@aiiware/aii 0.28.11 → 0.28.13

package/README.md

@@ -273,7 +273,7 @@ The agent autonomously picks from its built-in tools:
 | **Task** | Delegate to parallel subagents |
 | **Skill** | Invoke extensible skill packages |
 
-…plus task-planning and interaction helpers. You control what the agent can do: by default it asks before running commands or writing files. Use `--auto` to skip confirmations.
+…plus task-planning and interaction helpers. You control what the agent can do with four modes — **Ask** (the default: asks before edits and commands), **Accept edits** (edits run, commands still ask), **Read-only** (reads and searches, changes are refused) and **Auto** (nothing asks first, not limited to the workspace; secrets stay closed). `/permissions` shows and sets them, and Shift+Tab cycles them.
 
 ---
 
@@ -285,8 +285,9 @@ During interactive sessions, type `/` to see all commands. Highlights:
 |---------|-------------|
 | `/help` | Show all commands |
 | `/model [name]` / `/provider [name]` | View or switch model / provider |
-| `/auto` | Toggle auto-approve mode |
-| `/plan` | Toggle plan mode (read-only) |
+| `/permissions [mode]` | See and set what Aii may do: mode, the repo's deny rules, session grants (revoke), recent refusals, writable folders. `/permissions ask\|accept-edits\|read-only\|auto` switches in one step |
+| `/auto` | Switch to Auto, or back to Ask |
+| `/read-only` | Switch to Read-only (reads and searches; changes are refused). `/permissions ask` leaves it; `/plan` toggles it |
 | `/goal [objective]` | Set a session goal the agent works toward autonomously (see [Session Goals](#session-goals)) |
 | `/diff` | See all file changes this session |
 | `/undo` | Revert the last file change |
@@ -327,8 +328,8 @@ Aii is an autonomous agent — so it's built to act without handing over your ma
 
 | Protection | What it does |
 |------------|--------------|
-| **Workspace fence** | File reads and writes stay inside your workspace, resolved through `realpath` so `..` and symlink escapes are blocked; sensitive paths (`~/.aii` secrets, keychains) are denylisted |
-| **Permission model** | Asks before running commands or writing files; grants are scoped (per path / per session); `--auto` opts out when you trust the run |
+| **Workspace fence** | In Ask and Accept edits, writes outside your workspace need your approval, and loops and goal turns started from them run in Auto · workspace. Aii Server sessions and turns steered from your phone or the Portal always keep the fence. Auto lifts it for your own turns, loops and goal turns. Paths are resolved through `realpath`, so `..` and symlink escapes are caught; sensitive paths (`~/.aii` secrets, keychains) stay refused in every mode |
+| **Permission model** | Four modes (Ask, Accept edits, Read-only, Auto) set with `/permissions` or Shift+Tab; grants are scoped (per path / per session) and revocable; secrets and credential stores are refused in every mode; `permissions.default_mode` in `~/.aii/config.yaml` sets where new sessions start |
 | **Untrusted-content framing** | Web and MCP content is fenced as untrusted, so a malicious page can't smuggle instructions into the agent (prompt-injection defense) |
 | **Supply-chain integrity** | Installed skills and personas are pinned by commit SHA and checked against per-file SHA-256 manifests at load — fail-closed if anything's been tampered with |
 | **Persona-hook consent** | Hooks bundled in a remotely-installed persona require explicit first-use consent (keyed on install origin), so adding a persona can't silently run code |
@@ -370,7 +371,7 @@ aii loop --budget 1.00 --duration 8h "refactor the auth module"
 | `/note <text>` | Inject guidance immediately — seen at the next tool call (also works in normal sessions) |
 | Plain text + Enter | Queue guidance for the next iteration |
 
