jinzd-ai-cli 0.4.318 → 0.4.320

package/dist/electron-server.js

@@ -55,7 +55,7 @@ import {
   touchMemoryReferences,
   updateMemoryApproval,
   updateMemoryEntry
-} from "./chunk-4MLOMT3W.js";
+} from "./chunk-WW2LFOWE.js";
 import {
   DEFAULT_PATTERNS,
   redactJson,
@@ -77,10 +77,11 @@ import {
   decodeWindowsBuffer,
   killProcessTree,
   looksLikeGbkMojibake,
+  posixShell,
   recoverGbkMojibake,
   runTestsTool,
   shellInvocation
-} from "./chunk-IODFI5GY.js";
+} from "./chunk-N6YFBRQV.js";
 import {
   getCurrentSessionKey,
   getExecutionConfigDir,
@@ -122,7 +123,7 @@ import {
   SUBAGENT_MAX_ROUNDS_LIMIT,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-ZGIMXWXZ.js";
+} from "./chunk-SKQUWDRM.js";
 
 // src/web/access.ts
 import { randomBytes, timingSafeEqual } from "crypto";
@@ -1391,7 +1392,8 @@ function getDangerLevel(toolName, args) {
     if (/\bgit\s+(?:clean\b|reset\s+--hard\b|push\b[^\n]*(?:--force\b|\s-f\b))/i.test(cmd)) return "destructive";
     if (/\brm\s+[^\n]*(?:-\w*[rRfF]\w*|--recursive|--force)\b/.test(cmd)) return "destructive";
     if (/\brm\s+\S/.test(cmd)) return "destructive";
-    if (/\brmdir\b|\bformat\b|\bmkfs\b|\bdd\s+if=|\bshred\b|\bfdisk\b|\bparted\b/.test(cmd)) return "destructive";
+    if (/\brmdir\b|\bmkfs\b|\bdd\s+if=|\bshred\b|\bfdisk\b|\bparted\b/.test(cmd)) return "destructive";
+    if (/(?:^|[;&|(\n]\s*)format(?:\.com)?\s+[A-Za-z]:/im.test(cmd)) return "destructive";
     if (/\bshutdown\b|\breboot\b|\bhalt\b|\bpoweroff\b/.test(cmd)) return "destructive";
     if (/\bkill\s+-9\b|\bkillall\b/.test(cmd)) return "destructive";
     if (/\bRemove-Item\b|\bri\s+\S/i.test(cmd)) return "destructive";
@@ -2431,6 +2433,14 @@ var HALLUCINATION_PATTERNS = [
   // 已创建！
   /File\s+(?:written|saved|created)\s+(?:to|as|at)/i,
   // File written to / saved as（要求介词）
+  // 2026-10-07 审计 B-02：中英文判据不对称。中文「已保存到」要求引号、英文只认 `File saved to`，
+  // 于是「已保存到 report.md。」「I saved the changes to src/index.ts.」双双漏检。
+  // 改为「后面跟一个带扩展名的文件名」——同样挡得住「已保存到数据库」「saved my time」这类误报。
+  /已(?:保存|写入)到?\s*[^\s，,。；;：:]{1,120}\.\w{1,6}(?![\w/])/,
+  // 动词后直接跟文件名（中间只许冠词 / both / the file 之类），或「动词 … to/into 文件名」。
+  // 刻意不放宽成「同句任意文件名」：「I saved you some time by checking README.md」不是写入声明。
+  /\b(?:I|We)(?:'ve| have)?\s+(?:now\s+|just\s+|also\s+|successfully\s+)?(?:created|written|wrote|saved|generated)\s+(?:(?:the|a|an|both|all|two|three|new|following)\s+)*(?:(?:files?|documents?|reports?|scripts?)\s+)?[`'"]?[\w./-]+\.(?:md|txt|json|ya?ml|csv|html?|css|[jt]sx?|py|sh|go|rs|java|sql|xml|toml|ini|cfg|pdf|docx?|xlsx?|pptx?)\b/i,
+  /\b(?:I|We)(?:'ve| have)?\s+(?:now\s+|just\s+|also\s+|successfully\s+)?(?:created|written|wrote|saved|generated)\b[^.\n]{0,40}?\b(?:to|into)\s+[`'"]?[\w./-]+\.(?:md|txt|json|ya?ml|csv|html?|css|[jt]sx?|py|sh|go|rs|java|sql|xml|toml|ini|cfg|pdf|docx?|xlsx?|pptx?)\b/i,
   /生成完成[！!]/,
   // 生成完成！
   /✅\s*(?:文件|已[生保写创]|第)\S*\.\w{1,5}/,
@@ -2481,6 +2491,8 @@ var QUICK_WRITE_KEYWORDS = [
   "saved",
   "written",
   "created",
+  "wrote",
