jinzd-ai-cli 0.4.218 → 0.4.220

package/README.md

@@ -11,7 +11,7 @@
 [![GitHub Release](https://img.shields.io/github/v/release/jinzhengdong/ai-cli)](https://github.com/jinzhengdong/ai-cli/releases)
 [![CI](https://github.com/jinzhengdong/ai-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/jinzhengdong/ai-cli/actions/workflows/ci.yml)
 
-**ai-cli** is a powerful AI assistant that connects to 9 providers (including local Ollama models) and executes tasks autonomously through agentic tool calling. Use it as a terminal REPL, a browser-based Web UI, or a standalone Electron desktop app.
+**ai-cli** is a powerful AI assistant that connects to 10 providers (including local Ollama models) and executes tasks autonomously through agentic tool calling. Use it as a terminal REPL, a browser-based Web UI, or a standalone Electron desktop app.
 
 <p align="center">
   <img src="https://img.shields.io/badge/CLI-Terminal-blue" alt="CLI" />
@@ -21,7 +21,7 @@
 
 ## Highlights
 
-- **9 Built-in Providers** — Claude, Gemini, DeepSeek, OpenAI, Zhipu GLM, Kimi, **MiniMax (海螺)**, OpenRouter (300+ models), **Ollama** (local models, no API key needed)
+- **10 Built-in Providers** — Claude, Gemini, DeepSeek, OpenAI, Zhipu GLM, Kimi, Qwen, **MiniMax (海螺)**, OpenRouter (300+ models), **Ollama** (local models, no API key needed)
 - **3 Interfaces** — Terminal CLI, browser Web UI (`aicli web`), Electron desktop app
 - **Agentic Tool Calling** — AI autonomously runs shell commands, reads/writes files, searches code, fetches web, runs tests (default 200 rounds, configurable up to 10000 via `config.maxToolRounds` or `--max-tool-rounds`)
 - **Prompt Caching** *(v0.4.70+)* — System prompt split into stable/volatile halves so Claude caches the stable part with `cache_control: ephemeral`; cached tokens bill at ~10% of the input price
@@ -33,8 +33,8 @@
 - **Semantic Code Search** *(v0.4.77+)* — `search_code` tool finds code by meaning, not name. Local sentence embeddings (multilingual MiniLM, 117 MB one-time download) score symbols by cosine similarity against natural-language queries in English or Chinese ("where are users authenticated", "哪里做了速率限制"). No API key, runs on CPU. Manage with `/index semantic-rebuild|semantic-clear`
 - **MCP Server Mode** *(v0.4.84+)* — `aicli mcp-serve` reverses ai-cli into an MCP server (JSON-RPC 2.0 over stdio), exposing its 28 built-in tools (incl. `find_symbol` / `search_code` / `run_tests`) to Claude Desktop / Cursor / any MCP client. Opt-in destructive-tool allow, `--tools` whitelist, `--cwd` override
 - **Session Sensitive-Data Redaction** *(v0.4.88+)* — unified redactor scrubs `password=` / `api_key` / bearer tokens / OpenAI-style keys from every message **before it hits disk**. Query text is redacted too, so secrets never reach embeddings or logs. `/security status` + `/security scan` to audit
-- **Human-like Long-Term Memory** *(v0.4.89+, B4)* — semantic index over every past chat session + `recall_memory` AI tool + `/memory rebuild|refresh|status|recall` commands. AI is prompted to auto-recall when it sees "last time" / "之前" / ambiguous references. Reuses the same MiniLM embedder as semantic code search
-- **Governed Persistent Memory** *(v0.4.217+)* — `save_memory` and `/memory add` write auditable `memory.jsonl` entries with id/scope/source/sensitivity/approval/expiry; low-risk entries auto-approve, sensitive entries stay pending until `/memory approve <id>`, and project-scoped memories only inject inside the same project
