aicp-cli 0.4.0__tar.gz → 0.6.0__tar.gz

{aicp_cli-0.4.0 → aicp_cli-0.6.0}/CHANGELOG.md

@@ -1,8 +1,46 @@
+## [0.5.1] - 2026-09-17
+
+### 🐛 Bug Fixes
+
+- **cli:** Remove unused noqa directive
+
+### 📚 Documentation
+
+- **changelog:** Release v0.5.1
+## [0.5.0] - 2026-09-17
+
+### 🚀 Features
+
+- **cli:** Allow flags without their leading --
+
+### 🐛 Bug Fixes
+
+- **cli:** Remove duplicate commit handler row
+- **secret-scan:** Ignore url path slugs
+
+### 📚 Documentation
+
+- Clarify skill installation ownership
+- **changelog:** Release v0.5.0
+
+### ⚙️ Miscellaneous Tasks
+
+- **commit:** Remove model metadata
+- **release:** Add scripted release flow
+- **release:** Remove project release.sh, use global template
 ## [0.4.0] - 2026-09-14
 
+### 🐛 Bug Fixes
+
+- **release:** Sync uv.lock for v0.4.0
+
 ### 🚜 Refactor
 
 - **agents:** Centralize agent definitions
+
+### ⚙️ Miscellaneous Tasks
+
+- **release:** Bump version to 0.4.0
 ## [0.3.1] - 2026-09-14
 
 ### 🐛 Bug Fixes

{aicp_cli-0.4.0 → aicp_cli-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: aicp-cli
-Version: 0.4.0
+Version: 0.6.0
 Summary: AI commit + push, with a git-verified result summary
 Project-URL: Repository, https://github.com/weskao/aicp
 Project-URL: Issues, https://github.com/weskao/aicp/issues
@@ -30,7 +30,7 @@ push that never reached the remote.
 
 [Install](#install) · [Set up skills](#set-up-skills) · [Run it](#run-it) ·
 [`--undo`](#--undo) · [Automation / CI](#automation--ci) ·
-[Configuration](#configuration) · [Safety](#safety) ·
+[Configuration](#configuration) · [Custom agents](#custom-agents) · [Safety](#safety) ·
 [Platform support](#platform-support)
 
