chatup 0.2.13__tar.gz → 0.2.14__tar.gz

{chatup-0.2.13/src/chatup.egg-info → chatup-0.2.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chatup
-Version: 0.2.13
+Version: 0.2.14
 Summary: ChatArch setup CLI extracted from ChatTool
 Author-email: rexwzh <1073853456@qq.com>
 License-Expression: MIT
@@ -16,6 +16,7 @@ License-File: LICENSE
 Requires-Dist: click<9.0,>=8.0
 Requires-Dist: chatstyle<0.3.0,>=0.2.0
 Requires-Dist: chatenv<0.3.0,>=0.2.11
+Requires-Dist: python-dotenv<2.0,>=1.0
 Requires-Dist: colorama
 Provides-Extra: dev
 Requires-Dist: build; extra == "dev"

{chatup-0.2.13 → chatup-0.2.14}/pyproject.toml

@@ -13,6 +13,7 @@ dependencies = [
     "click>=8.0,<9.0",
     "chatstyle>=0.2.0,<0.3.0",
     "chatenv>=0.2.11,<0.3.0",
+    "python-dotenv>=1.0,<2.0",
     "colorama",
 ]
 authors = [{name = "rexwzh", email = "1073853456@qq.com"}]

{chatup-0.2.13 → chatup-0.2.14}/src/chatup/__init__.py

@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "0.2.13"
+__version__ = "0.2.14"

{chatup-0.2.13 → chatup-0.2.14}/src/chatup/setup/codex.py

@@ -1,13 +1,16 @@
 from __future__ import annotations
 
 import json
+import os
 from pathlib import Path
+import re
+import tempfile
 import click
+from dotenv import dotenv_values
 
 from chatenv.configs import OpenAIConfig
 from chatenv.fields import BaseEnvConfig
 from chatenv.source_chain import split_config_sources
-from chatenv.store import EnvStore
 from chatup.const import CHATARCH_ENV_DIR, CHATARCH_ENV_FILE
 from chatup.interaction import (
     BACK_VALUE,
@@ -29,6 +32,7 @@ from chatup.utils.custom_logger import setup_logger
 DEFAULT_MODEL = "gpt-5.5"
 DEFAULT_BASE_URL = "https://api.openai.com/v1"
 DEFAULT_AUTH_METHOD = "apikey"
+_ENV_VAR_REF_RE = re.compile(r"\$(?:\{[^}]+\}|[A-Za-z_][A-Za-z0-9_]*)")
 logger = setup_logger("setup_codex")
 
 
@@ -208,6 +212,29 @@ def _write_codex_config(config_path: Path, *, model: str, base_url: str) -> list
     return changed_root + changed_provider
 
 
+def _write_private_text(path: Path, content: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd, tmp_name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
+    try:
+        os.chmod(tmp_name, 0o600)
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            handle.write(content)
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.replace(tmp_name, path)
+        path.chmod(0o600)
+    except Exception:
+        try:
+            os.close(fd)
+        except OSError:
+            pass
+        try:
+            os.unlink(tmp_name)
+        except OSError:
+            pass
+        raise
+
+
 def _write_codex_auth(auth_path: Path, api_key: str) -> list[str]:
     auth_data = {}
     if auth_path.exists():
@@ -219,11 +246,9 @@ def _write_codex_auth(auth_path: Path, api_key: str) -> list[str]:
             auth_data = {}
     old_value = auth_data.get("OPENAI_API_KEY")
     auth_data["OPENAI_API_KEY"] = api_key
-    auth_path.parent.mkdir(parents=True, exist_ok=True)
-    auth_path.write_text(
-        json.dumps(auth_data, ensure_ascii=False, indent=2) + "\n", encoding="utf-8"
+    _write_private_text(
+        auth_path, json.dumps(auth_data, ensure_ascii=False, indent=2) + "\n"
     )
-    auth_path.chmod(0o600)
     logger.info(f"Patched auth file: {auth_path}")
     return ["OPENAI_API_KEY"] if old_value != api_key else []
 
@@ -251,11 +276,36 @@ def _restore_openai_values(values: dict[str, str | None]) -> None:
     OpenAIConfig.OPENAI_API_MODEL.value = values.get("model")
 