+- **Human-like Long-Term Memory** *(v0.4.89+, B4)* — semantic index over every past chat session + `recall_memory` AI tool + `/memory rebuild|refresh|status|recall` commands. AI is prompted to auto-recall when it sees "last time" / "之前" / ambiguous references. Reuses the same MiniLM embedder as semantic code search
+- **Governed Persistent Memory** *(v0.4.217+)* — `save_memory` and `/memory add` write auditable `memory.jsonl` entries with id/scope/source/sensitivity/approval/expiry; low-risk entries auto-approve, sensitive entries stay pending until `/memory approve <id>`, and project-scoped memories only inject inside the same project
 - **Package Plugin Ecosystem** *(v0.4.218+)* — install shareable .aicli-plugin/plugin.json packages with skills, hooks, commands, MCP servers, agents, and permission hints; only trusted+enabled plugins load, hooks still require hook trust, and MCP/tools remain under permission profiles/network policy
 - **Web UI Memory Panel** *(v0.4.90+, B4)* — new 🧠 Memory sidebar tab with semantic search across past chats; each hit has **➕ Inject** (quotes the snippet into the chat input as a markdown blockquote so you can review/edit before sending — no silent context injection) and **↗ Load** (jumps to source session). Bulk "Inject top 3" for recall bundles
 - **Streaming Tool Use** — Real-time streaming of AI reasoning and tool calls as they happen
@@ -127,10 +127,11 @@ aicli user delete x          # Delete user
 | **Claude** | Opus 4, Sonnet 4, Haiku 4 | [console.anthropic.com](https://console.anthropic.com) |
 | **Gemini** | 2.5 Pro, 2.5 Flash | [aistudio.google.com](https://aistudio.google.com) |
 | **DeepSeek** | DeepSeek-Chat (V3), Reasoner (R1) | [platform.deepseek.com](https://platform.deepseek.com) |
-| **OpenAI** | GPT-5.4, GPT-4o, o3, o4-mini | [platform.openai.com](https://platform.openai.com) |
+| **OpenAI** | GPT-5.4, GPT-5, GPT-4.1, o3, o4-mini | [platform.openai.com](https://platform.openai.com) |
 | **OpenRouter** | 300+ models (Claude, GPT, Gemini, Llama, Qwen, Mistral...) | [openrouter.ai](https://openrouter.ai) |
 | **Zhipu** | GLM-4, GLM-5 | [open.bigmodel.cn](https://open.bigmodel.cn) |
-| **Kimi** | Moonshot, Kimi-K2 | [platform.moonshot.cn](https://platform.moonshot.cn) |
+| **Kimi** | Kimi K2.6, K2.5, K2 Thinking | [platform.moonshot.cn](https://platform.moonshot.cn) |
+| **Qwen** | qwen-plus, qwen-max, qwen-turbo, qwen-coder-plus | [bailian.console.aliyun.com](https://bailian.console.aliyun.com) |
 | **Ollama** | Any locally installed model (Llama, Qwen, Gemma, Mistral...) | No API key — [ollama.com](https://ollama.com) |
 
 Any OpenAI-compatible API can also be used via `customBaseUrls` in config.
@@ -195,7 +196,7 @@ AI autonomously invokes these 27 tools during conversations:
 | Command | Description |
 |---------|-------------|
 | `/provider` | Switch AI provider |
-| `/model` | Switch model |
+| `/model` | Switch model; `/model refresh [provider]` refreshes live model cache |
 | `/plan` | Enter read-only planning mode |
 | `/think` | Toggle Claude extended thinking |
 | `/test` | Auto-detect and run project tests |
@@ -334,98 +335,98 @@ Control when tools require confirmation. Rules are checked in order — first ma
 | `action` | `auto-approve` (skip confirmation), `deny` (block), `confirm` (ask user) |
 | `when.dangerLevel` | Only match when danger level is `safe`, `write`, or `destructive` |
 | `when.pathPattern` | Substring match against tool's `path` or `command` argument |
-
-### Permission Profiles
-
-Permission profiles provide coarse-grained safety boundaries before fine-grained `permissionRules` run. The default profile is `legacy`, so existing configs keep their old behavior.