 ## Requirements
@@ -66,13 +66,12 @@ uv tool uninstall aicp-cli
 aicp --config   # -> Skills
 ```
 
-`/commit` and `/safe-git-push` only mean something if a skill by that exact
-name exists in the CLI's own config directory — otherwise the CLI receives a
-slash command it has never heard of and improvises. aicp ships byte-identical
-copies of both skills and installs them for you, but it never overwrites a
-skill you already have: a file with no aicp version marker next to it is
-treated as yours and left alone. If you already have a better `/commit` for
-this repo, it stays.
+`/safe-git-push` only means something if a skill by that exact name exists in
+the CLI's own config directory — otherwise the CLI receives a slash command it
+has never heard of and improvises. aicp ships and installs that skill for you,
+but it never overwrites a skill you already have: a file with no aicp version
+marker next to it is treated as yours and left alone. `/commit` is always left
+to your existing definition.
 
 Targets follow each CLI's own config directory, not its binary name — `agy`
 (this project's name for the Gemini CLI) reads `~/.gemini`, not `~/.agy`:
@@ -80,16 +79,16 @@ Targets follow each CLI's own config directory, not its binary name — `agy`
 | CLI | Config dir | `/commit` installed? | `/safe-git-push` installed? |
 | --- | --- | --- | --- |
 | `claude` | `~/.claude` | No — keeps your existing `commands/commit.md` | Yes |
-| `codex` | `~/.codex` | Yes | Yes |
-| `copilot` | `~/.copilot` | Yes | Yes |
-| `agy` (Gemini CLI) | `~/.gemini` | Yes | Yes |
-| `vibe` | `~/.vibe` | Yes | Yes |
-| `grok` | `$GROK_HOME` when set, otherwise `~/.grok` | Yes | Yes |
+| `codex` | `~/.codex` | No — keeps your existing `/commit` | Yes |
+| `copilot` | `~/.copilot` | No — keeps your existing `/commit` | Yes |
+| `agy` (Gemini CLI) | `~/.gemini` | No — keeps your existing `/commit` | Yes |
+| `vibe` | `~/.vibe` | No — keeps your existing `/commit` | Yes |
+| `grok` | `$GROK_HOME` when set, otherwise `~/.grok` | No — keeps your existing `/commit` | Yes |
 
-`claude` is the one exception: it already resolves `/commit` from its own
-`commands/commit.md`, so aicp never installs a competing definition under
-`skills/` there — installing one would just shadow the one Claude already
-uses. Every other CLI gets both skills.
+`/commit` is never installed: aicp keeps each CLI's existing command or skill
+definition. Claude resolves that definition from `commands/commit.md`; the
+other CLIs keep their existing `/commit` as well. Every configured CLI gets
+`/safe-git-push`.
 
 A CLI whose config directory doesn't exist at all is skipped, never created —
 aicp only ever installs into a CLI you've actually set up.
@@ -133,6 +132,9 @@ through the fallback chain, then `/safe-git-push` the same way, then prints
 the git-verified result table described above. `-v`/`--verbose` streams each
 CLI's raw output live instead of showing a spinner.
 
+Every long flag also works without its leading `--` — `aicp config` is the
+same as `aicp --config`.
+
 ![aicp run: commit, push, and the git-verified result table](docs/images/aicp-run.png)
 
 `aicp --config` is one menu for everything that isn't "commit and push
@@ -220,7 +222,7 @@ integration tests and installed-wheel checks on all three operating systems.
 | `config_dir` | Absolute path or `~/`-relative directory; home is resolved when used. |
 | `config_dir_env` | Optional environment variable overriding that directory (currently `GROK_HOME`). |
 | `skills_dir` | Relative directory inside `config_dir` where skills are installed. |
-| `skills` | Vendored skills to install: `commit` and/or `safe-git-push`. Claude keeps its existing `/commit`. |
+| `skills` | Vendored skills to install: `/safe-git-push`. Every CLI keeps its existing `/commit`. |
 | `memory_file` | Instruction filename used when adapting vendored skill text. Project directory references use the basename of `config_dir`. |
 | `args` | Argument array containing exactly one standalone `{prompt}`, replaced with the complete prompt as one argument. No shell evaluation. |
 
@@ -236,6 +238,79 @@ upgrades replace it; neither repository-local files nor
 `~/.aicp/config.json` can override agent execution settings. Ordinary user
 preferences continue to use the config file below.
 
+### Custom agents
+
+You can add agents that are not in the built-in registry — or suppress
+built-in ones — without touching the bundled `agents.json` (which package
+upgrades replace). Create `~/.aicp/agents.json` with the same `version: 1`
+/ `agents` envelope. aicp merges it over the built-in registry at startup:
+user-defined entries win on conflict, and an entry with `"disabled": true`
+removes that agent from the chain entirely.
+
+**Adding a new agent** — example: [MiniMax](https://www.minimaxi.com/) CLI:
+
+```json
+{
+  "version": 1,
+  "agents": {
+    "minimax": {
+      "executable": "minimax",
+      "config_dir": "~/.minimax",
+      "memory_file": "AGENTS.md",
+      "skills_dir": "skills",
+      "skills": ["safe-git-push"],
+      "args": ["--prompt", "{prompt}", "--yes"]
+    }
+  }
+}
+```
+
+Then add `minimax` anywhere in your preferred fallback order:
+
+```sh
+# ~/.aicp/config.json
+{ "aicp_cli_order": "minimax copilot agy codex claude vibe grok" }
+```
+
+Or set it as an environment variable for one run:
+
+```sh
+AICP_CLI_ORDER="minimax claude" aicp
+```
+
+**Disabling a built-in agent** — example: remove `grok` from the chain:
+
+```json
+{
+  "version": 1,
+  "agents": {
+    "grok": { "disabled": true }
+  }
+}
+```
+
+**Overriding a built-in agent's settings** — example: change `claude`'s
+executable path:
+
+```json
+{
+  "version": 1,
+  "agents": {
+    "claude": {
+      "executable": "/opt/homebrew/bin/claude"
+    }
+  }
+}
+```
+
+Only the fields you provide are overridden; unspecified fields keep the
+built-in values. The same agent-field table above applies to user-defined
+entries. Running the chain only needs the `executable` on `PATH`, same as any
+built-in agent (see [Fallback results](#fallback-results-and-quota-limits));
+`config_dir` matters for skill installation — a newly added agent whose
+`config_dir` doesn't exist yet is skipped there until you set it up (as
+above).
+
 The config file lives at `~/.aicp/config.json` (override the path itself
 with `AICP_CONFIG`, which — being the thing that names the file — can only be
 set as a real environment variable). Precedence everywhere is

{aicp_cli-0.4.0 → aicp_cli-0.6.0}/README.md

@@ -18,7 +18,7 @@ push that never reached the remote.
 
 [Install](#install) · [Set up skills](#set-up-skills) · [Run it](#run-it) ·
 [`--undo`](#--undo) · [Automation / CI](#automation--ci) ·
-[Configuration](#configuration) · [Safety](#safety) ·
+[Configuration](#configuration) · [Custom agents](#custom-agents) · [Safety](#safety) ·
 [Platform support](#platform-support)
 
 ## Requirements
@@ -54,13 +54,12 @@ uv tool uninstall aicp-cli
 aicp --config   # -> Skills
 ```
 
-`/commit` and `/safe-git-push` only mean something if a skill by that exact
-name exists in the CLI's own config directory — otherwise the CLI receives a
-slash command it has never heard of and improvises. aicp ships byte-identical
-copies of both skills and installs them for you, but it never overwrites a
-skill you already have: a file with no aicp version marker next to it is
-treated as yours and left alone. If you already have a better `/commit` for
-this repo, it stays.
+`/safe-git-push` only means something if a skill by that exact name exists in
+the CLI's own config directory — otherwise the CLI receives a slash command it
+has never heard of and improvises. aicp ships and installs that skill for you,
+but it never overwrites a skill you already have: a file with no aicp version
+marker next to it is treated as yours and left alone. `/commit` is always left
+to your existing definition.
 
