feat(auto): sticky execution mode, loose @rocky match, ExecutionModeV1 inject

Keep executionMode=auto across the same session after @rocky/@devcodex-auto
or natural-language auto authorization, instead of resetting every prompt.
Loosen alias token boundaries for CJK/punctuation adjacency, inject
ExecutionModeV1 on UserPromptSubmit, and clear sticky only on explicit exit
or session mismatch. Auto whitelist boundary is unchanged.

Author: rockyshi1993

agents/devcodex-auto.agent.md

@@ -1,6 +1,6 @@
 ---
 name: DevCodex Auto
-description: AI 开发规范助手（全自动模式 v1.1）— 显式 @devcodex-auto、全局默认 @rocky、Profile autoAliases 替换别名或明确自然语言 auto 授权 + 白名单路径下自动推进，安全底线仍强制执行。所有规则由 instructions/ 自动注入。
+description: AI 开发规范助手（全自动模式 v1.2 sticky）— 显式 @devcodex-auto、全局默认 @rocky、Profile autoAliases 替换别名或明确自然语言 auto 授权；会话 sticky 保持 auto；白名单路径下自动推进，安全底线仍强制执行。
 tools:
   - edit
   - execute
@@ -12,10 +12,12 @@ disable-model-invocation: true
 
 ## 全自动模式
 
-`DevCodex Auto` 不是“所有任务都自动推进”，而是 **Auto v1.1 最小闭环**：
+`DevCodex Auto` 不是“所有任务都自动推进”，而是 **Auto v1.2 最小闭环（含 Sticky Auto）**：
 
 - **正式入口**：显式 `@devcodex-auto`、全局默认 `@rocky`、项目 Profile `config.json` 的 `extensions.devcodex.autoAliases` 替换别名，或明确自然语言 auto 授权；配置了 `autoAliases` 时该列表替换全局默认别名，空数组表示关闭默认别名；模糊提及、询问 auto 规则、未生效昵称或普通“继续”不算授权
-- **hook-enforced 宿主**：仅对白名单路径自动推进；非白名单路径默认回确认模式
+- **Sticky Auto**：入口命中后同 session 保持 `executionMode=auto`，后续无别名确认/继续不掉回 confirm；退出词：`退出 auto` / `关闭自动模式` / `exit auto mode` / `切回确认模式`
+- **别名匹配**：允许中文/标点贴靠（`请@rocky执行`）；`UserPromptSubmit` 注入 `ExecutionModeV1`
+- **hook-enforced 宿主**：仅对白名单路径自动推进；非白名单路径默认回确认模式（白名单不因 sticky 扩大）
 - **instruction-fallback 宿主**：如 JetBrains / Cursor，只同步规则语义，不承诺 runtime 级硬放行；支持 Hook 的宿主按白名单执行 runtime 放行
 - **白名单范围**：DevCodex 治理文件、`.devcodex/` 产物、README 与 auto 专属回归脚本
 - **执行契约**：控制面、多批次、预计修改 ≥10 文件或发布前置任务必须先形成 ExecutionContract，并按 `allowedPaths`、`requiredArtifacts`、`validationRoute` 推进

