jinzd-ai-cli 0.4.8 → 0.4.10

package/dist/{auth-TWWF22YZ.js → auth-MSUWO6SE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   AuthManager
-} from "./chunk-CPLT6CD3.js";
+} from "./chunk-BYNY5JPB.js";
 export {
   AuthManager
 };

package/dist/{chunk-G3YURBV7.js → chunk-4EUTAZ6Q.js}

@@ -8,7 +8,7 @@ import { platform } from "os";
 import chalk from "chalk";
 
 // src/core/constants.ts
-var VERSION = "0.4.8";
+var VERSION = "0.4.10";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-CPLT6CD3.js → chunk-BYNY5JPB.js}

@@ -3,7 +3,7 @@
 // src/web/auth.ts
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, copyFileSync } from "fs";
 import { join } from "path";
-import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { createHmac, randomBytes, timingSafeEqual, pbkdf2Sync } from "crypto";
 var USERS_FILE = "users.json";
 var TOKEN_EXPIRY_HOURS = 24 * 7;
 var USERS_DIR = "users";
@@ -50,7 +50,8 @@ var AuthManager = class {
       passwordHash,
       salt,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      dataDir
+      dataDir,
+      hashVersion: 2
     };
     this.db.users.push(user);
     this.save();
@@ -61,12 +62,20 @@ var AuthManager = class {
     username = username.trim().toLowerCase();
     const user = this.db.users.find((u) => u.username === username);
     if (!user) return null;
-    const hash = this.hashPassword(password, user.salt);
+    const isLegacy = !user.hashVersion || user.hashVersion < 2;
+    const hash = isLegacy ? this.hashPasswordLegacy(password, user.salt) : this.hashPassword(password, user.salt);
     const a = Buffer.from(hash, "utf-8");
     const b = Buffer.from(user.passwordHash, "utf-8");
     if (a.length !== b.length || !timingSafeEqual(a, b)) {
       return null;
     }
+    if (isLegacy) {
+      const newSalt = randomBytes(16).toString("hex");
+      user.passwordHash = this.hashPassword(password, newSalt);
+      user.salt = newSalt;
+      user.hashVersion = 2;
+      this.save();
+    }
     return this.createToken(username);
   }
   /** Verify a token. Returns username or null. */
@@ -117,6 +126,7 @@ var AuthManager = class {
     const salt = randomBytes(16).toString("hex");
     user.passwordHash = this.hashPassword(newPassword, salt);
     user.salt = salt;
+    user.hashVersion = 2;
     this.save();
     return null;
   }
@@ -180,9 +190,13 @@ var AuthManager = class {
     mkdirSync(this.baseDir, { recursive: true });
     writeFileSync(this.usersFile, JSON.stringify(db, null, 2), "utf-8");
   }
-  hashPassword(password, salt) {
+  /** Legacy hash — kept only for migrating old users (v0.2.x) */
+  hashPasswordLegacy(password, salt) {
     return createHmac("sha256", salt).update(password).digest("hex");
   }
+  hashPassword(password, salt) {
+    return pbkdf2Sync(password, salt, 1e5, 64, "sha512").toString("hex");
+  }
   createToken(username) {
     const payload = {
       username,

package/dist/{chunk-GDMXHX27.js → chunk-IIVTIEWB.js}

@@ -6,7 +6,7 @@ import {
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT,
   runTestsTool
-} from "./chunk-G3YURBV7.js";
+} from "./chunk-4EUTAZ6Q.js";
 
 // src/tools/builtin/bash.ts
 import { execSync } from "child_process";

package/dist/{chunk-T2W7CI24.js → chunk-J3J44O4N.js}

@@ -2,7 +2,7 @@
 import {
   EnvLoader,
   schemaToJsonSchema
-} from "./chunk-GDMXHX27.js";
+} from "./chunk-IIVTIEWB.js";
 import {
   APP_NAME,
   CONFIG_DIR_NAME,
@@ -15,7 +15,7 @@ import {
   MCP_TOOL_PREFIX,
   PLUGINS_DIR_NAME,
   VERSION
-} from "./chunk-G3YURBV7.js";
+} from "./chunk-4EUTAZ6Q.js";
 
