coderio 0.4.0__py3-none-any.whl

coderio/config/loader.py

@@ -0,0 +1,273 @@
+from __future__ import annotations
+
+import os
+import tomllib
+from dataclasses import replace
+from pathlib import Path
+
+from coderio.config.models import (
+    CliConfig,
+    Config,
+    ContextConfig,
+    ModelConfig,
+    Profile,
+    SandboxFsConfig,
+    SessionConfig,
+    SkillsConfig,
+    ToolsConfig,
+)
+
+
+def _read_toml(path: Path) -> dict:
+    if path.is_file():
+        with open(path, "rb") as f:
+            return tomllib.load(f)
+    return {}
+
+
+def _merge(base: dict, override: dict) -> dict:
+    """Shallow-merge per section; override wins at the key level."""
+    out = {k: dict(v) if isinstance(v, dict) else v for k, v in base.items()}
+    for k, v in override.items():
+        if isinstance(v, dict):
+            out.setdefault(k, {})
+            out[k].update(v)
+        else:
+            out[k] = v
+    return out
+
+
+def _find_project_dir(search_from: Path) -> Path:
+    """Walk upward from search_from looking for a project's .coderio/config.toml.
+
+    Never ascends into the user's home directory (the home ~/.coderio is the USER
+    layer, handled separately), so a temp dir nested under home won't accidentally
+    pick up the real user config as if it were a project config.
+    """
+    cur = search_from.resolve()
+    home = Path(os.path.expanduser("~")).resolve()
+    for parent in [cur, *cur.parents]:
+        if parent == home:
+            break
+        if (parent / ".coderio" / "config.toml").is_file():
+            return parent
+    return search_from.resolve()
+
+
+def _default_user_dir() -> Path:
+    return Path(os.path.expanduser("~")) / ".coderio"
+
+
+def _parse_profiles(data: dict) -> list:
+    """Parse the [[profiles]] array into Profile objects.
+
+    Each table element must have at least name + provider_id + model. base_url
+    and kind fall back to "" and "openai_compatible". Malformed entries (missing
+    required fields) are skipped rather than crashing — a typo in one profile
+    shouldn't prevent the whole config from loading.
+    """
+    raw = data.get("profiles")
+    if not isinstance(raw, list):
+        return []
+    out = []
+    for entry in raw:
+        if not isinstance(entry, dict):
+            continue
+        name = entry.get("name")
+        pid = entry.get("provider_id")
+        model = entry.get("model")
+        if not (name and pid and model):
+            continue  # incomplete profile — skip silently
+        # context_limit is optional and best-effort: a missing/non-int value
+        # just means "not probed yet" (0), don't raise — the runtime falls back
+        # to ContextConfig.model_context_limit.
+        cl_raw = entry.get("context_limit", 0)
+        context_limit = cl_raw if isinstance(cl_raw, int) and not isinstance(cl_raw, bool) else 0
+        out.append(
+            Profile(
+                name=name,
+                provider_id=pid,
+                model=model,
+                base_url=entry.get("base_url", ""),
+                kind=entry.get("kind", "openai_compatible"),
+                context_limit=context_limit,
+            )
+        )
+    return out
+
+
+def _resolve_active_profile(data: dict) -> str:
+    """Resolve the active profile name from config, with a sane default.
+
+    Returns the explicit `active_profile` value if set and non-empty. Otherwise
+    empty string — build_chat_model treats empty active_profile as "use the
+    legacy [model] path", so old users with no profiles are unaffected. (The
+    "default to first profile when active is unset" lives in build_chat_model,
+    not here, because the loader shouldn't mutate user intent on disk.)
+    """
+    active = data.get("active_profile", "")
+    if isinstance(active, str):
+        return active.strip()
+    return ""
+
+
+def _read_fs_list(data: dict, key: str, default: list[str]) -> list[str]:
+    """Read a list-of-strings field from a config subtable (inline copy of
+    _from_dict._str_list, which is a closure-local helper and not visible here).
+
+    Returns the default on missing/malformed values — a bad config shouldn't
+    block startup.
+    """
+    v = data.get(key, default)
+    if isinstance(v, list) and all(isinstance(x, str) for x in v):
+        return v
+    return default
+
+
+def _read_sandbox_fs(data, default: SandboxFsConfig | None) -> SandboxFsConfig | None:
+    """Read the [tools.sandbox_filesystem] subtable into a SandboxFsConfig.
