coderio 0.4.0__py3-none-any.whl

coderio-0.4.0.dist-info/METADATA

@@ -0,0 +1,490 @@
+Metadata-Version: 2.5
+Name: coderio
+Version: 0.4.0
+Summary: A skill-driven coding agent — structural harness, foldable thinking TUI, deepagents engine.
+Author: coderio contributors
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agent,ai-agent,cli,coding-agent,langchain,langgraph,llm,mcp,model-context-protocol,sandbox,skills,textual,tui
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Code Generators
+Requires-Python: >=3.11
+Requires-Dist: ddgs>=4.0
+Requires-Dist: deepagents>=0.6
+Requires-Dist: httpx>=0.27
+Requires-Dist: langchain-anthropic>=0.2
+Requires-Dist: langchain-core>=0.3
+Requires-Dist: langchain-openai>=0.2
+Requires-Dist: langchain>=0.3
+Requires-Dist: langgraph-checkpoint-sqlite>=2.0
+Requires-Dist: langgraph>=0.2
+Requires-Dist: pydantic>=2
+Requires-Dist: rich>=13
+Requires-Dist: textual>=0.40
+Requires-Dist: tomli-w>=1.0
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
+Requires-Dist: pytest-cov>=4; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.16; extra == 'dev'
+Provides-Extra: mcp
+Requires-Dist: langchain-mcp-adapters>=0.3.2; extra == 'mcp'
+Description-Content-Type: text/markdown
+
+# coderio
+
+[中文](README.md) | **English**
+
+> A skill-driven coding agent — structural harness constraints, a foldable-thinking TUI, and a deepagents engine. Built on langchain + langgraph + deepagents + Lion-Skills. Windows-first, cross-platform.
+
+## Why this project
+
+It started as a way to spend some free tokens and walk the full langchain stack while building an agent. Once the framework was up, a plain REPL + CLI felt uninspiring, so I built a TUI — and that part I'm genuinely happy with.
+
+The framework has not been finely tuned; it's a demo built in spare time. It's open-sourced not as a product, but as a working reference for anyone using the langchain stack: how to wire the deepagents engine, how to build structural harness constraints, how to do streaming rendering in a TUI — the code is all here, it runs, take it and play.
+
+> About the name: **coderio = code + rio** (not coder + io). My English name is Lion; I first tried "codelion" but it felt odd, so coderio it is.
+
+---
+
+**coderio** is a skill-driven coding agent. Its skeleton is the [Lion-Skills](https://github.com/Lion-1209/Lion-Skills) suite (clarify → spec → task → execute → verify → commit workflow); coderio adds tools that actually get work done, a **harness layer** that enforces the workflow, and an interactive Textual TUI. The reference points are Claude Code / Codex / ZCode.
+
+Core philosophy: **skills are the playbook, the harness is the discipline, tools are the hands.** Three layers, none substituting for another.
+
+---
+
+## Features
+
+- **Harness four-gate hard constraints**: when the agent writes code but declares "done" without running it, the harness intercepts termination and force-continues the loop — not a prompt-level soft rule, but a system-level structural control based on tool-call ground truth. VerifyGate parses shell exit codes (both coderio's legacy format and deepagents' native format), so failing tests no longer count as "verified"; permission-denied runs don't either; non-code files (.md/.json/.yaml docs) are intelligently skipped; CompletionGate checks for pending todos.
+- **Explicit state machine**: execution phase derived in real time (explore → plan → implement → verify → complete), shown in the status bar; per-turn phase timelines persist to the session for replay/debugging.
+- **deepagents engine**: production engine built on [deepagents](https://github.com/langchain-ai/deepagents) with context management (offload + summarization), subagents (task tool, incl. a read-only research subagent), a filesystem backend, and persistent checkpoints (SqliteSaver). deepagents' default prompt is fully replaced — coderio's system prompt is the only one the model sees.
+- **Persistent checkpoints**: graph state persists to sqlite across turns; only the new message is sent (no full-history replay), and SummarizationMiddleware's accumulated state is preserved correctly.
+- **Automatic context compaction**: deepagents' SummarizationMiddleware triggers near 60% of the context window (configurable via `[context].trigger_ratio`) — old messages are offloaded to files + LLM-summarized.
+- **Intent classification**: CODE / QA / ANALYZE intents are auto-detected (bilingual signal words); coding tasks go through the workflow, questions are answered directly.
+- **Progressive disclosure**: skill bodies load on demand; the system prompt stays ~2K tokens instead of piling everything in.
+- **Interactive TUI**: Textual terminal UI with foldable thinking (Ctrl+O), streaming output, a tool-call status bar (animated spinner + step + task phase + timer + per-turn token count), slash-command autocomplete, a collapsible TODO panel (live ✓/→/○ progress), a vertical permission menu (↑↓ + Enter), session management (`/resume` + Del to delete), visual pickers (`/mode` `/profile`), file-change visualization, task interruption (Esc / ⏹ button), and error recovery.
+- **Tool error resilience**: failed tool calls become tool results fed back to the model for self-correction instead of crashing the turn; the bash tool kills the whole process tree on timeout (Windows Job Object).
+- **File path isolation**: the deepagents backend's `virtual_mode` confines file tools (write_file/edit_file/read_file/ls/grep/glob) to the workspace root — the agent's `/foo.py` maps to `{workdir}/foo.py`.