 // src/config/config-manager.ts
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";

package/dist/{chunk-56MYFIG4.js → chunk-WC6IEG2I.js}

@@ -6,7 +6,7 @@ import { platform } from "os";
 import chalk from "chalk";
 
 // src/core/constants.ts
-var VERSION = "0.4.8";
+var VERSION = "0.4.10";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{hub-V27PRAPU.js → hub-B3YT75IB.js}

@@ -381,7 +381,7 @@ ${content}`);
   }
 }
 async function runTaskMode(config, providers, configManager, topic) {
-  const { TaskOrchestrator } = await import("./task-orchestrator-OXDO5UWG.js");
+  const { TaskOrchestrator } = await import("./task-orchestrator-W56DGIZ4.js");
   const orchestrator = new TaskOrchestrator(config, providers, configManager);
   let interrupted = false;
   const onSigint = () => {

package/dist/index.js

@@ -23,7 +23,7 @@ import {
   saveDevState,
   sessionHasMeaningfulContent,
   setupProxy
-} from "./chunk-T2W7CI24.js";
+} from "./chunk-J3J44O4N.js";
 import {
   ToolRegistry,
   askUserContext,
@@ -38,7 +38,7 @@ import {
   theme,
   truncateOutput,
   undoStack
-} from "./chunk-GDMXHX27.js";
+} from "./chunk-IIVTIEWB.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
   AUTHOR,
@@ -58,7 +58,7 @@ import {
   REPO_URL,
   SKILLS_DIR_NAME,
   VERSION
-} from "./chunk-G3YURBV7.js";
+} from "./chunk-4EUTAZ6Q.js";
 
 // src/index.ts
 import { program } from "commander";
@@ -1914,7 +1914,7 @@ ${hint}` : "")
       description: "Run project tests and show structured report",
       usage: "/test [command|filter]",
       async execute(args, _ctx) {
-        const { executeTests } = await import("./run-tests-L2NQAT2M.js");
+        const { executeTests } = await import("./run-tests-YBNVSXTV.js");
         const argStr = args.join(" ").trim();
         let testArgs = {};
         if (argStr) {
@@ -5524,11 +5524,11 @@ program.command("web").description("Start Web UI server with browser-based chat
     console.error("Error: Invalid port number. Must be between 1 and 65535.");
     process.exit(1);
   }
-  const { startWebServer } = await import("./server-JYSNPBYK.js");
+  const { startWebServer } = await import("./server-YLN3YUUI.js");
   await startWebServer({ port, host: options.host });
 });
 program.command("user [action] [username]").description("Manage Web UI users (list | create <name> | delete <name> | reset-password <name> | migrate <name>)").action(async (action, username) => {
-  const { AuthManager } = await import("./auth-TWWF22YZ.js");
+  const { AuthManager } = await import("./auth-MSUWO6SE.js");
   const config = new ConfigManager();
   const auth = new AuthManager(config.getConfigDir());
   if (!action || action === "list") {
@@ -5757,7 +5757,7 @@ program.command("hub [topic]").description("Start multi-agent hub (discuss / bra
     }),
     config.get("customProviders")
   );
-  const { startHub } = await import("./hub-V27PRAPU.js");
+  const { startHub } = await import("./hub-B3YT75IB.js");
   await startHub(
     {
       topic: topic ?? "",

package/dist/{run-tests-ENUQXQG7.js → run-tests-VDZCQA4L.js}

@@ -1,7 +1,7 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-56MYFIG4.js";
+} from "./chunk-WC6IEG2I.js";
 export {
   executeTests,
   runTestsTool

package/dist/{run-tests-L2NQAT2M.js → run-tests-YBNVSXTV.js}

@@ -2,7 +2,7 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-G3YURBV7.js";
+} from "./chunk-4EUTAZ6Q.js";
 export {
   executeTests,
   runTestsTool

