jinzd-ai-cli 0.4.215 → 0.4.217

package/README.md

@@ -33,7 +33,8 @@
 - **Semantic Code Search** *(v0.4.77+)* — `search_code` tool finds code by meaning, not name. Local sentence embeddings (multilingual MiniLM, 117 MB one-time download) score symbols by cosine similarity against natural-language queries in English or Chinese ("where are users authenticated", "哪里做了速率限制"). No API key, runs on CPU. Manage with `/index semantic-rebuild|semantic-clear`
 - **MCP Server Mode** *(v0.4.84+)* — `aicli mcp-serve` reverses ai-cli into an MCP server (JSON-RPC 2.0 over stdio), exposing its 28 built-in tools (incl. `find_symbol` / `search_code` / `run_tests`) to Claude Desktop / Cursor / any MCP client. Opt-in destructive-tool allow, `--tools` whitelist, `--cwd` override
 - **Session Sensitive-Data Redaction** *(v0.4.88+)* — unified redactor scrubs `password=` / `api_key` / bearer tokens / OpenAI-style keys from every message **before it hits disk**. Query text is redacted too, so secrets never reach embeddings or logs. `/security status` + `/security scan` to audit
-- **Human-like Long-Term Memory** *(v0.4.89+, B4)* — semantic index over every past chat session + `recall_memory` AI tool + `/memory rebuild|refresh|status|recall` commands. AI is prompted to auto-recall when it sees "last time" / "之前" / ambiguous references. Reuses the same MiniLM embedder as semantic code search
+- **Human-like Long-Term Memory** *(v0.4.89+, B4)* — semantic index over every past chat session + `recall_memory` AI tool + `/memory rebuild|refresh|status|recall` commands. AI is prompted to auto-recall when it sees "last time" / "之前" / ambiguous references. Reuses the same MiniLM embedder as semantic code search
+- **Governed Persistent Memory** *(v0.4.217+)* — `save_memory` and `/memory add` write auditable `memory.jsonl` entries with id/scope/source/sensitivity/approval/expiry; low-risk entries auto-approve, sensitive entries stay pending until `/memory approve <id>`, and project-scoped memories only inject inside the same project
 - **Web UI Memory Panel** *(v0.4.90+, B4)* — new 🧠 Memory sidebar tab with semantic search across past chats; each hit has **➕ Inject** (quotes the snippet into the chat input as a markdown blockquote so you can review/edit before sending — no silent context injection) and **↗ Load** (jumps to source session). Bulk "Inject top 3" for recall bundles
 - **Streaming Tool Use** — Real-time streaming of AI reasoning and tool calls as they happen
 - **Sub-Agents** — Delegate complex subtasks to isolated child agents with independent tool loops
@@ -47,6 +48,8 @@
 - **Headless Mode** — `ai-cli -p "prompt"` for CI/CD pipelines and scripting
 - **44 REPL Commands** — Session management, checkpointing, code review, security review/scan, rewind, scaffolding, cross-session history search, chat-memory recall, smart model routing (`/route`), and more
 - **GitHub Actions CI/CD** — Automated testing on Node 20/22 + npm publish on release tags
+- **PR Review CLI** *(v0.4.216+)* — `aicli pr review|security-review|summarize` reviews `main...HEAD`, custom `--base/--head`, or GitHub PR URLs; optional `--agents security,bugs,tests,maintainability`; never posts comments unless `--post` is explicit
+- **CI Review Artifacts** *(v0.4.216+)* — `aicli ci` emits Markdown, JSON, or SARIF and gates on security-high, test-failure, and lint-failure findings in read-only review mode
 - **Cross-Platform** — Windows, macOS, Linux
 
 ## Installation
@@ -168,7 +171,7 @@ AI autonomously invokes these 27 tools during conversations:
 | `run_tests` | safe | Auto-detect and run project tests (JUnit XML parsing) |
 | `spawn_agent` | safe | Delegate subtasks to named isolated agents (`agent`: explorer/worker/reviewer/security/tester) |
 | `ask_user` | safe | Pause and ask the user a question |
-| `save_memory` | safe | Persist important info across sessions |
+| `save_memory` | safe | Persist governed memory across sessions; sensitive entries require `/memory approve <id>` |
 | `write_todos` | safe | Task breakdown with live progress rendering |
 | `save_last_response` | write | Save AI response to file |
 | `task_create` | write | Start a command running in the background |

package/dist/{batch-74H5SA7P.js → batch-YCOVKTXD.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   ConfigManager
-} from "./chunk-2224JGA6.js";
+} from "./chunk-WKOQ5CYC.js";
 import "./chunk-TZQHYZKT.js";
-import "./chunk-7JES2NWR.js";
+import "./chunk-XJGEQIYS.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chat-index-R2E27VXN.js → chat-index-PS274XM7.js}