 Targets follow each CLI's own config directory, not its binary name — `agy`
 (this project's name for the Gemini CLI) reads `~/.gemini`, not `~/.agy`:
@@ -68,16 +67,16 @@ Targets follow each CLI's own config directory, not its binary name — `agy`
 | CLI | Config dir | `/commit` installed? | `/safe-git-push` installed? |
 | --- | --- | --- | --- |
 | `claude` | `~/.claude` | No — keeps your existing `commands/commit.md` | Yes |
-| `codex` | `~/.codex` | Yes | Yes |
-| `copilot` | `~/.copilot` | Yes | Yes |
-| `agy` (Gemini CLI) | `~/.gemini` | Yes | Yes |
-| `vibe` | `~/.vibe` | Yes | Yes |
-| `grok` | `$GROK_HOME` when set, otherwise `~/.grok` | Yes | Yes |
+| `codex` | `~/.codex` | No — keeps your existing `/commit` | Yes |
+| `copilot` | `~/.copilot` | No — keeps your existing `/commit` | Yes |
+| `agy` (Gemini CLI) | `~/.gemini` | No — keeps your existing `/commit` | Yes |
+| `vibe` | `~/.vibe` | No — keeps your existing `/commit` | Yes |
+| `grok` | `$GROK_HOME` when set, otherwise `~/.grok` | No — keeps your existing `/commit` | Yes |
 
-`claude` is the one exception: it already resolves `/commit` from its own
-`commands/commit.md`, so aicp never installs a competing definition under
-`skills/` there — installing one would just shadow the one Claude already
-uses. Every other CLI gets both skills.
+`/commit` is never installed: aicp keeps each CLI's existing command or skill
+definition. Claude resolves that definition from `commands/commit.md`; the
+other CLIs keep their existing `/commit` as well. Every configured CLI gets
+`/safe-git-push`.
 
 A CLI whose config directory doesn't exist at all is skipped, never created —
 aicp only ever installs into a CLI you've actually set up.
@@ -121,6 +120,9 @@ through the fallback chain, then `/safe-git-push` the same way, then prints
 the git-verified result table described above. `-v`/`--verbose` streams each
 CLI's raw output live instead of showing a spinner.
 
+Every long flag also works without its leading `--` — `aicp config` is the
+same as `aicp --config`.
+
 ![aicp run: commit, push, and the git-verified result table](docs/images/aicp-run.png)
 
 `aicp --config` is one menu for everything that isn't "commit and push
@@ -208,7 +210,7 @@ integration tests and installed-wheel checks on all three operating systems.
 | `config_dir` | Absolute path or `~/`-relative directory; home is resolved when used. |
 | `config_dir_env` | Optional environment variable overriding that directory (currently `GROK_HOME`). |
 | `skills_dir` | Relative directory inside `config_dir` where skills are installed. |
-| `skills` | Vendored skills to install: `commit` and/or `safe-git-push`. Claude keeps its existing `/commit`. |
+| `skills` | Vendored skills to install: `/safe-git-push`. Every CLI keeps its existing `/commit`. |
 | `memory_file` | Instruction filename used when adapting vendored skill text. Project directory references use the basename of `config_dir`. |
 | `args` | Argument array containing exactly one standalone `{prompt}`, replaced with the complete prompt as one argument. No shell evaluation. |
 
@@ -224,6 +226,79 @@ upgrades replace it; neither repository-local files nor
 `~/.aicp/config.json` can override agent execution settings. Ordinary user
 preferences continue to use the config file below.
 
+### Custom agents
+
+You can add agents that are not in the built-in registry — or suppress
+built-in ones — without touching the bundled `agents.json` (which package
+upgrades replace). Create `~/.aicp/agents.json` with the same `version: 1`
+/ `agents` envelope. aicp merges it over the built-in registry at startup:
+user-defined entries win on conflict, and an entry with `"disabled": true`
+removes that agent from the chain entirely.
+
+**Adding a new agent** — example: [MiniMax](https://www.minimaxi.com/) CLI:
+
+```json
+{
+  "version": 1,
+  "agents": {
+    "minimax": {
+      "executable": "minimax",
+      "config_dir": "~/.minimax",
+      "memory_file": "AGENTS.md",
+      "skills_dir": "skills",
+      "skills": ["safe-git-push"],
+      "args": ["--prompt", "{prompt}", "--yes"]
+    }
+  }
+}
+```
+
+Then add `minimax` anywhere in your preferred fallback order:
+
+```sh
+# ~/.aicp/config.json
+{ "aicp_cli_order": "minimax copilot agy codex claude vibe grok" }
+```
+
+Or set it as an environment variable for one run:
+
+```sh
+AICP_CLI_ORDER="minimax claude" aicp
+```
+
+**Disabling a built-in agent** — example: remove `grok` from the chain:
+
+```json
+{
+  "version": 1,
+  "agents": {
+    "grok": { "disabled": true }
+  }
+}
+```
+
+**Overriding a built-in agent's settings** — example: change `claude`'s
+executable path:
+
+```json
+{
+  "version": 1,
+  "agents": {
+    "claude": {
+      "executable": "/opt/homebrew/bin/claude"
+    }
+  }
+}
+```
+
+Only the fields you provide are overridden; unspecified fields keep the
+built-in values. The same agent-field table above applies to user-defined
+entries. Running the chain only needs the `executable` on `PATH`, same as any
+built-in agent (see [Fallback results](#fallback-results-and-quota-limits));
+`config_dir` matters for skill installation — a newly added agent whose
+`config_dir` doesn't exist yet is skipped there until you set it up (as
+above).
+
 The config file lives at `~/.aicp/config.json` (override the path itself
 with `AICP_CONFIG`, which — being the thing that names the file — can only be
 set as a real environment variable). Precedence everywhere is