+
+    Returns the `default` unchanged when the subtable is empty/missing, so
+    users who don't configure filesystem isolation get None (bubblewrap uses
+    its built-in workspace-only layout).
+    """
+    if not isinstance(data, dict) or not data:
+        return default
+    return SandboxFsConfig(
+        allow_write=_read_fs_list(data, "allow_write", default.allow_write if default else []),
+        deny_write=_read_fs_list(data, "deny_write", default.deny_write if default else []),
+        deny_read=_read_fs_list(data, "deny_read", default.deny_read if default else []),
+        allow_read=_read_fs_list(data, "allow_read", default.allow_read if default else []),
+    )
+
+
+def _from_dict(data: dict) -> Config:
+    cfg = Config()
+    m = data.get("model", {})
+    t = data.get("tools", {})
+    s = data.get("skills", {})
+    se = data.get("session", {})
+    cl = data.get("cli", {})
+    cx = data.get("context", {})
+
+    # Validate int fields — TOML may give strings/bools if the user mis-types.
+    def _int(section: dict, key: str, default: int, section_name: str) -> int:
+        v = section.get(key, default)
+        if isinstance(v, bool) or not isinstance(v, int):
+            raise ValueError(f"config.toml [{section_name}] {key} 必须是整数，但得到 {type(v).__name__}: {v!r}")
+        return v
+
+    def _bool(section: dict, key: str, default: bool) -> bool:
+        v = section.get(key, default)
+        if not isinstance(v, bool):
+            # TOML's true/false parse to Python bool; anything else is a typo.
+            # Don't raise — fall back to default so a bad value doesn't block startup.
+            return default
+        return v
+
+    def _str_list(section: dict, key: str, default: list[str]) -> list[str]:
+        v = section.get(key, default)
+        if isinstance(v, list) and all(isinstance(x, str) for x in v):
+            return v
+        # Not a list of strings — fall back to default rather than crashing.
+        # A bad config value shouldn't block startup; the user will notice when
+        # their extra blocklist doesn't take effect.
+        return default
+
+    # Validate permission_mode against the known enum values.
+    perm = t.get("permission_mode", cfg.tools.permission_mode)
+    if isinstance(perm, str):
+        perm_lower = perm.lower()
+        valid = ("confirm", "plan", "auto", "full", "auto_edit")
+        if perm_lower not in valid:
+            raise ValueError(f"config.toml [tools] permission_mode='{perm}' 无效。可选值: {', '.join(valid)}")
+        perm = perm_lower
+
+    # context_limit is optional in [model]; a missing/non-int value falls back
+    # to 0 (not probed). Don't use the strict _int() helper — context_limit is
+    # a best-effort optimization, not a required config field.
+    m_cl_raw = m.get("context_limit", 0)
+    m_context_limit = m_cl_raw if isinstance(m_cl_raw, int) and not isinstance(m_cl_raw, bool) else 0
+    return Config(
+        model=ModelConfig(
+            default=m.get("default", cfg.model.default),
+            provider=m.get("provider", cfg.model.provider),
+            base_url=m.get("base_url", cfg.model.base_url),
+            provider_id=m.get("provider_id", ""),
+            max_output_tokens=_int(m, "max_output_tokens", cfg.model.max_output_tokens, "model"),
+            context_limit=m_context_limit,
+        ),
+        tools=ToolsConfig(
+            bash_shell=t.get("bash_shell", cfg.tools.bash_shell),
+            permission_mode=perm,
+            workspace_root=t.get("workspace_root", cfg.tools.workspace_root),
+            blocked_commands=_str_list(t, "blocked_commands", cfg.tools.blocked_commands),
+            network_allowed=_bool(t, "network_allowed", cfg.tools.network_allowed),
+            whitelist_mode=_bool(t, "whitelist_mode", cfg.tools.whitelist_mode),
+            allowed_commands=_str_list(t, "allowed_commands", cfg.tools.allowed_commands),
+            sandbox_mode=t.get("sandbox_mode", cfg.tools.sandbox_mode),
+            auto_allow_if_sandboxed=_bool(t, "auto_allow_if_sandboxed", cfg.tools.auto_allow_if_sandboxed),
