jinzd-ai-cli 0.4.210 → 0.4.212

package/README.md

@@ -329,7 +329,88 @@ Control when tools require confirmation. Rules are checked in order — first ma
 | `action` | `auto-approve` (skip confirmation), `deny` (block), `confirm` (ask user) |
 | `when.dangerLevel` | Only match when danger level is `safe`, `write`, or `destructive` |
 | `when.pathPattern` | Substring match against tool's `path` or `command` argument |
-
+
+### Permission Profiles
+
+Permission profiles provide coarse-grained safety boundaries before fine-grained `permissionRules` run. The default profile is `legacy`, so existing configs keep their old behavior.
+
+Built-in profiles:
+
+| Profile | Behavior |
+|---------|----------|
+| `legacy` | Backward-compatible mode. Uses `permissionRules` and `defaultPermission` as before. |
+| `read-only` | Allows known read-only/safe tools and safe MCP tools; blocks write and destructive tools. |
+| `workspace-write` | Allows explicit file writes only inside the workspace roots or temp dirs; destructive tools still require confirmation. |
+| `danger-full-access` | Auto-approves non-destructive tools by default; destructive tools still require confirmation. Use only in isolated environments. |
+
+```json
+{
+  "defaultPermissionProfile": "workspace-write",
+  "allowedPermissionProfiles": ["legacy", "read-only", "workspace-write", "danger-full-access"],
+  "permissionProfiles": {
+    "workspace-write": {
+      "workspaceRoots": ["D:/github/ai-cli"],
+      "allowTemp": true,
+      "rules": [
+        { "tool": "read_file", "action": "auto-approve" },
+        { "tool": "list_dir", "action": "auto-approve" }
+      ]
+    }
+  },
+  "permissionRules": [
+    { "tool": "bash", "action": "deny", "when": { "pathPattern": "rm -rf" } }
+  ]
+}
+```
+
+`/status` and `/security status` show the active profile. The Web status payload also includes `permissionProfile` for UI surfaces.
+### Network Policy
+
+`networkPolicy` is disabled by default for backward compatibility. When enabled, it governs network-facing tools before execution: `web_fetch`, `web_search`, `google_search`, MCP tools, and shell commands that look like network access (`curl`, `wget`, `git clone/fetch/pull/push`, package installs, SSH/SCP, etc.).
+
+```json
+{
+  "networkPolicy": {
+    "enabled": true,
+    "defaultAction": "confirm",
+    "allowDomains": ["github.com", "docs.anthropic.com", "platform.openai.com"],
+    "denyDomains": ["example-danger.test"],
+    "allowPrivateNetwork": false,
+    "tools": {
+      "web_fetch": "confirm",
+      "web_search": "allow",
+      "google_search": "confirm",
+      "shell": "confirm",
+      "mcp": "confirm"
+    }
+  }
+}
+```
+
+Actions are `allow`, `confirm`, or `deny`. Domain entries match the exact host or subdomains; port lists match the resolved URL port. Private/internal hosts such as `localhost`, `127.0.0.1`, `10.0.0.0/8`, `192.168.0.0/16`, and private IPv6 ranges are blocked unless `allowPrivateNetwork` is true.
+### Trusted Hooks Lifecycle
+
+Legacy `preToolExecution` / `postToolExecution` hooks still work. New lifecycle hooks live under `hooks.events.<EventName>` and receive a JSON payload through `AICLI_HOOK_EVENT_JSON`; if the command prints JSON, ai-cli reads decisions such as `allow`, `deny`, `ask`, `warning`, or `warnings`.
+
+```json
+{
+  "hooks": {
+    "events": {
+      "PreToolUse": {
+        "command": "node ./scripts/aicli-pre-tool-hook.mjs",
+        "source": "project",
+        "description": "Block unsafe local commands"
+      },
+      "UserPromptSubmit": "node ./scripts/aicli-prompt-hook.mjs",
+      "Stop": { "command": "npm test -- --runInBand", "timeoutMs": 10000 }
+    }
+  }
+}
+```
+
