aicp-cli 0.7.0__tar.gz → 0.9.0__tar.gz

{aicp_cli-0.7.0 → aicp_cli-0.9.0}/CHANGELOG.md

@@ -1,3 +1,27 @@
+## [0.9.0] - 2026-09-19
+
+### 🚀 Features
+
+- **notify:** Use direct Telegram delivery and row highlight
+
+### 🐛 Bug Fixes
+
+- Switch notifications to bot api
+
+### 🧪 Testing
+
+- Isolate Telegram credentials
+## [0.8.0] - 2026-09-18
+
+### 🐛 Bug Fixes
+
+- **agents:** Keep agent listing widths stable across toggles
+- **cli:** Parenthesize concatenated f-string for ruff ISC004
+
+### 📚 Documentation
+
+- **readme:** Document configurable agent chain and skills field
+- **changelog:** Release v0.8.0
 ## [0.7.0] - 2026-09-17
 
 ### 🚀 Features
@@ -7,6 +31,10 @@
 ### 🐛 Bug Fixes
 
 - **menu:** Size panels to their own content
+
+### 📚 Documentation
+
+- **changelog:** Release v0.7.0
 ## [0.6.0] - 2026-09-17
 
 ### 📚 Documentation

{aicp_cli-0.7.0 → aicp_cli-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: aicp-cli
-Version: 0.7.0
+Version: 0.9.0
 Summary: AI commit + push, with a git-verified result summary
 Project-URL: Repository, https://github.com/weskao/aicp
 Project-URL: Issues, https://github.com/weskao/aicp/issues
@@ -14,11 +14,19 @@ Description-Content-Type: text/markdown
 
 AI commit + push, with a git-verified result summary.
 
-`aicp` runs an AI coding CLI to write your commit message(s) and push, trying
-a fallback chain of six CLIs — `copilot` → `agy` → `codex` → `claude` →
-`vibe` → `grok` — until one exits 0; anything not installed is skipped. It
+`aicp` runs an AI coding CLI to write your commit message(s) and push, walking
+a fallback chain until one exits 0; anything not installed is skipped. It
 sends that CLI two literal prompts, `/commit` then `/safe-git-push`.
 
+**The chain is yours to arrange, and it isn't a fixed set.** The built-in
+registry ships six CLIs — `copilot`, `agy`, `codex`, `claude`, `vibe`,
+`grok` — but that's only the default *order*, not a hardcoded pipeline. Move
+any one of them to the front with `aicp --swap-ai`, set the whole order from
+`aicp --config` or `AICP_CLI_ORDER`, and add your own CLIs (or drop built-in
+ones) with `aicp --agents`. Every agent in the resolved registry is a
+first-class link in the chain — there is no privileged first CLI and no cap
+on how many you run with.
+
 The part that matters: **aicp never trusts the CLI's own account of what
 happened.** An AI CLI can print "pushed!" and exit 0 while `/safe-git-push`
 quietly aborted inside it. So every number in the result summary — new
@@ -28,17 +36,36 @@ failed `git fetch` is never read as "already in sync" either: a stale
 remote-tracking ref resolves just fine and would otherwise report a clean
 push that never reached the remote.
 
-[Install](#install) · [Set up skills](#set-up-skills) · [Run it](#run-it) ·
-[`--undo`](#--undo) · [Automation / CI](#automation--ci) ·
-[Configuration](#configuration) · [Custom agents](#custom-agents) · [Safety](#safety) ·
-[Platform support](#platform-support)
+## Contents
+
+**Getting started**
+
+- [Requirements](#requirements)
+- [Install](#install)
+- [Set up skills](#set-up-skills)
+- [Run it](#run-it)
+
+**Using it**
+
+- [Fallback order](#fallback-order) — reorder the chain, `--swap-ai`
+- [Fallback results and quota limits](#fallback-results-and-quota-limits)
+- [`--undo`](#--undo) — take back the last commit
+- [Automation / CI](#automation--ci) — the non-interactive flags
+
+**Reference**
+
+- [Configuration](#configuration) — every setting and env var
+- [Custom agents](#custom-agents) — add your own AI CLI
+- [Safety](#safety) — the pre-commit secret scan
+- [Platform support](#platform-support) — macOS, Linux, Windows
 
 ## Requirements
 
 - Python 3.10 or newer
 - [`uv`](https://docs.astral.sh/uv/) — the install path below
 - `git`
-- At least one of the six AI CLIs above on `PATH`
+- At least one AI CLI from the chain on `PATH` (a built-in one, or your own
+  via [Custom agents](#custom-agents))
 
 The Python package itself has no runtime dependencies.
 