+- **Command review layer**: shell (execute) commands are not covered by virtual_mode, so an additional `CommandReviewMiddleware` layer applies a built-in blacklist (`rm -rf /`, `mkfs`, fork bombs, `dd of=/dev/`, shutdown — blocked even in FULL mode) plus user-extendable `blocked_commands`. This is not a real OS sandbox (obfuscated commands can bypass regex), but it stops the vast majority of accidental damage. `network_allowed = false` disables the web tools entirely (offline mode).
+- **SSRF-protected web_fetch**: scheme allowlist (http/https only), private/loopback/link-local IP blocking (incl. cloud metadata endpoints), per-hop redirect validation, and a 1 MB response cap.
+- **Multi-layer OS sandbox** (Linux real isolation): `sandbox_mode = "job" | "write"` — Job Object resource limits on Windows; bubblewrap namespace isolation on Linux (read-only root, read-write workspace, optional network cutoff, Claude-Code-compatible filesystem 4-tuple `allow_write`/`deny_write`/`deny_read`/`allow_read`).
+- **MCP support**: connect external MCP servers via `.mcp.json` (Claude Code-compatible format); stdio and HTTP transports; project-level config overrides user-level. `coderio mcp` CLI manages entries; MCP tools are gated by the permission system like built-in tools.
+- **Repo-config trust confirmation**: first time a repository's `.coderio/config.toml` or `.mcp.json` is seen, coderio shows what it contains (permission mode, base_url, MCP commands) and requires explicit confirmation — content-hashed, so upstream edits re-trigger the prompt. Cloning a hostile repo no longer means silent arbitrary code execution.
+- **Multiple providers + named profiles**: Zhipu GLM / StepFun coding plans (Anthropic protocol) + OpenAI-compatible endpoints; multiple profiles with runtime `/profile` switching.
+- **Headless mode**: `coderio run "task"` for one-shot, non-interactive runs (CI, scripting, benchmark harnesses).
+
+---
+
+## Quick start
+
+### Install
+
+**Option 1: pip from PyPI (recommended)**
+
+```bash
+pip install coderio
+```
+
+**Option 2: from GitHub**
+
+```bash
+pip install "coderio @ git+https://github.com/Lion-1209/coderio.git"
+```
+
+**Option 3: Release wheel (offline/intranet)**
+
+Download the latest `coderio-*.whl` from the [Releases page](https://github.com/Lion-1209/coderio/releases), then:
+
+```bash
+pip install coderio-0.4.0-py3-none-any.whl
+```
+
+**Option 4: from source (developers, uv recommended)**
+
+```bash
+git clone https://github.com/Lion-1209/coderio.git
+cd coderio
+
+# uv (recommended — same as CI, deps locked in uv.lock)
+uv sync --extra dev          # creates .venv, installs exactly per uv.lock
+uv run pytest -q             # run commands via uv run
+
+# or plain pip (does not read the lockfile; resolves latest compatible versions)
+python -m venv .venv
+.venv/Scripts/python.exe -m pip install -e ".[dev]"    # Windows (Git Bash)
+.venv/bin/python -m pip install -e ".[dev]"            # Linux / macOS
+```
+
+Requirements: Python 3.11+; on Windows, Git Bash must be installed (the shell tool depends on it).
+
+**Dependency management**: CI installs exactly per [uv.lock](uv.lock) via `uv sync --frozen` (reproducible); Dependabot's weekly upgrade PRs update pyproject.toml and uv.lock together. After changing dependencies, run `uv lock` and commit both files.
+
+**MCP support** (optional): install the MCP extra to connect external MCP servers:
+
+```bash
+pip install "coderio[mcp]"            # or: uv sync --extra dev --extra mcp
+```
+
+Without the extra, coderio works normally — `.mcp.json` is silently ignored.
+
+### Configuration
+
+The first interactive run triggers an onboarding wizard (pick provider, model, paste API key); config is written to `~/.coderio/config.toml` and `~/.coderio/credentials`. The wizard probes the model's context window and persists it, so compaction thresholds match the real model. Manual configuration:
+
+```bash
+# ~/.coderio/config.toml
+[model]
+provider_id = "bigmodel_coding_plan"   # Zhipu/StepFun/OpenAI/Anthropic/Ollama/custom
+default = "glm-5.2"
+context_limit = 128000                  # (optional) auto-probed by onboarding; 0 = use the default below
+max_output_tokens = 16384               # (optional) max tokens per reply, default 16384
+
+[tools]
+permission_mode = "confirm"            # confirm | plan | auto_edit | full
+workspace_root = ""                    # shell backend CWD (empty = launch dir); file-path isolation is handled by deepagents virtual_mode
+blocked_commands = []                  # extra blacklist regexes, e.g. ["git push --force", "npm publish"]
+network_allowed = true                 # false = disable web_fetch/web_search + Linux sandbox network cutoff (--unshare-net)
+whitelist_mode = false                 # true = unknown commands degrade to confirm (see "Sandbox" below)
+allowed_commands = []                  # extend the built-in whitelist, e.g. ["docker", "kubectl"]
+sandbox_mode = "off"                   # off | job | write (see "Sandbox" below)
+auto_allow_if_sandboxed = false        # auto-approve execute when sandbox is active (Claude Code "autoAllowBashIfSandboxed")
+
+# Optional: sandbox filesystem isolation (Linux bubblewrap only; Windows ignores it for now)
+[tools.sandbox_filesystem]
+allow_write = []                       # extra writable paths (workspace is always writable), e.g. ["/tmp/build", "~/.cache"]
