jinzd-ai-cli 0.4.318 → 0.4.320

package/dist/{batch-Y7IG5WTY.js → batch-LRYDPB6F.js}

@@ -4,12 +4,12 @@ import {
 } from "./chunk-RS7SKYTS.js";
 import {
   ConfigManager
-} from "./chunk-DAWPHJSS.js";
+} from "./chunk-DB4HVUPI.js";
 import "./chunk-TU3L3PW7.js";
 import {
   atomicWriteFileSync
 } from "./chunk-BMLQPSHP.js";
-import "./chunk-KPCXZJW2.js";
+import "./chunk-J7IPNING.js";
 
 // src/cli/batch.ts
 import Anthropic from "@anthropic-ai/sdk";

package/dist/{chunk-VXQSMWXN.js → chunk-46M65JDN.js}

@@ -11,7 +11,7 @@ import {
   searchPersistentMemories,
   touchMemoryReferences,
   updateMemoryEntry
-} from "./chunk-APGWL4CQ.js";
+} from "./chunk-WY4IWCQ5.js";
 import {
   indexProject
 } from "./chunk-RWRZVQCB.js";
@@ -30,13 +30,13 @@ import {
   runHook,
   runLifecycleHooks,
   runTool
-} from "./chunk-ZXNQ37FB.js";
+} from "./chunk-5VZHSSLW.js";
 import {
   buildTruncatedArgumentsError,
   getDangerLevel,
   isFileWriteTool,
   runLeanAgentLoop
-} from "./chunk-6VBW3L57.js";
+} from "./chunk-E2W2MI6H.js";
 import {
   EnvLoader,
   NetworkError,
@@ -60,10 +60,11 @@ import {
   decodeWindowsBuffer,
   killProcessTree,
   looksLikeGbkMojibake,
+  posixShell,
   recoverGbkMojibake,
   runTestsTool,
   shellInvocation
-} from "./chunk-TNEGZIP6.js";
+} from "./chunk-NOAWUEJJ.js";
 import {
   CONFIG_DIR_NAME,
   DEFAULT_MAX_TOOL_OUTPUT_CHARS_CAP,
@@ -72,7 +73,7 @@ import {
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-KPCXZJW2.js";
+} from "./chunk-J7IPNING.js";
 import {
   getCurrentSessionKey,
   getExecutionConfigDir,
@@ -84,7 +85,7 @@ import {
 import { spawn } from "child_process";
 import { platform } from "os";
 var IS_WINDOWS2 = platform() === "win32";
-var SHELL = IS_WINDOWS2 ? "powershell.exe" : process.env["SHELL"] ?? "/bin/bash";
+var SHELL = IS_WINDOWS2 ? "powershell.exe" : posixShell();
 var pool = /* @__PURE__ */ new Map();
 var IDLE_EVICT_MS = 5 * 6e4;
 var evictionTimer = null;
@@ -93,7 +94,11 @@ function spawnShell(cwd) {
   const proc = spawn(SHELL, shellArgs, {
     cwd,
     windowsHide: true,
-    stdio: ["pipe", "pipe", "pipe"]
+    stdio: ["pipe", "pipe", "pipe"],
+    // POSIX: own process group, so a timeout / Ctrl+C can kill the whole tree
+    // (killProcessTree with processGroup=true). Without it only the shell host
+    // died and grandchildren were orphaned (2026-10-07 audit A-01).
+    detached: !IS_WINDOWS2
   });
   proc.on("exit", () => {
     for (const [key, entry] of pool) {
@@ -120,13 +125,17 @@ function startEvictionTimer() {
     }
   }, 6e4).unref();
 }
+function stderrMarker(id) {
+  return `AICLI_MARKER_ERR:${id}`;
+}
 function buildWrappedCommand(command, id, isWindows) {
   const markerStart = `AICLI_MARKER_START:${id}`;
   const markerEnd = `AICLI_MARKER_END:${id}`;
   if (!isWindows) {
+    const quoted = `'${command.replace(/'/g, `'\\''`)}'`;
     return `echo "${markerStart}"
-${command}
-echo "${markerEnd}:$?"`;
+eval ${quoted} </dev/null
+__aicli_rc=$?; echo "${stderrMarker(id)}" >&2; echo "${markerEnd}:$__aicli_rc"`;
   }
   const b64 = Buffer.from(command, "utf-8").toString("base64");
   const decoded = `[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('${b64}'))`;
@@ -158,32 +167,46 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
     const markerStartPattern = `AICLI_MARKER_START:${id}`;
     const markerEndPattern = `AICLI_MARKER_END:${id}`;
     const proc = entry.proc;
+    const errMarker = stderrMarker(id);
+    const cleanStderr = (s) => {
+      const i = s.indexOf(errMarker);
+      return i < 0 ? s : s.slice(0, i);
+    };
+    const checkDone = () => {
+      if (resolved) return;
+      const parsed = extractPoolOutput(stdout, markerStartPattern, markerEndPattern);
+      if (parsed.exitCode === null) return;
+      if (!IS_WINDOWS2 && !stderr.includes(errMarker)) return;
+      stdout = parsed.output;
+      stderr = cleanStderr(stderr);
+      resolved = true;
+      cleanup();
+      resolve7({ stdout, stderr, exitCode: parsed.exitCode, timedOut, aborted });
+    };
     const onData = (chunk) => {
       stdout += IS_WINDOWS2 ? decodeWindowsBuffer(chunk) : chunk.toString("utf-8");
-      if (!resolved && stdout.includes(markerEndPattern)) {
-        const endLine = stdout.split("\n").find((l) => l.includes(markerEndPattern));
-        const exitCode = endLine ? parseEndMarker(endLine) : null;