@@ -79,44 +106,26 @@ Targets follow each CLI's own config directory, not its binary name — `agy`
 | CLI | Config dir | `/commit` installed? | `/safe-git-push` installed? |
 | --- | --- | --- | --- |
 | `claude` | `~/.claude` | No — keeps your existing `commands/commit.md` | Yes |
-| `codex` | `~/.codex` | No — keeps your existing `/commit` | Yes |
-| `copilot` | `~/.copilot` | No — keeps your existing `/commit` | Yes |
-| `agy` (Gemini CLI) | `~/.gemini` | No — keeps your existing `/commit` | Yes |
-| `vibe` | `~/.vibe` | No — keeps your existing `/commit` | Yes |
-| `grok` | `$GROK_HOME` when set, otherwise `~/.grok` | No — keeps your existing `/commit` | Yes |
-
-`/commit` is never installed: aicp keeps each CLI's existing command or skill
-definition. Claude resolves that definition from `commands/commit.md`; the
-other CLIs keep their existing `/commit` as well. Every configured CLI gets
-`/safe-git-push`.
+| `codex` | `~/.codex` | Yes | Yes |
+| `copilot` | `~/.copilot` | Yes | Yes |
+| `agy` (Gemini CLI) | `~/.gemini` | Yes | Yes |
+| `vibe` | `~/.vibe` | Yes | Yes |
+| `grok` | `$GROK_HOME` when set, otherwise `~/.grok` | Yes | Yes |
+
+Every configured CLI gets `/safe-git-push`. `/commit` is installed everywhere
+*except* `claude`, which already resolves `/commit` from
+`commands/commit.md` — a second definition under `skills/` would compete with
+it. Which skills an agent gets is data, not a branch: it's the `skills` field
+of that agent's registry entry, so a [custom agent](#custom-agents) declares
+its own list the same way.
+
+The vendored text is rewritten per CLI on install — the shipped copy talks
+about `.claude/` and `CLAUDE.md`, which mean nothing to `codex` or `agy`, so
+each install substitutes that agent's own `config_dir` name and `memory_file`.
 
 A CLI whose config directory doesn't exist at all is skipped, never created —
 aicp only ever installs into a CLI you've actually set up.
 
-### Fallback results and quota limits
-
-The opening run panel prints the resolved chain, and the commit panel and
-final RESULT table name the CLI that handled each step (`—` when skipped).
-When a CLI emits a supported, exact quota/rate-limit signal, aicp records the
-outcome as `quota`, notifies through the usual notification path, and excludes
-that CLI from the rest of that one commit/push flow. The exclusion also
-persists: the CLI stays skipped for `AICP_QUOTA_COOLDOWN` seconds (default one
-hour, state in `~/.aicp/quota.json`), because a token or rate-limit wall
-normally stands for hours and every run inside that window would otherwise burn
-a full budget per step on a CLI that cannot succeed. A skipped CLI prints how
-long is left; `AICP_QUOTA_COOLDOWN=0` switches the cooldown off entirely, and
-deleting the file clears it.
-
-Only the `quota` outcome starts a cooldown. A timeout does not — a CLI that
-hangs on its rate limit instead of exiting is indistinguishable from one merely
-running long, and sidelining it for an hour on that guess costs more than the
-retry does.
-
-Exact detection is intentionally narrow. It is supported for Codex, Claude,
-Vibe, and Grok only; Copilot and `agy` have no verified quota signature, so a
-nonzero exit from either remains an ordinary failure and is still eligible for
-the next step.
-
 ## Run it
 
 The whole command surface is two things to remember:
@@ -141,6 +150,52 @@ same as `aicp --config`.
 right now": which steps run, message language, fallback CLI order, the
 skills install/upgrade view, and a health check.
 