+deny_write = []                        # forced read-only paths (even inside workspace), e.g. [".git/hooks"]
+deny_read = []                         # unreadable paths, e.g. ["~/.ssh", "~/.aws/credentials", "~/.gnupg"]
+allow_read = []                        # holes punched inside deny_read, e.g. ["~/.ssh/known_hosts"]
+
+[context]
+enabled = true                         # long-session auto-compaction (on by default)
+trigger_ratio = 0.6                    # trigger at 60% of the context window
+keep_recent = 8                        # keep the most recent N messages verbatim
+model_context_limit = 200000           # fallback when the profile has no probed context_limit
+```
+
+**MCP configuration** (`.mcp.json`, Claude-Code-compatible):
+
+Place `.mcp.json` in the project root (project scope) or `~/.coderio/mcp.json` (user scope). Configured servers and their tools load at startup:
+
+```json
+{
+  "mcpServers": {
+    "filesystem": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/tmp"]
+    },
+    "github": {
+      "type": "http",
+      "url": "https://api.githubcopilot.com/mcp/",
+      "headers": { "Authorization": "Bearer ghp_xxx" }
+    }
+  }
+}
+```
+
+- **stdio servers**: `{command, args, env?, cwd?, timeoutMs?, enabled?}` — spawn a local subprocess (e.g. npx-run server-filesystem)
+- **HTTP servers**: `{type: "http", url, headers?, timeoutMs?, enabled?}` — connect to a remote MCP endpoint
+- **SSE servers**: `{type: "sse", url, headers?, timeoutMs?, enabled?}`
+- **type inference**: omit `type` — a `command` implies stdio, a `url` implies http
+- Tool names are prefixed with the server name (e.g. `filesystem_read_file`), never colliding with built-in tools
+- Failed servers are skipped with a warning — startup is never blocked
+- Requires the MCP extra: `pip install "coderio[mcp]"`
+
+Optional fields (ZCode-compatible):
+- `enabled: false` — temporarily disable a server without removing its config
+- `cwd` — stdio subprocess working directory (often needed for npx/node on Windows)
+- `timeoutMs` — per-request timeout in ms; forwarded to the adapter as `timeout` (seconds)
+- Legacy field aliases auto-migrate: `enable`→`enabled`, `environment`→`env`, `http_headers`→`headers`, `type:"remote"`→`http`
+
+**CLI management** (`coderio mcp`):
+
+```bash
+# Add a stdio server to the project .mcp.json
+coderio mcp add filesystem --command npx --arg -y --arg @modelcontextprotocol/server-filesystem --arg /tmp
+
+# Add an HTTP server to the user config
+coderio mcp add github --type http --url https://api.githubcopilot.com/mcp/ --scope user
+
+# List all configured servers (project + user)
+coderio mcp list
+
+# Remove a server
+coderio mcp remove filesystem
+```
+
+**MCP tool permissions**: MCP tool names containing `write`/`create`/`delete`/`execute`/`run`/`fetch`/`request` (and similar keywords) are treated as destructive by the permission system (rejected in PLAN, prompted in CONFIRM, allowed in FULL) — same as built-in tools. Read-only MCP tools (`read`/`get`/`list`/`query`) pass in all modes.
+
+**Sandbox & command security** (defense in depth):
+
+coderio applies multiple security layers to shell (`execute`) commands, lightest to heaviest:
+
+| Layer | Mechanism | Config | Strength |
+|---|---|---|---|
+| 1. Blacklist | Regex-blocks destructive commands (`rm -rf /`, `mkfs`, fork bombs, ...), even in FULL mode | `[tools].blocked_commands` extends | Accident prevention; bypassable via base64/variables |
+| 2. Whitelist | Unknown commands (not in the ~60 built-in dev commands) degrade to confirm | `[tools].whitelist_mode = true` | Stronger (unknown commands prompt); still bypassable |
+| 3. OS sandbox | Kernel-level isolation — the process physically lacks the permission to write outside bounds | `[tools].sandbox_mode` | The real security boundary |
+
+`sandbox_mode` levels:
+
+- **`off`** (default): no OS sandbox; blacklist + whitelist only. Existing behavior.
+- **`job`**: Windows Job Object / POSIX process group + resource limits (process-count cap prevents fork bombs) + reliable process-tree kill. No file isolation, but stops resource abuse.
+- **`write`**: file-write isolation.
+  - **Linux**: ✅ **real isolation** — `bubblewrap` (`bwrap`), the same approach as Claude Code on Linux. Read-only root mount, read-write workspace, `--unshare-net` when `network_allowed=false`. Requires `apt install bubblewrap`.
+  - **Windows**: ⚠️ **currently equivalent to `job`**. The `CreateRestrictedToken` + `CreateProcessAsUserW` plumbing is in place, but on non-admin accounts the token is a no-op (verified: original and restricted tokens both have Medium integrity — identical write permissions). True isolation needs per-directory ACLs (~500 lines), tracked as future work. **Windows users currently have no OS-level write isolation** — use `job`; `write` provides no extra protection.
+
+```toml
+# Recommended: job for daily dev (fork-bomb prevention + reliable cleanup)
+# Linux users wanting real isolation: sandbox_mode = "write" (needs bubblewrap)
+sandbox_mode = "job"
+whitelist_mode = true
+allowed_commands = ["docker", "kubectl"]  # commands outside the whitelist trigger confirm
+
+# Advanced: auto-approve shell commands when the sandbox is active (fewer prompts)
+# This is Claude Code's "autoAllowBashIfSandboxed" design — the sandbox provides the
+# real isolation boundary, so per-command prompts become noise. The blacklist still applies.