hooks/_runtime/lifecycle-bootstrap-state.cjs

@@ -442,6 +442,16 @@ function buildLifecycleBootstrapStateUtils(ctx) {
         updatedAt: '',
         updatedAtMs: 0
       },
+      stickyAuto: {
+        active: false,
+        source: '',
+        kind: '',
+        sessionKey: '',
+        updatedAt: '',
+        updatedAtMs: 0,
+        authorityRef: '',
+        reason: ''
+      },
       cp3Runtime: {},
       governanceIntake: emptyGovernanceIntakeState(),
       turnLiveness: createTurnLivenessState(),
@@ -504,6 +514,7 @@ function buildLifecycleBootstrapStateUtils(ctx) {
       bootstrap: { ...current.bootstrap, ...(saved.bootstrap || {}) },
       visible: { ...current.visible, ...(saved.visible || {}) },
       stickyProject: { ...current.stickyProject, ...(saved.stickyProject || {}), ...(metaState?.stickyProject || {}) },
+      stickyAuto: { ...current.stickyAuto, ...(saved.stickyAuto || {}), ...(metaState?.stickyAuto || {}) },
       cp3Runtime: { ...current.cp3Runtime, ...(saved.cp3Runtime || {}) },
       governanceIntake: normalizeGovernanceIntakeState(saved.governanceIntake),
       turnLiveness: normalizeTurnLivenessState(saved.turnLiveness),
@@ -525,6 +536,7 @@ function buildLifecycleBootstrapStateUtils(ctx) {
         bootstrap: { ...(state.bootstrap || {}) },
         visible: { ...(state.visible || {}) },
         stickyProject: { ...(state.stickyProject || {}) },
+        stickyAuto: { ...(state.stickyAuto || {}) },
         dangerousApprovals: { ...(state.dangerousApprovals || {}) }
       }
       fs.mkdirSync(META_STATE_PATHS.dir, { recursive: true })
@@ -540,6 +552,7 @@ function buildLifecycleBootstrapStateUtils(ctx) {
     state.activeProjectSource = previousState?.activeProjectSource || (CONTEXT_PROJECT ? 'context' : '')
     state.lastMultiProjectWarningKey = previousState?.lastMultiProjectWarningKey || ''
     state.stickyProject = { ...state.stickyProject, ...(previousState?.stickyProject || {}) }
+    state.stickyAuto = { ...state.stickyAuto, ...(previousState?.stickyAuto || {}) }
     state.cp3Runtime = { ...(previousState?.cp3Runtime || {}) }
     state.governanceIntake = normalizeGovernanceIntakeState(previousState?.governanceIntake)
     state.turnLiveness = normalizeTurnLivenessState(previousState?.turnLiveness)

hooks/_runtime/lifecycle-project-target.cjs

@@ -235,11 +235,26 @@ function buildLifecycleProjectTargetUtils({
 
   function hasMentionToken(prompt, alias) {
     const escaped = escapeRegExp(alias)
-    return new RegExp(`(^|\\s)${escaped}(?=$|[\\s,.;:!?，。；：！？])`, 'i').test(prompt)
+    // Loose token boundary: allow CJK/punctuation adjacency (请@rocky执行 / （@rocky）),
+    // but reject alias glued to other identifier chars (ok@rocky / @rockyish).
+    return new RegExp(`(?:^|[^A-Za-z0-9_@])${escaped}(?=$|[^A-Za-z0-9_-])`, 'i').test(String(prompt || ''))
   }
 
   const DEFAULT_AUTO_ALIASES = ['@rocky']
 
+  function emptyStickyAuto(reason) {
+    return {
+      active: false,
+      source: '',
+      kind: '',
+      sessionKey: '',
+      updatedAt: '',
+      updatedAtMs: 0,
+      authorityRef: '',
+      reason: reason || ''
+    }
+  }
+
   function getConfiguredAutoAliases(state, target) {
     if (typeof readProjectProfileConfig !== 'function') return DEFAULT_AUTO_ALIASES.slice()
     const activeProject = target?.activeProject || state?.activeProject || ''
@@ -260,23 +275,128 @@ function buildLifecycleProjectTargetUtils({
     return validAliases
   }
 