-        stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
-        resolved = true;
-        cleanup();
-        resolve7({ stdout, stderr, exitCode, timedOut, aborted });
-      }
+      checkDone();
     };
     const onErr = (chunk) => {
       stderr += IS_WINDOWS2 ? decodeWindowsBuffer(chunk) : chunk.toString("utf-8");
+      checkDone();
     };
     const finishPoolFailure = (message, exitCode = null) => {
       if (resolved) return;
       resolved = true;
-      stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
+      stdout = extractPoolOutput(stdout, markerStartPattern, markerEndPattern).output;
+      stderr = cleanStderr(stderr);
       stderr += `${stderr ? "\n" : ""}[pool terminated] ${message}`;
       cleanup();
       pool.delete(sessionKey);
-      resolve7({ stdout, stderr, exitCode: exitCode === 0 ? null : exitCode, timedOut, aborted });
+      resolve7({ stdout, stderr, exitCode, timedOut, aborted });
     };
     const onClose = (code, signal) => {
       const detail = signal ? `signal ${signal}` : `exit code ${code ?? "unknown"}`;
-      finishPoolFailure(`Shell exited before the completion marker (${detail}).`, code);
+      finishPoolFailure(
+        `The shell exited before the command finished (${detail}) \u2014 typically an explicit \`exit\`/\`exec\`, or \`set -e\` aborting on a failing command. Shell state (variables, options, functions) was reset; the next command runs in a fresh shell in the same directory.`,
+        signal ? null : code
+      );
     };
     const onStdinError = (err) => {
       finishPoolFailure(`Shell stdin failed: ${err.message}`);
@@ -196,10 +219,11 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
       if (resolved) return;
       timedOut = true;
       resolved = true;
-      stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
+      stdout = extractPoolOutput(stdout, markerStartPattern, markerEndPattern).output;
+      stderr = cleanStderr(stderr);
       cleanup();
       resolve7({ stdout, stderr, exitCode: null, timedOut, aborted });
-      killProcessTree(proc);
+      killProcessTree(proc, true);
       pool.delete(sessionKey);
     }, timeout);
     const onAbort = () => {
@@ -207,9 +231,10 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
       aborted = true;
       resolved = true;
       cleanup();
-      stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
+      stdout = extractPoolOutput(stdout, markerStartPattern, markerEndPattern).output;
+      stderr = cleanStderr(stderr);
       resolve7({ stdout, stderr, exitCode: null, timedOut, aborted });
-      killProcessTree(proc);
+      killProcessTree(proc, true);
       pool.delete(sessionKey);
     };
     if (abortSignal?.aborted) {
@@ -241,36 +266,18 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
     }
   });
 }
-function parseEndMarker(line) {
-  const idx = line.lastIndexOf(":");
-  if (idx < 0) return null;
-  const code = line.slice(idx + 1).trim();
-  return /^\d+$/.test(code) ? Number(code) : null;
+function extractPoolOutput(stdout, startMarker, endMarker) {
+  const startMatch = new RegExp(`${escapeRegExp(startMarker)}\\r?\\n`).exec(stdout);
+  const bodyStart = startMatch ? startMatch.index + startMatch[0].length : 0;
+  const endMatch = new RegExp(`${escapeRegExp(endMarker)}:(\\d+)\\r?\\n`).exec(stdout.slice(bodyStart));
+  const body = endMatch ? stdout.slice(bodyStart, bodyStart + endMatch.index) : stdout.slice(bodyStart);
+  return {
+    output: body.trim(),
+    exitCode: endMatch ? Number(endMatch[1]) : null
+  };
 }
-function stripMarkerOutput(stdout, startMarker, endMarker) {
-  const lines = stdout.split("\n");
-  let capturing = false;
-  const out = [];
-  for (const line of lines) {
-    if (line.includes(startMarker)) {
-      capturing = true;
-      continue;
-    }
-    if (line.includes(endMarker)) {
-      capturing = false;
-      continue;
-    }
-    if (capturing) {
-      out.push(line);
-    }
-  }
-  if (!stdout.includes(endMarker) && out.length === 0) {
-    const startIdx = stdout.indexOf(startMarker);
-    if (startIdx >= 0) {
-      return stdout.slice(startIdx + startMarker.length).trimStart();
-    }
-  }
-  return out.join("\n").trim();
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function cleanupPoolSession(sessionKey) {
   const entry = pool.get(sessionKey);
@@ -427,7 +434,7 @@ var undoStack = new UndoStack();
 