+### Fallback order
+
+The order is a saved preference, not a property of the tool. Three ways to
+set it, all writing the same `aicp_cli_order` key:
+
+```sh
+aicp --swap-ai   # pick a CLI, it trades places with whoever holds #1
+aicp --config    # the AI CLI order row, arrow keys
+```
+
+```sh
+# ~/.aicp/config.json — or AICP_CLI_ORDER="claude codex" aicp for one run
+{ "aicp_cli_order": "claude codex copilot agy vibe grok" }
+```
+
+`--swap-ai` is a rotation, not a destructive set: the CLI you pick moves to
+`#1` and the old `#1` takes its place, so nothing falls out of the chain. It
+lists every agent in the registry, including ones whose binary isn't on
+`PATH` — a missing binary must not hide a choice you're about to install.
+Naming only the first few is enough; everything you leave out is appended
+behind them in registry order.
+
+### Fallback results and quota limits
+
+The opening run panel prints the resolved chain, and the commit panel and
+final RESULT table name the CLI that handled each step (`—` when skipped).
+When a CLI emits a supported, exact quota/rate-limit signal, aicp records the
+outcome as `quota`, notifies through the usual notification path, and excludes
+that CLI from the rest of that one commit/push flow. The exclusion also
+persists: the CLI stays skipped for `AICP_QUOTA_COOLDOWN` seconds (default one
+hour, state in `~/.aicp/quota.json`), because a token or rate-limit wall
+normally stands for hours and every run inside that window would otherwise burn
+a full budget per step on a CLI that cannot succeed. A skipped CLI prints how
+long is left; `AICP_QUOTA_COOLDOWN=0` switches the cooldown off entirely, and
+deleting the file clears it.
+
+Only the `quota` outcome starts a cooldown. A timeout does not — a CLI that
+hangs on its rate limit instead of exiting is indistinguishable from one merely
+running long, and sidelining it for an hour on that guess costs more than the
+retry does.
+
+Exact detection is intentionally narrow. It is supported for Codex, Claude,
+Vibe, and Grok only; Copilot, `agy` and any agent you add yourself have no
+verified quota signature, so a nonzero exit from those remains an ordinary
+failure and is still eligible for the next step.
+
 ### `--undo`
 
 ```sh
@@ -223,7 +278,7 @@ integration tests and installed-wheel checks on all three operating systems.
 | `config_dir` | Absolute path or `~/`-relative directory; home is resolved when used. |
 | `config_dir_env` | Optional environment variable overriding that directory (currently `GROK_HOME`). |
 | `skills_dir` | Relative directory inside `config_dir` where skills are installed. |
-| `skills` | Vendored skills to install: `/safe-git-push`. Every CLI keeps its existing `/commit`. |
+| `skills` | Which vendored skills to install for this agent — any of `safe-git-push`, `commit`. Omitting `commit` is how `claude` keeps its own `commands/commit.md`. |
 | `memory_file` | Instruction filename used when adapting vendored skill text. Project directory references use the basename of `config_dir`. |
 | `args` | Argument array containing exactly one standalone `{prompt}`, replaced with the complete prompt as one argument. No shell evaluation. |
 
@@ -351,7 +406,7 @@ See [`config.example.json`](config.example.json) for a ready-to-copy template.
 | `AICP_DO_COMMIT` | `1` | Run the `/commit` step. `0` = only push what's already committed. |
 | `AICP_DO_PUSH` | `1` | Run the `/safe-git-push` step. `0` = commit and stop. |
 | `AICP_LANG` | `en` | Message language: `en` or `zh-TW`, everywhere including notifications. |
-| `AICP_CLI_ORDER` | `copilot agy codex claude vibe grok` | Fallback order. A prefix is enough — any roster name left out is appended after it, in roster order. An unknown or repeated name is refused outright and the default order is used. |
+| `AICP_CLI_ORDER` | registry order (`copilot agy codex claude vibe grok` out of the box) | Fallback order, space-separated. A prefix is enough — any agent left out is appended after it, in registry order, so adding an agent never invalidates an order you already saved. An unknown or repeated name is refused outright and the default order is used. |
 | `AICP_TZ` | `Asia/Taipei` | IANA zone name used to render commit timestamps. Anything else falls back to the default. |
 | `AICP_TZ_LABEL` | `UTC+8` | Cosmetic label shown beside those timestamps; not validated. |
 | `AICP_STEP_TIMEOUT` | *(unset)* | Pins every CLI's per-step budget in seconds, skipping the formula and history below entirely. |
@@ -364,16 +419,22 @@ See [`config.example.json`](config.example.json) for a ready-to-copy template.
 | `AICP_QUOTA_COOLDOWN` | `3600` | Seconds a CLI that reported a quota/rate-limit signal stays skipped, across runs (state in `~/.aicp/quota.json`). `0` switches the feature off; anything not a plain integer in 1..604800 falls back to the default. |
 | `AICP_SKIP_SECRET_SCAN` | *(unset)* | `1` bypasses the pre-commit secret scan for one run — the documented escape for a false positive. |
 | `AICP_CONFIG` | `~/.aicp/config.json` | Which file this loader reads. Environment-variable only — a file can't rename itself. |
-| `AICP_TG_SEND` | `~/.claude/scripts/tg-send.sh` | The Telegram send script run at the end of a notification. **Environment-variable only** — refused if set in `config.json`. |
