jinzd-ai-cli 0.4.211 → 0.4.213

package/README.md

@@ -364,6 +364,13 @@ Built-in profiles:
 ```
 
 `/status` and `/security status` show the active profile. The Web status payload also includes `permissionProfile` for UI surfaces.
+### Auto Mode
+
+`/auto on|off|status` enables a session-scoped, rule-based action classifier. It is designed to reduce confirmation fatigue without widening `/yolo`: `/yolo` still only skips write confirmations, while destructive tools still require confirmation.
+
+Auto Mode may auto-approve low-risk actions such as explicit writes inside the workspace/temp roots, read-only HTTP tools, plain non-force `git push`, and dependency installs already declared in `package.json` or a lockfile. It denies high-risk shapes such as `curl | bash`, force push, and likely secret exfiltration. Production deploys, database migrations, IaC destroy, credential/permission changes, and third-party agent loops fall back to confirmation.
+
+Auto Mode is not enabled by project config. Use `/permissions recently-denied` to inspect actions it blocked, or `/permissions clear-denied` to clear that session list.
 ### Network Policy
 
 `networkPolicy` is disabled by default for backward compatibility. When enabled, it governs network-facing tools before execution: `web_fetch`, `web_search`, `google_search`, MCP tools, and shell commands that look like network access (`curl`, `wget`, `git clone/fetch/pull/push`, package installs, SSH/SCP, etc.).
@@ -388,6 +395,29 @@ Built-in profiles:
 ```
 
 Actions are `allow`, `confirm`, or `deny`. Domain entries match the exact host or subdomains; port lists match the resolved URL port. Private/internal hosts such as `localhost`, `127.0.0.1`, `10.0.0.0/8`, `192.168.0.0/16`, and private IPv6 ranges are blocked unless `allowPrivateNetwork` is true.
+### Trusted Hooks Lifecycle
+
+Legacy `preToolExecution` / `postToolExecution` hooks still work. New lifecycle hooks live under `hooks.events.<EventName>` and receive a JSON payload through `AICLI_HOOK_EVENT_JSON`; if the command prints JSON, ai-cli reads decisions such as `allow`, `deny`, `ask`, `warning`, or `warnings`.
+
+```json
+{
+  "hooks": {
+    "events": {
+      "PreToolUse": {
+        "command": "node ./scripts/aicli-pre-tool-hook.mjs",
+        "source": "project",
+        "description": "Block unsafe local commands"
+      },
+      "UserPromptSubmit": "node ./scripts/aicli-prompt-hook.mjs",
+      "Stop": { "command": "npm test -- --runInBand", "timeoutMs": 10000 }
+    }
+  }
+}
+```
+
+Supported lifecycle names are `SessionStart`, `UserPromptSubmit`, `PreToolUse`, `PermissionRequest`, `PostToolUse`, `PreCompact`, `PostCompact`, `Stop`, `SubagentStart`, and `SubagentStop`. Project-sourced hooks must be trusted before execution; ai-cli stores trust records locally under the user config directory, keyed by hook hash, so changing hook content requires re-trust.
+
+Use `/hooks list`, `/hooks inspect <id>`, `/hooks trust <id>`, `/hooks untrust <id>`, and `/hooks disable` to manage them. `/status`, `/security status`, and Web status show pending project hooks that require trust.
 **Recommended minimal config** — auto-approve all read-only tools to reduce y/N prompts:
 
 ```json

package/README.zh-CN.md

@@ -370,6 +370,36 @@ HTTPS_PROXY=http://127.0.0.1:10809 aicli
 }
 ```
 
+### Auto Mode
+
+`/auto on|off|status` 会开启会话级规则分类器，用来减少确认疲劳，但不会扩大 `/yolo` 的边界：`/yolo` 仍然只跳过 write 确认，destructive 仍需确认。
+
+Auto Mode 可自动通过低风险动作，例如 workspace/temp 根目录内的显式写入、只读 HTTP 工具、非 force 的普通 `git push`、已经写在 `package.json` 或 lockfile 中的依赖安装。它会拒绝 `curl | bash`、force push、疑似 secret 外传；生产部署、数据库迁移、IaC destroy、IAM/token/key/权限变更、第三方 agent loop 默认进入确认。
+
+Auto Mode 不会被项目配置静默开启。用 `/permissions recently-denied` 查看最近被 Auto Mode 拒绝的动作，用 `/permissions clear-denied` 清空本会话列表。
+### 可信 Hooks 生命周期
+
+旧版 `preToolExecution` / `postToolExecution` 仍然兼容。新版生命周期 hooks 配置在 `hooks.events.<EventName>` 下，通过 `AICLI_HOOK_EVENT_JSON` 接收 JSON 事件；命令 stdout 如果输出 JSON，ai-cli 会读取 `allow`、`deny`、`ask`、`warning` 或 `warnings` 等决策。
+
+```json
+{
+  "hooks": {
+    "events": {
+      "PreToolUse": {
+        "command": "node ./scripts/aicli-pre-tool-hook.mjs",
+        "source": "project",
+        "description": "Block unsafe local commands"
+      },
+      "UserPromptSubmit": "node ./scripts/aicli-prompt-hook.mjs",
+      "Stop": { "command": "npm test -- --runInBand", "timeoutMs": 10000 }
+    }
+  }
+}
+```
+
+支持的事件包括 `SessionStart`、`UserPromptSubmit`、`PreToolUse`、`PermissionRequest`、`PostToolUse`、`PreCompact`、`PostCompact`、`Stop`、`SubagentStart`、`SubagentStop`。`source: "project"` 的 hook 默认不会执行，必须通过 `/hooks trust <id>` 写入本地信任记录；命令内容变化后 hash 会变化，需要重新信任。
+
+使用 `/hooks list`、`/hooks inspect <id>`、`/hooks trust <id>`、`/hooks untrust <id>`、`/hooks disable` 管理 hooks。`/status`、`/security status` 和 Web 状态栏会显示待信任项目 hooks 数量。
 ### 环境变量
 