{aicp_cli-0.4.0 → aicp_cli-0.6.0}/TODO.md

@@ -37,3 +37,15 @@ reliably, so it was avoided in the safe git push stage afterward — find
 and fix cases like this where a slow/unreliable step gets silently
 bypassed instead of fixed. Audit other stages for similar slowness or
 failure-avoidance patterns.
+
+## Support "devin" harness (open)
+
+Detect and support the Devin AI agent environment (`~/.devin`).
+Add a `devin` harness so `aicp` can install skills, rules, and config
+into the paths and formats that Devin expects.
+
+## Support "opencode" harness (open)
+
+Detect and support the OpenCode agent environment (`~/.opencode`).
+Add an `opencode` harness so `aicp` can install skills, rules, and config
+into the paths and formats that OpenCode expects.

{aicp_cli-0.4.0 → aicp_cli-0.6.0}/pyproject.toml

@@ -2,7 +2,7 @@
 # PyPI distribution name only — the `aicp` name was taken in 2021 by an
 # unrelated project. The command, import path and repo stay `aicp`.
 name = "aicp-cli"
-version = "0.4.0"
+version = "0.6.0"
 description = "AI commit + push, with a git-verified result summary"
 readme = "README.md"
 requires-python = ">=3.10"

{aicp_cli-0.4.0 → aicp_cli-0.6.0}/skills/commit.md

@@ -1,13 +1,17 @@
 ---
 description: Stage and commit all changes, grouped into logical Conventional Commits batches.
-model: sonnet
-effort: medium
 ---
 
 # Commit
 
 Git commit current changes, split into logical batches if needed.
 
+## Secret-scan behavior
+
+The pre-command aicp gate ignores key-like text only in URL paths, not in
+ordinary text or URL query values. This prevents hyphenated article slugs from
+blocking `/commit` without weakening sensitive-string detection.
+
 ## Project override (check FIRST)
 