 // src/tools/builtin/bash.ts
 var IS_WINDOWS3 = platform2() === "win32";
-var SHELL2 = IS_WINDOWS3 ? "powershell.exe" : process.env["SHELL"] ?? "/bin/bash";
+var SHELL2 = IS_WINDOWS3 ? "powershell.exe" : posixShell();
 var cwdBySession = /* @__PURE__ */ new Map();
 function getCwd() {
   const key = getCurrentSessionKey();
@@ -556,7 +563,8 @@ Important rules:
       }
       if (timedOut) {
         pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
-        throw new ToolError("bash", formatTimeoutMessage(timeout, MAX_TIMEOUT, command));
+        throw new ToolError("bash", formatTimeoutMessage(timeout, MAX_TIMEOUT, command, `${stdout}
+${stderr}`));
       }
       if (status !== 0 || timedOut) {
         const poolStdout = (stdout ?? "").trim();
@@ -575,7 +583,12 @@ ${combined || formatFailureFallback(status)}
       }
       pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
       updateCwdFromCommand(command, effectiveCwd);
-      return annotateSuccessOutput(command, stdout) || emptyOutputResult(command, stderr ?? "");
+      const out = annotateSuccessOutput(command, suppressBinaryOutput(stdout));
+      const poolNote = /\[pool terminated\]/.test(stderr ?? "") ? `
+
+${(stderr ?? "").trim()}` : "";
+      const body = out ? out + poolNote : emptyOutputResult(command, stderr ?? "");
+      return body + backgroundJobNote(command);
     }
     try {
       const { stdout, stderr, status, signal, timedOut, aborted } = await runShell(
@@ -612,17 +625,18 @@ ${combined || formatFailureFallback(status)}
       updateCwdFromCommand(command, effectiveCwd);
       pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
       const result = Buffer.isBuffer(stdout) ? IS_WINDOWS3 ? decodeWindowsBuffer(stdout) : stdout.toString("utf-8") : String(stdout ?? "");
-      return annotateSuccessOutput(command, result) || emptyOutputResult(
+      return (annotateSuccessOutput(command, suppressBinaryOutput(result)) || emptyOutputResult(
         command,
         Buffer.isBuffer(stderr) ? IS_WINDOWS3 ? decodeWindowsBuffer(stderr) : stderr.toString("utf-8") : String(stderr ?? "")
-      );
+      )) + backgroundJobNote(command);
     } catch (err) {
       pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
       if (err && typeof err === "object") {
         const execErr = err;
         const isTimeout = execErr.code === "ETIMEDOUT" || execErr.status == null && execErr.signal === "SIGTERM" || /ETIMEDOUT/i.test(execErr.message ?? "");
         if (isTimeout) {
-          throw new ToolError("bash", formatTimeoutMessage(timeout, MAX_TIMEOUT, command));
+          const captured = [execErr.stdout, execErr.stderr].map((b) => Buffer.isBuffer(b) ? IS_WINDOWS3 ? decodeWindowsBuffer(b) : b.toString("utf-8") : String(b ?? "")).join("\n");
+          throw new ToolError("bash", formatTimeoutMessage(timeout, MAX_TIMEOUT, command, captured));
         }
         if ("status" in execErr && execErr.status !== void 0) {
           const stderr = IS_WINDOWS3 && Buffer.isBuffer(execErr.stderr) ? decodeWindowsBuffer(execErr.stderr).trim() : execErr.stderr?.toString().trim() ?? "";
@@ -655,8 +669,15 @@ function looksLikeTestCommand(command) {
     /(?:^|[;&|(\s])(?:go|cargo)\s+test\b/.test(command)
