSync21(this.usersFile, "utf-8");
+        const parsed = JSON.parse(raw);
         if (!this.isValidUsersDB(parsed)) {
           throw new Error("database structure is invalid");
         }
+        this.loadedRaw = raw;
         return parsed;
       } catch (err) {
         const detail = err instanceof Error ? err.message : String(err);
@@ -24505,7 +24558,7 @@ var AuthManager = class {
     }
     const db = {
       version: 1,
-      secret: randomBytes(32).toString("hex"),
+      secret: randomBytes2(32).toString("hex"),
       users: []
     };
     this.saveDB(db);
@@ -24524,7 +24577,7 @@ var AuthManager = class {
       if (typeof record.username !== "string" || !/^[a-z0-9_-]{2,32}$/.test(record.username) || usernames.has(record.username) || typeof record.passwordHash !== "string" || record.passwordHash.length === 0 || typeof record.salt !== "string" || record.salt.length === 0 || typeof record.createdAt !== "string" || typeof record.dataDir !== "string" || record.dataDir.length === 0 || isAbsolute3(record.dataDir)) {
         return false;
       }
-      const dataDirFromBase = relative5(this.baseDir, join27(this.baseDir, record.dataDir));
+      const dataDirFromBase = relative5(this.baseDir, join24(this.baseDir, record.dataDir));
       if (dataDirFromBase.startsWith("..") || isAbsolute3(dataDirFromBase)) return false;
       if (record.hashVersion !== void 0 && record.hashVersion !== 1 && record.hashVersion !== 2) return false;
       if (record.tokensRevokedBefore !== void 0 && !Number.isFinite(record.tokensRevokedBefore)) return false;
@@ -24536,8 +24589,19 @@ var AuthManager = class {
     this.saveDB(this.db);
   }
   saveDB(db) {
-    mkdirSync16(this.baseDir, { recursive: true });
-    atomicWriteFileSync(this.usersFile, JSON.stringify(db, null, 2));
+    mkdirSync16(this.baseDir, { recursive: true, mode: 448 });
+    const lock = this.usersFile + ".lock";
+    const fd = openSync(lock, "wx", 384);
+    try {
+      const current = existsSync30(this.usersFile) ? readFileSync21(this.usersFile, "utf8") : void 0;
+      if (current !== this.loadedRaw) throw new Error("Authentication database changed concurrently; retry the operation");
+      const raw = JSON.stringify(db, null, 2);
+      atomicWriteFileSync(this.usersFile, raw, { mode: 384 });
+      this.loadedRaw = raw;
+    } finally {
+      closeSync(fd);
+      unlinkSync8(lock);
+    }
   }
   /** Legacy hash — kept only for migrating old users (v0.2.x) */
   hashPasswordLegacy(password, salt) {
@@ -24561,6 +24625,19 @@ var AuthManager = class {
     return createHmac("sha256", this.db.secret).update(data).digest("base64url");
   }
 };
+function validCredentials(username, password) {
+  return typeof username === "string" && /^[a-z0-9_-]{2,32}$/i.test(username.trim()) && typeof password === "string" && password.length > 0 && password.length <= 1024;
+}
+var activeHashes = 0;
+async function hashPasswordAsync(password, salt) {
+  if (activeHashes >= 4) throw new Error("Authentication capacity reached; try again later");
+  activeHashes++;
+  try {
+    return await new Promise((resolve13, reject) => pbkdf2(password, salt, 1e5, 64, "sha512", (error, hash) => error ? reject(error) : resolve13(hash.toString("hex"))));
+  } finally {
+    activeHashes--;
+  }
+}
 
 // src/web/server.ts
 function getModuleDir() {
@@ -24580,6 +24657,10 @@ async function startWebServer(options = {}) {
   console.log(`\u{1F916} ai-cli Web UI v${VERSION}`);
   console.log(`   Initializing...`);
   const config = new ConfigManager();
+  const authManager = new AuthManager(config.getConfigDir());
+  if (!authManager.isEnabled() && !["localhost", "127.0.0.1", "::1"].includes(host)) {
+    throw new Error("Network listening requires authentication. Create a user with aicli user create first.");
+  }
   await setupProxy(config.get("proxy"));
   const providers = new ProviderRegistry();
   const sessions = new SessionManager(config);
@@ -24613,7 +24694,7 @@ async function startWebServer(options = {}) {
   const projectMcpResolved = mcpEnabled ? resolveProjectMcpPath() : null;