+Supported lifecycle names are `SessionStart`, `UserPromptSubmit`, `PreToolUse`, `PermissionRequest`, `PostToolUse`, `PreCompact`, `PostCompact`, `Stop`, `SubagentStart`, and `SubagentStop`. Project-sourced hooks must be trusted before execution; ai-cli stores trust records locally under the user config directory, keyed by hook hash, so changing hook content requires re-trust.
+
+Use `/hooks list`, `/hooks inspect <id>`, `/hooks trust <id>`, `/hooks untrust <id>`, and `/hooks disable` to manage them. `/status`, `/security status`, and Web status show pending project hooks that require trust.
 **Recommended minimal config** — auto-approve all read-only tools to reduce y/N prompts:
 
 ```json
@@ -422,6 +503,46 @@ npm run test:watch    # Watch mode
 
 79 offline test files covering: authentication, sessions, tool types & danger levels, permissions, output truncation, diff rendering, edit-file similarity, error hierarchy, config management, env loading, provider registry, web-fetch, grep-files, hub renderer, hub discussion, hub presets, dev-state, token estimator, tool registry budget, parallel tool execution, cost tracker, session tool history.
 
+## Releasing (Version Bump → npm Publish → GitHub Push)
+
+> **For contributors and AI agents: the entire release is driven by [`scripts/release.mjs`](scripts/release.mjs). Never manually bump the version or run `npm publish` yourself** — a hand-publish of `0.4.207` shipped a version that reported the wrong number and forced a corrective re-release (`0.4.208`). The script's guards exist precisely to stop that.
+
+**Prerequisites**
+
+- You are on the `main` branch and the changes to ship are already in the working tree.
+- `npx tsc --noEmit` is clean and `npm test` is green (the script enforces both and rolls the bump back on failure).
+- You are logged into npm as the package owner (`npm whoami`).
+- You have push access to the GitHub remote.
+
+**Step 1 — Write the milestone entry FIRST (Guard A).** Add a one-line entry to the `## 最近里程碑` section of [`CLAUDE.md`](CLAUDE.md) that contains the exact full-width-parenthesis marker `（vX.Y.Z）` for the target version. The script refuses to start without it. (Full narrative goes in `CHANGELOG.md`; this section is just the index line.)
+
+**Step 2 — Run the release script.**
+
+```bash
+# patch: 0.4.209 → 0.4.210  (also accepts: minor / major / an explicit x.y.z)
+node scripts/release.mjs patch -m "fix(scope): one-line commit title"
+
+# preview only — validates guards, writes nothing:
+node scripts/release.mjs patch -m "..." --dry-run
+```
+
+- Do **not** put a `(vX.Y.Z)` suffix in `-m`; the script appends it automatically.
+- On Windows PowerShell, call `node` directly — `npm run release -- -m ...` swallows the `-m` argument.
+
+**What the script does, in order:**
+
+1. **Guard A** — asserts `CLAUDE.md` contains the `（vX.Y.Z）` milestone entry.
+2. Bumps the version in **three** places: `package.json`, `src/core/constants.ts` (`VERSION`), and `CLAUDE.md` (`**当前版本**`).
+3. **Guard B** — re-reads all three files from disk and asserts every bump landed.
+4. **Guard C** — `tsc --noEmit` must be zero-error (rolls the bump back on failure).
+5. `npm test` must pass (rolls the bump back on failure).
+6. Prints the exact file list entering the release commit and blocks if any looks sensitive (`.env`, `*.pem`, `*.key`, `secret`, …). Override consciously with `--allow-sensitive`.
+7. `git add -A` + commit `"<title> (vX.Y.Z)"` (message passed via argv, not shell-interpolated).
+8. `npm publish` (the build runs automatically via `prepublishOnly`), then re-queries the registry to confirm the new version is live.
+9. `git push` to `main`.
+
+**Optional flags:** `--dry-run` · `--skip-tests` · `--no-publish` · `--no-push` · `--allow-sensitive`.
+
 ## Documentation
 
 - [`docs/USAGE.md`](docs/USAGE.md) — Complete reference manual (commands, tools, config)

package/README.zh-CN.md

@@ -370,6 +370,29 @@ HTTPS_PROXY=http://127.0.0.1:10809 aicli
 }
 ```
 
