jinzd-ai-cli 0.4.210 → 0.4.212

package/dist/{chunk-P6MTFCXB.js → chunk-NYCBOVNF.js}

@@ -8,7 +8,7 @@ import {
   CONFIG_FILE_NAME,
   HISTORY_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-GRJNQJA5.js";
+} from "./chunk-GBBVCZ4W.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";
@@ -157,12 +157,69 @@ var ConfigSchema = z.object({
     env: z.record(z.string()).optional(),
     timeout: z.number().default(3e4)
   })).default({}),
-  // 工具执行钩子（shell 命令，模板变量：{tool} {dangerLevel} {args} {status}）
+  // Hooks 生命周期（v0.4.212+）：兼容旧 pre/post 字符串，同时支持 events.<EventName> 结构化 JSON hook。
   hooks: z.object({
+    enabled: z.boolean().default(true),
     preToolExecution: z.string().optional(),
-    postToolExecution: z.string().optional()
+    postToolExecution: z.string().optional(),
+    events: z.record(z.union([
+      z.string(),
+      z.object({
+        command: z.string(),
+        source: z.enum(["user", "project", "managed"]).default("user"),
+        description: z.string().optional(),
+        required: z.boolean().default(false),
+        timeoutMs: z.number().int().min(100).max(3e4).default(5e3),
+        disabled: z.boolean().default(false)
+      }),
+      z.array(z.union([
+        z.string(),
+        z.object({
+          command: z.string(),
+          source: z.enum(["user", "project", "managed"]).default("user"),
+          description: z.string().optional(),
+          required: z.boolean().default(false),
+          timeoutMs: z.number().int().min(100).max(3e4).default(5e3),
+          disabled: z.boolean().default(false)
+        })
+      ]))
+    ])).default({})
   }).optional(),
-  // 工具权限规则（按顺序匹配第一个生效）
+  // 网络访问治理（v0.4.211+）：默认关闭以保持兼容；开启后统一治理 web/search/MCP/shell 网络出口。
+  networkPolicy: z.object({
+    enabled: z.boolean().default(false),
+    defaultAction: z.enum(["allow", "confirm", "deny"]).default("confirm"),
+    allowDomains: z.array(z.string()).default([]),
+    denyDomains: z.array(z.string()).default([]),
+    allowPorts: z.array(z.number().int().min(1).max(65535)).default([]),
+    denyPorts: z.array(z.number().int().min(1).max(65535)).default([]),
+    allowPrivateNetwork: z.boolean().default(false),
+    tools: z.object({
+      web_fetch: z.enum(["allow", "confirm", "deny"]).optional(),
+      web_search: z.enum(["allow", "confirm", "deny"]).optional(),
+      google_search: z.enum(["allow", "confirm", "deny"]).optional(),
+      shell: z.enum(["allow", "confirm", "deny"]).optional(),
+      mcp: z.enum(["allow", "confirm", "deny"]).optional()
+    }).default({})
+  }).default({ enabled: false, defaultAction: "confirm", allowDomains: [], denyDomains: [], allowPorts: [], denyPorts: [], allowPrivateNetwork: false, tools: {} }),
+  // 权限 Profile（v0.4.211+）：legacy 保持旧行为；其余 profile 提供更清晰的安全边界。
+  defaultPermissionProfile: z.enum(["legacy", "read-only", "workspace-write", "danger-full-access"]).default("legacy"),
+  allowedPermissionProfiles: z.array(z.string()).default(["legacy", "read-only", "workspace-write", "danger-full-access"]),
+  permissionProfiles: z.record(z.object({
+    extends: z.enum(["legacy", "read-only", "workspace-write", "danger-full-access"]).optional(),
+    defaultAction: z.enum(["auto-approve", "deny", "confirm"]).optional(),
+    workspaceRoots: z.array(z.string()).optional(),
+    allowTemp: z.boolean().optional(),
+    rules: z.array(z.object({
+      tool: z.string(),
+      action: z.enum(["auto-approve", "deny", "confirm"]),
+      when: z.object({
+        dangerLevel: z.enum(["safe", "write", "destructive"]).optional(),
+        pathPattern: z.string().optional()
+      }).optional()
+    })).optional()
+  })).default({}),
+  // 工具权限规则（按顺序匹配第一个生效；作为当前权限 Profile 内的细粒度规则）
   permissionRules: z.array(z.object({
     tool: z.string(),
     action: z.enum(["auto-approve", "deny", "confirm"]),
@@ -171,7 +228,7 @@ var ConfigSchema = z.object({
       pathPattern: z.string().optional()
     }).optional()
   })).default([]),
-  // 无规则匹配时的默认权限动作
+  // 无规则匹配时的默认权限动作（legacy profile 兼容旧行为）
   defaultPermission: z.enum(["auto-approve", "deny", "confirm"]).default("confirm"),
   // 自动上下文压缩开关
   // 当对话估算 token 数超过模型 contextWindow 的 80% 时，自动触发 compact 压缩旧消息

package/dist/{chunk-W7UKO3PS.js → chunk-OQGVGPEK.js}

@@ -120,6 +120,10 @@ function redactJson(value, options) {
   const redacted = walk(value);
   return { value: redacted, hits: allHits };
 }
+function scanString(input, options) {
+  const { hits } = redactString(input, { ...options, enabled: true });
+  return hits;
+}
 
 // src/memory/chat-index.ts
 var MEMORY_DIR_NAME = "memory-index";
@@ -451,6 +455,7 @@ function getChatIndexStatus() {
 
 export {
   redactJson,
+  scanString,
   chunkSession,
   loadChatIndex,
   clearChatIndex,

package/dist/{ci-QLJUDLMY.js → ci-X3LNUFZV.js}

@@ -10,11 +10,11 @@ import {
 import "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-P6MTFCXB.js";
+} from "./chunk-NYCBOVNF.js";
 import "./chunk-TZQHYZKT.js";
 import {
   VERSION
-} from "./chunk-GRJNQJA5.js";
+} from "./chunk-GBBVCZ4W.js";
 import "./chunk-IW3Q7AE5.js";
 
 // src/cli/ci.ts

package/dist/{constants-47OR72MV.js → constants-KDWG4KR4.js}

@@ -37,7 +37,7 @@ import {
   TEST_TIMEOUT,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-GRJNQJA5.js";
+} from "./chunk-GBBVCZ4W.js";
 export {
   AGENTIC_BEHAVIOR_GUIDELINE,
   APP_NAME,

package/dist/{doctor-cli-32COMA5K.js → doctor-cli-TJTWIW7U.js}

@@ -2,7 +2,7 @@
 import {
   getConfigDirUsage,
   listRecentCrashes
-} from "./chunk-NWP7C6CC.js";
+} from "./chunk-LU6FBJQ5.js";
 import {
   ProviderRegistry
 } from "./chunk-QMXC327F.js";
@@ -11,17 +11,17 @@ import {
   getTopFailingTools,
   getTopUsedTools,
   resetStats
-} from "./chunk-DJ35G5VO.js";
+} from "./chunk-IFZX26K7.js";
 import "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-P6MTFCXB.js";
+} from "./chunk-NYCBOVNF.js";
 import "./chunk-TZQHYZKT.js";
 import {
   DEV_STATE_FILE_NAME,
   MEMORY_FILE_NAME,
   VERSION
-} from "./chunk-GRJNQJA5.js";
+} from "./chunk-GBBVCZ4W.js";
 import "./chunk-IW3Q7AE5.js";
 
 // src/diagnostics/doctor-cli.ts