   let projectMcpServers = {};
   if (projectMcpResolved) {
-    const { checkTrust } = await import("./project-trust-MUG325AW.js");
+    const { checkTrust } = await import("./project-trust-6CJB5ZMX.js");
     const verdict = checkTrust(config.getConfigDir(), projectMcpResolved);
     if (verdict.trusted) {
       projectMcpServers = loadProjectMcpConfig() ?? {};
@@ -24640,8 +24721,8 @@ async function startWebServer(options = {}) {
     }
   }
   let skillManager = null;
-  const skillsDir = join28(config.getConfigDir(), SKILLS_DIR_NAME);
-  if (existsSync32(skillsDir)) {
+  const skillsDir = join25(config.getConfigDir(), SKILLS_DIR_NAME);
+  if (existsSync31(skillsDir)) {
     skillManager = new SkillManager(skillsDir, config.get("ui").skillSizeWarn);
     skillManager.loadSkills(pluginAssets.skillDirs);
     const count = skillManager.listSkills().length;
@@ -24660,6 +24741,16 @@ async function startWebServer(options = {}) {
     skillManager
   };
   const app = express();
+  const access = new WebAccess(host, options.externalOrigin);
+  const authLimits = new AuthRateLimiter();
+  app.use((req, res, next) => {
+    if (!access.accepts(req)) {
+      res.status(403).json({ error: "Untrusted request origin or host" });
+      return;
+    }
+    res.locals.externalSecure = !!options.externalOrigin?.startsWith("https://") && req.headers.host === new URL(options.externalOrigin).host;
+    next();
+  });
   app.use((_req, res, next) => {
     res.setHeader(
       "Content-Security-Policy",
@@ -24688,19 +24779,23 @@ async function startWebServer(options = {}) {
   const WS_MSG_RATE_PER_SEC = 30;
   const WS_MSG_BURST = 60;
   const WS_PREAUTH_TIMEOUT_MS = 3e4;
-  const wss = new WebSocketServer({ server, maxPayload: WS_MAX_PAYLOAD });
-  const authManager = new AuthManager(config.getConfigDir());
+  const wss = new WebSocketServer({ server, maxPayload: WS_MAX_PAYLOAD, verifyClient: ({ req }) => {
+    if (!access.accepts(req) || wss.clients.size >= 128) return false;
+    if (req.headers.origin) return true;
+    const cookie = parseCookie(req.headers.cookie ?? "");
+    return equalToken(cookie.aicli_local, access.localToken) || !!authManager.verifyToken(cookie.aicli_token ?? "");
+  } });
   if (authManager.isEnabled()) {
     console.log(`   Auth: ${authManager.listUsers().length} user(s) registered`);
   } else {
-    console.log(`   Auth: disabled (no users registered)`);
-    if (host === "0.0.0.0" || host === "::") {
-      console.log("   WARNING: Web UI is reachable from the network without authentication.");
-      console.log("            Create a user first for LAN/team use: aicli user create <name>");
-    }
+    console.log("   Auth: local launch token (no users registered)");
   }
   const requireAuth = (req, res, next) => {
-    if (!authManager.isEnabled()) return next();
+    if (!authManager.isEnabled()) {
+      if (equalToken(parseCookie(req.headers.cookie ?? "").aicli_local, access.localToken)) return next();
+      res.status(401).json({ error: "Open the launch URL printed by aicli to authorize this browser" });
+      return;
+    }
     const authHeader = req.headers.authorization;
     const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
     const cookieToken = parseCookie(req.headers.cookie ?? "")["aicli_token"];
@@ -24718,19 +24813,20 @@ async function startWebServer(options = {}) {
     next();
   };
   const moduleDir = getModuleDir();
-  let clientDir = join28(moduleDir, "web", "client");
-  if (!existsSync32(clientDir)) {
-    clientDir = join28(moduleDir, "client");
+  let clientDir = join25(moduleDir, "web", "client");
+  if (!existsSync31(clientDir)) {
+    clientDir = join25(moduleDir, "client");
   }
-  if (!existsSync32(clientDir)) {
-    clientDir = join28(moduleDir, "..", "..", "src", "web", "client");
+  if (!existsSync31(clientDir)) {
+    clientDir = join25(moduleDir, "..", "..", "src", "web", "client");
   }
-  if (!existsSync32(clientDir)) {
-    clientDir = join28(process.cwd(), "src", "web", "client");
+  if (!existsSync31(clientDir)) {