+  "generated",
   "File",
   "file",
   // emoji 勾选标记
@@ -2597,8 +2609,13 @@ function extractClaimedFilePaths(content) {
   }
   const zhRe = /(?:已保存(?:到)?|已写入(?:到)?|已创建|已生成|文件路径[：:]|保存为|写入到)\s*[`'”””]?([^\s`'”””，,。\n]+\.\w{1,6})/g;
   while ((m = zhRe.exec(content)) !== null) add(m[1]);
-  const enRe = /(?:saved|written|created)\s+(?:to|as|at)\s+[`'”]?([^\s`'”\n,]+\.\w{1,6})/gi;
+  const enRe = /\b(?:saved|written|wrote|created)\b[^.\n]{0,40}?\b(?:to|as|at|into)\s+[`'”]?([^\s`'”\n,]+\.\w{1,6})/gi;
   while ((m = enRe.exec(content)) !== null) add(m[1]);
+  const enClaimRe = /\b(?:I|We)(?:'ve| have)?\s+(?:now\s+|just\s+|also\s+|successfully\s+)?(?:created|written|wrote|saved|generated)\b([^\n;]*)/gi;
+  while ((m = enClaimRe.exec(content)) !== null) {
+    const clause = m[1].split(/[.!?](?:\s|$)|\b(?:based on|from|using|per|according to|referencing|following|after|by|while|when|checking|reading|reviewing)\b/i)[0] ?? "";
+    for (const f of clause.matchAll(/[`'"]?([\w./-]+\.\w{1,6})\b/g)) add(f[1]);
+  }
   const checkRe = /✅[^\n`]*?[`'”]?([^\s`'”\n,，。]+?\.\w{1,6})/g;
   while ((m = checkRe.exec(content)) !== null) {
     const pathStart = m.index + m[0].lastIndexOf(m[1]);
@@ -2873,8 +2890,27 @@ var META_NARRATION_HEURISTICS = [
   /(?:我来|让我|容我)\s*(?:整理|梳理|归纳|想想|看看|重新|检查|核实)/u,
   // 过渡语（需要 2+ hits）："以下是：" / "如下：" 作为独立行。文档中可作小节标题，
   // 但配合另一个对话模式（如"好的"）时是典型的 AI 内容包装。
-  /^.{0,60}(?:以下是|下面是|如下)\s*[：:，,]\s*$/mu
+  /^.{0,60}(?:以下是|下面是|如下)\s*[：:，,]\s*$/mu,
+  // 叙述自己要调用工具（2026-10-07 审计 B-05）：文档正文不会这样写自己。
+  /(?:让我|我来|我将|我会|接下来)\s*(?:调用|使用|用)\s*`?\w+`?\s*工具/u,
+  /\bI(?:'ll| will| am going to)\s+(?:now\s+)?(?:use|call|invoke)\s+the\s+`?\w+`?\s+tool\b/i
+];
+var ANNOUNCEMENT_PATTERNS = [
+  /^\s*(?:好的|好|收到|明白|了解|嗯|OK|Okay|Sure|Certainly)[，,。.!！\s]/iu,
+  /(?:我(?:这就|马上|现在|立即|立刻|来|将|会)|让我|下面我|接下来我)\s*(?:为[您你])?\s*(?:开始|着手|撰写|写|生成|整理|输出|编写|准备|调用|使用)/u,
+  /(?:请稍[候等]|稍等|马上就好|这就开始)/u,
+  /\b(?:let me|I(?:'ll| will| am going to)|I'm going to)\s+(?:now\s+)?(?:write|draft|generate|create|start|prepare|produce|compose|use|call)\b/i,
+  /\b(?:please wait|one moment|stand by)\b/i
 ];
+function looksLikeAnnouncementOnly(content) {
+  const text = content.trim();
+  if (!text || text.length > 300 || text.split("\n").length > 4) return null;
+  if (/^#{1,6}\s+\S/m.test(text)) return null;
+  for (const re of ANNOUNCEMENT_PATTERNS) {
+    if (re.test(text)) return re.source;
+  }
+  return null;
+}
 var CHINESE_TAIL_CLOSING_MARKERS = [
   /(?:需要你|请你|麻烦你|你看)\s*(?:确认|决定|选择|帮忙|看[一看下]|过目|觉得|认为)/u,
   /(?:随时|有问题|有需要|需要调整|需要修改)\s*(?:联系|找我|告诉|沟通|调整|修改)/u,
@@ -3011,6 +3047,15 @@ This fresh stream has NO tools \u2014 output is captured verbatim. STOP emitting
       summary: `[save_last_response REJECTED] The content-only stream produced NO text at all (output budget likely spent on reasoning). ${saveToFile} was NOT saved.`
     };
   }
+  const announced = looksLikeAnnouncementOnly(rawContent);
+  if (announced) {
+    return fallback(`announcement only: ${announced}`) ?? {