+### 可信 Hooks 生命周期
+
+旧版 `preToolExecution` / `postToolExecution` 仍然兼容。新版生命周期 hooks 配置在 `hooks.events.<EventName>` 下，通过 `AICLI_HOOK_EVENT_JSON` 接收 JSON 事件；命令 stdout 如果输出 JSON，ai-cli 会读取 `allow`、`deny`、`ask`、`warning` 或 `warnings` 等决策。
+
+```json
+{
+  "hooks": {
+    "events": {
+      "PreToolUse": {
+        "command": "node ./scripts/aicli-pre-tool-hook.mjs",
+        "source": "project",
+        "description": "Block unsafe local commands"
+      },
+      "UserPromptSubmit": "node ./scripts/aicli-prompt-hook.mjs",
+      "Stop": { "command": "npm test -- --runInBand", "timeoutMs": 10000 }
+    }
+  }
+}
+```
+
+支持的事件包括 `SessionStart`、`UserPromptSubmit`、`PreToolUse`、`PermissionRequest`、`PostToolUse`、`PreCompact`、`PostCompact`、`Stop`、`SubagentStart`、`SubagentStop`。`source: "project"` 的 hook 默认不会执行，必须通过 `/hooks trust <id>` 写入本地信任记录；命令内容变化后 hash 会变化，需要重新信任。
+
+使用 `/hooks list`、`/hooks inspect <id>`、`/hooks trust <id>`、`/hooks untrust <id>`、`/hooks disable` 管理 hooks。`/status`、`/security status` 和 Web 状态栏会显示待信任项目 hooks 数量。
 ### 环境变量
 
 | 变量 | 说明 |
@@ -441,6 +464,46 @@ npm run test:watch    # 监听模式
 
 26 个测试套件覆盖：认证、会话、工具类型与危险级别、权限、输出截断、diff 渲染、edit-file 相似度、错误层级、配置管理、环境变量、Provider 注册、web-fetch、grep-files、Hub 渲染、Hub 讨论、Hub 预设、开发状态、Token 估算、工具注册表预算、并行工具执行、费用追踪、会话工具历史。
 
+## 发布（版本提升 → npm 发布 → 推送 GitHub）
+
+> **给贡献者与 AI 模型：整个发布流程一律走 [`scripts/release.mjs`](scripts/release.mjs)，切勿手动 bump 版本号或自己跑 `npm publish`。** 曾经手工 publish 的 `0.4.207` 装上后 `--version` 报错版本号，被迫补发 `0.4.208` 对齐——脚本的四道守卫就是为拦住这类事故而存在。
+
+**前置条件**
+
+- 当前在 `main` 分支，待发布的改动已在工作区。
+- `npx tsc --noEmit` 零错误、`npm test` 全绿（脚本会强制校验，失败自动回滚版本号）。
+- 已登录 npm 且是包的 owner（`npm whoami`）。
+- 有 GitHub 远端推送权限。
+
+**第 1 步 —— 先写里程碑条目（Guard A）。** 在 [`CLAUDE.md`](CLAUDE.md) 的 `## 最近里程碑` 一节加一行，条目中必须含目标版本的**全角括号**标记 `（vX.Y.Z）`，否则脚本拒绝启动。（完整叙事写进 `CHANGELOG.md`，本节只留一行式索引。）
+
+**第 2 步 —— 运行发布脚本。**
+
+```bash
+# patch：0.4.209 → 0.4.210（也支持 minor / major / 显式 x.y.z）
+node scripts/release.mjs patch -m "fix(scope): 一句话 commit 标题"
+
+# 仅预览，只校验守卫、不改任何文件：
+node scripts/release.mjs patch -m "..." --dry-run
+```
+
+- `-m` 里**不要**自带 `(vX.Y.Z)` 后缀，脚本会自动追加。
+- Windows PowerShell 下请直接用 `node` 调用——`npm run release -- -m ...` 会把 `-m` 参数吞掉。
+
+**脚本执行顺序：**
+
+1. **Guard A** —— 断言 `CLAUDE.md` 已含 `（vX.Y.Z）` 里程碑条目。
+2. bump **三处**版本号：`package.json`、`src/core/constants.ts`（`VERSION`）、`CLAUDE.md`（`**当前版本**`）。
+3. **Guard B** —— 从磁盘重读这三处，逐一断言都真的改到了。
+4. **Guard C** —— `tsc --noEmit` 必须零错误（失败则回滚版本号）。
+5. `npm test` 必须全绿（失败则回滚版本号）。
+6. 打印进入发布 commit 的完整文件清单，若含疑似敏感文件（`.env`、`*.pem`、`*.key`、`secret`…）直接拦下，确认无误加 `--allow-sensitive`。
+7. `git add -A` + commit `"<标题> (vX.Y.Z)"`（消息走 argv 传参，不经 shell 拼接）。
+8. `npm publish`（build 经 `prepublishOnly` 自动跑），再回查 registry 确认新版本已上线。
+9. `git push` 推送 `main`。
+
+**可选 flag：** `--dry-run` · `--skip-tests` · `--no-publish` · `--no-push` · `--allow-sensitive`。
+
 ## 文档
 