+    clientDir = join25(process.cwd(), "src", "web", "client");
   }
   console.log(`   Static files: ${clientDir}`);
   const PRECOMPRESSED_TYPES = {
     ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
     ".css": "text/css; charset=utf-8",
     ".html": "text/html; charset=utf-8",
     ".json": "application/json; charset=utf-8",
@@ -24745,14 +24841,14 @@ async function startWebServer(options = {}) {
     const encoding = /\bbr\b/.test(accept) ? "br" : /\bgzip\b/.test(accept) ? "gzip" : null;
     if (!encoding) return next();
     const target = resolvePath(clientDir, `.${req.path}`) + (encoding === "br" ? ".br" : ".gz");
-    if (!target.startsWith(clientDir) || !existsSync32(target)) return next();
+    if (!target.startsWith(clientDir) || !existsSync31(target)) return next();
     res.setHeader("Content-Type", contentType);
     res.setHeader("Content-Encoding", encoding);
     res.setHeader("Vary", "Accept-Encoding");
     if (req.path.startsWith("/vendor/")) res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
     createReadStream(target).pipe(res);
   });
-  app.use("/vendor", express.static(join28(clientDir, "vendor"), { maxAge: "1y", immutable: true }));
+  app.use("/vendor", express.static(join25(clientDir, "vendor"), { maxAge: "1y", immutable: true }));
   app.use(express.static(clientDir));
   app.get("/api/status", (_req, res) => {
     res.json({
@@ -24771,9 +24867,28 @@ async function startWebServer(options = {}) {
       }
     });
   });
-  app.use(express.json());
-  app.post("/api/auth/register", (req, res) => {
+  app.use(express.json({ limit: "16kb" }));
+  app.post("/api/auth/bootstrap", (req, res) => {
+    if (!equalToken(req.body?.token, access.localToken)) {
+      res.status(403).json({ error: "Invalid launch token" });
+      return;
+    }
+    res.cookie("aicli_local", access.localToken, { httpOnly: true, sameSite: "strict", secure: isHttpsRequest(req) });
+    res.json({ success: true });
+  });
+  app.use("/api/auth", (req, res, next) => {
+    if (!authLimits.take(req.socket.remoteAddress ?? "unknown")) {
+      res.status(429).json({ error: "Too many authentication attempts; try again later" });
+      return;
+    }
+    next();
+  });
+  app.post("/api/auth/register", async (req, res) => {
     const firstRun = !authManager.hasUsers();
+    if (firstRun && !equalToken(parseCookie(req.headers.cookie ?? "").aicli_local, access.localToken)) {
+      res.status(403).json({ error: "Open the launch URL before enabling authentication" });
+      return;
+    }
     if (!firstRun) {
       const authHeader = req.headers.authorization;
       const token2 = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
@@ -24789,23 +24904,24 @@ async function startWebServer(options = {}) {
       res.status(400).json({ error: "Username and password required" });
       return;
     }
-    const err = authManager.register(username, password);
+    const err = await authManager.registerAsync(username, password);
     if (err) {
       res.status(400).json({ error: err });
       return;
     }
-    const token = authManager.login(username, password);
+    const token = await authManager.loginAsync(username, password);
+    invalidateConnections();
     console.log(`   \u2713 User registered via API: ${username}${firstRun ? " (first-run)" : ""}`);
     res.cookie("aicli_token", token, authCookieOptions(req));
     res.json({ success: true, username });
   });
-  app.post("/api/auth/login", (req, res) => {
+  app.post("/api/auth/login", async (req, res) => {
     const { username, password } = req.body ?? {};
     if (!username || !password) {
       res.status(400).json({ error: "Username and password required" });
       return;
     }
-    const token = authManager.login(username, password);
+    const token = await authManager.loginAsync(username, password);
     if (!token) {
       res.status(401).json({ error: "Invalid username or password" });
       return;
@@ -24814,13 +24930,16 @@ async function startWebServer(options = {}) {
     res.json({ success: true, username });