+      kind: "reject",
+      reason: "not-a-document",
+      matched: announced,
+      summary: `[save_last_response REJECTED] The content-only stream produced only an announcement (e.g. "OK, I'll write the report now\u2026"), not the document itself. ${saveToFile} was NOT saved.`
+    };
+  }
   const { lines, bytes } = teeFileStats(rawContent);
   return {
     kind: "ok",
@@ -3032,6 +3077,7 @@ function teeStreamErrorSummary(saveToFile, errMsg) {
 // src/core/stalled-intent.ts
 var WAITING_FOR_USER_RE = /[？?]\s*$|是否|要不要|需不需要|需要我|要我|可以吗|好吗|行吗|您看|你看看|请确认|确认后|同意后|如果(?:你|您)|若(?:你|您)|如(?:你|您)需要|等你|等待(?:你|您)|待(?:你|您)|我可以|我也可以|还可以|(?:你|您)可以|告诉我|或者(?:让我|我)|可以为(?:你|您)|可以帮|随时|\bwould you\b|\bshall i\b|\bshould i\b|\bdo you want\b|\blet me know\b|\bif you(?:'d| would)? like\b|\bonce you confirm\b|\byour (?:approval|confirmation)\b|\bif you want\b|\bi can also\b/i;
 var COMPLETED_RE = /已|完成|好了|完毕|写好|搞定|\b(?:done|finished|completed|have (?:written|created|generated))\b/i;
+var NEGATION_RE = /没有?|未|无法|不(?:会|能|再|打算|需要|用|必|要)|n't\b|\b(?:not|never|no longer|cannot)\b/i;
 var CN_VERBS = "\u5F00\u5199|\u52A8\u624B|\u7F16\u5199|\u5199\u5165|\u5199|\u751F\u6210|\u521B\u5EFA|\u5236\u4F5C|\u6267\u884C|\u8FD0\u884C|\u5B89\u88C5|\u4FEE\u6539|\u66F4\u65B0|\u4FEE\u590D|\u5B9E\u73B0|\u6784\u5EFA|\u8F93\u51FA|\u4FDD\u5B58|\u8BFB\u53D6|\u67E5\u770B|\u68C0\u67E5|\u8C03\u7528|\u5904\u7406|\u6574\u7406|\u8865\u5145|\u5B8C\u5584|\u91CD\u5199|\u6539\u5199|\u843D\u76D8";
 var CN_FIRST_PERSON_INTENT_RE = new RegExp(
   `(?:\u6211|\u54B1\u4EEC|\u6211\u4EEC|\u8BA9\u6211)(?:\u73B0\u5728|\u8FD9\u5C31|\u9A6C\u4E0A|\u7ACB\u5373|\u7ACB\u523B|\u76F4\u63A5|\u63A5\u4E0B\u6765|\u4E0B\u9762|\u5148|\u518D|\u968F\u540E|\u7136\u540E|\u5C31)*(?:\u5C06|\u4F1A|\u8981|\u6765|\u53BB|\u5F00\u59CB|\u7740\u624B|\u51C6\u5907)?(?:[^\uFF0C,\u3002\uFF01!\uFF1B;\uFF1A:\\n]{0,4})?(?:${CN_VERBS})`
@@ -3053,11 +3099,11 @@ function detectStalledIntent(content) {
   if (WAITING_FOR_USER_RE.test(tail)) return null;
   const clauses = tail.split(/[，,；;。！!：:\n]/).map((c) => c.trim()).filter(Boolean);
   for (const clause of clauses) {
-    if (COMPLETED_RE.test(clause)) continue;
+    if (COMPLETED_RE.test(clause) || NEGATION_RE.test(clause)) continue;
     if (CN_FIRST_PERSON_INTENT_RE.test(clause) || CN_BARE_INTENT_RE.test(clause)) return clause;
   }
   for (const sentence of tail.split(/(?<=[.!])\s+|\n/)) {
-    if (COMPLETED_RE.test(sentence)) continue;
+    if (COMPLETED_RE.test(sentence) || NEGATION_RE.test(sentence)) continue;
     const m = EN_INTENT_RE.exec(sentence);
     if (m) return sentence.trim();
   }
@@ -3505,7 +3551,12 @@ async function runAgentLoop(host) {
       if (tc.name.startsWith("mcp__")) host.onMcpToolUsed?.(tc.name);
     }
     host.persistRound?.(toolCalls, toolResults, {
-      assistantContent: outcome.content,
+      // 工具调用前模型说的话（"A 方向汇报：…"、"先看一下配置"）挂在 _streamedText 上：
+      // 本轮上下文里有（buildToolResultMessages 会带上），但此前存档只取 outcome.content，
+      // 而工具调用轮次的 outcome 没有 content——2026-10-07 审计会话 157 条带工具调用的