   );
 }
-function formatTimeoutMessage(timeout, maxTimeout, command) {
+var TIMEOUT_CAPTURE_MAX = 2e3;
+function formatTimeoutMessage(timeout, maxTimeout, command, captured) {
   const seconds = Math.round(timeout / 1e3);
+  const tail = (captured ?? "").trim();
+  const capturedSection = tail ? [
+    "Output captured before the timeout (last part \u2014 the cause is often here):",
+    tail.length > TIMEOUT_CAPTURE_MAX ? "\u2026" + tail.slice(-TIMEOUT_CAPTURE_MAX) : tail,
+    ""
+  ] : [];
   const testRunnerHint = command !== void 0 && looksLikeTestCommand(command) ? [
     "This looks like a TEST run. Prefer the 'run_tests' tool instead of running the test runner through bash: it has a 5-minute timeout, auto-detects the framework, and returns a structured summary (no findstr/grep filtering needed).",
     ""
@@ -664,6 +685,7 @@ function formatTimeoutMessage(timeout, maxTimeout, command) {
   return [
     `Command timed out after ${seconds}s.`,
     "",
+    ...capturedSection,
     ...testRunnerHint,
     "The previous command ran for longer than the timeout limit and was killed. This usually means it is scanning a large filesystem tree (recursive Get-ChildItem / find), compressing a big archive, or waiting on a network request.",
     "",
@@ -836,6 +858,19 @@ ${err}`;
   return detectPowerShellBackslashQuote(command) ? base + BACKSLASH_QUOTE_SILENT_WARNING : base;
 }
 var PS_TEXT_READ_CMDLET = /\b(?:Get-Content|gc|cat|type|Select-String|sls|Import-Csv)\b/i;
+function suppressBinaryOutput(stdout) {
+  if (!stdout) return stdout;
+  const sample = stdout.slice(0, 8e3);
+  const replacement = (sample.match(/\uFFFD/g) ?? []).length;
+  if (!sample.includes("\0") && !(sample.length >= 64 && replacement / sample.length > 0.3)) {
+    return stdout;
+  }
+  return `[binary output suppressed: ${Buffer.byteLength(stdout, "utf-8")} bytes. Inspect it with a hex dump limited in size (e.g. \`xxd file | head -20\`), or use \`file\` to identify the type.]`;
+}
+function backgroundJobNote(command) {
+  if (IS_WINDOWS3 || !/(?:^|\s)&(?![&>])/m.test(command)) return "";
+  return "\n\n[Note: this command started a background job (`&`). It is not tracked by aicli \u2014 task_list/task_stop cannot see it and it keeps running after this session. For long-running processes (dev servers, watchers) prefer task_create.]";
+}
 function annotateSuccessOutput(command, stdout) {
   if (!IS_WINDOWS3 || !PS_TEXT_READ_CMDLET.test(command)) return stdout;
   if (!looksLikeGbkMojibake(stdout)) return stdout;
@@ -1013,7 +1048,9 @@ function runShell(command, opts) {
       cwd: opts.cwd,
       env: opts.env,
       windowsHide: true,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      // POSIX: own process group so killChild can take the whole tree down (A-01).
+      detached: !IS_WINDOWS3
     });
     const stdoutChunks = [];
     const stderrChunks = [];
@@ -1070,7 +1107,7 @@ function runShell(command, opts) {
   });
 }
 function killChild(child) {
-  killProcessTree(child);
+  killProcessTree(child, true);
 }
 function updateCwdFromCommand(command, baseCwd) {
   const cdMatches = [...command.matchAll(/(?:^|[;&|])\s*cd\s+(['"]?)([^\s;&|'"]+)\1/g)];