   });
   app.post("/api/auth/logout", (req, res) => {
+    const user = authManager.verifyToken(parseCookie(req.headers.cookie ?? "").aicli_token ?? "");
+    if (user) authManager.logoutAll(user);
+    invalidateConnections();
     res.clearCookie("aicli_token", clearAuthCookieOptions(req));
     res.json({ success: true });
   });
   app.get("/api/files", requireAuth, (req, res) => {
     const cwd = process.cwd();
     const prefix = req.query.prefix || "";
-    const targetDir = join28(cwd, prefix);
+    const targetDir = join25(cwd, prefix);
     try {
       const canonicalTarget = realpathSync3(resolve12(targetDir));
       const canonicalCwd = realpathSync3(resolve12(cwd));
@@ -24837,7 +24956,7 @@ async function startWebServer(options = {}) {
       const entries = readdirSync15(targetDir, { withFileTypes: true });
       const files = entries.filter((e) => !SKIP.has(e.name) && !e.name.startsWith(".")).slice(0, 50).map((e) => ({
         name: e.name,
-        path: relative6(cwd, join28(targetDir, e.name)).replace(/\\/g, "/"),
+        path: relative6(cwd, join25(targetDir, e.name)).replace(/\\/g, "/"),
         isDir: e.isDirectory()
       }));
       res.json({ files });
@@ -24877,8 +24996,8 @@ async function startWebServer(options = {}) {
     try {
       const authUser = req._authUser;
       const histDir = authUser ? getUserShared(authUser).config.getHistoryDir() : config.getHistoryDir();
-      const filePath = join28(histDir, `${id}.json`);
-      if (!existsSync32(filePath)) {
+      const filePath = join25(histDir, `${id}.json`);
+      if (!existsSync31(filePath)) {
         res.status(404).json({ error: "Session not found" });
         return;
       }
@@ -24893,7 +25012,7 @@ async function startWebServer(options = {}) {
         res.status(404).json({ error: "Session not found" });
         return;
       }
-      const data = JSON.parse(readFileSync25(filePath, "utf-8"));
+      const data = JSON.parse(readFileSync22(filePath, "utf-8"));
       res.json({ session: data });
     } catch (err) {
       res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
@@ -24906,9 +25025,10 @@ async function startWebServer(options = {}) {
       return;
     }
     const cwd = process.cwd();
-    const fullPath = resolve12(join28(cwd, filePath));
+    const fullPath = resolve12(join25(cwd, filePath));
     try {
       const canonicalFull = realpathSync3(fullPath);
+      assertReadablePath(canonicalFull);
       const canonicalCwd = realpathSync3(resolve12(cwd));
       if (!canonicalFull.startsWith(canonicalCwd + sep5) && canonicalFull !== canonicalCwd) {
         res.json({ error: "Access denied" });
@@ -24924,7 +25044,7 @@ async function startWebServer(options = {}) {
         res.json({ error: `File too large (${(stat.size / 1024).toFixed(0)} KB, max 512 KB)` });
         return;
       }
-      const content = readFileSync25(fullPath, "utf-8");
+      const content = readFileSync22(fullPath, "utf-8");
       res.json({ content, size: stat.size });
     } catch {
       res.json({ error: "Cannot read file" });
@@ -24936,6 +25056,9 @@ async function startWebServer(options = {}) {
     if (cached) return cached;
     const userDataDir = authManager.getUserDataDir(username);
     const userConfig = new ConfigManager(userDataDir);
+    for (const key of ["defaultPermissionProfile", "allowedPermissionProfiles", "permissionProfiles", "permissionRules", "defaultPermission", "networkPolicy"]) {
+      userConfig.setTransient(key, structuredClone(config.get(key)));
+    }
     if (userConfig.isFirstRun()) {
       userConfig.setTransient("defaultProvider", config.get("defaultProvider"));
       userConfig.setTransient("defaultModels", config.get("defaultModels"));
@@ -24946,7 +25069,7 @@ async function startWebServer(options = {}) {
       // 每用户各自的 config 目录 → 各自的 cost-history.json
       costTracker: new CostTracker(userConfig.getConfigDir()),
       providers,
-      // Shared — providers re-read API keys per call
+      // Host-owned service credentials; shared explicitly, never per-user keys.