+auto_allow_if_sandboxed = true
+```
+
+**Permission-sandbox interplay** (Claude Code "autoAllowBashIfSandboxed" design):
+- Default (`auto_allow_if_sandboxed = false`): even with the sandbox on, every execute still prompts (backward compatible)
+- `true`: execute auto-approves when the sandbox is active — the sandbox is the boundary, prompts are noise
+- **The blacklist always applies**: `rm -rf /` is blocked even under sandbox + auto_allow (CommandReviewMiddleware is independent of the permission gate)
+- **PLAN mode is unaffected**: PLAN is always read-only; the sandbox doesn't change that contract
+
+**Linux filesystem 4-tuple isolation** (`[tools.sandbox_filesystem]`, bubblewrap only):
+```toml
+[tools.sandbox_filesystem]
+# Keep secrets away from sandboxed processes (the real prompt-injection exfiltration threat)
+deny_read = ["~/.ssh", "~/.aws/credentials", "~/.gnupg"]
+allow_read = ["~/.ssh/known_hosts"]  # punch a hole (SSH connection verification still works)
+allow_write = ["/tmp/build", "~/.cache"]  # extra writable paths
+deny_write = [".git/hooks"]  # forced read-only even inside the workspace
+```
+Paths support `~` (home), `./` or bare (workspace-relative), `/abs` (absolute). The `deny_read` tmpfs blackhole **must** mount before the `allow_read` ro-bind (later bwrap mounts override earlier ones) — the code guarantees this order.
+
+**Security model, honestly stated**:
+- **The blacklist/whitelist are accident prevention, NOT adversarial defense.** They intercept unintended destructive commands (wrong paths, missed consequences) but are **not a security boundary** — variable expansion (`X=/; rm -rf $X`), base64 encoding, and shell composition (`ls ; curl ... | sh`) all bypass regex matching. Real adversarial protection comes from the OS sandbox (Linux bubblewrap / `write` mode) + permission prompts; use a VM for hostile code. Do not trust untrusted code just because "a blacklist is configured".
+- `job` mode: resource limits + process control, not a permission sandbox.
+- `write` on Linux: bubblewrap provides full namespace isolation (out of the box) + the filesystem 4-tuple for fine-grained control.
+- `write` on Windows: **no actual isolation effect today** (token is a no-op); equivalent to `job`. Real isolation awaits the ACL work.
+- Whitelist degradation: in CONFIRM/AUTO_EDIT modes, commands outside the whitelist **run but carry a `[whitelist]` annotation** in the result (so the model/user knows the command is outside the trusted set); PLAN hard-rejects; FULL allows silently.
+- For **fully untrusted code**, use a VM (Windows Sandbox / Docker) — do not rely on this sandbox.
+
+Supported providers:
+| provider_id | Description | Protocol |
+|---|---|---|
+| `bigmodel_coding_plan` | Zhipu GLM Coding Plan | Anthropic |
+| `stepfun_coding_plan` | StepFun Step Plan | Anthropic |
+| `bigmodel_api` / `stepfun_api` | Zhipu/StepFun direct API key | Anthropic / OpenAI |
+| `openai` | OpenAI direct | OpenAI |
+| `anthropic` | Anthropic Claude direct | Anthropic |
+| `ollama` | Local Ollama (no key) | OpenAI |
+| `openai_custom` | any OpenAI-compatible endpoint | OpenAI |
+
+API keys live in `~/.coderio/credentials` (POSIX 0600 / Windows icacls protected).
+
+### Running
+
+```bash
+# Interactive TUI (Ctrl+O unfolds thinking, scrollable history, / autocomplete)
+coderio
+# or directly (Windows)
+.venv/Scripts/python.exe -m coderio.cli.app
+# (Linux / macOS)
+.venv/bin/python -m coderio.cli.app
+
+# Specify provider/model
+coderio --provider bigmodel_coding_plan --model glm-5.2
+
+# Headless one-shot run (CI / scripting / benchmarks)
+coderio run "write a hello-world script and test it"
+coderio run "fix the failing test in tests/foo.py" --quiet        # final result only
+coderio run "continue" --session-id <id>                           # resume a session
+
+# Manage skills (install pulls from GitHub; needs git on PATH)
+coderio skills list
+coderio skills install
+```
+
+---
+
+## TUI commands
+
+Inside the TUI, type `/` to trigger autocomplete:
+
+| Command | Effect |
+|------|------|
+| `/help` | list all commands |
+| `/exit` `/quit` | quit |
+| `/config` | show current config (provider/model/mode) |
+| `/mode` | switch permission mode (no arg opens a visual picker: confirm/plan/auto) |
+| `/model <name>` | switch model at runtime |
+| `/setup` | reconfigure provider/model (onboarding wizard, auto context-window probe) |
+| `/profile` | switch saved config profiles (visual picker) |
+| `/skills` | list skills (★ = activated) |
+| `/cost` | show session token usage |
+| `/clear` | reset context (fresh session) |
+| `/sessions` | list recent sessions |
+| `/resume` | resume a past session (↑↓ select, Enter resume, type to filter) |
+| `/think` | unfold the latest turn's thinking |
+| `/export [path]` | export the session to markdown |
+
+**Shortcuts**:
+
+| Key | Effect |
+|------|------|
+| `Ctrl+O` | unfold/fold the latest turn's thinking |
+| `Esc` / `⏹ stop` | interrupt the running agent task (TUI stays up) |
+| `↑↓` + `Enter` | command menu navigation (opens on `/`) |
+
+Just type natural language to chat or assign coding tasks.