 
+def _env_ref_has_path_separator(env_ref: str) -> bool:
+    return "/" in env_ref or "\\" in env_ref
+
+
+def _invalid_profile_name(env_ref: str) -> bool:
+    if env_ref == ".env":
+        return False
+    profile_name = env_ref.removesuffix(".env")
+    return (
+        not profile_name
+        or profile_name in {".", ".."}
+        or ".." in profile_name
+        or _env_ref_has_path_separator(profile_name)
+    )
+
+
 def _resolve_openai_env_path(env_ref: str) -> Path:
+    env_ref = str(env_ref).strip()
+    if not env_ref:
+        raise click.ClickException("OpenAI profile name cannot be empty.")
+
     candidate = Path(env_ref).expanduser()
     if candidate.is_file():
         return candidate
 
+    if _invalid_profile_name(env_ref) or _env_ref_has_path_separator(env_ref):
+        raise click.ClickException(
+            "Invalid OpenAI profile name. Profile names cannot contain path separators, '.' or '..'; pass an existing .env file path for file-based config."
+        )
+
     profile_path = OpenAIConfig.get_profile_env_file(CHATARCH_ENV_DIR, env_ref)
     if profile_path.exists():
         return profile_path
@@ -273,6 +323,22 @@ def _openai_values_from_mapping(values: dict[str, str]) -> dict[str, str | None]
     }
 
 
+def _load_dotenv_without_interpolation(env_path: Path) -> dict[str, str]:
+    return {
+        key: value
+        for key, value in dotenv_values(env_path, interpolate=False).items()
+        if value is not None
+    }
+
+
+def _reject_unresolved_env_references(values: dict[str, str | None]) -> None:
+    for field, value in values.items():
+        if isinstance(value, str) and _ENV_VAR_REF_RE.search(value):
+            raise click.ClickException(
+                f"OpenAI profile field {field} contains an unresolved variable reference; selected profiles are loaded without process-environment interpolation."
+            )
+
+
 def _load_openai_values_from_env_ref(env_ref: str) -> dict[str, str | None]:
     """Load only the explicitly selected OpenAI env file/profile.
 
@@ -282,7 +348,9 @@ def _load_openai_values_from_env_ref(env_ref: str) -> dict[str, str | None]:
     a different account's key into `~/.codex/auth.json`.
     """
     env_path = _resolve_openai_env_path(env_ref)
-    return _openai_values_from_mapping(EnvStore(CHATARCH_ENV_DIR).load_path(env_path))
+    values = _openai_values_from_mapping(_load_dotenv_without_interpolation(env_path))
+    _reject_unresolved_env_references(values)
+    return values
 
 
 def setup_codex(
@@ -391,27 +459,43 @@ def setup_codex(
         if api_key == BACK_VALUE:
             return
 
-        base_url = prompt_text_value(
-            "base_url (optional)",
-            base_url,
-            env_config.get("base_url"),
-            existing.get("base_url"),
-            env_values.get("OPENAI_API_BASE"),
-            typed_env_values.get("OPENAI_API_BASE"),
-            fallback=DEFAULT_BASE_URL,
-        )
+        if env_ref:
+            base_url = prompt_text_value(
+                "base_url (optional)",
+                base_url,
+                env_config.get("base_url"),
+                fallback=DEFAULT_BASE_URL,
+            )
+        else:
+            base_url = prompt_text_value(
+                "base_url (optional)",
+                base_url,
+                env_config.get("base_url"),
+                existing.get("base_url"),
+                env_values.get("OPENAI_API_BASE"),
+                typed_env_values.get("OPENAI_API_BASE"),
+                fallback=DEFAULT_BASE_URL,
+            )
         if base_url == BACK_VALUE:
             return
 
-        model = prompt_text_value(
-            "default model (optional)",
-            model,
-            env_config.get("model"),
-            existing.get("model"),
-            env_values.get("OPENAI_API_MODEL"),
-            typed_env_values.get("OPENAI_API_MODEL"),
-            fallback=DEFAULT_MODEL,
-        )
+        if env_ref:
+            model = prompt_text_value(
+                "default model (optional)",
+                model,
+                env_config.get("model"),
+                fallback=DEFAULT_MODEL,
+            )
+        else:
+            model = prompt_text_value(
+                "default model (optional)",
+                model,
+                env_config.get("model"),
+                existing.get("model"),
+                env_values.get("OPENAI_API_MODEL"),
+                typed_env_values.get("OPENAI_API_MODEL"),
+                fallback=DEFAULT_MODEL,
+            )
         if model == BACK_VALUE:
             return
 