 Skills/custom commands resolve **personal-over-project** on a name clash, so

aicp_cli-0.6.0/src/aicp/agents.py

@@ -0,0 +1,135 @@
+"""Bundled agent definitions shared by execution and skill management.
+
+The package's ``agents.json`` is the base registry. ``~/.aicp/agents.json``,
+if present, is merged over it at import time: an entry for a name already in
+the base registry overrides only the fields it lists (unspecified fields
+keep the built-in value); an entry for a new name must supply every field,
+same as the base registry; ``{"disabled": true}`` drops that name from the
+chain entirely. A malformed user file is warned about on stderr and ignored
+rather than crashing every invocation — see :func:`_load_user_overrides`.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass(frozen=True)
+class Agent:
+    executable: str
+    config_dir: str
+    memory_file: str
+    skills_dir: str
+    skills: tuple[str, ...]
+    args: tuple[str, ...]
+    config_dir_env: str = ""
+
+    def config_root(self, home: Path | None = None) -> Path:
+        if home is None and (override := os.environ.get(self.config_dir_env)):
+            return Path(override).expanduser()
+        if self.config_dir.startswith("~/"):
+            return (Path.home() if home is None else home) / self.config_dir[2:]
+        return Path(self.config_dir)
+
+
+def _read_registry(path: Path) -> dict[str, dict]:
+    data = json.loads(path.read_text(encoding="utf-8"))
+    if not isinstance(data, dict) or data.get("version") != 1:
+        raise ValueError(f"{path}: unsupported agent registry version")
+    entries = data.get("agents")
+    if not isinstance(entries, dict) or not entries:
+        raise ValueError(f"{path}: expected a nonempty agents object")
+    return entries
+
+
+def _build_agent(path: Path, name: str, entry: dict, base: Agent | None) -> Agent:
+    """Validate *entry*, falling back to *base*'s fields for anything it omits.
+
+    ``base=None`` (the built-in registry, or a brand-new name) requires every
+    field to be present, same as before this function existed.
+    """
+    if not isinstance(entry, dict):
+        raise TypeError(f"{path}: {name}: expected an agent object")
+    merged: dict[str, object] = {
+        "executable": base.executable if base else None,
+        "config_dir": base.config_dir if base else None,
+        "memory_file": base.memory_file if base else None,
+        "skills_dir": base.skills_dir if base else None,
+        "skills": list(base.skills) if base else None,
+        "args": list(base.args) if base else None,
+        "config_dir_env": base.config_dir_env if base else "",
+    }
+    merged.update({k: v for k, v in entry.items() if k != "disabled"})
+    for key in ["executable", "config_dir", "memory_file", "skills_dir"]:
+        value = merged.get(key)
+        if not isinstance(value, str) or not value.strip() or "\0" in value:
+            raise ValueError(f"{path}: {name}: invalid {key}")
+    for key in ("args", "skills"):
+        value = merged.get(key)
+        if not isinstance(value, list) or not all(
+            isinstance(item, str) and "\0" not in item for item in value
+        ):
+            raise ValueError(f"{path}: {name}: invalid {key}")
+    if merged["args"].count("{prompt}") != 1:
+        raise ValueError(f"{path}: {name}: args must contain one {{prompt}} argument")
+    if not merged["config_dir"].startswith("~/") and not Path(merged["config_dir"]).is_absolute():
+        raise ValueError(f"{path}: {name}: config_dir must be absolute or start with ~/")
+    skills_dir = Path(merged["skills_dir"])
+    if skills_dir.anchor or ".." in skills_dir.parts or skills_dir == Path("."):
+        raise ValueError(f"{path}: {name}: skills_dir must stay inside config_dir")
+    env = merged.get("config_dir_env", "")
+    if not isinstance(env, str) or (env and not env.isidentifier()):
+        raise ValueError(f"{path}: {name}: invalid config_dir_env")
+    return Agent(
+        executable=merged["executable"],
+        config_dir=merged["config_dir"],
+        memory_file=merged["memory_file"],
+        skills_dir=merged["skills_dir"],
+        skills=tuple(merged["skills"]),
+        args=tuple(merged["args"]),
+        config_dir_env=env,
+    )
+
+
+def load_agents(path: Path) -> dict[str, Agent]:
+    """Validate a full (built-in shaped) registry file."""
+    entries = _read_registry(path)
+    return {name: _build_agent(path, name, entry, base=None) for name, entry in entries.items()}
+
+
+def merge_user_agents(agents: dict[str, Agent], path: Path) -> dict[str, Agent]:
+    """Overlay ``path``'s entries onto *agents*: partial overrides for known
+    names, full entries for new ones, ``disabled: true`` to drop a name."""
+    merged = dict(agents)
+    for name, entry in _read_registry(path).items():
+        if not isinstance(entry, dict):
+            raise TypeError(f"{path}: {name}: expected an agent object")
+        if entry.get("disabled") is True:
+            merged.pop(name, None)
+            continue
+        merged[name] = _build_agent(path, name, entry, base=merged.get(name))
+    return merged
+
+
+def _load_user_overrides(agents: dict[str, Agent], home: Path | None = None) -> dict[str, Agent]:
+    path = (home or Path.home()) / ".aicp" / "agents.json"
+    if not path.is_file():
+        return agents
+    try:
+        return merge_user_agents(agents, path)
+    except (OSError, ValueError, TypeError, json.JSONDecodeError) as exc:
+        print(f"aicp: ignoring {path} ({exc}) — using built-in agents only", file=sys.stderr)
+        return agents
+
+
+AGENTS = _load_user_overrides(load_agents(Path(__file__).with_name("agents.json")))
+
+
+def executable(name: str) -> str:
+    """Resolve a roster ID to its binary; leave non-agent commands alone."""
+    agent = AGENTS.get(name)
+    return agent.executable if agent else name

{aicp_cli-0.4.0 → aicp_cli-0.6.0}/src/aicp/cli.py

@@ -185,6 +185,25 @@ class _Parser(argparse.ArgumentParser):
         raise SystemExit(1)
 
 
+def _normalize_argv(argv: Sequence[str], parser: argparse.ArgumentParser) -> list[str]:
+    """Let a long flag's ``--`` be omitted: ``aicp config`` == ``aicp --config``.
+
+    The allowed bare words are read off *parser* itself (every ``--xxx`` it
+    defines), so a flag added to :func:`build_parser` gains this for free with
+    no second list to keep in sync. A word already starting with ``-`` is
+    left alone — this only fills in a *missing* prefix, never reinterprets
+    one that is already there (``--conf`` still isn't ``--config``: that's
+    ``allow_abbrev=False``'s job, untouched by this).
+    """
+    long_flags = {
+        opt[2:]
+        for action in parser._actions
+        for opt in action.option_strings
+        if opt.startswith("--")
+    }
+    return [f"--{arg}" if arg in long_flags else arg for arg in argv]
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = _Parser(
         prog="aicp",
@@ -192,6 +211,11 @@ def build_parser() -> argparse.ArgumentParser:
         # English: it is argparse's, not aicp's, and gettext-patching a stdlib
         # module to translate four words is not worth the surprise.
         description=t("help_description", "AI commit + push, with a git-verified result summary."),
+        epilog=t(
+            "help_epilog",
+            "every flag above also works without its leading `--` "
+            "(`aicp config` is the same as `aicp --config`).",
+        ),
         # No abbreviation matching: `--conf` must not silently become
         # `--config` (which runs the settings menu instead of a commit).
         allow_abbrev=False,
@@ -318,7 +342,7 @@ def _commit_step(
         print()
         _echo(
             present.render(
-                [(t("commit_handler", "Commit handler"), result.winner or "—"), *rows],
+                rows,
                 f'{t("commits_panel_title", "NEW COMMITS")} · {gitflow.tz_label()}',
                 mode="panel",
                 accent=GREEN,
@@ -576,8 +600,9 @@ def _dispatch(args: argparse.Namespace) -> int:
 