+
+---
+
+## Architecture
+
+Layered monolith, dependencies flow downward:
+
+```
+CLI (cli/)              Typer app + Textual TUI + slash commands
+  │
+Agent (agent/)          deepagents engine + harness/permission middleware + prompt building
+  │
+Capabilities            tools/ · skills/ · llm/ · session/ · config/
+```
+
+### Engine: deepagents + coderio middleware
+
+coderio uses deepagents as the engine (context management, subagents, filesystem backend) and layers middlewares on top:
+
+| Middleware | Role |
+|---|---|
+| **HarnessMiddleware** | coderio's four-gate hard constraints (verify/completion/grounding/plan) — deepagents itself does not enforce verification |
+| **PermissionMiddleware** | four permission tiers (plan/confirm/auto_edit/full) — controls which tools may execute |
+| **CommandReviewMiddleware** | content-level review: built-in destructive-command blacklist (active even in FULL mode) + SSRF/network policies |
+
+deepagents' default BASE_AGENT_PROMPT is neutralized — coderio's system prompt stands alone, no conflicts.
+
+**Subagents**: built-in research subagent (read-only, physically isolated — cannot write or execute) + general-purpose (full tools, carrying the same Harness/Permission/CommandReview middleware as the main agent). The main agent delegates via the task tool; contexts are isolated.
+
+The old ReAct engine has been removed — deepagents is the only engine.
+
+### The harness four gates (core)
+
+| Gate | Strength | Mechanism |
+|----|------|------|
+| **VerifyGate** | hard, escalating | claims "done" after writing code without running it → intercepted, forced continuation; parses shell exit codes — **failing tests (non-zero) do not count as verified**; writing docs/configs (.md/.json/.yaml) doesn't trigger verification; releases after 2 interceptions + a red warning |
+| **CompletionGate** | hard | claims "done" with pending todos → intercepted |
+| **GroundingGate** | hard (CODE mode only) | after writing code, cites files never read via read_file → intercepted; **ANALYZE mode skips it** — mentioning filenames in an analysis is normal (based on a 105-session audit: 98.2% false-positive rate, never caught a real hallucinated citation) |
+| **PlanGate** | soft nudge | writes code without a todo list → appends a nudge to the tool result |
+
+### Context governance
+
+deepagents' SummarizationMiddleware manages context automatically:
+
+| Mechanism | Trigger | Behavior |
+|------|------|------|
+| **offload** | tool input/output >20K tokens | large blocks saved to disk + pointer left, context preserved |
+| **summarize** | tokens reach 60% of the window (configurable `trigger_ratio`) | old messages LLM-summarized + originals offloaded to `/conversation_history/` |
+| **checkpoint** | every turn end | graph state persisted to sqlite; next turn sends only the new message |
+
+### Explicit state machine
+
+The agent's execution phase is derived live and shown in the status bar (`step 3 · [implement] thinking · 12.4s`):
+
+```
+explore (read_file/grep) → plan (first write, no todos) → implement (write + todos)
+  → verify (bash pytest) → complete
+```
+
+Each turn's phase timeline persists to the session jsonl (`kind="phase_timeline"`) for replay/debugging, but stays invisible to the model (never pollutes context).
+
+Full architecture: [`docs/coderio-architecture.md`](docs/coderio-architecture.md).
+
+---
+
+## Testing
+
+```bash
+# Full unit test suite (~15s)
+# Windows (Git Bash):
+.venv/Scripts/python.exe -m pytest -q
+# Linux / macOS:
+.venv/bin/python -m pytest -q
+
+# By module
+.venv/Scripts/python.exe -m pytest tests/agent/ -v    # Windows
+.venv/bin/python -m pytest tests/agent/ -v            # Linux / macOS
+
+# Live verification (real model endpoint; requires ANTHROPIC_API_KEY)
+# harness four gates against a real model:
+ANTHROPIC_API_KEY=<key> .venv/Scripts/python.exe scripts/verify_harness_live.py   # Windows
+ANTHROPIC_API_KEY=<key> .venv/bin/python scripts/verify_harness_live.py           # Linux / macOS
+# deepagents engine integration:
+ANTHROPIC_API_KEY=<key> .venv/Scripts/python.exe scripts/verify_deepagent_live.py # Windows
+```
+
+Three test layers: unit tests (logic) + live verification (real integration) + manual experience testing.
+
+---
+
+## Tech stack
+
+| Dependency | Purpose |
+|------|------|
+| langchain >=0.3 | agent foundation |
+| langgraph >=0.2 | state-graph orchestration |
+| langchain-anthropic >=0.2 | Zhipu/StepFun endpoints (Anthropic protocol) |
+| textual >=0.40 | interactive TUI |
+| rich >=13 | terminal rendering |
+| typer >=0.12 | CLI framework |
+| deepagents >=0.6 | production engine (context management, subagents, filesystem backend) |
+
+---
+
+## Project structure
+
+```
+src/coderio/
+├── agent/          # deepagents engine, harness/permission middleware, prompts, stream protocol
+├── cli/            # Typer app, Textual TUI, slash commands, credentials/onboarding, headless run
+├── tools/          # tool set + permission gate + langchain adapters + sandbox
+├── skills/         # SkillStore 3-layer loading + Lion-Skills (bundled)
+├── config/         # 3-layer TOML config merge + repo trust
+├── session/        # jsonl session storage + resume
+└── llm/            # model factory (provider registry)
+```
+
+Lion-Skills ship as bundled skills (`src/coderio/skills/lion-skills/`) — no separate install needed.