+      // assistant 消息正文**全部为空**：下一条用户消息时模型看不到自己之前的阶段性汇报，
+      // /session show、导出、回放也全缺这部分（审计 X-01）。
+      assistantContent: outcome.content ?? toolCalls._streamedText,
       reasoningContent: outcome.reasoningContent
     });
     host.afterToolRoundPersist?.(toolCalls, toolResults, extraMessages);
@@ -3560,6 +3611,7 @@ async function runLeanAgentLoop(opts) {
   let roundsUsed = 0;
   let toolCallCount = 0;
   let stalledIntentNudges = 0;
+  let hallucinationRetries = 0;
   try {
     for (let round = 0; round < opts.maxRounds; round++) {
       roundsUsed = round + 1;
@@ -3575,6 +3627,7 @@ async function runLeanAgentLoop(opts) {
           timeout: opts.chatParams?.timeout,
           thinking: opts.chatParams?.thinking,
           thinkingEffort: opts.chatParams?.thinkingEffort,
+          thinkingBudget: opts.chatParams?.thinkingBudget,
           ...extraMessages.length > 0 ? { _extraMessages: extraMessages } : {}
         },
         opts.toolDefsForRound(round)
@@ -3594,6 +3647,24 @@ async function runLeanAgentLoop(opts) {
           );
           continue;
         }
+        const nextTools = round < opts.maxRounds - 1 ? opts.toolDefsForRound(round + 1) : [];
+        const canWrite = nextTools.some((t) => t.name === "write_file" || t.name === "edit_file");
+        if (canWrite && hallucinationRetries < 1 && result.content) {
+          const alreadyWrote = hadPreviousWriteToolCalls(extraMessages);
+          const coarse = !alreadyWrote && detectsHallucinatedFileOp(result.content) && extractBashCommands(extraMessages).length === 0;
+          const phantom = coarse || alreadyWrote ? findPhantomClaims(result.content, extraMessages) : [];
+          if (phantom.length > 0 || coarse) {
+            hallucinationRetries++;
+            extraMessages.push(
+              { role: "assistant", content: result.content },
+              {
+                role: "user",
+                content: phantom.length > 0 ? buildPhantomCorrectionMessage(phantom) : HALLUCINATION_CORRECTION_MESSAGE
+              }
+            );
+            continue;
+          }
+        }
         content = result.content;
         break;
       }
@@ -6082,7 +6153,7 @@ var undoStack = new UndoStack();
 import { spawn } from "child_process";
 import { platform } from "os";
 var IS_WINDOWS2 = platform() === "win32";
-var SHELL = IS_WINDOWS2 ? "powershell.exe" : process.env["SHELL"] ?? "/bin/bash";
+var SHELL = IS_WINDOWS2 ? "powershell.exe" : posixShell();
 var pool = /* @__PURE__ */ new Map();
 var IDLE_EVICT_MS = 5 * 6e4;
 var evictionTimer = null;
@@ -6091,7 +6162,11 @@ function spawnShell(cwd) {
   const proc = spawn(SHELL, shellArgs, {
     cwd,
     windowsHide: true,
-    stdio: ["pipe", "pipe", "pipe"]
+    stdio: ["pipe", "pipe", "pipe"],
+    // POSIX: own process group, so a timeout / Ctrl+C can kill the whole tree
+    // (killProcessTree with processGroup=true). Without it only the shell host
+    // died and grandchildren were orphaned (2026-10-07 audit A-01).