package/dist/{chunk-SPSFCJLM.js → chunk-4S2XD3M2.js}

@@ -8,13 +8,13 @@ import {
   listHooks,
   listInstalledPlugins,
   resetStats
-} from "./chunk-ZXNQ37FB.js";
+} from "./chunk-5VZHSSLW.js";
 import {
   ProviderRegistry
-} from "./chunk-MBI4RPRN.js";
+} from "./chunk-YAMPLTYO.js";
 import {
   ConfigManager
-} from "./chunk-DAWPHJSS.js";
+} from "./chunk-DB4HVUPI.js";
 import {
   getGitRoot
 } from "./chunk-HOSJZMQS.js";
@@ -26,7 +26,7 @@ import {
   MCP_PROJECT_CONFIG_NAME,
   MEMORY_FILE_NAME,
   VERSION
-} from "./chunk-KPCXZJW2.js";
+} from "./chunk-J7IPNING.js";
 
 // src/diagnostics/doctor-report.ts
 import { existsSync as existsSync3, statSync as statSync2 } from "fs";

package/dist/{chunk-ZXNQ37FB.js → chunk-5VZHSSLW.js}

@@ -8,7 +8,7 @@ import {
 import {
   CONFIG_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-KPCXZJW2.js";
+} from "./chunk-J7IPNING.js";
 
 // src/diagnostics/tool-stats.ts
 import { mkdirSync } from "fs";

package/dist/{chunk-DAWPHJSS.js → chunk-DB4HVUPI.js}

@@ -11,7 +11,7 @@ import {
   CONFIG_FILE_NAME,
   HISTORY_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-KPCXZJW2.js";
+} from "./chunk-J7IPNING.js";
 
 // src/config/config-manager.ts
 import { readFileSync, existsSync, mkdirSync } from "fs";