+            sandbox_fs=_read_sandbox_fs(t.get("sandbox_filesystem", {}), cfg.tools.sandbox_fs),
+        ),
+        skills=SkillsConfig(
+            auto_load=s.get("auto_load", cfg.skills.auto_load),
+            harness=s.get("harness", cfg.skills.harness),
+            repo_url=s.get("repo_url", cfg.skills.repo_url),
+        ),
+        session=SessionConfig(
+            save_dir=se.get("save_dir", cfg.session.save_dir),
+        ),
+        cli=CliConfig(
+            theme=cl.get("theme", cfg.cli.theme),
+            show_tool_output=cl.get("show_tool_output", cfg.cli.show_tool_output),
+        ),
+        context=ContextConfig(
+            enabled=cx.get("enabled", cfg.context.enabled),
+            trigger_ratio=cx.get("trigger_ratio", cfg.context.trigger_ratio),
+            keep_recent=_int(cx, "keep_recent", cfg.context.keep_recent, "context"),
+            model_context_limit=_int(cx, "model_context_limit", cfg.context.model_context_limit, "context"),
+        ),
+        profiles=_parse_profiles(data),
+        active_profile=_resolve_active_profile(data),
+    )
+
+
+def _apply_env(cfg: Config) -> Config:
+    model = cfg.model
+    v = os.environ.get("CODERIO_MODEL")
+    if v:
+        model = replace(model, default=v)
+    v = os.environ.get("CODERIO_PROVIDER")
+    if v:
+        model = replace(model, provider=v)
+    tools = cfg.tools
+    v = os.environ.get("CODERIO_BASH_SHELL")
+    if v:
+        tools = replace(tools, bash_shell=v)
+    # Preserve profiles/active_profile/context — env overrides only touch model/tools.
+    return Config(
+        model=model,
+        tools=tools,
+        skills=cfg.skills,
+        session=cfg.session,
+        cli=cfg.cli,
+        context=cfg.context,
+        profiles=cfg.profiles,
+        active_profile=cfg.active_profile,
+    )
+
+
+def load_config(search_from: Path | str = ".", user_dir: Path | str | None = None) -> Config:
+    """Load config merging: defaults < user < project < env.
+
+    Layers (low->high): built-in defaults, user ~/.coderio, project ./.coderio, env vars.
+    """
+    search_from = Path(search_from)
+    if user_dir is None:
+        user_dir = _default_user_dir()
+    data = _merge(
+        _read_toml(Path(user_dir) / "config.toml"),
+        _read_toml(_find_project_dir(search_from) / ".coderio" / "config.toml"),
+    )
+    cfg = _from_dict(data)
+    return _apply_env(cfg)

coderio/config/models.py

@@ -0,0 +1,193 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+
+@dataclass
+class ModelConfig:
+    default: str = "glm-4.5"
+    provider: str = "openai_compatible"
+    base_url: str = "https://open.bigmodel.cn/api/paas/v4"
+    provider_id: str = ""
+    max_output_tokens: int = 16384
+    # Context window size (tokens) for [model].default, probed at setup time.
+    # 0 = not probed (fall back to ContextConfig.model_context_limit). Mirrors
+    # Profile.context_limit for the legacy single-config path. Kept on ModelConfig
+    # (not ContextConfig) because it's per-model, not per-compaction-policy.
+    context_limit: int = 0
+
+
+@dataclass
+class Profile:
+    """A named, self-contained model configuration (provider + model + endpoint).
+
+    Bundles everything build_chat_model needs to construct a chat client, so the
+    user can keep several providers side by side (e.g. a Coding Plan subscription
+    and a personal OpenAI key) and switch between them with /profile without
+    re-running onboarding. The API key itself lives in the credentials file
+    (keyed by provider_id), not here — same as the legacy [model] path.
+    """
+
+    name: str
+    provider_id: str
+    model: str
+    base_url: str = ""
+    kind: str = "openai_compatible"
+    # Context window size (tokens) for THIS model, discovered at setup time by
+    # probing the provider's /v1/models/{id} endpoint. 0 = not probed (fall back
+    # to ContextConfig.model_context_limit). Stored per-profile because different
+    # providers/models have different windows — without this, a 256K model like
+    # step-3.7-flash gets mis-treated as the global default (200K), triggering
+    # compaction at 120K instead of 153K.