{chatup-0.2.13 → chatup-0.2.14/src/chatup.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chatup
-Version: 0.2.13
+Version: 0.2.14
 Summary: ChatArch setup CLI extracted from ChatTool
 Author-email: rexwzh <1073853456@qq.com>
 License-Expression: MIT
@@ -16,6 +16,7 @@ License-File: LICENSE
 Requires-Dist: click<9.0,>=8.0
 Requires-Dist: chatstyle<0.3.0,>=0.2.0
 Requires-Dist: chatenv<0.3.0,>=0.2.11
+Requires-Dist: python-dotenv<2.0,>=1.0
 Requires-Dist: colorama
 Provides-Extra: dev
 Requires-Dist: build; extra == "dev"

{chatup-0.2.13 → chatup-0.2.14}/src/chatup.egg-info/requires.txt

@@ -1,6 +1,7 @@
 click<9.0,>=8.0
 chatstyle<0.3.0,>=0.2.0
 chatenv<0.3.0,>=0.2.11
+python-dotenv<2.0,>=1.0
 colorama
 
 [dev]

{chatup-0.2.13 → chatup-0.2.14}/tests/test_codex_setup.py

@@ -144,6 +144,152 @@ def test_codex_env_dotenv_ref_loads_active_openai_profile(tmp_path, monkeypatch)
     assert "process-key-should-not-be-used" not in config_text
 
 
+def test_codex_env_profile_rejects_dotenv_interpolation_backfill(tmp_path, monkeypatch):
+    import chatup.setup.codex as codex_setup
+
+    home = tmp_path / "home"
+    envs_dir = tmp_path / "chatarch" / "envs"
+    openai_dir = envs_dir / "OpenAI"
+    monkeypatch.setenv("HOME", str(home))
+    monkeypatch.setenv("OPENAI_API_KEY", "process-key-should-not-be-used")
+    monkeypatch.setattr(codex_setup, "CHATARCH_ENV_DIR", envs_dir)
+    monkeypatch.setattr(codex_setup, "CHATARCH_ENV_FILE", envs_dir / ".env")
+    monkeypatch.setattr(codex_setup, "ensure_nodejs_requirement", lambda **kwargs: None)
+    monkeypatch.setattr(
+        codex_setup,
+        "should_install_global_npm_package",
+        lambda *args, **kwargs: False,
+    )
+    _write_env(
+        openai_dir / "apple.env",
+        {
+            "OPENAI_API_KEY": "${OPENAI_API_KEY}",
+            "OPENAI_API_BASE": "https://crs.example/openai/v1",
+            "OPENAI_API_MODEL": "gpt-5.5",
+        },
+    )
+
+    with pytest.raises(click.ClickException, match="unresolved variable reference"):
+        codex_setup.setup_codex(env_ref="apple", interactive=False)
+
+    assert not (home / ".codex" / "auth.json").exists()
+
+
+def test_codex_env_profile_rejects_path_traversal_name(tmp_path, monkeypatch):
+    import chatup.setup.codex as codex_setup
+
+    home = tmp_path / "home"
+    envs_dir = tmp_path / "chatarch" / "envs"
+    other_dir = envs_dir / "Other"
+    monkeypatch.setenv("HOME", str(home))
+    monkeypatch.setattr(codex_setup, "CHATARCH_ENV_DIR", envs_dir)
+    monkeypatch.setattr(codex_setup, "CHATARCH_ENV_FILE", envs_dir / ".env")
+    monkeypatch.setattr(codex_setup, "ensure_nodejs_requirement", lambda **kwargs: None)
+    monkeypatch.setattr(
+        codex_setup,
+        "should_install_global_npm_package",
+        lambda *args, **kwargs: False,
+    )
+    _write_env(
+        other_dir / "secret.env",
+        {
+            "OPENAI_API_KEY": "other-key-should-not-be-read",
+            "OPENAI_API_BASE": "https://other.example/v1",
+            "OPENAI_API_MODEL": "other-model",
+        },
+    )
+
+    with pytest.raises(click.ClickException, match="profile name"):
+        codex_setup.setup_codex(env_ref="../Other/secret", interactive=False)
+
+    assert not (home / ".codex" / "auth.json").exists()
+
+
+def test_codex_env_profile_prompt_defaults_stay_inside_selected_profile(
+    tmp_path, monkeypatch
+):
+    import chatup.setup.codex as codex_setup
+
+    home = tmp_path / "home"
+    envs_dir = tmp_path / "chatarch" / "envs"
+    openai_dir = envs_dir / "OpenAI"
+    codex_dir = home / ".codex"
+    codex_dir.mkdir(parents=True)
+    (codex_dir / "config.toml").write_text(
+        'model_provider = "crs"\n'
+        'model = "existing-model"\n\n'
+        '[model_providers.crs]\n'
+        'base_url = "https://existing.example/v1"\n',
+        encoding="utf-8",
+    )
+    monkeypatch.setenv("HOME", str(home))
+    monkeypatch.setenv("OPENAI_API_BASE", "https://process.example/v1")
+    monkeypatch.setenv("OPENAI_API_MODEL", "process-model")
+    monkeypatch.setattr(codex_setup, "CHATARCH_ENV_DIR", envs_dir)
+    monkeypatch.setattr(codex_setup, "CHATARCH_ENV_FILE", envs_dir / ".env")
+    monkeypatch.setattr(codex_setup, "ensure_nodejs_requirement", lambda **kwargs: None)
+    monkeypatch.setattr(
+        codex_setup,
+        "should_install_global_npm_package",
+        lambda *args, **kwargs: False,
+    )
+    monkeypatch.setattr(
+        codex_setup,
+        "resolve_interactive_mode",
+        lambda **kwargs: (True, True, True, False, True),
+    )
+    monkeypatch.setattr(codex_setup, "abort_if_force_without_tty", lambda *a, **k: None)
+    monkeypatch.setattr(codex_setup, "abort_if_missing_without_tty", lambda *a, **k: None)
+    monkeypatch.setattr(
+        codex_setup,
+        "resolve_install_only_mode",
+        lambda **kwargs: (False, False),
+    )
+    monkeypatch.setattr(
+        codex_setup,
+        "prompt_sensitive_value",
+        lambda _label, value, _masker: value,
+    )
+
+    prompt_candidates = []
+
+    def fake_prompt_text_value(_label, *candidates, fallback=None):
+        prompt_candidates.extend(candidates)
+        for candidate in candidates:
+            if candidate:
+                return candidate
+        return fallback
+
+    monkeypatch.setattr(codex_setup, "prompt_text_value", fake_prompt_text_value)
+    _write_env(
+        openai_dir / ".env",
+        {
+            "OPENAI_API_BASE": "https://active.example/v1",
+            "OPENAI_API_MODEL": "active-model",
+        },
+    )
+    _write_env(
+        openai_dir / "apple.env",
+        {
+            "OPENAI_API_KEY": "apple-key",
+            "OPENAI_API_BASE": "https://apple.example/v1",
+            "OPENAI_API_MODEL": "apple-model",
+        },
+    )
+
+    codex_setup.setup_codex(env_ref="apple", interactive=True)
+
+    assert "https://existing.example/v1" not in prompt_candidates
+    assert "existing-model" not in prompt_candidates
+    assert "https://process.example/v1" not in prompt_candidates
+    assert "process-model" not in prompt_candidates
+    assert "https://active.example/v1" not in prompt_candidates
+    assert "active-model" not in prompt_candidates
+    config_text = (codex_dir / "config.toml").read_text(encoding="utf-8")
+    assert 'base_url = "https://apple.example/v1"' in config_text
+    assert 'model = "apple-model"' in config_text
+
+
 def test_codex_default_model_matches_shared_openai_default():
     from chatenv.configs import OpenAIConfig
     import chatup.setup.codex as codex_setup