package/dist/{server-JYSNPBYK.js → server-YLN3YUUI.js}

@@ -18,10 +18,10 @@ import {
   renderDiff,
   runHook,
   setupProxy
-} from "./chunk-T2W7CI24.js";
+} from "./chunk-J3J44O4N.js";
 import {
   AuthManager
-} from "./chunk-CPLT6CD3.js";
+} from "./chunk-BYNY5JPB.js";
 import {
   ToolRegistry,
   askUserContext,
@@ -32,7 +32,7 @@ import {
   spawnAgentContext,
   truncateOutput,
   undoStack
-} from "./chunk-GDMXHX27.js";
+} from "./chunk-IIVTIEWB.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
   CONTEXT_FILE_CANDIDATES,
@@ -44,14 +44,14 @@ import {
   PLAN_MODE_SYSTEM_ADDON,
   SKILLS_DIR_NAME,
   VERSION
-} from "./chunk-G3YURBV7.js";
+} from "./chunk-4EUTAZ6Q.js";
 
 // src/web/server.ts
 import express from "express";
 import { createServer } from "http";
 import { WebSocketServer } from "ws";
-import { join as join3, dirname, resolve as resolve2, relative } from "path";
-import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { join as join3, dirname, resolve as resolve2, relative, sep } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync as readdirSync2, statSync as statSync2, realpathSync } from "fs";
 import { networkInterfaces } from "os";
 