+    detached: !IS_WINDOWS2
   });
   proc.on("exit", () => {
     for (const [key, entry] of pool) {
@@ -6118,13 +6193,17 @@ function startEvictionTimer() {
     }
   }, 6e4).unref();
 }
+function stderrMarker(id) {
+  return `AICLI_MARKER_ERR:${id}`;
+}
 function buildWrappedCommand(command, id, isWindows) {
   const markerStart = `AICLI_MARKER_START:${id}`;
   const markerEnd = `AICLI_MARKER_END:${id}`;
   if (!isWindows) {
+    const quoted = `'${command.replace(/'/g, `'\\''`)}'`;
     return `echo "${markerStart}"
-${command}
-echo "${markerEnd}:$?"`;
+eval ${quoted} </dev/null
+__aicli_rc=$?; echo "${stderrMarker(id)}" >&2; echo "${markerEnd}:$__aicli_rc"`;
   }
   const b64 = Buffer.from(command, "utf-8").toString("base64");
   const decoded = `[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('${b64}'))`;
@@ -6156,32 +6235,46 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
     const markerStartPattern = `AICLI_MARKER_START:${id}`;
     const markerEndPattern = `AICLI_MARKER_END:${id}`;
     const proc = entry.proc;
+    const errMarker = stderrMarker(id);
+    const cleanStderr = (s) => {
+      const i = s.indexOf(errMarker);
+      return i < 0 ? s : s.slice(0, i);
+    };
+    const checkDone = () => {
+      if (resolved) return;
+      const parsed = extractPoolOutput(stdout, markerStartPattern, markerEndPattern);
+      if (parsed.exitCode === null) return;
+      if (!IS_WINDOWS2 && !stderr.includes(errMarker)) return;
+      stdout = parsed.output;
+      stderr = cleanStderr(stderr);
+      resolved = true;
+      cleanup();
+      resolve13({ stdout, stderr, exitCode: parsed.exitCode, timedOut, aborted });
+    };
     const onData = (chunk) => {
       stdout += IS_WINDOWS2 ? decodeWindowsBuffer(chunk) : chunk.toString("utf-8");
-      if (!resolved && stdout.includes(markerEndPattern)) {
-        const endLine = stdout.split("\n").find((l) => l.includes(markerEndPattern));
-        const exitCode = endLine ? parseEndMarker(endLine) : null;
-        stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
-        resolved = true;
-        cleanup();
-        resolve13({ stdout, stderr, exitCode, timedOut, aborted });
-      }
+      checkDone();
     };
     const onErr = (chunk) => {
       stderr += IS_WINDOWS2 ? decodeWindowsBuffer(chunk) : chunk.toString("utf-8");
+      checkDone();
     };
     const finishPoolFailure = (message, exitCode = null) => {
       if (resolved) return;
       resolved = true;
-      stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
+      stdout = extractPoolOutput(stdout, markerStartPattern, markerEndPattern).output;
+      stderr = cleanStderr(stderr);
       stderr += `${stderr ? "\n" : ""}[pool terminated] ${message}`;
       cleanup();
       pool.delete(sessionKey);
-      resolve13({ stdout, stderr, exitCode: exitCode === 0 ? null : exitCode, timedOut, aborted });
+      resolve13({ stdout, stderr, exitCode, timedOut, aborted });
     };
     const onClose = (code, signal) => {
       const detail = signal ? `signal ${signal}` : `exit code ${code ?? "unknown"}`;
-      finishPoolFailure(`Shell exited before the completion marker (${detail}).`, code);
+      finishPoolFailure(
+        `The shell exited before the command finished (${detail}) \u2014 typically an explicit \`exit\`/\`exec\`, or \`set -e\` aborting on a failing command. Shell state (variables, options, functions) was reset; the next command runs in a fresh shell in the same directory.`,
+        signal ? null : code
+      );
     };
     const onStdinError = (err) => {
       finishPoolFailure(`Shell stdin failed: ${err.message}`);
@@ -6194,10 +6287,11 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
       if (resolved) return;
       timedOut = true;
       resolved = true;
-      stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
+      stdout = extractPoolOutput(stdout, markerStartPattern, markerEndPattern).output;
+      stderr = cleanStderr(stderr);
       cleanup();
       resolve13({ stdout, stderr, exitCode: null, timedOut, aborted });
-      killProcessTree(proc);
+      killProcessTree(proc, true);
       pool.delete(sessionKey);
     }, timeout);