package/dist/{chunk-6VBW3L57.js → chunk-E2W2MI6H.js}

@@ -14,6 +14,14 @@ var HALLUCINATION_PATTERNS = [
   // 已创建！
   /File\s+(?:written|saved|created)\s+(?:to|as|at)/i,
   // File written to / saved as（要求介词）
+  // 2026-10-07 审计 B-02：中英文判据不对称。中文「已保存到」要求引号、英文只认 `File saved to`，
+  // 于是「已保存到 report.md。」「I saved the changes to src/index.ts.」双双漏检。
+  // 改为「后面跟一个带扩展名的文件名」——同样挡得住「已保存到数据库」「saved my time」这类误报。
+  /已(?:保存|写入)到?\s*[^\s，,。；;：:]{1,120}\.\w{1,6}(?![\w/])/,
+  // 动词后直接跟文件名（中间只许冠词 / both / the file 之类），或「动词 … to/into 文件名」。
+  // 刻意不放宽成「同句任意文件名」：「I saved you some time by checking README.md」不是写入声明。
+  /\b(?:I|We)(?:'ve| have)?\s+(?:now\s+|just\s+|also\s+|successfully\s+)?(?:created|written|wrote|saved|generated)\s+(?:(?:the|a|an|both|all|two|three|new|following)\s+)*(?:(?:files?|documents?|reports?|scripts?)\s+)?[`'"]?[\w./-]+\.(?:md|txt|json|ya?ml|csv|html?|css|[jt]sx?|py|sh|go|rs|java|sql|xml|toml|ini|cfg|pdf|docx?|xlsx?|pptx?)\b/i,
+  /\b(?:I|We)(?:'ve| have)?\s+(?:now\s+|just\s+|also\s+|successfully\s+)?(?:created|written|wrote|saved|generated)\b[^.\n]{0,40}?\b(?:to|into)\s+[`'"]?[\w./-]+\.(?:md|txt|json|ya?ml|csv|html?|css|[jt]sx?|py|sh|go|rs|java|sql|xml|toml|ini|cfg|pdf|docx?|xlsx?|pptx?)\b/i,
   /生成完成[！!]/,
   // 生成完成！
   /✅\s*(?:文件|已[生保写创]|第)\S*\.\w{1,5}/,
@@ -64,6 +72,8 @@ var QUICK_WRITE_KEYWORDS = [
   "saved",
   "written",
   "created",
+  "wrote",
+  "generated",
   "File",
   "file",
   // emoji 勾选标记
@@ -186,8 +196,13 @@ function extractClaimedFilePaths(content) {
   }
   const zhRe = /(?:已保存(?:到)?|已写入(?:到)?|已创建|已生成|文件路径[：:]|保存为|写入到)\s*[`'”””]?([^\s`'”””，,。\n]+\.\w{1,6})/g;
   while ((m = zhRe.exec(content)) !== null) add(m[1]);
-  const enRe = /(?:saved|written|created)\s+(?:to|as|at)\s+[`'”]?([^\s`'”\n,]+\.\w{1,6})/gi;
+  const enRe = /\b(?:saved|written|wrote|created)\b[^.\n]{0,40}?\b(?:to|as|at|into)\s+[`'”]?([^\s`'”\n,]+\.\w{1,6})/gi;
   while ((m = enRe.exec(content)) !== null) add(m[1]);
+  const enClaimRe = /\b(?:I|We)(?:'ve| have)?\s+(?:now\s+|just\s+|also\s+|successfully\s+)?(?:created|written|wrote|saved|generated)\b([^\n;]*)/gi;
+  while ((m = enClaimRe.exec(content)) !== null) {
+    const clause = m[1].split(/[.!?](?:\s|$)|\b(?:based on|from|using|per|according to|referencing|following|after|by|while|when|checking|reading|reviewing)\b/i)[0] ?? "";
+    for (const f of clause.matchAll(/[`'"]?([\w./-]+\.\w{1,6})\b/g)) add(f[1]);
+  }
   const checkRe = /✅[^\n`]*?[`'”]?([^\s`'”\n,，。]+?\.\w{1,6})/g;
   while ((m = checkRe.exec(content)) !== null) {
     const pathStart = m.index + m[0].lastIndexOf(m[1]);
@@ -462,8 +477,27 @@ var META_NARRATION_HEURISTICS = [
   /(?:我来|让我|容我)\s*(?:整理|梳理|归纳|想想|看看|重新|检查|核实)/u,
   // 过渡语（需要 2+ hits）："以下是：" / "如下：" 作为独立行。文档中可作小节标题，
   // 但配合另一个对话模式（如"好的"）时是典型的 AI 内容包装。
-  /^.{0,60}(?:以下是|下面是|如下)\s*[：:，,]\s*$/mu
+  /^.{0,60}(?:以下是|下面是|如下)\s*[：:，,]\s*$/mu,
+  // 叙述自己要调用工具（2026-10-07 审计 B-05）：文档正文不会这样写自己。
+  /(?:让我|我来|我将|我会|接下来)\s*(?:调用|使用|用)\s*`?\w+`?\s*工具/u,
+  /\bI(?:'ll| will| am going to)\s+(?:now\s+)?(?:use|call|invoke)\s+the\s+`?\w+`?\s+tool\b/i
+];
+var ANNOUNCEMENT_PATTERNS = [
+  /^\s*(?:好的|好|收到|明白|了解|嗯|OK|Okay|Sure|Certainly)[，,。.!！\s]/iu,
+  /(?:我(?:这就|马上|现在|立即|立刻|来|将|会)|让我|下面我|接下来我)\s*(?:为[您你])?\s*(?:开始|着手|撰写|写|生成|整理|输出|编写|准备|调用|使用)/u,
+  /(?:请稍[候等]|稍等|马上就好|这就开始)/u,
+  /\b(?:let me|I(?:'ll| will| am going to)|I'm going to)\s+(?:now\s+)?(?:write|draft|generate|create|start|prepare|produce|compose|use|call)\b/i,
+  /\b(?:please wait|one moment|stand by)\b/i
 ];
+function looksLikeAnnouncementOnly(content) {
+  const text = content.trim();