 // src/web/tool-executor-web.ts
@@ -996,8 +996,6 @@ Tokens: in=${this.sessionTokenUsage.inputTokens} out=${this.sessionTokenUsage.ou
           if (found) {
             this.sessions.loadSession(found.id);
             this.sessionTokenUsage = { inputTokens: 0, outputTokens: 0 };
-            if (found.provider) this.currentProvider = found.provider;
-            if (found.model) this.currentModel = found.model;
             this.send({ type: "info", message: `Loaded session: ${found.id.slice(0, 8)} "${found.title ?? ""}" (${found.messageCount} messages)` });
             this.sendSessionMessages();
             this.sendStatus();
@@ -1440,7 +1438,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-L2NQAT2M.js");
+          const { executeTests } = await import("./run-tests-YBNVSXTV.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -2062,6 +2060,30 @@ async function startWebServer(options = {}) {
   const app = express();
   const server = createServer(app);
   const wss = new WebSocketServer({ server });
+  const authManager = new AuthManager(config.getConfigDir());
+  if (authManager.isEnabled()) {
+    console.log(`   Auth: ${authManager.listUsers().length} user(s) registered`);
+  } else {
+    console.log(`   Auth: disabled (no users registered)`);
+  }
+  const requireAuth = (req, res, next) => {
+    if (!authManager.isEnabled()) return next();
+    const authHeader = req.headers.authorization;
+    const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
+    const cookieToken = parseCookie(req.headers.cookie ?? "")["aicli_token"];
+    const effectiveToken = token ?? cookieToken;
+    if (!effectiveToken) {
+      res.status(401).json({ error: "Authentication required" });
+      return;
+    }
+    const username = authManager.verifyToken(effectiveToken);
+    if (!username) {
+      res.status(401).json({ error: "Invalid or expired token" });
+      return;
+    }
+    req._authUser = username;
+    next();
+  };
   const moduleDir = getModuleDir();
   let clientDir = join3(moduleDir, "web", "client");
   if (!existsSync4(clientDir)) {
@@ -2105,13 +2127,21 @@ async function startWebServer(options = {}) {
     }
     const token = authManager.login(username, password);
     console.log(`   \u2713 User registered via API: ${username}`);
+    res.cookie("aicli_token", token, { httpOnly: true, sameSite: "strict", maxAge: 7 * 24 * 3600 * 1e3 });
     res.json({ success: true, token, username });
   });
-  app.get("/api/files", (req, res) => {
+  app.get("/api/files", requireAuth, (req, res) => {
     const cwd = process.cwd();
     const prefix = req.query.prefix || "";
     const targetDir = join3(cwd, prefix);
-    if (!resolve2(targetDir).startsWith(resolve2(cwd))) {
+    try {
+      const canonicalTarget = realpathSync(resolve2(targetDir));
+      const canonicalCwd = realpathSync(resolve2(cwd));
+      if (!canonicalTarget.startsWith(canonicalCwd + sep) && canonicalTarget !== canonicalCwd) {
+        res.json({ files: [] });
+        return;
+      }
+    } catch {
       res.json({ files: [] });
       return;
     }
@@ -2128,7 +2158,7 @@ async function startWebServer(options = {}) {
       res.json({ files: [] });
     }
   });
-  app.get("/api/sessions", (_req, res) => {
+  app.get("/api/sessions", requireAuth, (_req, res) => {
     try {
       const list = sessions.listSessions();
       res.json({
@@ -2145,7 +2175,7 @@ async function startWebServer(options = {}) {
       res.json({ sessions: [] });
     }
   });
-  app.get("/api/file-content", (req, res) => {
+  app.get("/api/file-content", requireAuth, (req, res) => {
     const filePath = req.query.path;
     if (!filePath) {
       res.json({ error: "Missing path" });
@@ -2153,8 +2183,15 @@ async function startWebServer(options = {}) {
     }
     const cwd = process.cwd();
     const fullPath = resolve2(join3(cwd, filePath));
-    if (!fullPath.startsWith(resolve2(cwd))) {
-      res.json({ error: "Access denied" });
+    try {
+      const canonicalFull = realpathSync(fullPath);
+      const canonicalCwd = realpathSync(resolve2(cwd));
+      if (!canonicalFull.startsWith(canonicalCwd + sep) && canonicalFull !== canonicalCwd) {
+        res.json({ error: "Access denied" });
+        return;
+      }
+    } catch {
+      res.json({ error: "File not found" });
       return;
     }
     try {
@@ -2165,16 +2202,10 @@ async function startWebServer(options = {}) {
       }
       const content = readFileSync4(fullPath, "utf-8");
       res.json({ content, size: stat.size });
-    } catch (err) {
-      res.json({ error: `Cannot read: ${err.message}` });
+    } catch {
+      res.json({ error: "Cannot read file" });
     }
   });
-  const authManager = new AuthManager(config.getConfigDir());
-  if (authManager.isEnabled()) {
-    console.log(`   Auth: ${authManager.listUsers().length} user(s) registered`);
-  } else {
-    console.log(`   Auth: disabled (no users registered)`);
-  }
   const userResources = /* @__PURE__ */ new Map();
   function getUserShared(username) {
     const cached = userResources.get(username);
@@ -2203,7 +2234,8 @@ async function startWebServer(options = {}) {
     const qMark = urlStr.indexOf("?");
     const params = new URLSearchParams(qMark >= 0 ? urlStr.slice(qMark + 1) : "");
     const tabId = params.get("tabId") || `tab-${Date.now()}`;
-    const token = params.get("token") || "";
+    const cookies = parseCookie(req.headers.cookie ?? "");
+    const token = cookies["aicli_token"] || "";
     const existing = handlers.get(tabId);
     if (existing) {
       existing.onDisconnect();
@@ -2257,7 +2289,22 @@ async function startWebServer(options = {}) {
             handler = new SessionHandler(ws, userShared);
             handlers.set(tabId, handler);
             console.log(`   \u2713 User registered & connected: ${username} (tab: ${tabId.slice(0, 12)})`);
-            ws.send(JSON.stringify({ type: "auth_result", success: true, token: newToken, username }));
+            ws.send(JSON.stringify({ type: "auth_result", success: true, token: newToken, username, setCookie: true }));
+            return;
+          }
+          if (action === "token") {
+            const { token: clientToken } = parsed;
+            const verifiedUser = authManager.verifyToken(clientToken);
+            if (!verifiedUser) {
+              ws.send(JSON.stringify({ type: "auth_result", success: false, error: "Invalid or expired token" }));
+              return;
+            }
+            authenticatedUser = verifiedUser;
+            const userShared = getUserShared(verifiedUser);
+            handler = new SessionHandler(ws, userShared);
+            handlers.set(tabId, handler);
+            console.log(`   \u2713 Token auth: ${verifiedUser} (tab: ${tabId.slice(0, 12)})`);
+            ws.send(JSON.stringify({ type: "auth_result", success: true, token: clientToken, username: verifiedUser }));
             return;
           }
           if (action === "login") {
@@ -2271,7 +2318,7 @@ async function startWebServer(options = {}) {
             handler = new SessionHandler(ws, userShared);
             handlers.set(tabId, handler);
             console.log(`   \u2713 User logged in: ${username} (tab: ${tabId.slice(0, 12)})`);
-            ws.send(JSON.stringify({ type: "auth_result", success: true, token: loginToken, username }));
+            ws.send(JSON.stringify({ type: "auth_result", success: true, token: loginToken, username, setCookie: true }));
             return;
           }
           ws.send(JSON.stringify({ type: "auth_result", success: false, error: "Unknown auth action" }));
@@ -2366,6 +2413,14 @@ function loadProjectMcpConfig() {
     return null;
   }
 }
+function parseCookie(cookie) {
+  const result = {};
+  for (const part of cookie.split(";")) {
+    const [key, ...rest] = part.trim().split("=");
+    if (key) result[key.trim()] = rest.join("=").trim();
+  }
+  return result;
+}
 async function openBrowser(url) {
   try {
     const { exec } = await import("child_process");