 | 变量 | 说明 |

package/dist/{batch-DE4RXKZD.js → batch-PKY63TME.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   ConfigManager
-} from "./chunk-UOROWTGG.js";
+} from "./chunk-MRGWPCFQ.js";
 import "./chunk-TZQHYZKT.js";
-import "./chunk-E5XCM4A6.js";
+import "./chunk-IWLVH32D.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chat-index-UBCWHBLR.js → chat-index-R2E27VXN.js}

@@ -5,7 +5,7 @@ import {
   getChatIndexStatus,
   loadChatIndex,
   searchChatMemory
-} from "./chunk-W7UKO3PS.js";
+} from "./chunk-OQGVGPEK.js";
 import "./chunk-JV5N65KN.js";
 import "./chunk-6BUTA5VW.js";
 export {

package/dist/{chunk-JBWA73GK.js → chunk-7NTFMLJJ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CONFIG_DIR_NAME
-} from "./chunk-E5XCM4A6.js";
+} from "./chunk-IWLVH32D.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-C3OU2OPF.js → chunk-FGUKBIYO.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   truncateForPersist
-} from "./chunk-ZOPYREL5.js";
+} from "./chunk-THNECAAY.js";
 import {
   APP_NAME,
   CONFIG_DIR_NAME,
@@ -13,7 +13,7 @@ import {
   MCP_PROTOCOL_VERSION,
   MCP_TOOL_PREFIX,
   VERSION
-} from "./chunk-E5XCM4A6.js";
+} from "./chunk-IWLVH32D.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-BE6ERF7M.js → chunk-G3PW3AOB.js}

@@ -2,7 +2,7 @@
 import {
   CONFIG_DIR_NAME,
   VERSION
-} from "./chunk-E5XCM4A6.js";
+} from "./chunk-IWLVH32D.js";
 
 // src/diagnostics/crash-log.ts
 import {

package/dist/{chunk-E5XCM4A6.js → chunk-IWLVH32D.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/core/constants.ts
-var VERSION = "0.4.211";
+var VERSION = "0.4.213";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-ZY2N2N6T.js → chunk-J35V3IAH.js}

@@ -6,7 +6,7 @@ import { platform } from "os";
 import chalk from "chalk";
 
 // src/core/constants.ts
-var VERSION = "0.4.211";
+var VERSION = "0.4.213";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-UOROWTGG.js → chunk-MRGWPCFQ.js}

@@ -8,7 +8,7 @@ import {
   CONFIG_FILE_NAME,
   HISTORY_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-E5XCM4A6.js";
+} from "./chunk-IWLVH32D.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";
@@ -157,10 +157,33 @@ var ConfigSchema = z.object({
     env: z.record(z.string()).optional(),
     timeout: z.number().default(3e4)
   })).default({}),
-  // 工具执行钩子（shell 命令，模板变量：{tool} {dangerLevel} {args} {status}）
+  // Hooks 生命周期（v0.4.212+）：兼容旧 pre/post 字符串，同时支持 events.<EventName> 结构化 JSON hook。
   hooks: z.object({
+    enabled: z.boolean().default(true),
     preToolExecution: z.string().optional(),
-    postToolExecution: z.string().optional()
+    postToolExecution: z.string().optional(),
+    events: z.record(z.union([
+      z.string(),
+      z.object({
+        command: z.string(),
+        source: z.enum(["user", "project", "managed"]).default("user"),
+        description: z.string().optional(),
+        required: z.boolean().default(false),
+        timeoutMs: z.number().int().min(100).max(3e4).default(5e3),
+        disabled: z.boolean().default(false)
+      }),
+      z.array(z.union([
+        z.string(),
+        z.object({
+          command: z.string(),
+          source: z.enum(["user", "project", "managed"]).default("user"),
+          description: z.string().optional(),
+          required: z.boolean().default(false),
+          timeoutMs: z.number().int().min(100).max(3e4).default(5e3),
+          disabled: z.boolean().default(false)
+        })
+      ]))
+    ])).default({})
   }).optional(),
   // 网络访问治理（v0.4.211+）：默认关闭以保持兼容；开启后统一治理 web/search/MCP/shell 网络出口。
   networkPolicy: z.object({

package/dist/{chunk-W7UKO3PS.js → chunk-OQGVGPEK.js}

@@ -120,6 +120,10 @@ function redactJson(value, options) {
   const redacted = walk(value);
   return { value: redacted, hits: allHits };
 }
+function scanString(input, options) {
+  const { hits } = redactString(input, { ...options, enabled: true });
+  return hits;
+}
 
 // src/memory/chat-index.ts
 var MEMORY_DIR_NAME = "memory-index";
@@ -451,6 +455,7 @@ function getChatIndexStatus() {
 
 export {
   redactJson,
+  scanString,
   chunkSession,
   loadChatIndex,
   clearChatIndex,