 | `AICP_TIMING_LOG` | `~/.aicp/timing.log` | Where per-CLI timing rows are appended (rotated at 5 MB, 5 kept). **Environment-variable only** — refused if set in `config.json`. |
-
-`AICP_TG_SEND` and `AICP_TIMING_LOG` are refused from `config.json` on
-purpose: both name a path that then gets *executed* (`AICP_TG_SEND`, run as a
-script) or *written and rotated* (`AICP_TIMING_LOG`, `mkdir -p` / `>>` / a
-rename). A config file is exactly the kind of thing that can arrive synced
-from someone else's dotfiles repo, so anything that becomes a command or a
-filesystem sink stays a real-environment-only decision — set it in your
-shell, not the file.
+| `TG_BOT_TOKEN` | *(unset)* | Telegram bot token used to send the end-of-run notification — sent directly to the Bot API via stdlib HTTP (`aicp.telegram_notify`), no external script or project required. Same name `~/.claude/scripts/tg-send.sh` already uses, so an existing setup carries over. Not part of the `AICP_*` config system at all (see below), so it can only ever be a real environment variable. |
+| `TG_CHAT_ID` | *(unset)* | Telegram chat to notify. Same rules as `TG_BOT_TOKEN`. |
+
+Either `TG_BOT_TOKEN` or `TG_CHAT_ID` missing (or the request failing) just
+means the notification prints to the terminal instead — nothing about the
+commit/push run itself depends on it.
+
+`AICP_TIMING_LOG` is refused from `config.json` on purpose: it names a path
+that then gets *written and rotated* (`mkdir -p` / `>>` / a rename). A config
+file is exactly the kind of thing that can arrive synced from someone else's
+dotfiles repo, so anything that becomes a filesystem sink stays a
+real-environment-only decision — set it in your shell, not the file.
+(`TG_BOT_TOKEN`/`TG_CHAT_ID` don't need this treatment: they aren't
+`AICP_`-prefixed, so `config.json` was never able to supply them to begin
+with.)
 
 ## Safety
 

{aicp_cli-0.7.0 → aicp_cli-0.9.0}/README.md

@@ -2,11 +2,19 @@
 
 AI commit + push, with a git-verified result summary.
 
-`aicp` runs an AI coding CLI to write your commit message(s) and push, trying
-a fallback chain of six CLIs — `copilot` → `agy` → `codex` → `claude` →
-`vibe` → `grok` — until one exits 0; anything not installed is skipped. It
+`aicp` runs an AI coding CLI to write your commit message(s) and push, walking
+a fallback chain until one exits 0; anything not installed is skipped. It
 sends that CLI two literal prompts, `/commit` then `/safe-git-push`.
 
+**The chain is yours to arrange, and it isn't a fixed set.** The built-in
+registry ships six CLIs — `copilot`, `agy`, `codex`, `claude`, `vibe`,
+`grok` — but that's only the default *order*, not a hardcoded pipeline. Move
+any one of them to the front with `aicp --swap-ai`, set the whole order from
+`aicp --config` or `AICP_CLI_ORDER`, and add your own CLIs (or drop built-in
+ones) with `aicp --agents`. Every agent in the resolved registry is a
+first-class link in the chain — there is no privileged first CLI and no cap
+on how many you run with.
+
 The part that matters: **aicp never trusts the CLI's own account of what
 happened.** An AI CLI can print "pushed!" and exit 0 while `/safe-git-push`
 quietly aborted inside it. So every number in the result summary — new
@@ -16,17 +24,36 @@ failed `git fetch` is never read as "already in sync" either: a stale
 remote-tracking ref resolves just fine and would otherwise report a clean
 push that never reached the remote.
 
-[Install](#install) · [Set up skills](#set-up-skills) · [Run it](#run-it) ·
-[`--undo`](#--undo) · [Automation / CI](#automation--ci) ·
-[Configuration](#configuration) · [Custom agents](#custom-agents) · [Safety](#safety) ·
-[Platform support](#platform-support)
+## Contents
+
+**Getting started**
+
+- [Requirements](#requirements)
+- [Install](#install)
+- [Set up skills](#set-up-skills)
+- [Run it](#run-it)
+
+**Using it**
+
+- [Fallback order](#fallback-order) — reorder the chain, `--swap-ai`
+- [Fallback results and quota limits](#fallback-results-and-quota-limits)
+- [`--undo`](#--undo) — take back the last commit
+- [Automation / CI](#automation--ci) — the non-interactive flags
+
+**Reference**
+
+- [Configuration](#configuration) — every setting and env var
+- [Custom agents](#custom-agents) — add your own AI CLI
+- [Safety](#safety) — the pre-commit secret scan
+- [Platform support](#platform-support) — macOS, Linux, Windows
 
 ## Requirements
 
 - Python 3.10 or newer
 - [`uv`](https://docs.astral.sh/uv/) — the install path below
 - `git`
-- At least one of the six AI CLIs above on `PATH`
+- At least one AI CLI from the chain on `PATH` (a built-in one, or your own
+  via [Custom agents](#custom-agents))
 
 The Python package itself has no runtime dependencies.
 
@@ -67,44 +94,26 @@ Targets follow each CLI's own config directory, not its binary name — `agy`
 | CLI | Config dir | `/commit` installed? | `/safe-git-push` installed? |
 | --- | --- | --- | --- |
 | `claude` | `~/.claude` | No — keeps your existing `commands/commit.md` | Yes |
-| `codex` | `~/.codex` | No — keeps your existing `/commit` | Yes |
-| `copilot` | `~/.copilot` | No — keeps your existing `/commit` | Yes |
-| `agy` (Gemini CLI) | `~/.gemini` | No — keeps your existing `/commit` | Yes |