     const onAbort = () => {
@@ -6205,9 +6299,10 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
       aborted = true;
       resolved = true;
       cleanup();
-      stdout = stripMarkerOutput(stdout, markerStartPattern, markerEndPattern);
+      stdout = extractPoolOutput(stdout, markerStartPattern, markerEndPattern).output;
+      stderr = cleanStderr(stderr);
       resolve13({ stdout, stderr, exitCode: null, timedOut, aborted });
-      killProcessTree(proc);
+      killProcessTree(proc, true);
       pool.delete(sessionKey);
     };
     if (abortSignal?.aborted) {
@@ -6239,36 +6334,18 @@ async function execInPool(sessionKey, command, timeout, cwd, abortSignal) {
     }
   });
 }
-function parseEndMarker(line) {
-  const idx = line.lastIndexOf(":");
-  if (idx < 0) return null;
-  const code = line.slice(idx + 1).trim();
-  return /^\d+$/.test(code) ? Number(code) : null;
+function extractPoolOutput(stdout, startMarker, endMarker) {
+  const startMatch = new RegExp(`${escapeRegExp(startMarker)}\\r?\\n`).exec(stdout);
+  const bodyStart = startMatch ? startMatch.index + startMatch[0].length : 0;
+  const endMatch = new RegExp(`${escapeRegExp(endMarker)}:(\\d+)\\r?\\n`).exec(stdout.slice(bodyStart));
+  const body = endMatch ? stdout.slice(bodyStart, bodyStart + endMatch.index) : stdout.slice(bodyStart);
+  return {
+    output: body.trim(),
+    exitCode: endMatch ? Number(endMatch[1]) : null
+  };
 }
-function stripMarkerOutput(stdout, startMarker, endMarker) {
-  const lines = stdout.split("\n");
-  let capturing = false;
-  const out = [];
-  for (const line of lines) {
-    if (line.includes(startMarker)) {
-      capturing = true;
-      continue;
-    }
-    if (line.includes(endMarker)) {
-      capturing = false;
-      continue;
-    }
-    if (capturing) {
-      out.push(line);
-    }
-  }
-  if (!stdout.includes(endMarker) && out.length === 0) {
-    const startIdx = stdout.indexOf(startMarker);
-    if (startIdx >= 0) {
-      return stdout.slice(startIdx + startMarker.length).trimStart();
-    }
-  }
-  return out.join("\n").trim();
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function cleanupPoolSession(sessionKey) {
   const entry = pool.get(sessionKey);
@@ -6282,7 +6359,7 @@ function cleanupPoolSession(sessionKey) {
 
 // src/tools/builtin/bash.ts
 var IS_WINDOWS3 = platform2() === "win32";
-var SHELL2 = IS_WINDOWS3 ? "powershell.exe" : process.env["SHELL"] ?? "/bin/bash";
+var SHELL2 = IS_WINDOWS3 ? "powershell.exe" : posixShell();
 var cwdBySession = /* @__PURE__ */ new Map();
 function getCwd() {
   const key = getCurrentSessionKey();
@@ -6411,7 +6488,8 @@ Important rules:
       }
       if (timedOut) {
         pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
-        throw new ToolError("bash", formatTimeoutMessage(timeout, MAX_TIMEOUT, command));
+        throw new ToolError("bash", formatTimeoutMessage(timeout, MAX_TIMEOUT, command, `${stdout}
+${stderr}`));
       }
       if (status !== 0 || timedOut) {
         const poolStdout = (stdout ?? "").trim();
@@ -6430,7 +6508,12 @@ ${combined || formatFailureFallback(status)}
       }
       pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
       updateCwdFromCommand(command, effectiveCwd);
-      return annotateSuccessOutput(command, stdout) || emptyOutputResult(command, stderr ?? "");
+      const out = annotateSuccessOutput(command, suppressBinaryOutput(stdout));
+      const poolNote = /\[pool terminated\]/.test(stderr ?? "") ? `
+
+${(stderr ?? "").trim()}` : "";
+      const body = out ? out + poolNote : emptyOutputResult(command, stderr ?? "");
+      return body + backgroundJobNote(command);
     }
     try {
       const { stdout, stderr, status, signal, timedOut, aborted } = await runShell(
@@ -6467,17 +6550,18 @@ ${combined || formatFailureFallback(status)}
       updateCwdFromCommand(command, effectiveCwd);
       pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
       const result = Buffer.isBuffer(stdout) ? IS_WINDOWS3 ? decodeWindowsBuffer(stdout) : stdout.toString("utf-8") : String(stdout ?? "");
-      return annotateSuccessOutput(command, result) || emptyOutputResult(