-
-Built-in profiles:
-
-| Profile | Behavior |
-|---------|----------|
-| `legacy` | Backward-compatible mode. Uses `permissionRules` and `defaultPermission` as before. |
-| `read-only` | Allows known read-only/safe tools and safe MCP tools; blocks write and destructive tools. |
-| `workspace-write` | Allows explicit file writes only inside the workspace roots or temp dirs; destructive tools still require confirmation. |
-| `danger-full-access` | Auto-approves non-destructive tools by default; destructive tools still require confirmation. Use only in isolated environments. |
-
-```json
-{
-  "defaultPermissionProfile": "workspace-write",
-  "allowedPermissionProfiles": ["legacy", "read-only", "workspace-write", "danger-full-access"],
-  "permissionProfiles": {
-    "workspace-write": {
-      "workspaceRoots": ["D:/github/ai-cli"],
-      "allowTemp": true,
-      "rules": [
-        { "tool": "read_file", "action": "auto-approve" },
-        { "tool": "list_dir", "action": "auto-approve" }
-      ]
-    }
-  },
-  "permissionRules": [
-    { "tool": "bash", "action": "deny", "when": { "pathPattern": "rm -rf" } }
-  ]
-}
-```
-
+
+### Permission Profiles
+
+Permission profiles provide coarse-grained safety boundaries before fine-grained `permissionRules` run. The default profile is `legacy`, so existing configs keep their old behavior.
+
+Built-in profiles:
+
+| Profile | Behavior |
+|---------|----------|
+| `legacy` | Backward-compatible mode. Uses `permissionRules` and `defaultPermission` as before. |
+| `read-only` | Allows known read-only/safe tools and safe MCP tools; blocks write and destructive tools. |
+| `workspace-write` | Allows explicit file writes only inside the workspace roots or temp dirs; destructive tools still require confirmation. |
+| `danger-full-access` | Auto-approves non-destructive tools by default; destructive tools still require confirmation. Use only in isolated environments. |
+
+```json
+{
+  "defaultPermissionProfile": "workspace-write",
+  "allowedPermissionProfiles": ["legacy", "read-only", "workspace-write", "danger-full-access"],
+  "permissionProfiles": {
+    "workspace-write": {
+      "workspaceRoots": ["D:/github/ai-cli"],
+      "allowTemp": true,
+      "rules": [
+        { "tool": "read_file", "action": "auto-approve" },
+        { "tool": "list_dir", "action": "auto-approve" }
+      ]
+    }
+  },
+  "permissionRules": [
+    { "tool": "bash", "action": "deny", "when": { "pathPattern": "rm -rf" } }
+  ]
+}
+```
+
 `/status` and `/security status` show the active profile. The Web status payload also includes `permissionProfile` for UI surfaces.
-### Auto Mode
-
-`/auto on|off|status` enables a session-scoped, rule-based action classifier. It is designed to reduce confirmation fatigue without widening `/yolo`: `/yolo` still only skips write confirmations, while destructive tools still require confirmation.
-
-Auto Mode may auto-approve low-risk actions such as explicit writes inside the workspace/temp roots, read-only HTTP tools, plain non-force `git push`, and dependency installs already declared in `package.json` or a lockfile. It denies high-risk shapes such as `curl | bash`, force push, and likely secret exfiltration. Production deploys, database migrations, IaC destroy, credential/permission changes, and third-party agent loops fall back to confirmation.
-
-Auto Mode is not enabled by project config. Use `/permissions recently-denied` to inspect actions it blocked, or `/permissions clear-denied` to clear that session list.
-### Agent Team
-
-`spawn_agent` can now use named roles from built-ins or JSON configs in `~/.aicli/agents/` and `.aicli/agents/`. Built-ins are `explorer`, `worker`, `reviewer`, `security`, and `tester`. Agent configs may set description, provider/model, system instructions, allowed/blocked tools, permission profile, max tool rounds, and context policy; they can only narrow the inherited sub-agent safety boundary. Use `/agent list|switch|stop|summary` to inspect roles and recent sub-agent runs.