-| `vibe` | `~/.vibe` | No — keeps your existing `/commit` | Yes |
-| `grok` | `$GROK_HOME` when set, otherwise `~/.grok` | No — keeps your existing `/commit` | Yes |
-
-`/commit` is never installed: aicp keeps each CLI's existing command or skill
-definition. Claude resolves that definition from `commands/commit.md`; the
-other CLIs keep their existing `/commit` as well. Every configured CLI gets
-`/safe-git-push`.
+| `codex` | `~/.codex` | Yes | Yes |
+| `copilot` | `~/.copilot` | Yes | Yes |
+| `agy` (Gemini CLI) | `~/.gemini` | Yes | Yes |
+| `vibe` | `~/.vibe` | Yes | Yes |
+| `grok` | `$GROK_HOME` when set, otherwise `~/.grok` | Yes | Yes |
+
+Every configured CLI gets `/safe-git-push`. `/commit` is installed everywhere
+*except* `claude`, which already resolves `/commit` from
+`commands/commit.md` — a second definition under `skills/` would compete with
+it. Which skills an agent gets is data, not a branch: it's the `skills` field
+of that agent's registry entry, so a [custom agent](#custom-agents) declares
+its own list the same way.
+
+The vendored text is rewritten per CLI on install — the shipped copy talks
+about `.claude/` and `CLAUDE.md`, which mean nothing to `codex` or `agy`, so
+each install substitutes that agent's own `config_dir` name and `memory_file`.
 
 A CLI whose config directory doesn't exist at all is skipped, never created —
 aicp only ever installs into a CLI you've actually set up.
 
-### Fallback results and quota limits
-
-The opening run panel prints the resolved chain, and the commit panel and
-final RESULT table name the CLI that handled each step (`—` when skipped).
-When a CLI emits a supported, exact quota/rate-limit signal, aicp records the
-outcome as `quota`, notifies through the usual notification path, and excludes
-that CLI from the rest of that one commit/push flow. The exclusion also
-persists: the CLI stays skipped for `AICP_QUOTA_COOLDOWN` seconds (default one
-hour, state in `~/.aicp/quota.json`), because a token or rate-limit wall
-normally stands for hours and every run inside that window would otherwise burn
-a full budget per step on a CLI that cannot succeed. A skipped CLI prints how
-long is left; `AICP_QUOTA_COOLDOWN=0` switches the cooldown off entirely, and
-deleting the file clears it.
-
-Only the `quota` outcome starts a cooldown. A timeout does not — a CLI that
-hangs on its rate limit instead of exiting is indistinguishable from one merely
-running long, and sidelining it for an hour on that guess costs more than the
-retry does.
-
-Exact detection is intentionally narrow. It is supported for Codex, Claude,
-Vibe, and Grok only; Copilot and `agy` have no verified quota signature, so a
-nonzero exit from either remains an ordinary failure and is still eligible for
-the next step.
-
 ## Run it
 
 The whole command surface is two things to remember:
@@ -129,6 +138,52 @@ same as `aicp --config`.
 right now": which steps run, message language, fallback CLI order, the
 skills install/upgrade view, and a health check.
 
+### Fallback order
+
+The order is a saved preference, not a property of the tool. Three ways to
+set it, all writing the same `aicp_cli_order` key:
+
+```sh
+aicp --swap-ai   # pick a CLI, it trades places with whoever holds #1
+aicp --config    # the AI CLI order row, arrow keys
+```
+
+```sh
+# ~/.aicp/config.json — or AICP_CLI_ORDER="claude codex" aicp for one run
+{ "aicp_cli_order": "claude codex copilot agy vibe grok" }
+```
+
+`--swap-ai` is a rotation, not a destructive set: the CLI you pick moves to
+`#1` and the old `#1` takes its place, so nothing falls out of the chain. It
+lists every agent in the registry, including ones whose binary isn't on
+`PATH` — a missing binary must not hide a choice you're about to install.
+Naming only the first few is enough; everything you leave out is appended
+behind them in registry order.
+
+### Fallback results and quota limits
+
+The opening run panel prints the resolved chain, and the commit panel and
+final RESULT table name the CLI that handled each step (`—` when skipped).
+When a CLI emits a supported, exact quota/rate-limit signal, aicp records the
+outcome as `quota`, notifies through the usual notification path, and excludes
+that CLI from the rest of that one commit/push flow. The exclusion also
+persists: the CLI stays skipped for `AICP_QUOTA_COOLDOWN` seconds (default one
+hour, state in `~/.aicp/quota.json`), because a token or rate-limit wall
+normally stands for hours and every run inside that window would otherwise burn
+a full budget per step on a CLI that cannot succeed. A skipped CLI prints how
+long is left; `AICP_QUOTA_COOLDOWN=0` switches the cooldown off entirely, and
+deleting the file clears it.
+
+Only the `quota` outcome starts a cooldown. A timeout does not — a CLI that
+hangs on its rate limit instead of exiting is indistinguishable from one merely
+running long, and sidelining it for an hour on that guess costs more than the
+retry does.
+
+Exact detection is intentionally narrow. It is supported for Codex, Claude,
+Vibe, and Grok only; Copilot, `agy` and any agent you add yourself have no
+verified quota signature, so a nonzero exit from those remains an ordinary
+failure and is still eligible for the next step.
+
 ### `--undo`
 
