jinzd-ai-cli 0.4.214 → 0.4.216

package/README.md

@@ -47,6 +47,8 @@
 - **Headless Mode** — `ai-cli -p "prompt"` for CI/CD pipelines and scripting
 - **44 REPL Commands** — Session management, checkpointing, code review, security review/scan, rewind, scaffolding, cross-session history search, chat-memory recall, smart model routing (`/route`), and more
 - **GitHub Actions CI/CD** — Automated testing on Node 20/22 + npm publish on release tags
+- **PR Review CLI** *(v0.4.216+)* — `aicli pr review|security-review|summarize` reviews `main...HEAD`, custom `--base/--head`, or GitHub PR URLs; optional `--agents security,bugs,tests,maintainability`; never posts comments unless `--post` is explicit
+- **CI Review Artifacts** *(v0.4.216+)* — `aicli ci` emits Markdown, JSON, or SARIF and gates on security-high, test-failure, and lint-failure findings in read-only review mode
 - **Cross-Platform** — Windows, macOS, Linux
 
 ## Installation

package/dist/{batch-NPUUDETK.js → batch-C6HCXZIG.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   ConfigManager
-} from "./chunk-YFHF3PVB.js";
+} from "./chunk-WAI3WPV2.js";
 import "./chunk-TZQHYZKT.js";
-import "./chunk-DBYMX2ZC.js";
+import "./chunk-7YWS3JLU.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-JQC7IATA.js → chunk-6HLKCSB3.js}

@@ -2,7 +2,7 @@
 import {
   CONFIG_DIR_NAME,
   VERSION
-} from "./chunk-DBYMX2ZC.js";
+} from "./chunk-7YWS3JLU.js";
 
 // src/diagnostics/crash-log.ts
 import {

package/dist/{chunk-YMFGGCUP.js → chunk-77HDCGTN.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CONFIG_DIR_NAME
-} from "./chunk-DBYMX2ZC.js";
+} from "./chunk-7YWS3JLU.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-DBYMX2ZC.js → chunk-7YWS3JLU.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/core/constants.ts
-var VERSION = "0.4.214";
+var VERSION = "0.4.216";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{ci-3TU7WCY4.js → chunk-GY3C3C2Y.js}

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+import {
+  evaluateCiGate,
+  normalizeCiThresholds
+} from "./chunk-TJ6GGN4B.js";
 import {
   buildReviewPrompt,
   buildSecurityReviewPrompt,
@@ -7,19 +11,30 @@ import {
 import {
   ProviderRegistry
 } from "./chunk-QMXC327F.js";
-import "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-YFHF3PVB.js";
-import "./chunk-TZQHYZKT.js";
+} from "./chunk-WAI3WPV2.js";
 import {
   VERSION
-} from "./chunk-DBYMX2ZC.js";
-import "./chunk-IW3Q7AE5.js";
+} from "./chunk-7YWS3JLU.js";
 
