coderio 0.4.1__tar.gz → 0.4.2__tar.gz

{coderio-0.4.1 → coderio-0.4.2}/CHANGELOG.md

@@ -6,6 +6,106 @@ All notable changes to coderio are documented here. The format follows
 `pyproject.toml`'s `[project].version` — `coderio.__version__` reads it via
 `importlib.metadata`.
 
+## [0.4.2] — 2026-08-18
+
+### Security — v3 audit short-term batch (#7/#8/#9/#11/#14, all runtime-verified)
+- **#7 · headless default permission full → plan**: a headless entry that
+  silently allowed everything was a zero-confirmation door. `coderio run` now
+  defaults to read-only plan; full requires the explicit
+  `--dangerously-skip-permissions` flag (Claude Code's name for the same
+  escape hatch). confirm/auto_edit fail fast without a TTY (the gate is lazy,
+  so input() would otherwise EOFError mid-execution); invalid --permission
+  values are rejected up front.
+- **#8 · project-layer skills join the trust gate**: a repo shipping ONLY
+  `.coderio/skills` previously loaded them with zero confirmation — yet skills
+  enter the system prompt and may carry tools.py that exec's on activation.
+  Skills now participate in discovery + content fingerprint (per-file hash;
+  any skill edit re-triggers the prompt), and the confirmation summary marks
+  skills carrying tools.py with "⚠ executes code". tools.py load failures are
+  logged, no longer silent.
+- **#9 · trust store hardening**: the store gets owner-only permissions
+  (POSIX 0600 / Windows icacls, reusing the credentials helper); a corrupt
+  store is left untouched instead of being reset (the old reset destroyed
+  every other repo's trust entries); `SandboxFsConfig.deny_write` now
+  defaults to `["~/.coderio"]` so sandboxed commands can't rewrite the
+  config/credentials/trust store (explicit `deny_write = []` opts out;
+  Linux bwrap only — Windows sandbox is a no-op today).
+- **#11 · research subagent execution-time enforcement**: PermissionMiddleware
+  + CommandReviewMiddleware now ride the research subagent (the tool
+  whitelist filters what the model SEES; these gate what actually RUNS).
+  Failover direction reversed: a whitelist that cannot be constructed — or
+  fails at runtime — degrades to a DENY-ALL middleware (zero tools), not to
+  the old no-middleware state that inherited every tool including
+  write/execute.
+- **#14 · headless wall-clock timeout + exit codes**: `--timeout <seconds>`
+  (thread+join; SIGALRM doesn't exist on Windows) exits 124 on expiry;
+  agent execution failures exit 2 (distinct from config errors' 1); success
+  0. Documented in README for CI use.
+
+### Fixed — hooks completion (2026-08-14 v3 audit P1/P2 items)
+- **Timeout latency (v3 P1: timeout=2 hook took 12s)**: the post-kill pipe
+  drain waited 10s for an EOF that never comes on Windows (a pre-kill
+  grandchild holds the write end) — and the drained output was never consumed
+  anyway (hardcoded empty return). Now a 1s grace then abandon: a timeout=2
+  hook returns in ~3s. Windows grandchild leak documented as a known
+  limitation (the turn is no longer hostage; root fix = CREATE_SUSPENDED +
+  pre-assigned Job + stdin pipe through _create_process_with_token). Latency
+  regression test added (`elapsed < timeout + 2`), mutation-verified.
+- **Per-event budget (v3 P1: N hooks × 60s on every tool call)**: fire() now
+  enforces a 30s total budget per event (overridable on HookRunner for
+  tests). Each hook's timeout tightens to min(spec.timeout, budget
+  remaining); exhaustion skips the remaining hooks with an error note