+
+---
+
+## Known limitations
+
+- **Windows encoding**: shell output under GBK locales has a built-in mitigation (`_WinLocalShellBackend` decodes bytes with errors='replace')
+- **Windows write sandbox**: `sandbox_mode = "write"` is currently equivalent to `job` on Windows (documented above under Sandbox)
+
+---
+
+## Contributing
+
+Contributions welcome! See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+---
+
+## License
+
+MIT (see [LICENSE](LICENSE)). Bundled Lion-Skills are also MIT (see [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md)).

coderio-0.4.0.dist-info/RECORD

@@ -0,0 +1,97 @@
+coderio/__init__.py,sha256=IBcx61GkSme78wZcxj2sOkaVOSLsDJyjPT0-FRH2XFo,686
+coderio/mcp_loader.py,sha256=dK0BLvPbip636FQy_FSGTEmlp_BdT9N4CU0lu3GkMjw,10059
+coderio/agent/__init__.py,sha256=dZQ7YPHC4JCSsJtJCI2C5s0Ing7fr8oaI6_jcveMEwE,255
+coderio/agent/_deepagents_compat.py,sha256=q3xM_Y6wm2gcLZpE1y_1Y30QLyGYDnB-cF4IE-pqRvo,6175
+coderio/agent/command_review.py,sha256=HSeUtKa9h9k7SeEHnI5OSpSh-th2amneJWX1L_3myns,7057
+coderio/agent/deep_loop.py,sha256=Is5Lmj4n_3PdyV0eVK4k63F7lLUruKSSO0395m3u7ck,35859
+coderio/agent/harness.py,sha256=UkxdvXqUUl-xLdqJj3sgzxlL16u_1tWYFndCXJMgL0s,36781
+coderio/agent/harness_middleware.py,sha256=5t39aS0kfVNLoFdAljyxEzLT9nGWunfx59QL9DnQJX8,14616
+coderio/agent/permission_middleware.py,sha256=MSeLJ2WK4rjw7X4xUxLojk7IMS07XyUjMFN2xsxMyzE,2113
+coderio/agent/prompts.py,sha256=ZeXmmEAC2crDKsxBuQEAREIPmx8K2tVmv8G71940HzY,17769
+coderio/agent/skill_tool.py,sha256=sdO-nYrac2c4oR-yS3rh8XKG7nfTXfChBDElukJlaLc,2743
+coderio/agent/state.py,sha256=t9zkGTAk98NYam-zYLZ326hGSNPCx_KfQo1wZRTFliw,5568
+coderio/agent/stream.py,sha256=oTtA16jmqD2t9gZWvE6qB1DfyaHPRuyp-Das3sHEq8A,3464
+coderio/cli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+coderio/cli/app.py,sha256=1YbnMjTzj3jLZTXmoZBnaN3Y7hLUbvI4mGqjDvWt5-g,8960
+coderio/cli/commands.py,sha256=2T_bMeyWhJ63FfKbobim0b-e0odpK4wTN2e_jyXlSKA,13934
+coderio/cli/credentials.py,sha256=cv8GrBDuHDxU1gsvt91ZUT-8opq57FTCVfCCTLCJfR0,2298
+coderio/cli/mcp_cmd.py,sha256=z7a6qp6c89ysT1fuHVzNQ03CvGfpqqQzt8tJrnHjyTo,7485
+coderio/cli/multimodal.py,sha256=4KXat-d1jJZKfLRutfahQK03NzIdOaRbmaup_dGV-v4,3199
+coderio/cli/onboarding.py,sha256=vIvVoWre0zwgZSc_8PwiTMmEfeAsoyhuMPiF06OrrS0,10891
+coderio/cli/providers.py,sha256=pYGonvbjNTtPn62tUwPPNNVAuyZbg8zqZwtgXg2aydE,3525
+coderio/cli/render.py,sha256=6HlDvoOi3bitq-2PPYUCkerKQzS6b7hsuY7fShHEvik,824
+coderio/cli/repl.py,sha256=aEAaaRckV1WcyAkP7WE-RRnUVa_qFGbTuHUCo5U6Wo4,6995
+coderio/cli/run_cmd.py,sha256=Q5nT9RZW5L__MCNeaAYhG3ht9vvfgX1uBw25CCXFa-A,6207
+coderio/cli/skills_cmd.py,sha256=7BeahSELRqZR9akNXK6t3Bb4V73y0KJuX2OIePJbX4M,2423
+coderio/cli/stream.py,sha256=flvENJ7-I-Osr5cZdBY08Hoe8h0dYzE8fAalPHNMTYc,8445
+coderio/cli/tui.py,sha256=LdiraaS_r_ZkPEDj_4TM9Od_5dQ8XBBHtMkT-KZYqYU,70863
+coderio/cli/tui_onboarding.py,sha256=c1ArjcOz1WjMwZ7H-pTyIJSeApoBTUe7xKIkp_ELVig,19598
+coderio/cli/tui_screens.py,sha256=FphUhjWhm10YZfdifTY7d9O1nsKzUyVgB6LiXDsUkhc,13084
+coderio/cli/tui_widgets.py,sha256=-PHP4nxgla_RnulmYiqPsoo0f6SKR-3G3iiUe5PboRM,19016
+coderio/config/__init__.py,sha256=UkLeKyXEHfe2NqZpxS8d60SPaAI_neweOGnvmjvgbAM,362
+coderio/config/bootstrap.py,sha256=Ug8alY6A-BQbyE4Cdwy1vibdyzzS-Ry0VBmCwtj-CG8,1165