 // src/cli/ci.ts
 import { execFileSync } from "child_process";
 var CI_COMMENT_MARKER = "<!-- aicli-ci-review -->";
+function zeroSeverity() {
+  return { critical: 0, high: 0, warning: 0, info: 0 };
+}
+function earlyResult(exitCode, markdown, thresholds) {
+  const gate = evaluateCiGate(markdown, thresholds);
+  return {
+    exitCode: exitCode === 0 && gate.failed ? 1 : exitCode,
+    markdown,
+    posted: false,
+    severity: zeroSeverity(),
+    gate,
+    meta: { mode: "read-only", thresholds }
+  };
+}
 function fetchDiff(opts) {
   if (opts.diffOverride != null) return opts.diffOverride;
   if (opts.pr != null) {
@@ -48,9 +63,7 @@ function fetchDiff(opts) {
   throw new Error("aicli ci: must supply --pr <num> or --base <ref> to determine the diff source");
 }
 function validateGitRef(ref) {
-  if (!/^[A-Za-z0-9._/\-]+$/.test(ref)) {
-    throw new Error(`unsafe ref: ${ref}`);
-  }
+  if (!/^[A-Za-z0-9._/\-]+$/.test(ref)) throw new Error(`unsafe ref: ${ref}`);
 }
 function buildGitContextStr(opts) {
   const parts = [];
@@ -62,6 +75,7 @@ function buildGitContextStr(opts) {
   } catch {
   }
   parts.push(`Reviewer: aicli v${VERSION}`);
+  parts.push("Mode: read-only CI review (no tools executed)");
   return parts.join(" | ");
 }
 function countSeverity(md) {
@@ -118,9 +132,7 @@ ${CI_COMMENT_MARKER}`;
 function gqlIdToRest(graphqlId) {
   if (/^\d+$/.test(graphqlId)) return graphqlId;
   const query = `query($id:ID!){ node(id:$id){ ... on IssueComment { databaseId } } }`;
-  const out = execFileSync("gh", ["api", "graphql", "-f", `query=${query}`, "-F", `id=${graphqlId}`], {
-    encoding: "utf-8"
-  });
+  const out = execFileSync("gh", ["api", "graphql", "-f", `query=${query}`, "-F", `id=${graphqlId}`], { encoding: "utf-8" });
   const parsed = JSON.parse(out);
   const id = parsed.data?.node?.databaseId;
   if (!id) throw new Error(`could not resolve comment id ${graphqlId}`);
@@ -128,25 +140,14 @@ function gqlIdToRest(graphqlId) {
 }
 async function runCi(opts) {
   const maxDiff = opts.maxDiffChars ?? 3e4;
+  const thresholds = normalizeCiThresholds(opts.thresholds);
   let diff;
   try {
     diff = fetchDiff(opts).trim();
   } catch (err) {
-    return {
-      exitCode: 2,
-      markdown: `\u274C ${err.message}`,
-      posted: false,
-      severity: { critical: 0, high: 0, warning: 0, info: 0 }
-    };
-  }
-  if (!diff) {
-    return {
-      exitCode: 0,
-      markdown: "\u2705 No changes to review.",
-      posted: false,
-      severity: { critical: 0, high: 0, warning: 0, info: 0 }
-    };
+    return earlyResult(2, `\u274C ${err.message}`, thresholds);
   }
+  if (!diff) return earlyResult(0, "\u2705 No changes to review.", thresholds);
   const { diff: trimmedDiff, truncated } = truncateDiff(diff, maxDiff);
   const gitCtx = buildGitContextStr(opts);
   const config = new ConfigManager();
@@ -162,18 +163,14 @@ async function runCi(opts) {
   );
   const providerId = opts.provider ?? config.getDefaultProvider();
   if (!registry.has(providerId)) {
-    return {
-      exitCode: 2,
-      markdown: `\u274C Provider '${providerId}' is not configured. Set the right AICLI_API_KEY_* env var or pass --provider.`,
-      posted: false,
-      severity: { critical: 0, high: 0, warning: 0, info: 0 }
-    };
+    return earlyResult(2, `\u274C Provider '${providerId}' is not configured. Set the right AICLI_API_KEY_* env var or pass --provider.`, thresholds);
   }
   const providerInfo = registry.get(providerId).info;
   const modelId = opts.model ?? config.get("defaultModels")[providerId] ?? providerInfo.defaultModel;
+  const meta = { provider: providerId, model: modelId, mode: "read-only", thresholds };
   const sections = [];
-  sections.push(`## \u{1F916} aicli code review`);
-  sections.push(`*Provider: \`${providerId}\` \xB7 Model: \`${modelId}\` \xB7 aicli v${VERSION}*`);
+  sections.push("## \u{1F916} aicli code review");
+  sections.push(`*Provider: \`${providerId}\` \xB7 Model: \`${modelId}\` \xB7 Mode: \`read-only CI review\` \xB7 aicli v${VERSION}*`);
   sections.push("");
   try {
     if (!opts.skipCode) {
@@ -195,14 +192,15 @@ async function runCi(opts) {
       exitCode: 2,
       markdown: `\u274C Review call failed: ${err.message}`,
       posted: false,
-      severity: { critical: 0, high: 0, warning: 0, info: 0 }
+      severity: zeroSeverity(),
+      gate: evaluateCiGate("", thresholds),
+      meta
     };
   }
-  if (truncated) {
-    sections.push(`> \u26A0 Diff was truncated to ${maxDiff} chars (original: ${diff.length}). Consider splitting large PRs.`);
-  }
+  if (truncated) sections.push(`> \u26A0 Diff was truncated to ${maxDiff} chars (original: ${diff.length}). Consider splitting large PRs.`);
   const markdown = sections.join("\n");
   const severity = countSeverity(markdown);
+  const gate = evaluateCiGate(markdown, thresholds);
   let posted = false;
   let updatedCommentId;
   if (opts.post && opts.pr != null && !opts.dryRun) {
@@ -219,19 +217,15 @@ async function runCi(opts) {
 