+    context_limit: int = 0
+
+
+@dataclass
+class ToolsConfig:
+    bash_shell: str = ""
+    permission_mode: str = "confirm"
+    # Workspace root for the shell backend's CWD. Empty = use the process CWD
+    # (the directory coderio was launched from). File-path isolation is handled
+    # by deepagents' backend virtual_mode (not by a coderio-side policy) — this
+    # value only affects where shell commands run.
+    workspace_root: str = ""
+    # Extra regex patterns appended to the built-in command blacklist. The
+    # built-in defaults (rm -rf /, mkfs, fork bomb, etc.) are always active;
+    # these are ADDITIONAL blocks for project-specific commands you never want
+    # run (e.g. ["git push --force", "npm publish"]). See command_policy.py.
+    blocked_commands: list[str] = field(default_factory=list)
+    # Master switch for web_fetch / web_search. False = offline mode (both web
+    # tools blocked). True (default) = web tools available subject to the
+    # normal permission gate.
+    network_allowed: bool = True
+    # Whitelist mode: when True, commands whose first token isn't in the
+    # allowed set (built-in + allowed_commands) are flagged for confirmation
+    # (NOT hard-blocked — FULL mode still allows them). Defaults to False
+    # (blacklist-only, backward compatible). See command_policy.py.
+    whitelist_mode: bool = False
+    # User-supplied additions to the built-in command whitelist. Applied only
+    # when whitelist_mode is True. E.g. ["docker", "kubectl"] to allow those
+    # without confirmation in whitelist mode.
+    allowed_commands: list[str] = field(default_factory=list)
+    # Sandbox mode: OS-level isolation for the execute tool.
+    #   "off"    = no OS sandbox (regex blacklist + whitelist only) [default]
+    #   "job"    = Job Object resource limits + reliable process-tree kill
+    #              (prevents fork bombs, OOM, orphaned grandchildren)
+    #   "write"  = Job Object + Windows Restricted Token write isolation
+    #              (reads system-wide, writes gated — needs Win10+, no admin)
+    # On Linux, "write" uses bubblewrap if available (see linux_sandbox.py).
+    sandbox_mode: str = "off"
+    # When True + sandbox_mode != "off", the execute (shell) tool auto-approves
+    # without a confirmation prompt (Claude Code's "autoAllowBashIfSandboxed"
+    # design: the sandbox provides the real isolation boundary, so per-command
+    # prompts become noise). Defaults False (backward compat). The blacklist
+    # still applies — rm -rf / is blocked even in auto-allow mode.
+    auto_allow_if_sandboxed: bool = False
+    # Filesystem isolation 4-tuple for the sandbox (Linux bubblewrap only;
+    # Windows ignores it — token is no-op). See SandboxFsConfig.
+    sandbox_fs: "SandboxFsConfig | None" = None
+
+
+@dataclass
+class SandboxFsConfig:
+    """Filesystem isolation config for the sandbox (Claude-Code-compatible 4-tuple).
+
+    Applied on Linux via bubblewrap mounts. Windows ignores these (the token
+    is currently a no-op — see win_sandbox.py docstring). All paths support:
+      - ``~/foo``  → home-relative
+      - ``./foo``  → workspace-relative
+      - ``foo``    → workspace-relative (same as ./)
+      - ``/abs``   → absolute
+
+    Semantics (bwrap mount order matters — later mounts override earlier):
+      - workspace is ALWAYS read-write (built-in, no need to list it)
+      - ``allow_write``  → extra read-write mounts (e.g. /tmp/build, ~/.cache)
+      - ``deny_write``   → read-only override (e.g. .git/hooks inside workspace)
+      - ``deny_read``    → tmpfs blackhole (path exists but contents invisible)
+      - ``allow_read``   → read-only re-mount punching through a deny_read
+    """
+
+    allow_write: list[str] = field(default_factory=list)
+    deny_write: list[str] = field(default_factory=list)
+    deny_read: list[str] = field(default_factory=list)
+    allow_read: list[str] = field(default_factory=list)
+
+
+@dataclass
+class SkillsConfig:
+    auto_load: bool = True
+    harness: bool = True
+    repo_url: str = "https://github.com/Lion-1209/Lion-Skills"
+
+
+@dataclass
+class CliConfig:
+    theme: str = "dark"
+    show_tool_output: bool = True
+
+
+@dataclass
+class SessionConfig:
+    save_dir: str = "~/.coderio/sessions"
+
+
+@dataclass
+class ContextConfig:
+    """Context-window compaction settings (spec: harness phase 2).