       sessions: userSessions,
       toolRegistry,
       // Shared
@@ -24959,6 +25082,21 @@ async function startWebServer(options = {}) {
     return userShared;
   }
   const handlers = /* @__PURE__ */ new Map();
+  const validators = /* @__PURE__ */ new Set();
+  function invalidateConnections() {
+    for (const validate of validators) validate();
+  }
+  let authRefreshTimer;
+  server.on("listening", () => {
+    if (!authRefreshTimer) {
+      authRefreshTimer = setInterval(invalidateConnections, 1e3);
+      authRefreshTimer.unref();
+    }
+  });
+  server.on("close", () => {
+    clearInterval(authRefreshTimer);
+    authRefreshTimer = void 0;
+  });
   wss.on("connection", (ws, req) => {
     const urlStr = req.url ?? "";
     const qMark = urlStr.indexOf("?");
@@ -24966,6 +25104,8 @@ async function startWebServer(options = {}) {
     const tabId = params.get("tabId") || `tab-${Date.now()}`;
     const cookies = parseCookie(req.headers.cookie ?? "");
     const token = cookies["aicli_token"] || "";
+    let activeToken = token;
+    const localAuthorized = equalToken(cookies.aicli_local, access.localToken);
     let tokens = WS_MSG_BURST;
     let lastRefill = Date.now();
     const takeToken = () => {
@@ -25025,7 +25165,7 @@ async function startWebServer(options = {}) {
       authenticatedUser = authManager.verifyToken(token);
     }
     const authRequired = authManager.isEnabled();
-    if (!authRequired) {
+    if (!authRequired && localAuthorized) {
       console.log(`   \u2713 Tab connected: ${tabId.slice(0, 12)} (no auth) (total: ${handlers.size + 1})`);
       handler = attachHandler(shared);
       clearPreAuthTimer();
@@ -25043,7 +25183,26 @@ async function startWebServer(options = {}) {
         }));
       }
     }
+    const validate = () => {
+      if (!handler) return;
+      let valid = false;
+      try {
+        valid = authManager.isEnabled() ? !!activeToken && authManager.verifyToken(activeToken) === authenticatedUser : localAuthorized && !authenticatedUser;
+      } catch {
+      }
+      if (!valid) {
+        handler.onDisconnect(false);
+        if (handlers.get(handlerKey) === handler) handlers.delete(handlerKey);
+        handler = null;
+        ws.close(1008, "Authentication changed; reconnect");
+      }
+    };
+    validators.add(validate);
+    ws.on("close", () => validators.delete(validate));
+    let authBusy = false;
     ws.on("message", async (data) => {
+      validate();
+      if (ws.readyState !== ws.OPEN) return;
       if (!takeToken()) {
         if (ws.readyState === ws.OPEN) {
           try {
@@ -25063,57 +25222,73 @@ async function startWebServer(options = {}) {
           return;
         }
         if (parsed.type === "auth") {
-          const { action, username, password } = parsed;
-          if (action === "register") {
-            if (authManager.hasUsers() && !authenticatedUser) {
-              ws.send(JSON.stringify({ type: "auth_result", success: false, error: "Registration is closed. Use `aicli user create` on the host to add users." }));
+          if (authBusy) return;
+          authBusy = true;
+          try {
+            if (!authLimits.take(req.socket.remoteAddress ?? "unknown")) {
+              ws.close(1008, "Authentication rate limit");
               return;
             }
-            const err = authManager.register(username, password);
-            if (err) {
-              ws.send(JSON.stringify({ type: "auth_result", success: false, error: err }));
+            const { action, password } = parsed;
+            const username = typeof parsed.username === "string" ? parsed.username.trim().toLowerCase() : "";
+            if (action === "register") {
+              if (!authenticatedUser && (authManager.hasUsers() || !localAuthorized)) {
+                ws.send(JSON.stringify({ type: "auth_result", success: false, error: "Registration is closed. Use `aicli user create` on the host to add users." }));
+                return;
+              }