+  if (!text || text.length > 300 || text.split("\n").length > 4) return null;
+  if (/^#{1,6}\s+\S/m.test(text)) return null;
+  for (const re of ANNOUNCEMENT_PATTERNS) {
+    if (re.test(text)) return re.source;
+  }
+  return null;
+}
 var CHINESE_TAIL_CLOSING_MARKERS = [
   /(?:需要你|请你|麻烦你|你看)\s*(?:确认|决定|选择|帮忙|看[一看下]|过目|觉得|认为)/u,
   /(?:随时|有问题|有需要|需要调整|需要修改)\s*(?:联系|找我|告诉|沟通|调整|修改)/u,
@@ -600,6 +634,15 @@ This fresh stream has NO tools \u2014 output is captured verbatim. STOP emitting
       summary: `[save_last_response REJECTED] The content-only stream produced NO text at all (output budget likely spent on reasoning). ${saveToFile} was NOT saved.`
     };
   }
+  const announced = looksLikeAnnouncementOnly(rawContent);
+  if (announced) {
+    return fallback(`announcement only: ${announced}`) ?? {
+      kind: "reject",
+      reason: "not-a-document",
+      matched: announced,
+      summary: `[save_last_response REJECTED] The content-only stream produced only an announcement (e.g. "OK, I'll write the report now\u2026"), not the document itself. ${saveToFile} was NOT saved.`
+    };
+  }
   const { lines, bytes } = teeFileStats(rawContent);
   return {
     kind: "ok",
@@ -621,6 +664,7 @@ function teeStreamErrorSummary(saveToFile, errMsg) {
 // src/core/stalled-intent.ts
 var WAITING_FOR_USER_RE = /[？?]\s*$|是否|要不要|需不需要|需要我|要我|可以吗|好吗|行吗|您看|你看看|请确认|确认后|同意后|如果(?:你|您)|若(?:你|您)|如(?:你|您)需要|等你|等待(?:你|您)|待(?:你|您)|我可以|我也可以|还可以|(?:你|您)可以|告诉我|或者(?:让我|我)|可以为(?:你|您)|可以帮|随时|\bwould you\b|\bshall i\b|\bshould i\b|\bdo you want\b|\blet me know\b|\bif you(?:'d| would)? like\b|\bonce you confirm\b|\byour (?:approval|confirmation)\b|\bif you want\b|\bi can also\b/i;
 var COMPLETED_RE = /已|完成|好了|完毕|写好|搞定|\b(?:done|finished|completed|have (?:written|created|generated))\b/i;
+var NEGATION_RE = /没有?|未|无法|不(?:会|能|再|打算|需要|用|必|要)|n't\b|\b(?:not|never|no longer|cannot)\b/i;
 var CN_VERBS = "\u5F00\u5199|\u52A8\u624B|\u7F16\u5199|\u5199\u5165|\u5199|\u751F\u6210|\u521B\u5EFA|\u5236\u4F5C|\u6267\u884C|\u8FD0\u884C|\u5B89\u88C5|\u4FEE\u6539|\u66F4\u65B0|\u4FEE\u590D|\u5B9E\u73B0|\u6784\u5EFA|\u8F93\u51FA|\u4FDD\u5B58|\u8BFB\u53D6|\u67E5\u770B|\u68C0\u67E5|\u8C03\u7528|\u5904\u7406|\u6574\u7406|\u8865\u5145|\u5B8C\u5584|\u91CD\u5199|\u6539\u5199|\u843D\u76D8";
 var CN_FIRST_PERSON_INTENT_RE = new RegExp(
   `(?:\u6211|\u54B1\u4EEC|\u6211\u4EEC|\u8BA9\u6211)(?:\u73B0\u5728|\u8FD9\u5C31|\u9A6C\u4E0A|\u7ACB\u5373|\u7ACB\u523B|\u76F4\u63A5|\u63A5\u4E0B\u6765|\u4E0B\u9762|\u5148|\u518D|\u968F\u540E|\u7136\u540E|\u5C31)*(?:\u5C06|\u4F1A|\u8981|\u6765|\u53BB|\u5F00\u59CB|\u7740\u624B|\u51C6\u5907)?(?:[^\uFF0C,\u3002\uFF01!\uFF1B;\uFF1A:\\n]{0,4})?(?:${CN_VERBS})`
@@ -642,11 +686,11 @@ function detectStalledIntent(content) {
   if (WAITING_FOR_USER_RE.test(tail)) return null;
   const clauses = tail.split(/[，,；;。！!：:\n]/).map((c) => c.trim()).filter(Boolean);
   for (const clause of clauses) {
-    if (COMPLETED_RE.test(clause)) continue;
+    if (COMPLETED_RE.test(clause) || NEGATION_RE.test(clause)) continue;
     if (CN_FIRST_PERSON_INTENT_RE.test(clause) || CN_BARE_INTENT_RE.test(clause)) return clause;
   }
   for (const sentence of tail.split(/(?<=[.!])\s+|\n/)) {
-    if (COMPLETED_RE.test(sentence)) continue;
+    if (COMPLETED_RE.test(sentence) || NEGATION_RE.test(sentence)) continue;
     const m = EN_INTENT_RE.exec(sentence);
     if (m) return sentence.trim();
   }
@@ -1094,7 +1138,12 @@ async function runAgentLoop(host) {
       if (tc.name.startsWith("mcp__")) host.onMcpToolUsed?.(tc.name);
     }