-A canceled or exhausted loop is resumable: `/loop list` shows saved loops, `/loop resume <id>` continues one with its remaining limits. A loop or goal turn runs in auto mode only while it runs: if Aii is stopped or killed mid-loop, the saved session keeps the permission mode you had before the loop, so `aii resume` never comes back in auto on its own. The status bar tracks iterations, tokens, cost, and pause state in real time.
+A canceled or exhausted loop is resumable: `/loop list` shows saved loops, `/loop resume <id>` continues one with its remaining limits. A loop or goal turn runs in Auto · workspace (no prompts, writes stay inside the workspace) only while it runs, unless you started it in Auto: if Aii is stopped or killed mid-loop, the saved session keeps the permission mode you had before the loop, so `aii resume` never comes back in auto on its own. The status bar tracks iterations, tokens, cost, and pause state in real time.
 
 Work survives a crash. A loop, a goal, or a session that starts agents keeps a work log in Aii's private store. After `aii resume <id>` or `/loop resume <id>`, Aii marks what was interrupted, brings back your task list (labelled as restored), re-checks each agent's worktree, and tells the model which agents it may continue with `TaskContinue`. `/tasks` lists past agents; `/tasks unlock <id>` clears a lock left by a process that no longer runs.
 
@@ -395,7 +396,7 @@ While a goal is **active**, the agent sees the objective every turn and auto-con
 
 **Verified completion** — with `--verify` armed, `GOAL COMPLETE` only counts when every command exits 0; failures keep the goal active and feed back to the agent, so "done" means *provably* done. Even without `--verify`, a bare completion isn't taken at face value: the agent gets one nudge to show proof, self-contradicting evidence is rejected, and an uncapped goal (the default) **never ends on an unverified claim** (opt out with `--no-proof` or `goal.proof_expected: false` in config).
 
-Guardrails: a goal **runs until achieved** by default and its own turns **auto-approve tools** (workspace-fenced; your typed turns keep prompting — opt out with `--no-auto` or `goal.auto_approve: false` in config) — cap it with `--auto-turns <n>` or a durable `goal.auto_turns` in config; anti-spin pauses a goal that stops doing work, limit stops hand off with measured progress/remaining/next, typing always wins the turn, Esc pauses, and the `◎ Goal` status-bar segment keeps the state in view.
+Guardrails: a goal **runs until achieved** by default and its own turns **auto-approve tools** (workspace-fenced, or not limited to the workspace if you are in Auto; your typed turns keep prompting — opt out with `--no-auto` or `goal.auto_approve: false` in config) — cap it with `--auto-turns <n>` or a durable `goal.auto_turns` in config; anti-spin pauses a goal that stops doing work, limit stops hand off with measured progress/remaining/next, typing always wins the turn, Esc pauses, and the `◎ Goal` status-bar segment keeps the state in view.
 
 **Finding a goal again** — every goal carries its session's short id (`◎ Goal paused #7khq`), shown on the set card, status bar, `/goal` view, and the exit summary (which prints the exact pick-up command). Across sessions:
 
@@ -630,7 +631,8 @@ Run `aii help` for the full command list.
 | `--model <name>` | Override model (e.g., `deepseek/deepseek-chat`) |
 | `--inference cloud\|server` | Select inference for this invocation; independent of remote control |
 | `--remote-control` | Enable AiiCloud access to an interactive conversation and host new web conversations |
-| `--auto` | Auto-approve tool prompts (the write fence, sensitive-path reads and project deny rules still apply) |
+| `--auto` | Start in Auto: nothing asks first and writes are not limited to the workspace (secrets and project deny rules still apply). With `aii loop` it keeps the workspace fence |
+| `--dangerously-skip-permissions`, `--yolo` | Start in Auto, on every lane including `aii loop` |
 | `-y`, `--yes` | Auto-confirm shell prompts (does **not** authorise installs — see `--trust-source`) |
 | `--trust-source` | Authorise installing third-party code (skills, plugins, personas) non-interactively |
 | `-c`, `--continue-chat <id>` | **Deprecated — no effect.** Use `--continue <id>` |