{chatup-0.2.13 → chatup-0.2.14}/tests/test_pyproject_metadata.py

@@ -24,6 +24,7 @@ def test_chatup_depends_on_chatenv_and_registers_cursor_agent_config_provider():
     assert "click>=8.0,<9.0" in data["project"]["dependencies"]
     assert "chatstyle>=0.2.0,<0.3.0" in data["project"]["dependencies"]
     assert "chatenv>=0.2.11,<0.3.0" in data["project"]["dependencies"]
+    assert "python-dotenv>=1.0,<2.0" in data["project"]["dependencies"]
     entry_points = data["project"]["entry-points"]["chatenv.configs"]
     assert entry_points["cursor-agent"] == "chatup.config:CursorAgentConfig"
     assert entry_points["discourse"] == "chatup.config:DiscourseAdminConfig"

{chatup-0.2.13 → chatup-0.2.14}/tests/test_version.py

@@ -5,7 +5,7 @@ from chatup.cli import main
 
 
 def test_version_present():
-    assert __version__ == "0.2.13"
+    assert __version__ == "0.2.14"
 
 
 def test_cli_help():
@@ -61,4 +61,4 @@ def test_cli_doctor():
     result = CliRunner().invoke(main, ["doctor"])
 
     assert result.exit_code == 0
-    assert "chatup 0.2.13 ok" in result.output
+    assert "chatup 0.2.14 ok" in result.output