+      return (annotateSuccessOutput(command, suppressBinaryOutput(result)) || emptyOutputResult(
         command,
         Buffer.isBuffer(stderr) ? IS_WINDOWS3 ? decodeWindowsBuffer(stderr) : stderr.toString("utf-8") : String(stderr ?? "")
-      );
+      )) + backgroundJobNote(command);
     } catch (err) {
       pushBashUndoEntries(beforeSnapshot, parsedTargetsBefore, effectiveCwd);
       if (err && typeof err === "object") {
         const execErr = err;
         const isTimeout = execErr.code === "ETIMEDOUT" || execErr.status == null && execErr.signal === "SIGTERM" || /ETIMEDOUT/i.test(execErr.message ?? "");
         if (isTimeout) {
-          throw new ToolError("bash", formatTimeoutMessage(timeout, MAX_TIMEOUT, command));
+          const captured = [execErr.stdout, execErr.stderr].map((b) => Buffer.isBuffer(b) ? IS_WINDOWS3 ? decodeWindowsBuffer(b) : b.toString("utf-8") : String(b ?? "")).join("\n");
+          throw new ToolError("bash", formatTimeoutMessage(timeout, MAX_TIMEOUT, command, captured));
         }
         if ("status" in execErr && execErr.status !== void 0) {
           const stderr = IS_WINDOWS3 && Buffer.isBuffer(execErr.stderr) ? decodeWindowsBuffer(execErr.stderr).trim() : execErr.stderr?.toString().trim() ?? "";
@@ -6510,8 +6594,15 @@ function looksLikeTestCommand(command) {
     /(?:^|[;&|(\s])(?:go|cargo)\s+test\b/.test(command)
   );
 }
-function formatTimeoutMessage(timeout, maxTimeout, command) {
+var TIMEOUT_CAPTURE_MAX = 2e3;
+function formatTimeoutMessage(timeout, maxTimeout, command, captured) {
   const seconds = Math.round(timeout / 1e3);
+  const tail = (captured ?? "").trim();
+  const capturedSection = tail ? [
+    "Output captured before the timeout (last part \u2014 the cause is often here):",
+    tail.length > TIMEOUT_CAPTURE_MAX ? "\u2026" + tail.slice(-TIMEOUT_CAPTURE_MAX) : tail,
+    ""
+  ] : [];
   const testRunnerHint = command !== void 0 && looksLikeTestCommand(command) ? [
     "This looks like a TEST run. Prefer the 'run_tests' tool instead of running the test runner through bash: it has a 5-minute timeout, auto-detects the framework, and returns a structured summary (no findstr/grep filtering needed).",
     ""
@@ -6519,6 +6610,7 @@ function formatTimeoutMessage(timeout, maxTimeout, command) {
   return [
     `Command timed out after ${seconds}s.`,
     "",
+    ...capturedSection,
     ...testRunnerHint,
     "The previous command ran for longer than the timeout limit and was killed. This usually means it is scanning a large filesystem tree (recursive Get-ChildItem / find), compressing a big archive, or waiting on a network request.",
     "",
@@ -6691,6 +6783,19 @@ ${err}`;
   return detectPowerShellBackslashQuote(command) ? base + BACKSLASH_QUOTE_SILENT_WARNING : base;
 }
 var PS_TEXT_READ_CMDLET = /\b(?:Get-Content|gc|cat|type|Select-String|sls|Import-Csv)\b/i;
+function suppressBinaryOutput(stdout) {
+  if (!stdout) return stdout;
+  const sample = stdout.slice(0, 8e3);
+  const replacement = (sample.match(/\uFFFD/g) ?? []).length;
+  if (!sample.includes("\0") && !(sample.length >= 64 && replacement / sample.length > 0.3)) {
+    return stdout;
+  }
+  return `[binary output suppressed: ${Buffer.byteLength(stdout, "utf-8")} bytes. Inspect it with a hex dump limited in size (e.g. \`xxd file | head -20\`), or use \`file\` to identify the type.]`;
+}
+function backgroundJobNote(command) {
+  if (IS_WINDOWS3 || !/(?:^|\s)&(?![&>])/m.test(command)) return "";
+  return "\n\n[Note: this command started a background job (`&`). It is not tracked by aicli \u2014 task_list/task_stop cannot see it and it keeps running after this session. For long-running processes (dev servers, watchers) prefer task_create.]";
+}
 function annotateSuccessOutput(command, stdout) {
   if (!IS_WINDOWS3 || !PS_TEXT_READ_CMDLET.test(command)) return stdout;
   if (!looksLikeGbkMojibake(stdout)) return stdout;
@@ -6868,7 +6973,9 @@ function runShell(command, opts) {
       cwd: opts.cwd,
       env: opts.env,
       windowsHide: true,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      // POSIX: own process group so killChild can take the whole tree down (A-01).