-  function hasAutoAuthorizationPrompt(prompt, state, target) {
-    if (hasMentionToken(String(prompt || ''), '@devcodex-auto')) return true
+  function resolveAutoAuthorization(prompt, state, target) {
+    const text = String(prompt || '')
+    if (hasMentionToken(text, '@devcodex-auto')) {
+      return { authorized: true, source: '@devcodex-auto', kind: 'explicit' }
+    }
     for (const alias of getConfiguredAutoAliases(state, target)) {
-      if (hasMentionToken(String(prompt || ''), alias)) return true
+      if (hasMentionToken(text, alias)) {
+        return { authorized: true, source: alias, kind: 'alias' }
+      }
     }
-    const normalized = String(prompt || '').replace(/\s+/g, ' ').trim()
+    const normalized = text.replace(/\s+/g, ' ').trim()
     const naturalLanguageAutoPatterns = [
       /(?:进入|启用|开启|使用|切换到)\s*(?:auto|自动|全自动)\s*(?:模式|执行|推进|处理)?/i,
       /(?:auto|自动|全自动)\s*(?:模式)?\s*(?:开始|继续|执行|推进|处理|修复|实施)/i,
       /(?:run|continue|proceed)\s+(?:in\s+)?auto\s+mode/i
     ]
-    return naturalLanguageAutoPatterns.some(pattern => pattern.test(normalized))
+    if (naturalLanguageAutoPatterns.some(pattern => pattern.test(normalized))) {
+      return { authorized: true, source: 'natural-language', kind: 'nl' }
+    }
+    return { authorized: false, source: '', kind: '' }
+  }
+
+  function hasAutoAuthorizationPrompt(prompt, state, target) {
+    return resolveAutoAuthorization(prompt, state, target).authorized === true
+  }
+
+  function hasAutoExitPrompt(prompt) {
+    const normalized = String(prompt || '').replace(/\s+/g, ' ').trim()
+    if (!normalized) return false
+    const exitPatterns = [
+      /(?:退出|关闭|停用|结束)\s*(?:auto|自动|全自动)\s*(?:模式)?/i,
+      /(?:exit|leave|disable|turn\s+off)\s+(?:auto\s+mode|auto)\b/i,
+      /(?:切回|切换到)\s*确认模式/i
+    ]
+    return exitPatterns.some(pattern => pattern.test(normalized))
+  }
+
+  function getValidStickyAuto(state, payload) {
+    const sticky = state?.stickyAuto || {}
+    if (!sticky.active) return null
+    const updatedAtMs = Number(sticky.updatedAtMs || 0)
+    if (!updatedAtMs || Date.now() - updatedAtMs > STICKY_PROJECT_TTL_MS) return null
+    const currentSessionKey = getPayloadSessionKey(payload)
+    const stickySessionKey = String(sticky.sessionKey || '').trim()
+    // Fail only on explicit session mismatch. Allow:
+    // - both empty (file-scoped sticky for hosts without session ids)
+    // - sticky has session but current prompt omits it (common host payload gaps)
+    // Reject when both present and differ.
+    if (currentSessionKey && stickySessionKey && currentSessionKey !== stickySessionKey) {
+      return null
+    }
+    return sticky
+  }
+
+  function setStickyAuto(state, source, kind, payload) {
+    if (!state || typeof state !== 'object') return
+    const sessionKey = getPayloadSessionKey(payload)
+    const now = Date.now()
+    const authorityRef = `auto:${source || 'unknown'}:${sessionKey || 'no-session'}:${now}`
+    state.stickyAuto = {
+      active: true,
+      source: source || 'unknown',
+      kind: kind || 'unknown',
+      sessionKey,
+      updatedAt: new Date().toISOString(),
+      updatedAtMs: now,
+      authorityRef,
+      reason: ''
+    }
+  }
+
+  function clearStickyAuto(state, reason) {
+    if (!state || typeof state !== 'object') return
+    state.stickyAuto = emptyStickyAuto(reason || '')
   }
 