     host.persistRound?.(toolCalls, toolResults, {
-      assistantContent: outcome.content,
+      // 工具调用前模型说的话（"A 方向汇报：…"、"先看一下配置"）挂在 _streamedText 上：
+      // 本轮上下文里有（buildToolResultMessages 会带上），但此前存档只取 outcome.content，
+      // 而工具调用轮次的 outcome 没有 content——2026-10-07 审计会话 157 条带工具调用的
+      // assistant 消息正文**全部为空**：下一条用户消息时模型看不到自己之前的阶段性汇报，
+      // /session show、导出、回放也全缺这部分（审计 X-01）。
+      assistantContent: outcome.content ?? toolCalls._streamedText,
       reasoningContent: outcome.reasoningContent
     });
     host.afterToolRoundPersist?.(toolCalls, toolResults, extraMessages);
@@ -1149,6 +1198,7 @@ async function runLeanAgentLoop(opts) {
   let roundsUsed = 0;
   let toolCallCount = 0;
   let stalledIntentNudges = 0;
+  let hallucinationRetries = 0;
   try {
     for (let round = 0; round < opts.maxRounds; round++) {
       roundsUsed = round + 1;
@@ -1164,6 +1214,7 @@ async function runLeanAgentLoop(opts) {
           timeout: opts.chatParams?.timeout,
           thinking: opts.chatParams?.thinking,
           thinkingEffort: opts.chatParams?.thinkingEffort,
+          thinkingBudget: opts.chatParams?.thinkingBudget,
           ...extraMessages.length > 0 ? { _extraMessages: extraMessages } : {}
         },
         opts.toolDefsForRound(round)
@@ -1183,6 +1234,24 @@ async function runLeanAgentLoop(opts) {
           );
           continue;
         }
+        const nextTools = round < opts.maxRounds - 1 ? opts.toolDefsForRound(round + 1) : [];
+        const canWrite = nextTools.some((t) => t.name === "write_file" || t.name === "edit_file");
+        if (canWrite && hallucinationRetries < 1 && result.content) {
+          const alreadyWrote = hadPreviousWriteToolCalls(extraMessages);
+          const coarse = !alreadyWrote && detectsHallucinatedFileOp(result.content) && extractBashCommands(extraMessages).length === 0;
+          const phantom = coarse || alreadyWrote ? findPhantomClaims(result.content, extraMessages) : [];
+          if (phantom.length > 0 || coarse) {
+            hallucinationRetries++;
+            extraMessages.push(
+              { role: "assistant", content: result.content },
+              {
+                role: "user",
+                content: phantom.length > 0 ? buildPhantomCorrectionMessage(phantom) : HALLUCINATION_CORRECTION_MESSAGE
+              }
+            );
+            continue;
+          }
+        }
         content = result.content;
         break;
       }
@@ -1219,7 +1288,8 @@ function getDangerLevel(toolName, args) {
     if (/\bgit\s+(?:clean\b|reset\s+--hard\b|push\b[^\n]*(?:--force\b|\s-f\b))/i.test(cmd)) return "destructive";
     if (/\brm\s+[^\n]*(?:-\w*[rRfF]\w*|--recursive|--force)\b/.test(cmd)) return "destructive";
     if (/\brm\s+\S/.test(cmd)) return "destructive";
-    if (/\brmdir\b|\bformat\b|\bmkfs\b|\bdd\s+if=|\bshred\b|\bfdisk\b|\bparted\b/.test(cmd)) return "destructive";
+    if (/\brmdir\b|\bmkfs\b|\bdd\s+if=|\bshred\b|\bfdisk\b|\bparted\b/.test(cmd)) return "destructive";
+    if (/(?:^|[;&|(\n]\s*)format(?:\.com)?\s+[A-Za-z]:/im.test(cmd)) return "destructive";
     if (/\bshutdown\b|\breboot\b|\bhalt\b|\bpoweroff\b/.test(cmd)) return "destructive";
     if (/\bkill\s+-9\b|\bkillall\b/.test(cmd)) return "destructive";
     if (/\bRemove-Item\b|\bri\s+\S/i.test(cmd)) return "destructive";

package/dist/{chunk-KPCXZJW2.js → chunk-J7IPNING.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/core/constants.ts
-var VERSION = "0.4.318";
+var VERSION = "0.4.320";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";