+      detached: !IS_WINDOWS3
     });
     const stdoutChunks = [];
     const stderrChunks = [];
@@ -6925,7 +7032,7 @@ function runShell(command, opts) {
   });
 }
 function killChild(child) {
-  killProcessTree(child);
+  killProcessTree(child, true);
 }
 function updateCwdFromCommand(command, baseCwd) {
   const cdMatches = [...command.matchAll(/(?:^|[;&|])\s*cd\s+(['"]?)([^\s;&|'"]+)\1/g)];
@@ -17488,7 +17595,7 @@ Cache:  write=${cacheCreate} read=${cacheRead}` : "";
 Cost:   ${formatCost(cost)}` : "";
   let memoryLine = "";
   try {
-    const { countPendingMemories: countPendingMemories2 } = await import("./persistent-memory-VBVGH3P5.js");
+    const { countPendingMemories: countPendingMemories2 } = await import("./persistent-memory-ZIM6ICIR.js");
     const pending = countPendingMemories2(ctx.config.getConfigDir());
     if (pending > 0) memoryLine = `
 Memory: \u26A0 ${pending} pending approval \u2014 see the Memory panel or /memory`;
@@ -18476,7 +18583,7 @@ async function handleTest(args, ctx) {
       const isCommand = argStr.includes(" ") || /^(mvn|gradle|npm|pytest|cargo|go)\b/.test(argStr);
       testArgs = isCommand ? { command: argStr } : { filter: argStr };
     }
-    const runTests = ctx.runTests ?? (await import("./run-tests-OBX5CEPQ.js")).executeTests;
+    const runTests = ctx.runTests ?? (await import("./run-tests-HCID73KE.js")).executeTests;
     const report = await runTests(testArgs);
     ctx.send({ type: "info", message: report });
   } catch (err) {
@@ -18867,7 +18974,7 @@ async function handleMemory(args, ctx) {
   }
   if (intent.kind === "status") {
     const { getChatIndexStatus: getChatIndexStatus2 } = await import("./chat-index-RLVLQRRC.js");
-    const { listMemoryEntries: listMemoryEntries2, isMemoryExpired: isMemoryExpired2, formatMemoryForPrompt: formatMemoryForPrompt2 } = await import("./persistent-memory-VBVGH3P5.js");
+    const { listMemoryEntries: listMemoryEntries2, isMemoryExpired: isMemoryExpired2, formatMemoryForPrompt: formatMemoryForPrompt2 } = await import("./persistent-memory-ZIM6ICIR.js");
     const memories = listMemoryEntries2(configDir, { includeExpired: true, includeRejected: true });
     const injected = formatMemoryForPrompt2(configDir, process.cwd(), ctx.config.get("memory")?.maxChars);
     const view = buildMemoryStatusView({
@@ -18890,7 +18997,7 @@ async function handleMemory(args, ctx) {
     return;
   }
   if (intent.kind === "recall") {
-    const { searchPersistentMemories: searchPersistentMemories2, touchMemoryReferences: touchMemoryReferences2 } = await import("./persistent-memory-VBVGH3P5.js");
+    const { searchPersistentMemories: searchPersistentMemories2, touchMemoryReferences: touchMemoryReferences2 } = await import("./persistent-memory-ZIM6ICIR.js");
     const { searchChatMemory: searchChatMemory2 } = await import("./chat-index-RLVLQRRC.js");
     const persistentHits = searchPersistentMemories2(configDir, intent.query, process.cwd(), 3);
     if (persistentHits.length > 0) {
@@ -19011,7 +19118,7 @@ async function handleMemory(args, ctx) {
     ctx.handleMemoryManage(intent.action, args[1], intent.action === "expire" ? args[2] : void 0);
   } else if (intent.kind === "export") {
     if (args[1] === "md") {
-      const { exportMemoryEntries: exportMemoryEntries2 } = await import("./persistent-memory-VBVGH3P5.js");
+      const { exportMemoryEntries: exportMemoryEntries2 } = await import("./persistent-memory-ZIM6ICIR.js");
       ctx.send({
         type: "export_data",
         format: "md",
@@ -20016,7 +20123,7 @@ No tools match "${filter}".
           const { join: join26 } = await import("path");
           const { existsSync: existsSync32 } = await import("fs");
           const { getGitRoot: getGitRoot2 } = await import("./git-context-VNCA2GU7.js");
-          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-HVWL645G.js");
+          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-EHYM2NS5.js");
           const { approveProject, hashMcpFile } = await import("./project-trust-6CJB5ZMX.js");
           const cwd = process.cwd();
           const projectRoot = getGitRoot2(cwd) ?? cwd;
@@ -20935,7 +21042,7 @@ function createReviewCommands() {
       usage: "/test [command|filter]",
       async execute(args, ctx) {
         try {
-          const { executeTests } = await import("./run-tests-OBX5CEPQ.js");
+          const { executeTests } = await import("./run-tests-HCID73KE.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {

package/dist/{hub-34YQNQF3.js → hub-JACLTKYY.js}

@@ -158,7 +158,7 @@ ${content}`);
   }
 }
 async function runTaskMode(config, providers, configManager, topic) {
-  const { TaskOrchestrator } = await import("./task-orchestrator-2IKNOOMG.js");
+  const { TaskOrchestrator } = await import("./task-orchestrator-6NRCGF5V.js");
   const orchestrator = new TaskOrchestrator(config, providers, configManager);
   let interrupted = false;
   const onSigint = () => {