 def main(argv: list[str] | None = None) -> int:
     parser = build_parser()
+    raw = sys.argv[1:] if argv is None else argv
     try:
-        args = parser.parse_args(argv)
+        args = parser.parse_args(_normalize_argv(raw, parser))
         _reject_orphan_sub_flags(parser, args)
     except SystemExit as exc:  # --help/--version (0), or a bad flag (1)
         return int(exc.code or 0)

{aicp_cli-0.4.0 → aicp_cli-0.6.0}/src/aicp/i18n.py

@@ -213,6 +213,7 @@ CATALOG: dict[str, str] = {
     "help_install_skills": "把內建的 skills 安裝到每個已設定的 CLI",
     "help_yes": "--install-skills：實際寫入（不加就只是預覽）",
     "help_force": "--install-skills：覆蓋別人的同名檔案，並留下 .bak",
+    "help_epilog": "以上任一 flag 都可以省略開頭的 `--`（`aicp config` 等同 `aicp --config`）。",
 }
 
 

{aicp_cli-0.4.0 → aicp_cli-0.6.0}/src/aicp/secrets.py

@@ -40,10 +40,12 @@ from .i18n import t
 
 __all__ = ["PATTERNS", "ScanResult", "report_lines", "scan"]
 
-# Prefix/format checks only, copied verbatim from AICP_SECRET_PATTERNS in
-# bin/aicp. The human name is the only half ever printed.
+# Prefix/format checks only. The human name is the only half ever printed.
 PATTERNS: tuple[tuple[re.Pattern[str], str], ...] = (
-    (re.compile(r"sk-(proj-)?[A-Za-z0-9_-]{20,}"), "OpenAI-style API key (sk-…)"),
+    (
+        re.compile(r"sk-(proj-)?[A-Za-z0-9_-]{20,}"),
+        "OpenAI-style API key (sk-…)",
+    ),
     (re.compile(r"ghp_[A-Za-z0-9]{20,}"), "GitHub personal access token (ghp_…)"),
     (re.compile(r"ghs_[A-Za-z0-9]{20,}"), "GitHub App/server token (ghs_…)"),
     (re.compile(r"github_pat_[A-Za-z0-9_]{20,}"), "GitHub fine-grained PAT (github_pat_…)"),
@@ -52,6 +54,8 @@ PATTERNS: tuple[tuple[re.Pattern[str], str], ...] = (
     (re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY( BLOCK)?-----"), "private key block"),
 )
 
+_URL_PATH = re.compile(r"https?://[^/\s?#]+(?P<path>/[^\s?#]*)")
+
 #: How much of a file is inspected for a NUL byte before calling it binary —
 #: the same "first block decides" rule `grep -I` applies.
 _BINARY_SNIFF_BYTES = 8192
@@ -77,8 +81,12 @@ def _hit(file: str, lineno: int, content: str) -> str | None:
     """The redaction boundary: *content* is matched and discarded, and only
     the location plus the pattern's name survive into the returned string."""
     for pattern, name in PATTERNS:
-        if pattern.search(content):
-            return f"{file}:{lineno}  looks like {name}"
+        for match in pattern.finditer(content):
+            if not any(
+                url.start("path") <= match.start() and match.end() <= url.end("path")
+                for url in _URL_PATH.finditer(content)
+            ):
+                return f"{file}:{lineno}  looks like {name}"
     return None
 
 

{aicp_cli-0.4.0 → aicp_cli-0.6.0}/tests/test_agents.py

@@ -10,7 +10,7 @@ from pathlib import Path
 import pytest
 
 import aicp
-from aicp.agents import load_agents
+from aicp.agents import _load_user_overrides, load_agents, merge_user_agents
 
 
 @pytest.mark.parametrize("location", ["home", "absolute", "environment"])
@@ -99,6 +99,106 @@ def test_rejects_invalid_registry_fields(tmp_path, field, value):
         load_agents(path)
 