-
-### Network Policy
-`networkPolicy` is disabled by default for backward compatibility. When enabled, it governs network-facing tools before execution: `web_fetch`, `web_search`, `google_search`, MCP tools, and shell commands that look like network access (`curl`, `wget`, `git clone/fetch/pull/push`, package installs, SSH/SCP, etc.).
-
-```json
-{
-  "networkPolicy": {
-    "enabled": true,
-    "defaultAction": "confirm",
-    "allowDomains": ["github.com", "docs.anthropic.com", "platform.openai.com"],
-    "denyDomains": ["example-danger.test"],
-    "allowPrivateNetwork": false,
-    "tools": {
-      "web_fetch": "confirm",
-      "web_search": "allow",
-      "google_search": "confirm",
-      "shell": "confirm",
-      "mcp": "confirm"
-    }
-  }
-}
-```
-
-Actions are `allow`, `confirm`, or `deny`. Domain entries match the exact host or subdomains; port lists match the resolved URL port. Private/internal hosts such as `localhost`, `127.0.0.1`, `10.0.0.0/8`, `192.168.0.0/16`, and private IPv6 ranges are blocked unless `allowPrivateNetwork` is true.
-### Trusted Hooks Lifecycle
-
-Legacy `preToolExecution` / `postToolExecution` hooks still work. New lifecycle hooks live under `hooks.events.<EventName>` and receive a JSON payload through `AICLI_HOOK_EVENT_JSON`; if the command prints JSON, ai-cli reads decisions such as `allow`, `deny`, `ask`, `warning`, or `warnings`.
-
-```json
-{
-  "hooks": {
-    "events": {
-      "PreToolUse": {
-        "command": "node ./scripts/aicli-pre-tool-hook.mjs",
-        "source": "project",
-        "description": "Block unsafe local commands"
-      },
-      "UserPromptSubmit": "node ./scripts/aicli-prompt-hook.mjs",
-      "Stop": { "command": "npm test -- --runInBand", "timeoutMs": 10000 }
-    }
-  }
-}
-```
-
-Supported lifecycle names are `SessionStart`, `UserPromptSubmit`, `PreToolUse`, `PermissionRequest`, `PostToolUse`, `PreCompact`, `PostCompact`, `Stop`, `SubagentStart`, and `SubagentStop`. Project-sourced hooks must be trusted before execution; ai-cli stores trust records locally under the user config directory, keyed by hook hash, so changing hook content requires re-trust.
-
-Use `/hooks list`, `/hooks inspect <id>`, `/hooks trust <id>`, `/hooks untrust <id>`, and `/hooks disable` to manage them. `/status`, `/security status`, and Web status show pending project hooks that require trust.
+### Auto Mode
+
+`/auto on|off|status` enables a session-scoped, rule-based action classifier. It is designed to reduce confirmation fatigue without widening `/yolo`: `/yolo` still only skips write confirmations, while destructive tools still require confirmation.
+
+Auto Mode may auto-approve low-risk actions such as explicit writes inside the workspace/temp roots, read-only HTTP tools, plain non-force `git push`, and dependency installs already declared in `package.json` or a lockfile. It denies high-risk shapes such as `curl | bash`, force push, and likely secret exfiltration. Production deploys, database migrations, IaC destroy, credential/permission changes, and third-party agent loops fall back to confirmation.
+
+Auto Mode is not enabled by project config. Use `/permissions recently-denied` to inspect actions it blocked, or `/permissions clear-denied` to clear that session list.
+### Agent Team
+
+`spawn_agent` can now use named roles from built-ins or JSON configs in `~/.aicli/agents/` and `.aicli/agents/`. Built-ins are `explorer`, `worker`, `reviewer`, `security`, and `tester`. Agent configs may set description, provider/model, system instructions, allowed/blocked tools, permission profile, max tool rounds, and context policy; they can only narrow the inherited sub-agent safety boundary. Use `/agent list|switch|stop|summary` to inspect roles and recent sub-agent runs.
+
+### Network Policy
+`networkPolicy` is disabled by default for backward compatibility. When enabled, it governs network-facing tools before execution: `web_fetch`, `web_search`, `google_search`, MCP tools, and shell commands that look like network access (`curl`, `wget`, `git clone/fetch/pull/push`, package installs, SSH/SCP, etc.).