package/dist/{task-orchestrator-OXDO5UWG.js → task-orchestrator-W56DGIZ4.js}

@@ -4,10 +4,10 @@ import {
   getDangerLevel,
   googleSearchContext,
   truncateOutput
-} from "./chunk-GDMXHX27.js";
+} from "./chunk-IIVTIEWB.js";
 import {
   SUBAGENT_ALLOWED_TOOLS
-} from "./chunk-G3YURBV7.js";
+} from "./chunk-4EUTAZ6Q.js";
 
 // src/hub/task-orchestrator.ts
 import { createInterface } from "readline";

package/dist/web/client/app.js

@@ -76,14 +76,19 @@ let reconnectDelay = 1000; // Start at 1s, exponential backoff
 
 function connect() {
   const protocol = location.protocol === 'https:' ? 'wss:' : 'ws:';
-  const tokenParam = authToken ? `&token=${encodeURIComponent(authToken)}` : '';
-  ws = new WebSocket(`${protocol}//${location.host}?tabId=${tabId}${tokenParam}`);
+  // Security: do NOT put token in URL (visible in logs/referrer). Cookie is sent automatically.
+  // For reconnection, also send token as first message in case cookie is blocked.
+  ws = new WebSocket(`${protocol}//${location.host}?tabId=${tabId}`);
 
   ws.onopen = () => {
     connected = true;
     reconnectDelay = 1000; // Reset backoff on success
     connectionStatus.textContent = '🟢 Connected';
     connectionStatus.className = 'status-connected';
+    // Send stored token for auth (in case cookie is not available)
+    if (authToken) {
+      ws.send(JSON.stringify({ type: 'auth', action: 'token', token: authToken }));
+    }
     requestSessionList();
     checkAuthStatus();
     // Start heartbeat ping every 30s
@@ -1886,6 +1891,11 @@ function handleAuthResult(msg) {
     authUsername = msg.username;
     localStorage.setItem('aicli-auth-token', msg.token);
     localStorage.setItem('aicli-auth-user', msg.username);
+    // Set cookie for secure WebSocket auth (httpOnly cookie set by server on HTTP login,
+    // but for WS-only login, set a JS cookie as fallback)
+    if (msg.setCookie && msg.token) {
+      document.cookie = `aicli_token=${encodeURIComponent(msg.token)}; path=/; max-age=${7 * 24 * 3600}; SameSite=Strict`;
+    }
     hideAuthScreen();
     // Request session list now that we're authenticated
     requestSessionList();
@@ -1913,6 +1923,7 @@ function handleLogout() {
   authToken = '';
   authUsername = '';
   localStorage.removeItem('aicli-auth-token');
+  document.cookie = 'aicli_token=; path=/; max-age=0'; // Clear auth cookie
   localStorage.removeItem('aicli-auth-user');
   sessionStorage.removeItem('aicli-active-session');
   // Reconnect — server will send auth_required

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jinzd-ai-cli",
-  "version": "0.4.8",
+  "version": "0.4.10",
   "description": "Cross-platform REPL-style AI CLI with multi-provider support",
   "type": "module",
   "main": "./dist/index.js",