 ```sh
@@ -211,7 +266,7 @@ integration tests and installed-wheel checks on all three operating systems.
 | `config_dir` | Absolute path or `~/`-relative directory; home is resolved when used. |
 | `config_dir_env` | Optional environment variable overriding that directory (currently `GROK_HOME`). |
 | `skills_dir` | Relative directory inside `config_dir` where skills are installed. |
-| `skills` | Vendored skills to install: `/safe-git-push`. Every CLI keeps its existing `/commit`. |
+| `skills` | Which vendored skills to install for this agent — any of `safe-git-push`, `commit`. Omitting `commit` is how `claude` keeps its own `commands/commit.md`. |
 | `memory_file` | Instruction filename used when adapting vendored skill text. Project directory references use the basename of `config_dir`. |
 | `args` | Argument array containing exactly one standalone `{prompt}`, replaced with the complete prompt as one argument. No shell evaluation. |
 
@@ -339,7 +394,7 @@ See [`config.example.json`](config.example.json) for a ready-to-copy template.
 | `AICP_DO_COMMIT` | `1` | Run the `/commit` step. `0` = only push what's already committed. |
 | `AICP_DO_PUSH` | `1` | Run the `/safe-git-push` step. `0` = commit and stop. |
 | `AICP_LANG` | `en` | Message language: `en` or `zh-TW`, everywhere including notifications. |
-| `AICP_CLI_ORDER` | `copilot agy codex claude vibe grok` | Fallback order. A prefix is enough — any roster name left out is appended after it, in roster order. An unknown or repeated name is refused outright and the default order is used. |
+| `AICP_CLI_ORDER` | registry order (`copilot agy codex claude vibe grok` out of the box) | Fallback order, space-separated. A prefix is enough — any agent left out is appended after it, in registry order, so adding an agent never invalidates an order you already saved. An unknown or repeated name is refused outright and the default order is used. |
 | `AICP_TZ` | `Asia/Taipei` | IANA zone name used to render commit timestamps. Anything else falls back to the default. |
 | `AICP_TZ_LABEL` | `UTC+8` | Cosmetic label shown beside those timestamps; not validated. |
 | `AICP_STEP_TIMEOUT` | *(unset)* | Pins every CLI's per-step budget in seconds, skipping the formula and history below entirely. |
@@ -352,16 +407,22 @@ See [`config.example.json`](config.example.json) for a ready-to-copy template.
 | `AICP_QUOTA_COOLDOWN` | `3600` | Seconds a CLI that reported a quota/rate-limit signal stays skipped, across runs (state in `~/.aicp/quota.json`). `0` switches the feature off; anything not a plain integer in 1..604800 falls back to the default. |
 | `AICP_SKIP_SECRET_SCAN` | *(unset)* | `1` bypasses the pre-commit secret scan for one run — the documented escape for a false positive. |
 | `AICP_CONFIG` | `~/.aicp/config.json` | Which file this loader reads. Environment-variable only — a file can't rename itself. |
-| `AICP_TG_SEND` | `~/.claude/scripts/tg-send.sh` | The Telegram send script run at the end of a notification. **Environment-variable only** — refused if set in `config.json`. |
 | `AICP_TIMING_LOG` | `~/.aicp/timing.log` | Where per-CLI timing rows are appended (rotated at 5 MB, 5 kept). **Environment-variable only** — refused if set in `config.json`. |
-
-`AICP_TG_SEND` and `AICP_TIMING_LOG` are refused from `config.json` on
-purpose: both name a path that then gets *executed* (`AICP_TG_SEND`, run as a
-script) or *written and rotated* (`AICP_TIMING_LOG`, `mkdir -p` / `>>` / a
-rename). A config file is exactly the kind of thing that can arrive synced
-from someone else's dotfiles repo, so anything that becomes a command or a
-filesystem sink stays a real-environment-only decision — set it in your
-shell, not the file.
+| `TG_BOT_TOKEN` | *(unset)* | Telegram bot token used to send the end-of-run notification — sent directly to the Bot API via stdlib HTTP (`aicp.telegram_notify`), no external script or project required. Same name `~/.claude/scripts/tg-send.sh` already uses, so an existing setup carries over. Not part of the `AICP_*` config system at all (see below), so it can only ever be a real environment variable. |
+| `TG_CHAT_ID` | *(unset)* | Telegram chat to notify. Same rules as `TG_BOT_TOKEN`. |
+
+Either `TG_BOT_TOKEN` or `TG_CHAT_ID` missing (or the request failing) just
+means the notification prints to the terminal instead — nothing about the
+commit/push run itself depends on it.
+
+`AICP_TIMING_LOG` is refused from `config.json` on purpose: it names a path
+that then gets *written and rotated* (`mkdir -p` / `>>` / a rename). A config
+file is exactly the kind of thing that can arrive synced from someone else's
+dotfiles repo, so anything that becomes a filesystem sink stays a
+real-environment-only decision — set it in your shell, not the file.
+(`TG_BOT_TOKEN`/`TG_CHAT_ID` don't need this treatment: they aren't
+`AICP_`-prefixed, so `config.json` was never able to supply them to begin
+with.)
 