   function detectExecutionMode(payload, state, target) {
     const prompt = extractUserPrompt(payload)
-    return hasAutoAuthorizationPrompt(prompt, state, target) ? EXECUTION_MODE.AUTO : EXECUTION_MODE.CONFIRM
+    if (hasAutoExitPrompt(prompt)) {
+      clearStickyAuto(state, 'user-exit')
+      return EXECUTION_MODE.CONFIRM
+    }
+    const auth = resolveAutoAuthorization(prompt, state, target)
+    if (auth.authorized) {
+      setStickyAuto(state, auth.source, auth.kind, payload)
+      return EXECUTION_MODE.AUTO
+    }
+    const sticky = getValidStickyAuto(state, payload)
+    if (sticky) {
+      // Refresh TTL while the same session keeps working under auto.
+      state.stickyAuto = {
+        ...sticky,
+        updatedAt: new Date().toISOString(),
+        updatedAtMs: Date.now(),
+        reason: ''
+      }
+      return EXECUTION_MODE.AUTO
+    }
+    if (state?.stickyAuto?.active) clearStickyAuto(state, 'sticky-expired')
+    return EXECUTION_MODE.CONFIRM
+  }
+
+  function buildExecutionModeContextMessage(state) {
+    const mode = state?.executionMode === EXECUTION_MODE.AUTO ? EXECUTION_MODE.AUTO : EXECUTION_MODE.CONFIRM
+    const sticky = state?.stickyAuto || {}
+    const stickyActive = mode === EXECUTION_MODE.AUTO && sticky.active === true
+    const source = sticky.source || (mode === EXECUTION_MODE.AUTO ? 'prompt' : 'none')
+    const authority = sticky.authorityRef ? ` authorityRef=${sticky.authorityRef}` : ''
+    if (mode === EXECUTION_MODE.AUTO) {
+      return [
+        `ExecutionModeV1: auto`,
+        `sticky=${stickyActive ? 'true' : 'false'}`,
+        `source=${source}${authority}`,
+        'CP1/CP2/CP3 auto-pass; do not wait for per-gate user confirmation; S01/S03-S07/C01/C10/C18 not waived; auto whitelist boundary unchanged; exit with 退出auto / exit auto mode'
+      ].join(' | ')
+    }
+    return [
+      'ExecutionModeV1: confirm',
+      'sticky=false',
+      'source=none',
+      'confirm mode: wait for explicit CP confirmation'
+    ].join(' | ')
   }
 
   function buildMultiProjectBlockMessage() {
@@ -314,7 +434,13 @@ function buildLifecycleProjectTargetUtils({
     buildMultiProjectWarningKey,
     shouldSuppressMultiProjectWarning,
     hasAutoAuthorizationPrompt,
+    hasAutoExitPrompt,
+    resolveAutoAuthorization,
+    getValidStickyAuto,
+    setStickyAuto,
+    clearStickyAuto,
     detectExecutionMode,
+    buildExecutionModeContextMessage,
     buildMultiProjectBlockMessage
   }
 }

hooks/_runtime/lifecycle.cjs

@@ -350,6 +350,7 @@ const {
   setStickyProject,
   shouldSuppressMultiProjectWarning,
   detectExecutionMode,
+  buildExecutionModeContextMessage,
   buildMultiProjectBlockMessage
 } = buildLifecycleProjectTargetUtils({
   fs,
@@ -1322,6 +1323,7 @@ async function main() {
       'UserPromptSubmit',
       [
         buildBootstrapMessage(state),
+        buildExecutionModeContextMessage(state),
         continuationResolution
           ? `TaskResolutionV1 resolved-active: ${continuationResolution.candidate.project}/${continuationResolution.candidate.kind}/${continuationResolution.candidate.displayName}. The name only locates the task; rehydrate identity, sessions, and current bound artifacts before continuing.`
           : '',

instructions/01-common.instructions.md

@@ -135,6 +135,8 @@ version: 1.15.3
 当用户选择 `@devcodex-auto`、全局默认 `@rocky`、Profile `config.json` 的 `extensions.devcodex.autoAliases` 替换别名，或在文本宿主中明确自然语言授权 auto（如“进入 auto 模式执行”“全自动继续”“run in auto mode”）时：
 