+
+```json
+{
+  "networkPolicy": {
+    "enabled": true,
+    "defaultAction": "confirm",
+    "allowDomains": ["github.com", "docs.anthropic.com", "platform.openai.com"],
+    "denyDomains": ["example-danger.test"],
+    "allowPrivateNetwork": false,
+    "tools": {
+      "web_fetch": "confirm",
+      "web_search": "allow",
+      "google_search": "confirm",
+      "shell": "confirm",
+      "mcp": "confirm"
+    }
+  }
+}
+```
+
+Actions are `allow`, `confirm`, or `deny`. Domain entries match the exact host or subdomains; port lists match the resolved URL port. Private/internal hosts such as `localhost`, `127.0.0.1`, `10.0.0.0/8`, `192.168.0.0/16`, and private IPv6 ranges are blocked unless `allowPrivateNetwork` is true.
+### Trusted Hooks Lifecycle
+
+Legacy `preToolExecution` / `postToolExecution` hooks still work. New lifecycle hooks live under `hooks.events.<EventName>` and receive a JSON payload through `AICLI_HOOK_EVENT_JSON`; if the command prints JSON, ai-cli reads decisions such as `allow`, `deny`, `ask`, `warning`, or `warnings`.
+
+```json
+{
+  "hooks": {
+    "events": {
+      "PreToolUse": {
+        "command": "node ./scripts/aicli-pre-tool-hook.mjs",
+        "source": "project",
+        "description": "Block unsafe local commands"
+      },
+      "UserPromptSubmit": "node ./scripts/aicli-prompt-hook.mjs",
+      "Stop": { "command": "npm test -- --runInBand", "timeoutMs": 10000 }
+    }
+  }
+}
+```
+
+Supported lifecycle names are `SessionStart`, `UserPromptSubmit`, `PreToolUse`, `PermissionRequest`, `PostToolUse`, `PreCompact`, `PostCompact`, `Stop`, `SubagentStart`, and `SubagentStop`. Project-sourced hooks must be trusted before execution; ai-cli stores trust records locally under the user config directory, keyed by hook hash, so changing hook content requires re-trust.
+
+Use `/hooks list`, `/hooks inspect <id>`, `/hooks trust <id>`, `/hooks untrust <id>`, and `/hooks disable` to manage them. `/status`, `/security status`, and Web status show pending project hooks that require trust.
 **Recommended minimal config** — auto-approve all read-only tools to reduce y/N prompts:
 
 ```json
@@ -455,7 +456,8 @@ Environment variables take precedence over config file values:
 | `AICLI_API_KEY_OPENAI` | OpenAI API Key |
 | `AICLI_API_KEY_OPENROUTER` | OpenRouter API Key |
 | `AICLI_API_KEY_ZHIPU` | Zhipu API Key |
-| `AICLI_API_KEY_KIMI` | Kimi API Key |
+| `AICLI_API_KEY_KIMI` | Kimi API Key |
+| `AICLI_API_KEY_QWEN` | Qwen / Alibaba Cloud API Key |
 | `AICLI_PROVIDER` | Default provider ID |
 | `AICLI_NO_STREAM` | Set to `1` to disable streaming |
 | `HTTPS_PROXY` / `HTTP_PROXY` | Proxy URL |
@@ -563,6 +565,7 @@ node scripts/release.mjs patch -m "..." --dry-run
 - [`docs/USAGE.md`](docs/USAGE.md) — Complete reference manual (commands, tools, config)
 - [`docs/TUTORIAL.md`](docs/TUTORIAL.md) — Hands-on tutorial, zero to fluent in an hour
 - [`docs/ADVANCED.md`](docs/ADVANCED.md) — Architecture and internals (for developers)
+- [`docs/MIGRATION.md`](docs/MIGRATION.md) — Migration guide from Claude Code, Codex, Claude Desktop, and Cursor
 - [`docs/RECIPES.md`](docs/RECIPES.md) — Practical recipes by scenario
 - [`docs/SECURITY.md`](docs/SECURITY.md) — **Security model, deployment checklist, audit history.** Read before exposing `aicli web` to a network.