+coderio/config/loader.py,sha256=IMUSmr9RXlAQCOLLy3XViFksv8x0OrrwNM8pjuCq77Q,10749
+coderio/config/models.py,sha256=PVOle3mGZl1KwP1MdbQAzDgRV4dp46i_62cKg0nIr9E,8778
+coderio/config/trust.py,sha256=nVsXRvPUNcNCWCUhFgCYx-ANeoLlk2FpK2nuRe8EPMY,5720
+coderio/llm/__init__.py,sha256=M6Xat7TaB5Lo3KEvqdsYbtv5Ksi4H2W5nssmwvVI73g,81
+coderio/llm/factory.py,sha256=izaFfKSWE278Nx0u-zvXCbD6GGxG_lJMzkYEHbYmQOI,6570
+coderio/llm/probe.py,sha256=ooWAlL0cU6rcU5kx_H6wXk2mm7ms-jFJK3UB5G1IpbI,5672
+coderio/session/__init__.py,sha256=Cxi6gVbZG11jR0SyCyUT_EpKTz56gbJ8WwsO73X1zZg,89
+coderio/session/message.py,sha256=uvjMxbUYtPwf-lk5mTZ_NAACLxVvO5QUI5HWV9K3pwg,2991
+coderio/session/store.py,sha256=QDUyPc4mOYj42h3FcA__CZ-72QriVNlM_RjCNPY0Ec0,9892
+coderio/skills/__init__.py,sha256=-pFpMNAURGF6ZlZ4z0qnTXlXV_mulwPXamlm_hqtQsI,132
+coderio/skills/models.py,sha256=kufhhfi2jDDBuYaFmnQCB2ZiLnEcp3H29Ag8RgWP6WQ,2443
+coderio/skills/parser.py,sha256=I8yiTkTOh7Dqb1TI6kWaa3b9rufl5wbxFmjLcKCInFo,1386
+coderio/skills/store.py,sha256=j4JlGEtNxiPgd7LoNJ_Ma7HnlvkpxQpmKulL7M3yAhs,3669
+coderio/skills/bundled/executing-plans/SKILL.md,sha256=NaG6teTm9NYMZIfzycJnyduNwzfQqdm2fWNWMf13r5s,681
+coderio/skills/lion-skills/LICENSE,sha256=MpcHa7llf6sBOH_mzaHLaPxA9qt11JnxDqbkJS6Bfc8,1061
+coderio/skills/lion-skills/README.md,sha256=goYuG18lO3AyR3GMNEes0jyggGqhCFToEHYcW_otNbA,5047
+coderio/skills/lion-skills/skills/clarifying-questions/SKILL.md,sha256=DJutzNge4NlgCS9nrU119ippOdkK_ZK2FQvbDW5Yuf4,10568
+coderio/skills/lion-skills/skills/clarifying-questions/evals/evals.json,sha256=HZoWAimIVIZiUnCfIK8m8l6yI93BGkoqtnUvXeqZl8g,3912
+coderio/skills/lion-skills/skills/code-review/SKILL.md,sha256=1gpgBZcjJkiooGDu6XCp3l0gX9FLp25oSGmG6QxjmSw,8091
+coderio/skills/lion-skills/skills/code-review/evals/evals.json,sha256=y6ftftk_xCWggzVcvwyfytZnfGL98mkemi-Ht0JxZLs,3772
+coderio/skills/lion-skills/skills/commit-message/SKILL.md,sha256=gTedC9Pmx_52uYefvxrlF1dth45YinpBTl7SUK5M5bI,4236
+coderio/skills/lion-skills/skills/commit-message/evals/evals.json,sha256=mqLa0sT9yQBvR4zTuCm1-GY3ekSvOZZxVRueIWMUYq0,889
+coderio/skills/lion-skills/skills/debugging/SKILL.md,sha256=kLvI74dGzpONbCilYqYeAfABZFgbnfb8rxD9raR6-ms,9088
+coderio/skills/lion-skills/skills/debugging/evals/evals.json,sha256=8mGV1m5lLyomxbD7zNt2fUVfnORChGt7YgdjAJnWz_w,4031
+coderio/skills/lion-skills/skills/error-handling/SKILL.md,sha256=tbLc0MO66U_it3IeGWRBZv7DWRAmRuzW9YAJu8rPmJA,5022
+coderio/skills/lion-skills/skills/error-handling/evals/evals.json,sha256=gdXBLvLNsudO6dChYA4feG65UilaQonpv04gPxmOfr8,1186
+coderio/skills/lion-skills/skills/lion-writing-skills/SKILL.md,sha256=fANsRU7gLCnvw3xRfOEUjbBM8naz-KXd4naaYuJW7fg,5980
+coderio/skills/lion-skills/skills/lion-writing-skills/evals/evals.json,sha256=DC1Vh6IHr7TsT5q5j4g51J5EncHZHJbUrc2ZdIhmrpc,865
+coderio/skills/lion-skills/skills/naming/SKILL.md,sha256=a6E8-29vSqFRRNktiubbEEChsAXGhE_vbMBewjz6KBI,4548
+coderio/skills/lion-skills/skills/naming/evals/evals.json,sha256=7V3V6h-78Mxof8qCxC5lThexqFob1s6JWcTYVYP-cBw,881
+coderio/skills/lion-skills/skills/onboarding-unknown-codebase/SKILL.md,sha256=4cPg0_phJodUNvZSgIJ5dKOfC87E9SKgBX2W8QcJcYA,4851
+coderio/skills/lion-skills/skills/onboarding-unknown-codebase/evals/evals.json,sha256=O2klgyXuF7xJ765IymwbCMVcLzH4FrV0YGr6uEauGbA,1064