 ## Safety
 

{aicp_cli-0.7.0 → aicp_cli-0.9.0}/pyproject.toml

@@ -2,7 +2,7 @@
 # PyPI distribution name only — the `aicp` name was taken in 2021 by an
 # unrelated project. The command, import path and repo stay `aicp`.
 name = "aicp-cli"
-version = "0.7.0"
+version = "0.9.0"
 description = "AI commit + push, with a git-verified result summary"
 readme = "README.md"
 requires-python = ">=3.10"

{aicp_cli-0.7.0 → aicp_cli-0.9.0}/src/aicp/cli.py

@@ -91,12 +91,11 @@ def export_settings(settings: config.Settings) -> None:
 
     Safe by construction with respect to :data:`aicp.config.DENYLIST`:
     ``settings.values`` is what :func:`aicp.config.load_config` accepted, and
-    that loader drops every denied key — ``AICP_TG_SEND`` (reaches ``bash
-    "$value"``), ``AICP_TIMING_LOG`` (path-mutating sinks) and ``AICP_CONFIG``
-    (would re-point the next ``persist_key`` write) — before they ever reach
-    here. So a file can never smuggle an exec-path or path-mutation knob into
-    the environment through this door. Whoever adds the next such knob adds it
-    to ``DENYLIST``, not to a filter here.
+    that loader drops every denied key — ``AICP_TIMING_LOG`` (path-mutating
+    sinks) and ``AICP_CONFIG`` (would re-point the next ``persist_key``
+    write) — before they ever reach here. So a file can never smuggle a
+    path-mutation knob into the environment through this door. Whoever adds
+    the next such knob adds it to ``DENYLIST``, not to a filter here.
 