 - [`CHANGELOG.md`](CHANGELOG.md) — Per-version change log

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 # ai-cli
 
-> 跨平台 AI 编程助手 — CLI 终端、Web 界面、桌面应用三合一，支持 9 大 Provider（含本地 Ollama）与 Agentic 工具调用
+> 跨平台 AI 编程助手 — CLI 终端、Web 界面、桌面应用三合一，支持 10 大 Provider（含本地 Ollama）与 Agentic 工具调用
 
 [![npm version](https://img.shields.io/npm/v/jinzd-ai-cli)](https://www.npmjs.com/package/jinzd-ai-cli)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
@@ -13,7 +13,7 @@
 
 ## 特性亮点
 
-- **9 大内置 Provider** — Claude、Gemini、DeepSeek、OpenAI、智谱 GLM、Kimi、**MiniMax（海螺）**、OpenRouter（300+ 模型）、**Ollama**（本地模型，无需 API Key）
+- **10 大内置 Provider** — Claude、Gemini、DeepSeek、OpenAI、智谱 GLM、Kimi、Qwen、**MiniMax（海螺）**、OpenRouter（300+ 模型）、**Ollama**（本地模型，无需 API Key）
 - **三种使用方式** — 终端 CLI、浏览器 Web UI（`aicli web`）、Electron 桌面应用
 - **Agentic 工具调用** — AI 自主执行 bash 命令、读写文件、搜索代码、抓取网页、运行测试（默认 200 轮，可通过 `config.maxToolRounds` 或 `--max-tool-rounds` 调整，上限 10000）
 - **Prompt Caching**（v0.4.70+）— system prompt 拆分稳定/易变两段，Claude 对稳定段启用 `cache_control: ephemeral`，命中时按 10% 计费
@@ -115,10 +115,11 @@ aicli user delete x          # 删除用户
 | **Claude** | Opus 4, Sonnet 4, Haiku 4 | [console.anthropic.com](https://console.anthropic.com) |
 | **Gemini** | 2.5 Pro, 2.5 Flash | [aistudio.google.com](https://aistudio.google.com) |
 | **DeepSeek** | DeepSeek-Chat (V3), Reasoner (R1) | [platform.deepseek.com](https://platform.deepseek.com) |
-| **OpenAI** | GPT-5.4, GPT-4o, o3, o4-mini | [platform.openai.com](https://platform.openai.com) |
+| **OpenAI** | GPT-5.4, GPT-5, GPT-4.1, o3, o4-mini | [platform.openai.com](https://platform.openai.com) |
 | **OpenRouter** | 300+ 模型（Claude/GPT/Gemini/Llama/Qwen/Mistral...） | [openrouter.ai](https://openrouter.ai) |
 | **智谱清言** | GLM-4, GLM-5 | [open.bigmodel.cn](https://open.bigmodel.cn) |
-| **Kimi** | Moonshot, Kimi-K2 | [platform.moonshot.cn](https://platform.moonshot.cn) |
+| **Kimi** | Kimi K2.6, K2.5, K2 Thinking | [platform.moonshot.cn](https://platform.moonshot.cn) |
+| **Qwen** | qwen-plus, qwen-max, qwen-turbo, qwen-coder-plus | [bailian.console.aliyun.com](https://bailian.console.aliyun.com) |
 | **Ollama** | 任意本地模型（Llama、Qwen、Gemma、Mistral...） | 无需 API Key — [ollama.com](https://ollama.com) |
 
 也可通过 `customBaseUrls` 配置接入任意 OpenAI 兼容 API。
@@ -370,39 +371,39 @@ HTTPS_PROXY=http://127.0.0.1:10809 aicli
 }
 ```
 
-### Auto Mode
-
-`/auto on|off|status` 会开启会话级规则分类器，用来减少确认疲劳，但不会扩大 `/yolo` 的边界：`/yolo` 仍然只跳过 write 确认，destructive 仍需确认。
-
