@singbox-iac/cli 0.1.7 → 0.1.9

package/docs/natural-language-authoring.md

@@ -178,12 +178,48 @@ and writes a new staging config.
 
 With `--preview`, the command does not write anything. Instead it prints:
 
+- Intent IR diff
 - rules diff
 - builder config diff
 - staging config diff
 
 This is the safest way to inspect what a prompt or local AI CLI would change before touching your local files.
 
+## Audit-Friendly Flags
+
+Use these flags when you want stronger control over one-sentence authoring:
+
+- `--strict`
+  Reject vague language instead of guessing. This is recommended for production changes.
+- `--diff`
+  Print the `IntentIR` diff, rules diff, builder config diff, and staging config diff without writing files.
+- `--emit-intent-ir`
+  Print the generated `IntentIR` JSON and exit without touching local files.
+
+Examples:
+
+```bash
+./node_modules/.bin/tsx src/cli/index.ts use \
+  'GitHub 这类开发类都走香港，Gemini 走新加坡' \
+  --strict --diff
+```
+
+```bash
+./node_modules/.bin/tsx src/cli/index.ts author \
+  --config ./builder.config.local.yaml \
+  --prompt 'OpenRouter 走香港' \
+  --emit-intent-ir
+```
+
+In strict mode, the command rejects prompts like:
+
+- `快一点`
+- `大部分`
+- `差不多`
+- `AI 都走好一点的节点`
+
+Those phrases are too vague to compile into a stable routing policy.
+
 ## Exec Provider
 
 The `exec` provider is the escape hatch for developer machines that already have local AI tooling.

package/docs/proxifier-onboarding.md

@@ -18,6 +18,8 @@ Typical files:
 - `bundles/antigravity.txt`
 - `bundles/cursor.txt`
 - `bundles/developer-ai-cli.txt`
+- `bundle-specs/antigravity.yaml`
+- `bundle-specs/cursor.yaml`
 - `all-processes.txt`
 
 ## Fast Path
@@ -44,6 +46,18 @@ To see the supported bundle presets:
 singbox-iac proxifier bundles
 ```
 
+To inspect one declarative bundle:
+
+```bash
+singbox-iac proxifier bundles show antigravity
+```
+
+To render one bundle spec as YAML:
+
+```bash
+singbox-iac proxifier bundles render antigravity
+```
+
 ## Endpoint
 
 By default the process-aware listener is:

package/docs/runtime-on-macos.md

@@ -7,6 +7,7 @@ The target runtime is a headless macOS deployment:
 - `sing-box` installed separately
 - this CLI generates and validates config
 - `launchd` handles periodic updates
+- a dedicated runtime LaunchAgent can keep `sing-box` running in desktop mode
 
 ## Planned Flow
 
@@ -22,6 +23,9 @@ The target runtime is a headless macOS deployment:
 singbox-iac go '<url>' '<一句话策略>'
 singbox-iac use '<新的需求描述>'
 singbox-iac update
+singbox-iac start
+singbox-iac stop
+singbox-iac status
 ```
 
 Advanced commands remain available for debugging or fine-grained control:
@@ -33,13 +37,45 @@ singbox-iac author
 singbox-iac build
 singbox-iac verify
 singbox-iac schedule install
+singbox-iac restart
 ```
 
+## Desktop Runtime Profiles
+
+The builder config now persists an internal desktop runtime profile:
+
+- `system-proxy`
+  - `in-mixed` is still used
+  - `set_system_proxy: true` is emitted so `sing-box` can set and clean the macOS system proxy
+- `tun`
+  - a `tun` inbound is emitted
+  - `auto_route` is enabled
+  - this is closer to the "global capture" experience of GUI clients
+
+During onboarding, prompts that mention `TUN`, `全局代理`, or `全局模式` are inferred as `tun`; otherwise the default is `system-proxy`.
+
+## Runtime Control
+
+Use the dedicated runtime commands for GUI-like everyday control:
+
+```bash
+singbox-iac start
+singbox-iac stop
+singbox-iac restart
+singbox-iac status
+```
+
+- `start` writes or refreshes a dedicated runtime LaunchAgent and boots it
+- `stop` unloads and removes that runtime LaunchAgent
+- `restart` replaces the runtime LaunchAgent
+- `status` reports `sing-box` binary resolution, live config presence, desktop runtime state, system proxy/TUN hints, scheduler state, and recent transactions
+
 ## Launchd Notes
 
 - In source-tree development, `schedule install` emits a LaunchAgent that runs `node_modules/.bin/tsx src/cli/index.ts update --config <path>`.
 - In built distributions, the same logic emits a LaunchAgent that runs the compiled CLI entrypoint with `node`.
 - Use `--no-load` during testing to validate the generated plist without calling `launchctl bootstrap`.
+- Desktop runtime uses a separate LaunchAgent label from the update scheduler.
 
 ## Why `launchd`
 

package/examples/builder.config.yaml

@@ -17,6 +17,15 @@ runtime:
     kind: "signal"
     processName: "sing-box"
     signal: "HUP"
+  desktop:
+    profile: "system-proxy"
+    launchAgentLabel: "org.singbox-iac.runtime"
+    tun:
+      autoRoute: true
+      strictRoute: false
+      addresses:
+        - "172.19.0.1/30"
+        - "fdfe:dcba:9876::1/126"
 
 listeners:
   mixed:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@singbox-iac/cli",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Policy-first subscription compiler for sing-box on macOS.",
   "repository": {
     "type": "git",
@@ -46,6 +46,7 @@
     "prepack": "npm run build",
     "release:check": "node ./scripts/release-check.mjs",
     "release:dry-run": "node ./scripts/release-dry-run.mjs",
+    "fixtures:regenerate": "tsx tests/regression/generate-fixtures.ts",
     "test": "vitest run",
     "test:watch": "vitest",
     "lint": "biome check .",