 - Auto v1.1 正式入口包括显式 `@devcodex-auto`、全局默认 `@rocky`、项目 Profile 配置的 `extensions.devcodex.autoAliases` 替换别名与明确自然语言 auto 授权；配置了 `autoAliases` 时该列表替换全局默认别名，空数组表示关闭默认别名；模糊提及、追问 auto 规则、普通“继续”或未生效昵称不等价于 auto 授权
+- **Sticky Auto**：有效入口命中后会话级保持 `executionMode=auto`（与 sticky 项目同量级 TTL）；后续无别名的确认/继续/补充不掉回 confirm；显式 `退出 auto` / `关闭自动模式` / `exit auto mode` / `切回确认模式` 或 sticky 过期/换会话后回到 confirm
+- **别名匹配**：允许中文/标点贴靠（`请@rocky执行`）；`UserPromptSubmit` 注入 `ExecutionModeV1` 供模型消费；**白名单不因 sticky 扩大**
 - 仅在 `hook-enforced` 宿主中，对治理文件 / `.devcodex/` 产物 / README / auto 专属回归脚本等**白名单路径**启用自动推进
 - 非白名单路径默认切回确认模式，不承诺“所有源码任务自动执行”
 - `instruction-fallback` 宿主（如 JetBrains / Cursor）只保留 auto 规则语义，不承诺 runtime 级行为；支持 Hook 的宿主默认采用 `safety-only`：白名单边界输出提醒，`strict` 模式下才形成 runtime 硬拦截
@@ -232,7 +234,7 @@ version: 1.15.3
 | 安全底线 S01~S06 | 🔴 强制（不受 ENV_MODE 影响）| 🔴 强制（不受 ENV_MODE 影响）|
 | S07（入口检查强制）| 🔴 致命自修正（`instruction-fallback` 模式自检触发，自动补输出 PC0~PC7 基础状态）| 🔴 致命自修正（`instruction-fallback` 模式自检触发，自动补输出 PC0~PC7 + dev 扩展诊断）|
 
-> **CP 跳过路径**：显式 `@devcodex-auto`、全局默认 `@rocky`、Profile `extensions.devcodex.autoAliases` 替换别名或明确自然语言 auto 授权（如“进入 auto 模式执行”）；这是 Agent 级行为，与 ENV_MODE 无关。
+> **CP 跳过路径**：显式 `@devcodex-auto`、全局默认 `@rocky`、Profile `extensions.devcodex.autoAliases` 替换别名、明确自然语言 auto 授权，或会话 **Sticky Auto** 仍有效；这是 Agent 级行为，与 ENV_MODE 无关。
 
 ## NODE_META 读取规则
 

scripts/test-hooks-runtime.js

@@ -242,6 +242,85 @@ function main() {
   runBootstrapReads()
   const defaultAliasState = JSON.parse(fs.readFileSync(STATE_FILE, 'utf8'))
   assert.strictEqual(defaultAliasState.executionMode, 'auto')
+  assert.strictEqual(defaultAliasState.stickyAuto?.active, true)
+  assert.strictEqual(defaultAliasState.stickyAuto?.source, '@rocky')
+
+  // Sticky Auto: next turn without @rocky stays auto (same session)
+  cleanState({ mode: 'dev', agent: TEST_AGENT })
+  const stickyAutoOut1 = run({
+    hookEventName: 'UserPromptSubmit',
+    session_id: 'sticky-auto-session',
+    prompt: '@rocky 开始需求'
+  })
+  assert.ok(
+    /ExecutionModeV1:\s*auto/i.test(String(stickyAutoOut1.systemMessage || '')),
+    'UserPromptSubmit should inject ExecutionModeV1: auto'
+  )
+  let stickyAutoState = JSON.parse(fs.readFileSync(STATE_FILE, 'utf8'))
+  assert.strictEqual(stickyAutoState.executionMode, 'auto')
+  run({
+    hookEventName: 'UserPromptSubmit',
+    session_id: 'sticky-auto-session',
+    prompt: '确认'
+  })
+  stickyAutoState = JSON.parse(fs.readFileSync(STATE_FILE, 'utf8'))
+  assert.strictEqual(stickyAutoState.executionMode, 'auto', 'sticky auto must survive follow-up without @rocky')
+  assert.strictEqual(stickyAutoState.stickyAuto?.active, true)
+
+  // Loose CJK adjacency: 请@rocky执行
+  cleanState({ mode: 'dev', agent: TEST_AGENT })
+  run({
+    hookEventName: 'UserPromptSubmit',
+    session_id: 'cjk-auto-session',
+    prompt: '请@rocky执行当前需求'
+  })
+  const cjkAutoState = JSON.parse(fs.readFileSync(STATE_FILE, 'utf8'))
+  assert.strictEqual(cjkAutoState.executionMode, 'auto', 'CJK-adjacent @rocky must enter auto')
+
+  // Explicit exit auto clears sticky
+  cleanState({ mode: 'dev', agent: TEST_AGENT })
+  run({
+    hookEventName: 'UserPromptSubmit',
+    session_id: 'exit-auto-session',
+    prompt: '@rocky 进入任务'
+  })
+  run({
+    hookEventName: 'UserPromptSubmit',
+    session_id: 'exit-auto-session',
+    prompt: '退出 auto 模式'
+  })
+  const exitAutoState = JSON.parse(fs.readFileSync(STATE_FILE, 'utf8'))
+  assert.strictEqual(exitAutoState.executionMode, 'confirm')
+  assert.strictEqual(exitAutoState.stickyAuto?.active, false)
+
+  // Sticky survives host payloads that omit session_id after first auto turn
+  cleanState({ mode: 'dev', agent: TEST_AGENT })
+  run({
+    hookEventName: 'UserPromptSubmit',
+    session_id: 'omit-session-auto',
+    prompt: '@rocky 启动'
+  })
+  run({
+    hookEventName: 'UserPromptSubmit',
+    prompt: '继续推进'
+  })
+  const omitSessionSticky = JSON.parse(fs.readFileSync(STATE_FILE, 'utf8'))
+  assert.strictEqual(omitSessionSticky.executionMode, 'auto', 'sticky auto must tolerate missing session_id on follow-up')
+
+  // Explicit different session_id drops sticky
+  cleanState({ mode: 'dev', agent: TEST_AGENT })
+  run({
+    hookEventName: 'UserPromptSubmit',
+    session_id: 'session-a-auto',
+    prompt: '@rocky 启动'
+  })
+  run({
+    hookEventName: 'UserPromptSubmit',
+    session_id: 'session-b-auto',
+    prompt: '继续推进'
+  })
+  const crossSessionSticky = JSON.parse(fs.readFileSync(STATE_FILE, 'utf8'))
+  assert.strictEqual(crossSessionSticky.executionMode, 'confirm', 'different session_id must not inherit sticky auto')
 