 - [English README](README.md) — English documentation

package/dist/{batch-MFPYHOIL.js → batch-WIKFEOAZ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   ConfigManager
-} from "./chunk-P6MTFCXB.js";
+} from "./chunk-NYCBOVNF.js";
 import "./chunk-TZQHYZKT.js";
-import "./chunk-GRJNQJA5.js";
+import "./chunk-GBBVCZ4W.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chat-index-UBCWHBLR.js → chat-index-R2E27VXN.js}

@@ -5,7 +5,7 @@ import {
   getChatIndexStatus,
   loadChatIndex,
   searchChatMemory
-} from "./chunk-W7UKO3PS.js";
+} from "./chunk-OQGVGPEK.js";
 import "./chunk-JV5N65KN.js";
 import "./chunk-6BUTA5VW.js";
 export {

package/dist/{chunk-GRJNQJA5.js → chunk-GBBVCZ4W.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/core/constants.ts
-var VERSION = "0.4.210";
+var VERSION = "0.4.212";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-7JWT3KXO.js → chunk-HW2ALWQJ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   truncateForPersist
-} from "./chunk-NEPFADHX.js";
+} from "./chunk-N5LB3PPL.js";
 import {
   APP_NAME,
   CONFIG_DIR_NAME,
@@ -13,7 +13,7 @@ import {
   MCP_PROTOCOL_VERSION,
   MCP_TOOL_PREFIX,
   VERSION
-} from "./chunk-GRJNQJA5.js";
+} from "./chunk-GBBVCZ4W.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-E2ZWWE6Q.js → chunk-HX6N6QEY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   TEST_TIMEOUT
-} from "./chunk-GRJNQJA5.js";
+} from "./chunk-GBBVCZ4W.js";
 
 // src/tools/builtin/run-tests.ts
 import { execSync, spawnSync } from "child_process";

package/dist/{chunk-DJ35G5VO.js → chunk-IFZX26K7.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CONFIG_DIR_NAME
-} from "./chunk-GRJNQJA5.js";
+} from "./chunk-GBBVCZ4W.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-HZQVX7VF.js → chunk-KE4B3NOQ.js}

@@ -6,7 +6,7 @@ import { platform } from "os";
 import chalk from "chalk";
 
 // src/core/constants.ts
-var VERSION = "0.4.210";
+var VERSION = "0.4.212";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-NWP7C6CC.js → chunk-LU6FBJQ5.js}

@@ -2,7 +2,7 @@
 import {
   CONFIG_DIR_NAME,
   VERSION
-} from "./chunk-GRJNQJA5.js";
+} from "./chunk-GBBVCZ4W.js";
 
 // src/diagnostics/crash-log.ts
 import {