+  (fail-open, consistent with the module's positioning).
+- **Subagents bypassed hooks (v3 #12)**: research and general-purpose
+  subagents both carry HooksMiddleware now (outermost, same order as the main
+  agent) — task() delegation can no longer sidestep PreToolUse/PostToolUse.
+  No middleware overhead when no hooks are configured.
+- **Repo [[hooks]] silently dropped user hooks (v3 P2)**: _merge replaces
+  lists wholesale, so a repo's hooks config wiped the user's protective
+  hooks. Hooks now APPEND across layers — user hooks first (first-blocker-
+  wins: the user's deny reason is what the model sees). The first and only
+  list-merge in the loader; every other key keeps replace semantics.
+- +7 tests (latency guard, budget skip/tighten, subagent middleware stacks ×3,
+  merge order). Mutation check: reintroducing the 10s drain turns the latency
+  test red (10.1s ≥ 4s bound) — the guard actually guards.
+
+### Fixed — 2026-08-18 self-audit (3 bugs + 3 warnings, all runtime-verified)
+- **BUG A · `--permission full` had no flag gate (claim vs code mismatch)**:
+  the 0.4.1 commit message and CHANGELOG claimed "full requires
+  --dangerously-skip-permissions" — no such gate existed; `--permission full`
+  alone ran with full access (verified end-to-end by an audit agent that
+  unintentionally ran three real model turns through it). The gate is real
+  now: full without the flag exits 1. +2 tests (negative and positive sides).
+  Fourth seam-class failure in project history (v1: deepagents↔coderio; v3:
+  config↔runtime, trust↔mcp_loader; this: message↔code) — new rule in the
+  audit report: every behavior claim in a commit message must have a
+  corresponding verified command output before release.
+- **BUG B · Windows NUL bypassed the confirm-mode TTY check**: `</dev/null`
+  (the classic CI idiom) makes `sys.stdin.isatty()` return True on Windows
+  (MSVCRT treats character devices as ttys) — the check passed, then
+  `input()` read NUL, EOFError'd, and crashed the agent mid-execution.
+  confirm/auto_edit are no longer valid headless values AT ALL (rejected
+  unconditionally); the interactive TUI is the only prompting surface.
+- **BUG C · the deny_write default was dead config for most users**:
+  SandboxFsConfig's `deny_write=["~/.coderio"]` default only applied when the
+  `[tools.sandbox_filesystem]` table EXISTED — users without the table got
+  fs_config=None, and bwrap's built-in layout had no deny_write, so sandboxed
+  commands could write ~/.coderio (config/credentials/TRUST STORE). The
+  sandbox runner now constructs the default config when fs_config is None;
+  explicit user configs (including `deny_write = []`) pass through unchanged.
+- **hooks budget skip-count was dead code**: `self.specs[len(self.specs):]`
+  is always the empty slice, so the "N hook(s) skipped" message always
+  printed "remaining" — the count never appeared (and no test asserted it).
+  Fixed with enumerate-indexed slicing (verified: 4 hooks skipped →
+  "4 hook(s) skipped").
+- **trust store `null` slipped the corruption guard**: JSON `null` parsed to
+  None and bypassed the `is not None` shape check, getting overwritten. All
+  non-dict JSON (including null) now leaves the store untouched.
+- **nested typer.Exit produced a misleading second error line**: typer.Exit
+  is a RuntimeError subclass, so the session-load failure's clean exit was
+  re-caught by "Runtime setup failed" and printed twice. Nested exits now
+  pass through with their original code and message.
+
 ## [0.4.1] — 2026-08-17
 
