@aiiware/aii 0.16.38 → 0.17.1

package/README.md

@@ -417,7 +417,9 @@ aii sessions info <id>             # View stats (tokens, cost, tools)
 
 ```bash
 aii config init                          # Interactive setup wizard
+aii config init --project                # Scaffold project config for this repo
 aii config show                          # Current settings
+aii config show --sources                # Per-key provenance (env/local/project/global)
 aii config validate                      # Check config + API key validity
 aii config set <key> <value>             # Set a specific value
 aii config provider [name]               # Show or switch provider
@@ -450,6 +452,51 @@ sessions:
 
 Environment variables also work: `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `DEEPSEEK_API_KEY`, etc.
 
+### Project configuration (v0.17)
+
+A repository can carry its own Aii config — committed for the team, layered under your personal settings:
+
+```bash
+aii config init --project     # creates .aii/settings.json, gitignores .aii/settings.local.json
+```
+
+```jsonc
+// .aii/settings.json (committed)
+{
+  "llm": { "model": "deepseek-v4", "provider": "deepseek" },
+  "output_modes": { "default": "clean" },
+  "permissions": {
+    "deny_write": ["db/migrations/**"],   // paths the agent may never write in this repo
+    "deny_tools": ["Bash"]                // tools the agent may never use in this repo
+  }
+}
+```
+
+Precedence: `flag > env > .aii/settings.local.json > .aii/settings.json > ~/.aii/config.yaml > defaults` — your env pins always win. `aii config show --sources` shows exactly where each effective value came from.
+
+**A repo can only narrow, never widen.** Only safe keys are accepted (model, provider, temperature, output mode, persona, theme, deny rules); anything that would widen authority — `api.*`, `allow_write`, auto-approve flags — is rejected with a warning. Deny rules are enforced everywhere (file tools, Bash write targets, subagents) as hard tool errors. Project values are session-effective only: `aii config set` still writes exclusively to your `~/.aii/config.yaml`.
+
+A repo's `.aii/hooks.json` never runs silently: the first interactive session shows each hook's event + command and asks for approval, remembered in `~/.aii/project-trust.json` until the file changes. Headless runs fail closed. Skip the whole project layer for one session with `aii --no-project-config`.
+
+### Project slash commands (v0.17.1)
+
+A repository can ship its own slash commands — one markdown file per command under `.aii/commands/`, committed and shared with the team:
+
+```markdown
+<!-- .aii/commands/deploy.md -->
+---
+description: Deploy the current branch to staging
+argument-hint: <environment>
+---
+Deploy the current branch to $ARGUMENTS:
+1. Run the test suite; abort on failure.
+2. Build and push the image tagged with the short sha.
+```
+
+Typing `/deploy staging` expands the file's body (with `$ARGUMENTS` → `staging`) into the agent turn. The filename is the command name; frontmatter is optional (`description` and `argument-hint` are shown in the `/` menu and `/help`, where project commands carry a `[project]` badge).
+
+**First use asks once.** A cloned repo's command is prompt content the agent will follow with your tools — so the first `/deploy` shows the file's full body and asks. Approve and it's remembered (per file content, in `~/.aii/project-trust.json`) until the file changes; decline and it's skipped. Headless runs fail closed. The same gate now also covers project `.aii/skills/` — repo-committed skills ask before they first run, and an unapproved one is never model-auto-invoked. Project commands are typed-slash only (never triggered by plain English), and `aii --no-project-config` disables commands and skills along with the rest of the project layer.
+
 ---
 
 ## CLI Reference