+              const err = await authManager.registerAsync(username, password);
+              if (err) {
+                ws.send(JSON.stringify({ type: "auth_result", success: false, error: err }));
+                return;
+              }
+              activeToken = await authManager.loginAsync(username, password) ?? "";
+              if (ws.readyState !== ws.OPEN || authManager.verifyToken(activeToken) !== username) return;
+              authenticatedUser = username;
+              const userShared = getUserShared(username);
+              handler = attachHandler(userShared);
+              clearPreAuthTimer();
+              invalidateConnections();
+              console.log(`   \u2713 User registered & connected: ${username} (tab: ${tabId.slice(0, 12)})`);
+              ws.send(JSON.stringify({ type: "auth_result", success: true, username }));
               return;
             }
-            authManager.login(username, password);
-            authenticatedUser = username;
-            const userShared = getUserShared(username);
-            handler = attachHandler(userShared);
-            clearPreAuthTimer();
-            console.log(`   \u2713 User registered & connected: ${username} (tab: ${tabId.slice(0, 12)})`);
-            ws.send(JSON.stringify({ type: "auth_result", success: true, username }));
-            return;
-          }
-          if (action === "token") {
-            const { token: clientToken } = parsed;
-            const verifiedUser = authManager.verifyToken(clientToken);
-            if (!verifiedUser) {
-              ws.send(JSON.stringify({ type: "auth_result", success: false, error: "Invalid or expired token" }));
+            if (action === "token") {
+              const { token: clientToken } = parsed;
+              const verifiedUser = authManager.verifyToken(clientToken);
+              if (!verifiedUser) {
+                ws.send(JSON.stringify({ type: "auth_result", success: false, error: "Invalid or expired token" }));
+                return;
+              }
+              activeToken = clientToken;
+              authenticatedUser = verifiedUser;
+              const userShared = getUserShared(verifiedUser);
+              handler = attachHandler(userShared);
+              clearPreAuthTimer();
+              console.log(`   \u2713 Token auth: ${verifiedUser} (tab: ${tabId.slice(0, 12)})`);
+              ws.send(JSON.stringify({ type: "auth_result", success: true, username: verifiedUser }));
               return;
             }
-            authenticatedUser = verifiedUser;
-            const userShared = getUserShared(verifiedUser);
-            handler = attachHandler(userShared);
-            clearPreAuthTimer();
-            console.log(`   \u2713 Token auth: ${verifiedUser} (tab: ${tabId.slice(0, 12)})`);
-            ws.send(JSON.stringify({ type: "auth_result", success: true, username: verifiedUser }));
-            return;
-          }
-          if (action === "login") {
-            const loginToken = authManager.login(username, password);
-            if (!loginToken) {
-              ws.send(JSON.stringify({ type: "auth_result", success: false, error: "Invalid username or password" }));
+            if (action === "login") {
+              const loginToken = await authManager.loginAsync(username, password);
+              if (!loginToken) {
+                ws.send(JSON.stringify({ type: "auth_result", success: false, error: "Invalid username or password" }));
+                return;
+              }
+              if (ws.readyState !== ws.OPEN || authManager.verifyToken(loginToken) !== username) return;
+              activeToken = loginToken;
+              authenticatedUser = username;
+              const userShared = getUserShared(username);
+              handler = attachHandler(userShared);
+              clearPreAuthTimer();
+              console.log(`   \u2713 User logged in: ${username} (tab: ${tabId.slice(0, 12)})`);
+              ws.send(JSON.stringify({ type: "auth_result", success: true, username }));