-Auto Mode 可自动通过低风险动作，例如 workspace/temp 根目录内的显式写入、只读 HTTP 工具、非 force 的普通 `git push`、已经写在 `package.json` 或 lockfile 中的依赖安装。它会拒绝 `curl | bash`、force push、疑似 secret 外传；生产部署、数据库迁移、IaC destroy、IAM/token/key/权限变更、第三方 agent loop 默认进入确认。
-
-Auto Mode 不会被项目配置静默开启。用 `/permissions recently-denied` 查看最近被 Auto Mode 拒绝的动作，用 `/permissions clear-denied` 清空本会话列表。
-### Agent Team
-
-`spawn_agent` 现在支持命名角色，来源包括内置角色以及 `~/.aicli/agents/`、`.aicli/agents/` 下的 JSON 配置。内置角色包括 `explorer`、`worker`、`reviewer`、`security`、`tester`。agent 配置可声明 description、provider/model、system instructions、allowed/blocked tools、permission profile、max tool rounds、context policy；这些配置只能在继承的子代理安全边界内继续收窄，不能越权放宽。使用 `/agent list|switch|stop|summary` 查看角色和最近子代理运行记录。
-
-### 可信 Hooks 生命周期
-旧版 `preToolExecution` / `postToolExecution` 仍然兼容。新版生命周期 hooks 配置在 `hooks.events.<EventName>` 下，通过 `AICLI_HOOK_EVENT_JSON` 接收 JSON 事件；命令 stdout 如果输出 JSON，ai-cli 会读取 `allow`、`deny`、`ask`、`warning` 或 `warnings` 等决策。
-
-```json
-{
-  "hooks": {
-    "events": {
-      "PreToolUse": {
-        "command": "node ./scripts/aicli-pre-tool-hook.mjs",
-        "source": "project",
-        "description": "Block unsafe local commands"
-      },
-      "UserPromptSubmit": "node ./scripts/aicli-prompt-hook.mjs",
-      "Stop": { "command": "npm test -- --runInBand", "timeoutMs": 10000 }
-    }
-  }
-}
-```
-
-支持的事件包括 `SessionStart`、`UserPromptSubmit`、`PreToolUse`、`PermissionRequest`、`PostToolUse`、`PreCompact`、`PostCompact`、`Stop`、`SubagentStart`、`SubagentStop`。`source: "project"` 的 hook 默认不会执行，必须通过 `/hooks trust <id>` 写入本地信任记录；命令内容变化后 hash 会变化，需要重新信任。
-
-使用 `/hooks list`、`/hooks inspect <id>`、`/hooks trust <id>`、`/hooks untrust <id>`、`/hooks disable` 管理 hooks。`/status`、`/security status` 和 Web 状态栏会显示待信任项目 hooks 数量。
+### Auto Mode
+
+`/auto on|off|status` 会开启会话级规则分类器，用来减少确认疲劳，但不会扩大 `/yolo` 的边界：`/yolo` 仍然只跳过 write 确认，destructive 仍需确认。
+
+Auto Mode 可自动通过低风险动作，例如 workspace/temp 根目录内的显式写入、只读 HTTP 工具、非 force 的普通 `git push`、已经写在 `package.json` 或 lockfile 中的依赖安装。它会拒绝 `curl | bash`、force push、疑似 secret 外传；生产部署、数据库迁移、IaC destroy、IAM/token/key/权限变更、第三方 agent loop 默认进入确认。
+
+Auto Mode 不会被项目配置静默开启。用 `/permissions recently-denied` 查看最近被 Auto Mode 拒绝的动作，用 `/permissions clear-denied` 清空本会话列表。
+### Agent Team
+
+`spawn_agent` 现在支持命名角色，来源包括内置角色以及 `~/.aicli/agents/`、`.aicli/agents/` 下的 JSON 配置。内置角色包括 `explorer`、`worker`、`reviewer`、`security`、`tester`。agent 配置可声明 description、provider/model、system instructions、allowed/blocked tools、permission profile、max tool rounds、context policy；这些配置只能在继承的子代理安全边界内继续收窄，不能越权放宽。使用 `/agent list|switch|stop|summary` 查看角色和最近子代理运行记录。
+
+### 可信 Hooks 生命周期