     Two things this deliberately does NOT close, both stated rather than left
     to be discovered:
@@ -305,9 +304,17 @@ def _doctor(*, as_json: bool) -> int:
 
 
 def _agents_list() -> int:
+    inventory = agents.inventory()
+    exec_w = max((present.width(row.executable) for row in inventory), default=0)
     rows = [
-        (row.name, f"{row.executable}  {DIM}·  {t(*agentcfg.STATE_LABELS[row.state])}{RESET}")
-        for row in agents.inventory()
+        (
+            row.name,
+            (
+                f"{row.executable}{' ' * (exec_w - present.width(row.executable))}"
+                f"  {DIM}·  {t(*agentcfg.STATE_LABELS[row.state])}{RESET}"
+            ),
+        )
+        for row in inventory
     ]
     _echo(present.render(rows, t("agents_title", "AGENTS")))
     _dim(t("agents_hint", "  aicp --agents set <name> executable=… · disable <name> · reset <name>"))

{aicp_cli-0.7.0 → aicp_cli-0.9.0}/src/aicp/config.py

@@ -29,22 +29,23 @@ later used AS a command or a path. Hence three more layers:
    a key is written ``aicp_do_commit``, matching the environment's
    ``AICP_DO_COMMIT`` only once case-folded on read — see
    :func:`_read_json_object`). A line naming ``PATH`` is inert text to this
-   loader, not an assignment.
+   loader, not an assignment. (Telegram credentials, ``TG_BOT_TOKEN`` and
+   ``TG_CHAT_ID``, aren't ``AICP_``-prefixed at all, so they never reach this
+   loader in the first place — see :mod:`aicp.notify`.)
 2. **Value charset allowlist** — letters, digits and
    ``/ . _ : @ + -`` plus whitespace. ``=`` and ``,`` are excluded because in
    the zsh original a value like ``PATH=0`` reaching an arithmetic context
    would assign into the real ``$PATH``; ``$``/backtick/``;``/``|``/parens
    are excluded as defence in depth for whatever the next consumer of these
    values does with them.
-3. **Denylist** (:data:`DENYLIST`) — ``AICP_TG_SEND`` (reaches
-   ``bash "$value"``), ``AICP_TIMING_LOG`` (reaches ``mkdir -p``, ``>>``,
-   ``mv -f``, ``rm -f``) and ``AICP_CONFIG`` (names the file this loader
-   reads, and the file :func:`persist_key` then ``mkdir -p``s and atomically
-   replaces) are ENVIRONMENT-VARIABLE ONLY. All three are plain literal paths
-   that sail through the charset allowlist, and all three were real holes.
-   Whoever adds the next knob that flows into an exec path or a path-mutating
-   sink adds its name here — the charset allowlist does not protect against
-   this class at all.
+3. **Denylist** (:data:`DENYLIST`) — ``AICP_TIMING_LOG`` (reaches
+   ``mkdir -p``, ``>>``, ``mv -f``, ``rm -f``) and ``AICP_CONFIG`` (names the
+   file this loader reads, and the file :func:`persist_key` then
+   ``mkdir -p``s and atomically replaces) are ENVIRONMENT-VARIABLE ONLY. Both
+   are plain literal paths that sail through the charset allowlist, and both
+   were real holes. Whoever adds the next knob that flows into an exec path
+   or a path-mutating sink adds its name here — the charset allowlist does
+   not protect against this class at all.
 
    ``AICP_CONFIG`` is the subtlest of the three, because a file naming
    *itself* looks inert: nothing in this module acts on the value. The zsh
@@ -107,7 +108,7 @@ __all__ = [
 #: synced from someone else's dotfiles repo. ``AICP_CONFIG`` belongs here for
 #: the reason spelled out in this module's docstring — a file must not be able
 #: to rename the file the next write lands on.
-DENYLIST = frozenset({"AICP_TG_SEND", "AICP_TIMING_LOG", "AICP_CONFIG"})
+DENYLIST = frozenset({"AICP_TIMING_LOG", "AICP_CONFIG"})
 
 #: Knobs resolved from the system, never from configuration — see
 #: :func:`timeout_bin`. Kept as a set so the reason is greppable from both