 \u274C Failed to post comment: ${err.message}`,
         posted: false,
-        severity
+        severity,
+        gate,
+        meta
       };
     }
   }
-  const hasBlocker = severity.critical > 0 || severity.high > 0;
-  return {
-    exitCode: hasBlocker ? 1 : 0,
-    markdown,
-    posted,
-    updatedCommentId,
-    severity
-  };
+  return { exitCode: gate.failed ? 1 : 0, markdown, posted, updatedCommentId, severity, gate, meta };
 }
+
 export {
   CI_COMMENT_MARKER,
   countSeverity,

package/dist/{chunk-JOJA35RK.js → chunk-OLN7VUZA.js}

@@ -6,7 +6,7 @@ import { platform } from "os";
 import chalk from "chalk";
 
 // src/core/constants.ts
-var VERSION = "0.4.214";
+var VERSION = "0.4.216";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-5FG7PSVM.js → chunk-PNTLA3MN.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   truncateForPersist
-} from "./chunk-R5CJD2AB.js";
+} from "./chunk-TCOC4AUI.js";
 import {
   APP_NAME,
   CONFIG_DIR_NAME,
@@ -13,7 +13,7 @@ import {
   MCP_PROTOCOL_VERSION,
   MCP_TOOL_PREFIX,
   VERSION
-} from "./chunk-DBYMX2ZC.js";
+} from "./chunk-7YWS3JLU.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-R5CJD2AB.js → chunk-TCOC4AUI.js}

@@ -5,10 +5,10 @@ import {
 } from "./chunk-T2NL5ZIA.js";
 import {
   runTestsTool
-} from "./chunk-TR6MSPSS.js";
+} from "./chunk-VW7Y27WW.js";
 import {
   runTool
-} from "./chunk-YMFGGCUP.js";
+} from "./chunk-77HDCGTN.js";
 import {
   getDangerLevel,
   isFileWriteTool,
@@ -26,7 +26,7 @@ import {
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-DBYMX2ZC.js";
+} from "./chunk-7YWS3JLU.js";
 import {
   fileCheckpoints
 } from "./chunk-4BKXL7SM.js";