 
+def _write(path: Path, agents: dict) -> Path:
+    path.write_text(json.dumps({"version": 1, "agents": agents}))
+    return path
+
+
+def test_merge_user_agents_adds_a_new_agent(tmp_path):
+    base = load_agents(Path(aicp.__file__).with_name("agents.json"))
+    override = _write(
+        tmp_path / "agents.json",
+        {
+            "minimax": {
+                "executable": "minimax",
+                "config_dir": "~/.minimax",
+                "memory_file": "AGENTS.md",
+                "skills_dir": "skills",
+                "skills": ["safe-git-push"],
+                "args": ["--prompt", "{prompt}", "--yes"],
+            }
+        },
+    )
+    merged = merge_user_agents(base, override)
+    assert set(merged) == set(base) | {"minimax"}
+    assert merged["minimax"].executable == "minimax"
+
+
+def test_merge_user_agents_overrides_only_listed_fields(tmp_path):
+    base = load_agents(Path(aicp.__file__).with_name("agents.json"))
+    override = _write(tmp_path / "agents.json", {"claude": {"executable": "/opt/claude"}})
+    merged = merge_user_agents(base, override)
+    assert merged["claude"].executable == "/opt/claude"
+    assert merged["claude"].config_dir == base["claude"].config_dir
+    assert merged["claude"].args == base["claude"].args
+
+
+def test_merge_user_agents_disabled_drops_the_agent(tmp_path):
+    base = load_agents(Path(aicp.__file__).with_name("agents.json"))
+    override = _write(tmp_path / "agents.json", {"grok": {"disabled": True}})
+    merged = merge_user_agents(base, override)
+    assert "grok" not in merged
+    assert set(merged) == set(base) - {"grok"}
+
+
+def test_merge_user_agents_new_agent_requires_every_field(tmp_path):
+    base = load_agents(Path(aicp.__file__).with_name("agents.json"))
+    override = _write(tmp_path / "agents.json", {"minimax": {"executable": "minimax"}})
+    with pytest.raises(ValueError, match="config_dir"):
+        merge_user_agents(base, override)
+
+
+def test_load_user_overrides_warns_and_falls_back_on_malformed_file(tmp_path, capsys):
+    base = load_agents(Path(aicp.__file__).with_name("agents.json"))
+    (tmp_path / ".aicp").mkdir()
+    (tmp_path / ".aicp" / "agents.json").write_text("not json")
+    result = _load_user_overrides(base, home=tmp_path)
+    assert result == base
+    assert "ignoring" in capsys.readouterr().err
+
+
+def test_load_user_overrides_is_a_noop_with_no_file(tmp_path):
+    base = load_agents(Path(aicp.__file__).with_name("agents.json"))
+    assert _load_user_overrides(base, home=tmp_path) == base
+
+
+def test_user_agents_json_reaches_roster_and_cli_order(tmp_path):
+    home = tmp_path / "home"
+    (home / ".aicp").mkdir(parents=True)
+    _write(
+        home / ".aicp" / "agents.json",
+        {
+            "grok": {"disabled": True},
+            "minimax": {
+                "executable": "minimax",
+                "config_dir": "~/.minimax",
+                "memory_file": "AGENTS.md",
+                "skills_dir": "skills",
+                "skills": ["safe-git-push"],
+                "args": ["--prompt", "{prompt}", "--yes"],
+            },
+        },
+    )
+    result = subprocess.run(
+        [sys.executable, "-c", """
+from aicp.contracts import ROSTER
+from aicp.config import resolve_cli_chain
+names = [c.name for c in ROSTER]
+assert 'grok' not in names, names
+assert 'minimax' in names, names
+assert resolve_cli_chain('minimax claude')[0] == 'minimax'
+print('ok')
+"""],
+        env={**os.environ, "HOME": str(home), "PYTHONUTF8": "1"},
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        check=False,
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert "ok" in result.stdout
+
+
 def test_config_root_preserves_absolute_paths_and_live_env(tmp_path, monkeypatch):
     from dataclasses import replace
 

{aicp_cli-0.4.0 → aicp_cli-0.6.0}/tests/test_cli.py

@@ -174,6 +174,32 @@ def test_flags_are_not_abbreviation_matched(run, aicprc, git_repo, stub_cli, cal
     assert calls(call_log) == []
 
 
+def test_a_bare_flag_name_works_the_same_as_its_dashed_form(
+    run, aicprc, git_repo, stub_cli, call_log, monkeypatch
+):
+    """``aicp config`` == ``aicp --config``."""
+    stub_cli()
+    opened: list[int] = []
+    monkeypatch.setattr(cli.menu, "config_menu", lambda **_kw: opened.append(1) or 0)
+    assert run(git_repo, "config") == 0
+    assert len(opened) == 1
+    assert calls(call_log) == []
+
+
+def test_a_bare_word_that_is_not_a_known_flag_still_fails(
+    run, aicprc, git_repo, stub_cli, call_log
+):
+    stub_cli()
+    assert run(git_repo, "not-a-flag") != 0
+    assert calls(call_log) == []
+
+
+def test_help_mentions_the_optional_dashes(run, aicprc, git_repo, stub_cli, call_log, capsys):
+    stub_cli()
+    assert run(git_repo, "--help") == 0
+    assert "aicp config" in capsys.readouterr().out
+
+
 # ── repo / branch guards ─────────────────────────────────────────────────────
 
 
@@ -297,6 +323,7 @@ def test_result_presents_the_winning_handler_for_each_attempt(
     out = capsys.readouterr().out
     assert "Commit handler" in out and "writer" in out
     assert "Push handler" in out and "pusher" in out
+    assert out.count("Commit handler") == 1
 