@@ -5,7 +5,7 @@ import {
   getChatIndexStatus,
   loadChatIndex,
   searchChatMemory
-} from "./chunk-OQGVGPEK.js";
+} from "./chunk-VHY6NVMQ.js";
 import "./chunk-JV5N65KN.js";
 import "./chunk-6BUTA5VW.js";
 export {

package/dist/{chunk-ZOF5NFKW.js → chunk-524WZOKS.js}

@@ -2,7 +2,7 @@
 import {
   CONFIG_DIR_NAME,
   VERSION
-} from "./chunk-7JES2NWR.js";
+} from "./chunk-XJGEQIYS.js";
 
 // src/diagnostics/crash-log.ts
 import {

package/dist/{ci-3ALK2XJN.js → chunk-KOPUCJXM.js}

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+import {
+  evaluateCiGate,
+  normalizeCiThresholds
+} from "./chunk-WZ3VKLF3.js";
 import {
   buildReviewPrompt,
   buildSecurityReviewPrompt,
@@ -7,19 +11,30 @@ import {
 import {
   ProviderRegistry
 } from "./chunk-QMXC327F.js";
-import "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-2224JGA6.js";
-import "./chunk-TZQHYZKT.js";
+} from "./chunk-WKOQ5CYC.js";
 import {
   VERSION
-} from "./chunk-7JES2NWR.js";
-import "./chunk-IW3Q7AE5.js";
+} from "./chunk-XJGEQIYS.js";
 