 ### Added
@@ -67,8 +167,6 @@ All notable changes to coderio are documented here. The format follows
   solely on the token stream; a non-streamed final message vanished. The
   final result is now always printed (after a separator in non-quiet mode).
 
-## [Unreleased]
-
 ## [0.4.0] — 2026-08-17
 
 ### Added

{coderio-0.4.1 → coderio-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coderio
-Version: 0.4.1
+Version: 0.4.2
 Summary: A skill-driven coding agent — structural harness, foldable thinking TUI, deepagents engine.
 Author: coderio contributors
 License-Expression: MIT
@@ -81,7 +81,7 @@ Core philosophy: **skills are the playbook, the harness is the discipline, tools
 - **SSRF-protected web_fetch**: scheme allowlist (http/https only), private/loopback/link-local IP blocking (incl. cloud metadata endpoints), per-hop redirect validation, and a 1 MB response cap.
 - **Multi-layer OS sandbox** (Linux real isolation): `sandbox_mode = "job" | "write"` — Job Object resource limits on Windows; bubblewrap namespace isolation on Linux (read-only root, read-write workspace, optional network cutoff, Claude-Code-compatible filesystem 4-tuple `allow_write`/`deny_write`/`deny_read`/`allow_read`).
 - **MCP support**: connect external MCP servers via `.mcp.json` (Claude Code-compatible format); stdio and HTTP transports; project-level config overrides user-level. `coderio mcp` CLI manages entries; MCP tools are gated by the permission system like built-in tools.
-- **Repo-config trust confirmation**: first time a repository's `.coderio/config.toml` or `.mcp.json` is seen, coderio shows what it contains (permission mode, base_url, MCP commands) and requires explicit confirmation — content-hashed, so upstream edits re-trigger the prompt. Cloning a hostile repo no longer means silent arbitrary code execution.
+- **Repo-config trust confirmation**: first time a repository's `.coderio/config.toml`, `.mcp.json`, **or project-layer skills** (with tools.py markers) is seen, coderio shows what it contains (permission mode, base_url, hook/MCP commands) and requires explicit confirmation — content-hashed, so upstream edits re-trigger the prompt. Cloning a hostile repo no longer means silent arbitrary code execution.
 - **Multiple providers + named profiles**: Zhipu GLM / StepFun coding plans (Anthropic protocol) + OpenAI-compatible endpoints; multiple profiles with runtime `/profile` switching.
 - **Headless mode**: `coderio run "task"` for one-shot, non-interactive runs (CI, scripting, benchmark harnesses).
 
@@ -314,7 +314,15 @@ command = "cat .hooks/conventions.txt"
 
 **Honest positioning**: hooks are an EXTENSIBILITY point, not a security boundary — timeout/crash/non-2 exits all fail-open (a broken hook must never brick the agent loop). Hard policy belongs to the permission gate + command blacklist. Repo-level hooks live in config.toml and ride the existing repo-config trust gate (cloning a hostile repo does not silently run its hooks).
 
-**v1 event set and non-goals**: SessionStart (once per session, resume included) / UserPromptSubmit (reject or inject) / PreToolUse (deny) / PostToolUse (append feedback) / Stop (notification-only — never fights the harness force-continue). Not in v1: SessionEnd (no injection point), Notification/SubagentStop/PreCompact, `updatedInput` rewriting, hook-allow skipping the permission prompt, parallel execution (v1 is serial; with multiple hooks the first blocker's reason wins but all hooks run).
+**Execution semantics**:
+- **Timeouts**: 60s per hook by default (`timeout` configurable); **30s per-event total budget** — when all matching hooks together exceed it, the rest are skipped (fail-open); one slow hook can't eat the whole turn
+- **Serial execution**: multiple hooks run in config order; the first blocker's reason wins, but every hook still runs (side effects preserved)
+- **Environment inheritance**: hooks inherit the full environment (including API keys) — only configure hook commands you trust
+- **Subagents are covered too**: research / general-purpose subagents both carry HooksMiddleware — `task()` delegation cannot bypass PreToolUse
+- **Merge semantics**: user-level `[[hooks]]` + project-level `[[hooks]]` **append** (user first — under first-blocker-wins, the user's protective hook's reason takes priority); a repo's config never drops the user's protections
+- Windows grandchild leak on timeout is a known limitation (the turn is no longer hostage; the root fix awaits the CREATE_SUSPENDED approach)
+
+**v1 event set and non-goals**: SessionStart (once per session, resume included) / UserPromptSubmit (reject or inject) / PreToolUse (deny) / PostToolUse (append feedback) / Stop (notification-only — never fights the harness force-continue). Not in v1: SessionEnd (no injection point), Notification/SubagentStop/PreCompact, `updatedInput` rewriting, hook-allow skipping the permission prompt.
 
 Supported providers:
 | provider_id | Description | Protocol |
@@ -343,9 +351,13 @@ coderio
 coderio --provider bigmodel_coding_plan --model glm-5.2
 
 # Headless one-shot run (CI / scripting / benchmarks)
-coderio run "write a hello-world script and test it"
-coderio run "fix the failing test in tests/foo.py" --quiet        # final result only
+coderio run "write a hello-world script and test it"              # default: plan (read-only)
+coderio run "fix the failing test in tests/foo.py" --quiet         # final result only
 coderio run "continue" --session-id <id>                           # resume a session
+coderio run "run any command" --dangerously-skip-permissions       # full access (explicit opt-in)
+coderio run "task" --timeout 600                                   # wall-clock timeout (recommended for CI)
+
+# headless exit codes: 0 success / 1 config error / 2 agent failure / 124 timeout
 