   cleanState({
     mode: 'dev',

skills/cp-gate/SKILL.md

@@ -21,6 +21,9 @@ CP 门控**不受 ENV_MODE 影响**。dev/prod 均强制保持 CP1→CP2 顺序
 > 当用户选择 `@devcodex-auto`、全局默认 `@rocky`、Profile 配置的 auto 替换别名，或在文本宿主中明确自然语言授权 auto（如“进入 auto 模式执行”“全自动继续”“run in auto mode”）时：
 
 - Auto v1.1 正式入口包括显式 `@devcodex-auto`、全局默认 `@rocky`、项目 Profile `extensions.devcodex.autoAliases` 替换别名与明确自然语言 auto 授权；配置了 `autoAliases` 时该列表替换全局默认别名，空数组表示关闭默认别名；模糊提及、询问 auto 规则、普通“继续”或未生效昵称不等价于 auto 授权
+- **Sticky Auto（v1.2）**：有效入口命中后写入会话级 `stickyAuto`（TTL 与 sticky 项目同量级）；后续同 session 无别名的“确认/继续/补充”**保持** `executionMode=auto`，直到显式退出（`退出 auto` / `关闭自动模式` / `exit auto mode` / `切回确认模式`）或 sticky 过期/换会话
+- **别名匹配**：允许中文/标点贴靠（如 `请@rocky执行`、`（@rocky）`）；拒绝与标识符粘连（如 `ok@rocky`）
+- **模型可见回执**：`UserPromptSubmit` 注入 `ExecutionModeV1: auto|confirm`（含 sticky/source/authorityRef 与 CP auto-pass 提示）；白名单边界**不**因 sticky 扩大
 - `hook-enforced` 宿主下，CP 自动通过对白名单路径形成无提醒通过；非白名单路径在默认 `safety-only` 下提醒放行，在 `strict` 模式下回确认模式并硬拦截
 - `instruction-fallback` 宿主（如 JetBrains / Cursor）只同步 auto 规则说明，不承诺 runtime 级 CP 行为；支持 Hook 的宿主由 `DEVCODEX_HOOK_ENFORCEMENT` 决定提醒或硬拦截
 - `auto:` / `/auto` / profile `executionMode` 不属于本轮正式入口