 // src/cli/ci.ts
 import { execFileSync } from "child_process";
 var CI_COMMENT_MARKER = "<!-- aicli-ci-review -->";
+function zeroSeverity() {
+  return { critical: 0, high: 0, warning: 0, info: 0 };
+}
+function earlyResult(exitCode, markdown, thresholds) {
+  const gate = evaluateCiGate(markdown, thresholds);
+  return {
+    exitCode: exitCode === 0 && gate.failed ? 1 : exitCode,
+    markdown,
+    posted: false,
+    severity: zeroSeverity(),
+    gate,
+    meta: { mode: "read-only", thresholds }
+  };
+}
 function fetchDiff(opts) {
   if (opts.diffOverride != null) return opts.diffOverride;
   if (opts.pr != null) {
@@ -48,9 +63,7 @@ function fetchDiff(opts) {
   throw new Error("aicli ci: must supply --pr <num> or --base <ref> to determine the diff source");
 }
 function validateGitRef(ref) {
-  if (!/^[A-Za-z0-9._/\-]+$/.test(ref)) {
-    throw new Error(`unsafe ref: ${ref}`);
-  }
+  if (!/^[A-Za-z0-9._/\-]+$/.test(ref)) throw new Error(`unsafe ref: ${ref}`);
 }
 function buildGitContextStr(opts) {
   const parts = [];
@@ -62,6 +75,7 @@ function buildGitContextStr(opts) {
   } catch {
   }
   parts.push(`Reviewer: aicli v${VERSION}`);
+  parts.push("Mode: read-only CI review (no tools executed)");
   return parts.join(" | ");
 }
 function countSeverity(md) {
@@ -118,9 +132,7 @@ ${CI_COMMENT_MARKER}`;
 function gqlIdToRest(graphqlId) {
   if (/^\d+$/.test(graphqlId)) return graphqlId;
   const query = `query($id:ID!){ node(id:$id){ ... on IssueComment { databaseId } } }`;
-  const out = execFileSync("gh", ["api", "graphql", "-f", `query=${query}`, "-F", `id=${graphqlId}`], {
-    encoding: "utf-8"
-  });
+  const out = execFileSync("gh", ["api", "graphql", "-f", `query=${query}`, "-F", `id=${graphqlId}`], { encoding: "utf-8" });
   const parsed = JSON.parse(out);
   const id = parsed.data?.node?.databaseId;
   if (!id) throw new Error(`could not resolve comment id ${graphqlId}`);
@@ -128,25 +140,14 @@ function gqlIdToRest(graphqlId) {
 }
 async function runCi(opts) {
   const maxDiff = opts.maxDiffChars ?? 3e4;
+  const thresholds = normalizeCiThresholds(opts.thresholds);
   let diff;
   try {
     diff = fetchDiff(opts).trim();
   } catch (err) {
-    return {
-      exitCode: 2,
-      markdown: `\u274C ${err.message}`,
-      posted: false,
-      severity: { critical: 0, high: 0, warning: 0, info: 0 }
-    };
-  }
-  if (!diff) {
-    return {
-      exitCode: 0,
-      markdown: "\u2705 No changes to review.",
-      posted: false,
-      severity: { critical: 0, high: 0, warning: 0, info: 0 }
-    };
+    return earlyResult(2, `\u274C ${err.message}`, thresholds);
   }
+  if (!diff) return earlyResult(0, "\u2705 No changes to review.", thresholds);
   const { diff: trimmedDiff, truncated } = truncateDiff(diff, maxDiff);
   const gitCtx = buildGitContextStr(opts);
   const config = new ConfigManager();
@@ -162,18 +163,14 @@ async function runCi(opts) {
   );
   const providerId = opts.provider ?? config.getDefaultProvider();
   if (!registry.has(providerId)) {
-    return {
-      exitCode: 2,
-      markdown: `\u274C Provider '${providerId}' is not configured. Set the right AICLI_API_KEY_* env var or pass --provider.`,
-      posted: false,
-      severity: { critical: 0, high: 0, warning: 0, info: 0 }
-    };
+    return earlyResult(2, `\u274C Provider '${providerId}' is not configured. Set the right AICLI_API_KEY_* env var or pass --provider.`, thresholds);
   }
   const providerInfo = registry.get(providerId).info;
   const modelId = opts.model ?? config.get("defaultModels")[providerId] ?? providerInfo.defaultModel;
+  const meta = { provider: providerId, model: modelId, mode: "read-only", thresholds };
   const sections = [];
-  sections.push(`## \u{1F916} aicli code review`);
-  sections.push(`*Provider: \`${providerId}\` \xB7 Model: \`${modelId}\` \xB7 aicli v${VERSION}*`);
+  sections.push("## \u{1F916} aicli code review");
+  sections.push(`*Provider: \`${providerId}\` \xB7 Model: \`${modelId}\` \xB7 Mode: \`read-only CI review\` \xB7 aicli v${VERSION}*`);
   sections.push("");
   try {
     if (!opts.skipCode) {
@@ -195,14 +192,15 @@ async function runCi(opts) {
       exitCode: 2,
       markdown: `\u274C Review call failed: ${err.message}`,
       posted: false,
-      severity: { critical: 0, high: 0, warning: 0, info: 0 }
+      severity: zeroSeverity(),
+      gate: evaluateCiGate("", thresholds),
+      meta
     };
   }
-  if (truncated) {
-    sections.push(`> \u26A0 Diff was truncated to ${maxDiff} chars (original: ${diff.length}). Consider splitting large PRs.`);
-  }
+  if (truncated) sections.push(`> \u26A0 Diff was truncated to ${maxDiff} chars (original: ${diff.length}). Consider splitting large PRs.`);
   const markdown = sections.join("\n");
   const severity = countSeverity(markdown);
+  const gate = evaluateCiGate(markdown, thresholds);
   let posted = false;
   let updatedCommentId;
   if (opts.post && opts.pr != null && !opts.dryRun) {
@@ -219,19 +217,15 @@ async function runCi(opts) {
 
 \u274C Failed to post comment: ${err.message}`,
         posted: false,
-        severity
+        severity,
+        gate,
+        meta
       };
     }
   }
-  const hasBlocker = severity.critical > 0 || severity.high > 0;
-  return {
-    exitCode: hasBlocker ? 1 : 0,
-    markdown,
-    posted,
-    updatedCommentId,
-    severity
-  };
+  return { exitCode: gate.failed ? 1 : 0, markdown, posted, updatedCommentId, severity, gate, meta };
 }
+
 export {
   CI_COMMENT_MARKER,
   countSeverity,