 
 # ── the git-verified RESULT table ────────────────────────────────────────────

{aicp_cli-0.4.0 → aicp_cli-0.6.0}/tests/test_secrets.py

@@ -32,6 +32,7 @@ SAMPLES: tuple[tuple[str, str], ...] = (
     ("aws-asia", "ASIAABCDEFGHIJKLMNOP"),
     ("bearer", "Bearer abcdefghijklmnopqrstuvwxyz0123"),
     ("private-key", "-----BEGIN RSA PRIVATE KEY-----"),
+    ("openai-url-safe", "sk-abcde_fghij-klmno_pqrstuvwxyz0123"),
 )
 
 # The entropy heuristic was deliberately rejected upstream (see the comment
@@ -39,6 +40,7 @@ SAMPLES: tuple[tuple[str, str], ...] = (
 # source, and this repo's own strings would trip it.
 BENIGN: tuple[str, ...] = (
     "sk-automation",
+    "https://example.com/elon-musk-authorized-biography",
     "Bearer short",
     "AKIAZ demo",
     "ghp_short",
@@ -95,6 +97,13 @@ def test_benign_lookalikes_are_not_flagged(repo: Path, line: str) -> None:
     assert result.ok
 
 
+def test_sensitive_value_in_a_url_query_is_flagged(repo: Path) -> None:
+    (repo / "notes.txt").write_text(
+        f"https://example.com/?api_key={SAMPLES[-1][1]}\n", encoding="utf-8"
+    )
+    assert scan(repo).hits
+
+
 # ── scan surface ─────────────────────────────────────────────────────────────
 
 

{aicp_cli-0.4.0 → aicp_cli-0.6.0}/uv.lock

@@ -4,7 +4,7 @@ requires-python = ">=3.10"
 
 [[package]]
 name = "aicp-cli"
-version = "0.4.0"
+version = "0.6.0"
 source = { editable = "." }
 
 [package.dev-dependencies]

aicp_cli-0.4.0/src/aicp/agents.py

@@ -1,83 +0,0 @@
-"""Bundled agent definitions shared by execution and skill management.
-
-Only the package's agents.json is read; working-directory and user config
-files cannot supply executable paths or arguments through this registry.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-from dataclasses import dataclass
-from pathlib import Path
-
-
-@dataclass(frozen=True)
-class Agent:
-    executable: str
-    config_dir: str
-    memory_file: str
-    skills_dir: str
-    skills: tuple[str, ...]
-    args: tuple[str, ...]
-    config_dir_env: str = ""
-
-    def config_root(self, home: Path | None = None) -> Path:
-        if home is None and (override := os.environ.get(self.config_dir_env)):
-            return Path(override).expanduser()
-        if self.config_dir.startswith("~/"):
-            return (Path.home() if home is None else home) / self.config_dir[2:]
-        return Path(self.config_dir)
-
-
-def load_agents(path: Path) -> dict[str, Agent]:
-    """Validate packaged data and preserve its default fallback order."""
-    data = json.loads(path.read_text(encoding="utf-8"))
-    if not isinstance(data, dict) or data.get("version") != 1:
-        raise ValueError(f"{path}: unsupported agent registry version")
-    entries = data.get("agents")
-    if not isinstance(entries, dict) or not entries:
-        raise ValueError(f"{path}: expected a nonempty agents object")
-    agents = {}
-    for name, entry in entries.items():
-        if not isinstance(entry, dict):
-            raise TypeError(f"{path}: {name}: expected an agent object")
-        for key in ["executable", "config_dir", "memory_file", "skills_dir"]:
-            value = entry.get(key)
-            if not isinstance(value, str) or not value.strip() or "\0" in value:
-                raise ValueError(f"{path}: {name}: invalid {key}")
-        for key in ("args", "skills"):
-            value = entry.get(key)
-            if not isinstance(value, list) or not all(
-                isinstance(item, str) and "\0" not in item for item in value
-            ):
-                raise ValueError(f"{path}: {name}: invalid {key}")
-        if entry["args"].count("{prompt}") != 1:
-            raise ValueError(f"{path}: {name}: args must contain one {{prompt}} argument")
-        if not entry["config_dir"].startswith("~/") and not Path(entry["config_dir"]).is_absolute():
-            raise ValueError(f"{path}: {name}: config_dir must be absolute or start with ~/")
-        skills_dir = Path(entry["skills_dir"])
-        if skills_dir.anchor or ".." in skills_dir.parts or skills_dir == Path("."):
-            raise ValueError(f"{path}: {name}: skills_dir must stay inside config_dir")
-        env = entry.get("config_dir_env", "")
-        if not isinstance(env, str) or (env and not env.isidentifier()):
-            raise ValueError(f"{path}: {name}: invalid config_dir_env")
-        agents[name] = Agent(
-            executable=entry["executable"],
-            config_dir=entry["config_dir"],
-            memory_file=entry["memory_file"],
-            skills_dir=entry["skills_dir"],
-            skills=tuple(entry["skills"]),
-            args=tuple(entry["args"]),
-            config_dir_env=env,
-        )
-    return agents
-
-
-AGENTS = load_agents(Path(__file__).with_name("agents.json"))
-
-
-def executable(name: str) -> str:
-    """Resolve a roster ID to its binary; leave non-agent commands alone."""
-    agent = AGENTS.get(name)
-    return agent.executable if agent else name