+
+    When the provider-reported input_tokens exceeds ``trigger_ratio`` of
+    ``model_context_limit``, old messages are summarized into a single system
+    message and the most recent ``keep_recent`` are kept verbatim. Disabled
+    when ``enabled=False`` (no compaction attempts, original behavior).
+    """
+
+    enabled: bool = True
+    trigger_ratio: float = 0.6  # compact at 60% of the context window (lowered
+    # from 0.75 — a 30-read_file analysis session
+    # hit 61k tokens without triggering; 60% gives
+    # earlier, healthier compaction)
+    keep_recent: int = 8  # messages preserved verbatim at the tail
+    model_context_limit: int = 200_000  # assumed window size when the active
+    # profile has no probed context_limit.
+    # Raised from 128K (too aggressive — a
+    # 256K model was compacting at 76K) to
+    # 200K, the floor for modern models
+    # (Claude, GPT-4o, step-3.7). The real
+    # value comes from probe_context_limit
+    # at setup time, stored per-profile.
+
+
+@dataclass
+class Config:
+    # All sub-config fields default to None and are populated in __post_init__.
+    # The `Type = None` default is a dataclass idiom: the field IS declared as
+    # the concrete type, but defaults to None before __post_init__ runs. mypy
+    # accepts this for dataclasses (the None is the "not yet initialized"
+    # sentinel, replaced in __post_init__ which the loader always calls).
+    model: ModelConfig = None  # type: ignore[assignment]
+    tools: ToolsConfig = None  # type: ignore[assignment]
+    skills: SkillsConfig = None  # type: ignore[assignment]
+    session: SessionConfig = None  # type: ignore[assignment]
+    cli: CliConfig = None  # type: ignore[assignment]
+    context: ContextConfig = None  # type: ignore[assignment]
+    # Named profiles (multi-config). Empty list = legacy single-config mode:
+    # build_chat_model falls through to the [model] section's 3-layer path,
+    # so existing users with no profiles are unaffected.
+    profiles: list = None  # type: ignore[assignment]
+    active_profile: str = ""
+
+    def __post_init__(self):
+        if self.model is None:
+            object.__setattr__(self, "model", ModelConfig())
+        if self.tools is None:
+            object.__setattr__(self, "tools", ToolsConfig())
+        if self.skills is None:
+            object.__setattr__(self, "skills", SkillsConfig())
+        if self.session is None:
+            object.__setattr__(self, "session", SessionConfig())
+        if self.cli is None:
+            object.__setattr__(self, "cli", CliConfig())
+        if self.context is None:
+            object.__setattr__(self, "context", ContextConfig())
+        if self.profiles is None:
+            object.__setattr__(self, "profiles", [])

coderio/config/trust.py

@@ -0,0 +1,136 @@
+"""First-use trust confirmation for repository-level config files.
+
+SECURITY (2026-08-14 v2 audit, biggest remaining hole): the loader placed the
+REPOSITORY's ``.coderio/config.toml`` ABOVE the user config — a cloned malicious
+repo could set ``permission_mode = "full"``, point ``model.base_url`` at an
+attacker's endpoint (session exfiltration), and ``.mcp.json``'s ``command``
+entries are spawned directly at startup. Cloning a hostile repo + starting
+coderio ≈ arbitrary code execution, with zero prompt.
+
+Mitigation (same approach as Claude Code / Codex / ZCode): on first detection
+of repo-level config, SHOW the user what it contains and require explicit
+confirmation. The confirmation is recorded per-repo in the USER's trust store
+(``~/.coderio/trusted-repos.json``), keyed by a content hash — a later commit
+that changes the config re-triggers the prompt (trust the content, not just
+the path).
+
+Non-interactive contexts (tests, CI) use :func:`is_repo_trusted` /
+:func:`mark_repo_trusted` directly, or pass ``assume_trusted=True``.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+from pathlib import Path
+
+_log = logging.getLogger(__name__)
+
+# Files that constitute "repo-level config" and therefore require trust.
+# A repo with none of these starts silently (nothing to confirm).
+REPO_CONFIG_FILES = (".coderio/config.toml", ".mcp.json")
+
+# Safety-relevant keys called out in the confirmation summary — the user should
+# see these even if they don't read the full file.