package/dist/chunk-TJ6GGN4B.js

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+import {
+  VERSION
+} from "./chunk-7YWS3JLU.js";
+
+// src/cli/ci-format.ts
+var DEFAULT_CI_THRESHOLDS = {
+  securityHigh: true,
+  testFailure: true,
+  lintFailure: true
+};
+function normalizeCiThresholds(input) {
+  return {
+    securityHigh: input?.securityHigh ?? DEFAULT_CI_THRESHOLDS.securityHigh,
+    testFailure: input?.testFailure ?? DEFAULT_CI_THRESHOLDS.testFailure,
+    lintFailure: input?.lintFailure ?? DEFAULT_CI_THRESHOLDS.lintFailure
+  };
+}
+function extractSection(markdown, heading) {
+  const start = markdown.indexOf(heading);
+  if (start < 0) return "";
+  const rest = markdown.slice(start + heading.length);
+  const next = rest.search(/\n###\s+/);
+  return next >= 0 ? rest.slice(0, next) : rest;
+}
+function detectCiGateSignals(markdown) {
+  const security = extractSection(markdown, "### Security Review");
+  const securityHigh = (security.match(/(?:🔴\s*CRITICAL|🔴\s*Critical|🟠\s*HIGH|🟠\s*High)/g) ?? []).length;
+  const testFailure = (markdown.match(/(?:test(?:s|ing)?\s+(?:failed|failure|failures)|failing\s+test|npm\s+test\s+failed|pytest\s+failed|vitest\s+failed)/gi) ?? []).length;
+  const lintFailure = (markdown.match(/(?:lint\s+(?:failed|failure|failures)|eslint\s+failed|ruff\s+failed|biome\s+failed|typecheck\s+failed|tsc\s+failed)/gi) ?? []).length;
+  return { securityHigh, testFailure, lintFailure };
+}
+function evaluateCiGate(markdown, thresholds) {
+  const normalized = normalizeCiThresholds(thresholds);
+  const signals = detectCiGateSignals(markdown);
+  const reasons = [];
+  if (normalized.securityHigh && signals.securityHigh > 0) reasons.push(`security-high:${signals.securityHigh}`);
+  if (normalized.testFailure && signals.testFailure > 0) reasons.push(`test-failure:${signals.testFailure}`);
+  if (normalized.lintFailure && signals.lintFailure > 0) reasons.push(`lint-failure:${signals.lintFailure}`);
+  return { thresholds: normalized, signals, failed: reasons.length > 0, reasons };
+}
+function sarifLevel(line) {
+  if (/🔴|🟠|CRITICAL|HIGH/i.test(line)) return "error";
+  if (/🟡|WARNING|MEDIUM/i.test(line)) return "warning";
+  return "note";
+}
+function stripMarkdown(line) {
+  return line.replace(/^[\s>*-]+/, "").replace(/[`*_]/g, "").trim();
+}
+function formatCiSarif(result) {
+  const lines = result.markdown.split(/\r?\n/);
+  const findingLines = lines.map((line, idx) => ({ line, idx })).filter(({ line }) => /🔴|🟠|🟡|🔵|CRITICAL|HIGH|MEDIUM|LOW|WARNING|INFO/i.test(line));
+  const results = findingLines.map(({ line, idx }, n) => ({
+    ruleId: "aicli-review-finding",
+    level: sarifLevel(line),
+    message: { text: stripMarkdown(line) || line.trim() },
+    locations: [{
+      physicalLocation: {
+        artifactLocation: { uri: "aicli-review.md" },
+        region: { startLine: idx + 1 }
+      }
+    }],
+    partialFingerprints: { aicliLine: String(n + 1) }
+  }));
+  return JSON.stringify({
+    version: "2.1.0",
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    runs: [{
+      tool: {
+        driver: {
+          name: "aicli",
+          informationUri: "https://github.com/jinzhengdong/ai-cli",
+          version: VERSION,
+          rules: [{
+            id: "aicli-review-finding",
+            name: "aicli review finding",
+            shortDescription: { text: "Finding emitted by aicli CI review" },
+            helpUri: "https://github.com/jinzhengdong/ai-cli"
+          }]
+        }
+      },
+      invocations: [{ executionSuccessful: !result.gate.failed }],
+      results,
+      properties: {
+        severity: result.severity,
+        gate: result.gate,
+        posted: result.posted
+      }
+    }]
+  }, null, 2);
+}
+function formatCiResult(result, format) {
+  if (format === "json") return JSON.stringify(result, null, 2);
+  if (format === "sarif") return formatCiSarif(result);
+  return result.markdown;
+}
+
+export {
+  DEFAULT_CI_THRESHOLDS,
+  normalizeCiThresholds,
+  detectCiGateSignals,
+  evaluateCiGate,
+  formatCiSarif,
+  formatCiResult
+};

package/dist/{chunk-TR6MSPSS.js → chunk-VW7Y27WW.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   TEST_TIMEOUT
-} from "./chunk-DBYMX2ZC.js";
+} from "./chunk-7YWS3JLU.js";
 