+旧版 `preToolExecution` / `postToolExecution` 仍然兼容。新版生命周期 hooks 配置在 `hooks.events.<EventName>` 下，通过 `AICLI_HOOK_EVENT_JSON` 接收 JSON 事件；命令 stdout 如果输出 JSON，ai-cli 会读取 `allow`、`deny`、`ask`、`warning` 或 `warnings` 等决策。
+
+```json
+{
+  "hooks": {
+    "events": {
+      "PreToolUse": {
+        "command": "node ./scripts/aicli-pre-tool-hook.mjs",
+        "source": "project",
+        "description": "Block unsafe local commands"
+      },
+      "UserPromptSubmit": "node ./scripts/aicli-prompt-hook.mjs",
+      "Stop": { "command": "npm test -- --runInBand", "timeoutMs": 10000 }
+    }
+  }
+}
+```
+
+支持的事件包括 `SessionStart`、`UserPromptSubmit`、`PreToolUse`、`PermissionRequest`、`PostToolUse`、`PreCompact`、`PostCompact`、`Stop`、`SubagentStart`、`SubagentStop`。`source: "project"` 的 hook 默认不会执行，必须通过 `/hooks trust <id>` 写入本地信任记录；命令内容变化后 hash 会变化，需要重新信任。
+
+使用 `/hooks list`、`/hooks inspect <id>`、`/hooks trust <id>`、`/hooks untrust <id>`、`/hooks disable` 管理 hooks。`/status`、`/security status` 和 Web 状态栏会显示待信任项目 hooks 数量。
 ### 环境变量
 
 | 变量 | 说明 |
@@ -413,7 +414,8 @@ Auto Mode 不会被项目配置静默开启。用 `/permissions recently-denied`
 | `AICLI_API_KEY_OPENAI` | OpenAI API Key |
 | `AICLI_API_KEY_OPENROUTER` | OpenRouter API Key |
 | `AICLI_API_KEY_ZHIPU` | 智谱 API Key |
-| `AICLI_API_KEY_KIMI` | Kimi API Key |
+| `AICLI_API_KEY_KIMI` | Kimi API Key |
+| `AICLI_API_KEY_QWEN` | Qwen / Alibaba Cloud API Key |
 | `AICLI_PROVIDER` | 默认 Provider |
 | `AICLI_NO_STREAM` | 设为 `1` 禁用流式输出 |
 | `HTTPS_PROXY` / `HTTP_PROXY` | 代理地址 |

package/dist/{batch-7V7OTMUP.js → batch-QBSKTLTO.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   ConfigManager
-} from "./chunk-P4VBLXKS.js";
-import "./chunk-TZQHYZKT.js";
-import "./chunk-NTCB7CMT.js";
+} from "./chunk-5WBNXYDJ.js";
+import "./chunk-5ULLIOVC.js";
+import "./chunk-QZYNRCPX.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-TZQHYZKT.js → chunk-5ULLIOVC.js}

@@ -8,6 +8,7 @@ var ENV_KEY_MAP = {
   zhipu: "AICLI_API_KEY_ZHIPU",
   kimi: "AICLI_API_KEY_KIMI",
   minimax: "AICLI_API_KEY_MINIMAX",
+  qwen: "AICLI_API_KEY_QWEN",
   openai: "AICLI_API_KEY_OPENAI",
   openrouter: "AICLI_API_KEY_OPENROUTER",
   "google-search": "AICLI_API_KEY_GOOGLESEARCH",

package/dist/{chunk-P4VBLXKS.js → chunk-5WBNXYDJ.js}

@@ -2,13 +2,13 @@
 import {
   ConfigError,
   EnvLoader
-} from "./chunk-TZQHYZKT.js";
+} from "./chunk-5ULLIOVC.js";
 import {
   CONFIG_DIR_NAME,
   CONFIG_FILE_NAME,
   HISTORY_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-NTCB7CMT.js";
+} from "./chunk-QZYNRCPX.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";