+_SENSITIVE_KEYS = ("permission_mode", "sandbox_mode", "base_url", "auto_allow_if_sandboxed", "network_allowed")
+
+
+def _trust_store(user_dir: Path | str) -> Path:
+    return Path(user_dir) / "trusted-repos.json"
+
+
+def _repo_fingerprint(project_dir: Path) -> str:
+    """Hash the CONTENT of every repo config file (not the path alone).
+
+    Content-keyed trust: editing the config after confirmation re-triggers the
+    prompt — a malicious upstream commit can't ride on a previously-granted
+    trust.
+    """
+    h = hashlib.sha256()
+    for rel in REPO_CONFIG_FILES:
+        p = project_dir / rel
+        h.update(rel.encode("utf-8"))
+        if p.is_file():
+            h.update(p.read_bytes())
+    return h.hexdigest()
+
+
+def existing_repo_configs(project_dir: Path | str) -> list[Path]:
+    """Return the repo-level config files that exist (possibly empty list)."""
+    project_dir = Path(project_dir)
+    return [project_dir / rel for rel in REPO_CONFIG_FILES if (project_dir / rel).is_file()]
+
+
+def is_repo_trusted(project_dir: Path | str, user_dir: Path | str) -> bool:
+    """True when the repo's CURRENT config content matches a stored trust entry.
+
+    A repo with no repo-level config is trusted by definition (nothing to
+    confirm). A config change after confirmation invalidates the trust.
+    """
+    project_dir = Path(project_dir)
+    if not existing_repo_configs(project_dir):
+        return True
+    store = _trust_store(user_dir)
+    if not store.is_file():
+        return False
+    try:
+        entries = json.loads(store.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, OSError):
+        return False
+    trusted = entries.get(str(project_dir.resolve()))
+    return trusted == _repo_fingerprint(project_dir)
+
+
+def mark_repo_trusted(project_dir: Path | str, user_dir: Path | str) -> None:
+    """Record the repo's current config content as trusted (after the user
+    confirms). Best-effort: a failure to write the store logs a warning and
+    leaves the repo untrusted (safe direction — the prompt reappears)."""
+    project_dir = Path(project_dir)
+    store = _trust_store(user_dir)
+    try:
+        entries: dict = {}
+        if store.is_file():
+            entries = json.loads(store.read_text(encoding="utf-8"))
+            if not isinstance(entries, dict):
+                entries = {}
+        entries[str(project_dir.resolve())] = _repo_fingerprint(project_dir)
+        store.parent.mkdir(parents=True, exist_ok=True)
+        store.write_text(json.dumps(entries, indent=2), encoding="utf-8")
+    except (json.JSONDecodeError, OSError) as e:
+        _log.warning("could not persist repo trust for %s: %s", project_dir, e)
+
+
+def summarize_repo_configs(project_dir: Path | str) -> str:
+    """Build the human-readable summary shown in the confirmation prompt.
+
+    Lists each file, its size, and any safety-relevant settings found in it —
+    so ``permission_mode = "full"`` can't hide inside a long TOML file the user
+    didn't read. MCP ``command``/``url`` entries are listed by server name
+    (those spawn processes / make network calls at startup).
+    """
+    project_dir = Path(project_dir)
+    lines = []
+    for path in existing_repo_configs(project_dir):
+        rel = path.relative_to(project_dir).as_posix()
+        lines.append(f"{rel} ({path.stat().st_size} bytes)")
+        try:
+            text = path.read_text(encoding="utf-8")
+        except OSError:
+            lines.append("  <unreadable>")
+            continue
+        if path.name == "config.toml":
+            for ln in text.splitlines():
+                s = ln.strip()
+                if any(k in s for k in _SENSITIVE_KEYS) and "=" in s:
+                    lines.append(f"  {s}")
+        else:  # .mcp.json — list servers (they spawn/connect at startup)
+            try:
+                servers = json.loads(text).get("mcpServers", {})
+                for name in servers:
+                    cfg = servers[name] or {}
+                    what = cfg.get("command") or cfg.get("url") or "?"
+                    lines.append(f"  server {name!r}: {what}")
+            except json.JSONDecodeError:
+                lines.append("  <invalid JSON>")
+    return "\n".join(lines)

coderio/llm/__init__.py

@@ -0,0 +1,3 @@
+from coderio.llm.factory import build_chat_model
+
+__all__ = ["build_chat_model"]