 // src/tools/builtin/run-tests.ts
 import { execSync, spawnSync } from "child_process";

package/dist/{chunk-YFHF3PVB.js → chunk-WAI3WPV2.js}

@@ -8,7 +8,7 @@ import {
   CONFIG_FILE_NAME,
   HISTORY_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-DBYMX2ZC.js";
+} from "./chunk-7YWS3JLU.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/ci-6ZTFO3LX.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import {
+  CI_COMMENT_MARKER,
+  countSeverity,
+  runCi
+} from "./chunk-GY3C3C2Y.js";
+import "./chunk-TJ6GGN4B.js";
+import "./chunk-HLWUDRBO.js";
+import "./chunk-QMXC327F.js";
+import "./chunk-XPBEJB27.js";
+import "./chunk-WAI3WPV2.js";
+import "./chunk-TZQHYZKT.js";
+import "./chunk-7YWS3JLU.js";
+import "./chunk-IW3Q7AE5.js";
+export {
+  CI_COMMENT_MARKER,
+  countSeverity,
+  runCi
+};

package/dist/ci-format-CLZ6QJRL.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+import {
+  DEFAULT_CI_THRESHOLDS,
+  detectCiGateSignals,
+  evaluateCiGate,
+  formatCiResult,
+  formatCiSarif,
+  normalizeCiThresholds
+} from "./chunk-TJ6GGN4B.js";
+import "./chunk-7YWS3JLU.js";
+export {
+  DEFAULT_CI_THRESHOLDS,
+  detectCiGateSignals,
+  evaluateCiGate,
+  formatCiResult,
+  formatCiSarif,
+  normalizeCiThresholds
+};

package/dist/{constants-BKR7T3QH.js → constants-APSORFOH.js}

@@ -37,7 +37,7 @@ import {
   TEST_TIMEOUT,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-DBYMX2ZC.js";
+} from "./chunk-7YWS3JLU.js";
 export {
   AGENTIC_BEHAVIOR_GUIDELINE,
   APP_NAME,

package/dist/{doctor-cli-TGVSWKDB.js → doctor-cli-GUIX4X5F.js}

@@ -2,7 +2,7 @@
 import {
   getConfigDirUsage,
   listRecentCrashes
-} from "./chunk-JQC7IATA.js";
+} from "./chunk-6HLKCSB3.js";
 import {
   ProviderRegistry
 } from "./chunk-QMXC327F.js";
@@ -11,17 +11,17 @@ import {
   getTopFailingTools,
   getTopUsedTools,
   resetStats
-} from "./chunk-YMFGGCUP.js";
+} from "./chunk-77HDCGTN.js";
 import "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-YFHF3PVB.js";
+} from "./chunk-WAI3WPV2.js";
 import "./chunk-TZQHYZKT.js";
 import {
   DEV_STATE_FILE_NAME,
   MEMORY_FILE_NAME,
   VERSION
-} from "./chunk-DBYMX2ZC.js";
+} from "./chunk-7YWS3JLU.js";
 import "./chunk-IW3Q7AE5.js";
 
 // src/diagnostics/doctor-cli.ts

package/dist/electron-server.js

@@ -37,7 +37,7 @@ import {
   VERSION,
   buildUserIdentityPrompt,
   runTestsTool
-} from "./chunk-JOJA35RK.js";
+} from "./chunk-OLN7VUZA.js";
 import {
   hasSemanticIndex,
   semanticSearch
@@ -16070,7 +16070,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-R6FL6CQ3.js");
+          const { executeTests } = await import("./run-tests-4PKSIVK5.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {

package/dist/{hub-GURYEW6F.js → hub-ZGHQWNWE.js}

@@ -154,7 +154,7 @@ ${content}`);
   }
 }
 async function runTaskMode(config, providers, configManager, topic) {
-  const { TaskOrchestrator } = await import("./task-orchestrator-6AZD5WSR.js");
+  const { TaskOrchestrator } = await import("./task-orchestrator-TUMDTOAX.js");
   const orchestrator = new TaskOrchestrator(config, providers, configManager);
   let interrupted = false;
   const onSigint = () => {