+coderio/skills/lion-skills/skills/spec-writing/SKILL.md,sha256=OOxWWXW5weBlYmhDYWjYzeBAguNsDcEJbrVWsA97ibA,12322
+coderio/skills/lion-skills/skills/spec-writing/evals/evals.json,sha256=maqYgHYsg5pN0ZZ8JLu5w5nXG62cVjSs4JA7ZEPObro,4554
+coderio/skills/lion-skills/skills/task-breakdown/SKILL.md,sha256=PQ6lkbKrQEy4WgepCkvamnYvIWaAPQ89ZO6G9YVbAtU,11217
+coderio/skills/lion-skills/skills/task-breakdown/evals/evals.json,sha256=Ph1jlDgukA6Y0HwncezXQBNNEMss3_JIo93hfOS4NnI,4499
+coderio/skills/lion-skills/skills/testing/SKILL.md,sha256=zxugv11K-1ihpHd1xrVvtE7zcMAf_iOg3gsLig3D5rU,9620
+coderio/skills/lion-skills/skills/testing/evals/evals.json,sha256=vqNj1S5iiS9JfyyOo9lpVw_IulmjdgXnOwDjxettdrQ,4107
+coderio/skills/lion-skills/skills/verify-and-fix/SKILL.md,sha256=10wOZRBQhsNeRPnDlf4OfSZjXimOOYmQYb-ZAeJPnIg,10453
+coderio/skills/lion-skills/skills/verify-and-fix/evals/evals.json,sha256=W2nrGFJ4hcyr64O4vCW263sRPNr5j3ABg0QUYdEY7Uk,4565
+coderio/tools/__init__.py,sha256=WauD3S1KrsaUn1Bsr9RZaCzx4m_PpdWn9qPEESv8keo,2898
+coderio/tools/base.py,sha256=cSDh5gBb4WfAh5mE5WhlefsMl4vMd707SkW-O4pMS58,2220
+coderio/tools/bash.py,sha256=zk2CvYhc5NpXrsocTk_3VcJXgO71RP_ExwBAb4nC7DA,7142
+coderio/tools/command_policy.py,sha256=2gHsBfRizkSjI1iGq5oFZ87KfPKsGk3RtGQq_acBHxs,14753
+coderio/tools/edit_file.py,sha256=iFVblW_RFFwC8Wet9q9786cHsrcGanFB9vw0lTJCggA,2308
+coderio/tools/glob_tool.py,sha256=xZJnzZDa_XdTmrpS8Tu68LP6ATVxFgBZvptcv7DeINc,649
+coderio/tools/grep_tool.py,sha256=ye54L7d1X_kTkd899D_hu2j4BoWfhcObTtMH0vPEM-c,3158
+coderio/tools/linux_sandbox.py,sha256=5S2qfAQqUfDRPZNeLUytnzZ6BpO-wTodKcRYQqOJMhE,8089
+coderio/tools/list_dir.py,sha256=2lxeGh1VrEg_6IGN1GQdH3bjiCc-p44UPcascSEs_j4,1976
+coderio/tools/multi_edit.py,sha256=Mxxqofl4kjp1BnqjM58bcigDqfH0JCM1n6kgb2pNjZ0,2714
+coderio/tools/note.py,sha256=wYZNDLNdBLPuR1cB8u6b9qRZx1w2IyhsFiUzZXf15xA,2983
+coderio/tools/permission.py,sha256=04vOO2z2irYQTEfmpNHmd90j4SGyiOC1yutjXRo-_Iw,8886
+coderio/tools/read_file.py,sha256=2oItLmw9vaB-SYhiDFVYrhMAPJ7p7CUJ1JWUxF4fCLI,2006
+coderio/tools/sandbox_runner.py,sha256=YpUxHDXFxpSJZVqfUny7dbswy5G4y_g8XRz-3wCH9ac,4928
+coderio/tools/todo.py,sha256=fU0cAvl1eB_hLu2i03NA-SC9h7zaLKE0s505x84NPh8,2320
+coderio/tools/web_fetch.py,sha256=sWhS0MulWtjfTg8WJ9oeFhVHKxaMtmgMki7-7uXe0Is,7928
+coderio/tools/web_search.py,sha256=bFoNtmqrh3JvBGvpo6xTSiE5II-FuiP51bMxZV9emUo,1856
+coderio/tools/win_job.py,sha256=dYCKlSEvXWi33Q-VftNCBbKZE2_ltp_uHx0yIXHn1MI,8501
+coderio/tools/win_sandbox.py,sha256=4rrInelwDLDo8IGkWjiFT_b_Gormn2nQf6ASYgWFoSE,27382
+coderio/tools/write_file.py,sha256=KVLZ1_G0VBIxC9ejBtezXRSHL2gDT4eZTO9mVQk3U-o,761
+coderio-0.4.0.dist-info/METADATA,sha256=YgT1R5IZHEq1iRWS7iGpcQctF47HkGZI9NbHR0gU2w4,27793
+coderio-0.4.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+coderio-0.4.0.dist-info/entry_points.txt,sha256=W7UKP7W8NlMloF1mvi86WGUshWmfMPBVjrYSOSNwkPw,55
+coderio-0.4.0.dist-info/licenses/LICENSE,sha256=_Hx31iGkyJzw0_BcBPl2jLuPuJxeFg2MS6FVfWyN7aw,1077
+coderio-0.4.0.dist-info/RECORD,,

coderio-0.4.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.0
+Root-Is-Purelib: true
+Tag: py3-none-any

coderio-0.4.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+coderio = coderio.cli.app:main_entry

coderio-0.4.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 coderio contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.