               return;
             }
-            authenticatedUser = username;
-            const userShared = getUserShared(username);
-            handler = attachHandler(userShared);
-            clearPreAuthTimer();
-            console.log(`   \u2713 User logged in: ${username} (tab: ${tabId.slice(0, 12)})`);
-            ws.send(JSON.stringify({ type: "auth_result", success: true, username }));
+            ws.send(JSON.stringify({ type: "auth_result", success: false, error: "Unknown auth action" }));
             return;
+          } finally {
+            authBusy = false;
           }
-          ws.send(JSON.stringify({ type: "auth_result", success: false, error: "Unknown auth action" }));
-          return;
         }
         if (!handler) {
           if (ws.readyState === ws.OPEN) {
@@ -25159,13 +25334,15 @@ async function startWebServer(options = {}) {
         }
       });
       server.listen(actualPort, host, () => {
-        const url = `http://${host === "0.0.0.0" ? "localhost" : host}:${actualPort}`;
+        actualPort = server.address().port;
+        const address = host.includes(":") ? `[${host}]` : host === "0.0.0.0" ? "localhost" : host;
+        const url = `http://${address}:${actualPort}` + (!authManager.isEnabled() ? `#token=${access.localToken}` : "");
         console.log(`
    \u{1F310} Web UI ready: ${url}`);
         if (actualPort !== port) console.log(`   (port ${port} was in use, using ${actualPort})`);
         if (host === "0.0.0.0" || host === "::") {
           try {
-            const nets = networkInterfaces();
+            const nets = networkInterfaces2();
             for (const name of Object.keys(nets)) {
               for (const net2 of nets[name] ?? []) {
                 if (net2.family === "IPv4" && !net2.internal) {
@@ -25198,27 +25375,24 @@ function resolveProjectMcpPath() {
   const cwd = process.cwd();
   const gitRoot = getGitRoot(cwd);
   const projectRoot = gitRoot ?? cwd;
-  const configPath = join28(projectRoot, MCP_PROJECT_CONFIG_NAME);
-  return existsSync32(configPath) ? configPath : null;
+  const configPath = join25(projectRoot, MCP_PROJECT_CONFIG_NAME);
+  return existsSync31(configPath) ? configPath : null;
 }
 function loadProjectMcpConfig() {
   const cwd = process.cwd();
   const gitRoot = getGitRoot(cwd);
   const projectRoot = gitRoot ?? cwd;
-  const configPath = join28(projectRoot, MCP_PROJECT_CONFIG_NAME);
-  if (!existsSync32(configPath)) return null;
+  const configPath = join25(projectRoot, MCP_PROJECT_CONFIG_NAME);
+  if (!existsSync31(configPath)) return null;
   try {
-    const raw = JSON.parse(readFileSync25(configPath, "utf-8"));
+    const raw = JSON.parse(readFileSync22(configPath, "utf-8"));
     return raw.mcpServers ?? raw;
   } catch {
     return null;
   }
 }
 function isHttpsRequest(req) {
-  if (req.secure) return true;
-  const forwardedProto = req.headers["x-forwarded-proto"];
-  const proto = Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto;
-  return proto?.split(",")[0]?.trim().toLowerCase() === "https";
+  return req.secure || req.res?.locals.externalSecure === true;
 }
 function authCookieOptions(req) {
   return {
@@ -25245,13 +25419,13 @@ function parseCookie(cookie) {
 }
 async function openBrowser(url) {
   try {
-    const { spawn: spawn7 } = await import("child_process");
+    const { spawn: spawn6 } = await import("child_process");
     if (process.platform === "win32") {
-      spawn7("cmd", ["/c", "start", '""', url], { detached: true, stdio: "ignore" }).unref();
+      spawn6("cmd", ["/c", "start", '""', url], { detached: true, stdio: "ignore" }).unref();
     } else if (process.platform === "darwin") {
-      spawn7("open", [url], { detached: true, stdio: "ignore" }).unref();
+      spawn6("open", [url], { detached: true, stdio: "ignore" }).unref();
     } else {
-      spawn7("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
+      spawn6("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
     }
   } catch {
   }