 # Manage skills (install pulls from GitHub; needs git on PATH)
 coderio skills list

{coderio-0.4.1 → coderio-0.4.2}/README.md

@@ -36,7 +36,7 @@
 - **命令审查层**：shell（execute）命令不受 virtual_mode 约束，所以额外加了一层 `CommandReviewMiddleware`——内置黑名单挡住 `rm -rf /`、`mkfs`、fork bomb、`dd of=/dev/`、shutdown 等破坏性命令（即使 FULL 模式也挡），用户可在 config.toml 追加 `blocked_commands`。这不是真 OS 沙箱（混淆命令可绕过正则），但能挡住绝大多数意外破坏。`network_allowed = false` 可完全禁用 web 工具（离线模式）
 - **多 provider + 命名 profile**：智谱 GLM / 阶跃 StepFun 的 coding plan（Anthropic 协议）+ OpenAI 兼容；支持多套配置 profile，`/profile` 运行时切换
 - **MCP 支持**：通过 `.mcp.json`（与 Claude Code 格式兼容）接入外部 MCP 服务器，自动加载它们的工具。支持 stdio（本地进程）和 HTTP（远程）两种传输。项目级 `.mcp.json` 覆盖用户级同名服务器
-- **仓库配置信任确认**：首次在某仓库检测到 `.coderio/config.toml` 或 `.mcp.json` 时，展示其内容（权限模式、base_url、MCP 命令）并要求显式确认——按内容 hash 记忆，上游改配置会重新触发确认。克隆恶意仓库不再等于静默任意代码执行
+- **仓库配置信任确认**：首次在某仓库检测到 `.coderio/config.toml`、`.mcp.json` **或项目级 skills**（含 tools.py 标注）时，展示其内容（权限模式、base_url、hook/MCP 命令）并要求显式确认——按内容 hash 记忆，上游改配置会重新触发确认。克隆恶意仓库不再等于静默任意代码执行
 - **web_fetch SSRF 防护**：scheme 白名单（仅 http/https）+ 私网/环回/链路本地 IP 拦截（含云元数据端点）+ 逐跳重定向校验 + 1MB 响应上限
 - **headless 模式**：`coderio run "任务"` 单次无交互运行（CI / 脚本 / benchmark 接入）
 
@@ -269,7 +269,15 @@ command = "cat .hooks/conventions.txt"
 
 **诚实定位**：hooks 是**扩展点不是安全边界**——超时/崩溃/非 2 退出码都 fail-open（一个坏 hook 绝不能搞死 agent loop）。硬策略请用权限审批 + 命令黑名单。项目级 hooks 写在 config.toml 里，自动被仓库信任门覆盖（克隆恶意仓库不会静默执行其 hooks）。
 
-**v1 事件集与不做的事**：SessionStart（每 session 一次，含 resume）/ UserPromptSubmit（可拒绝可注入）/ PreToolUse（可 deny）/ PostToolUse（追加反馈）/ Stop（通知型，不与 harness 续跑冲突）。不做：SessionEnd（无注入点）、Notification/SubagentStop/PreCompact、`updatedInput` 参数改写、hook allow 跳过权限弹窗、并行执行（v1 串行，多 hook 第一个 blocker 生效但全部执行）。
+**执行语义**：
+- **超时**：每个 hook 默认 60s（`timeout` 可配）；**单事件总预算 30s**——同事件所有 hook 合计超预算后，剩余 hook 跳过（fail-open），一个慢 hook 吃不光整个 turn
+- **串行执行**：多 hook 按配置顺序串行，第一个 blocker 的理由生效，但所有 hook 都会执行（副作用保留）
+- **环境继承**：hook 继承完整环境变量（含 API key）——只配置你信任的 hook 命令
+- **子 agent 同样受约束**：research / general-purpose 子 agent 都挂 HooksMiddleware，`task()` 委派无法绕过 PreToolUse
+- **合并语义**：用户级 `[[hooks]]` + 项目级 `[[hooks]]` **追加合并**（用户在前——首个 blocker 的优先理由来自用户的防护 hook），项目配置不会剔除用户防护
+- Windows 孙进程泄漏为已知 limitation（超时后 turn 不受挟持；根治待 CREATE_SUSPENDED 方案）
+
+**v1 事件集与不做的事**：SessionStart（每 session 一次，含 resume）/ UserPromptSubmit（可拒绝可注入）/ PreToolUse（可 deny）/ PostToolUse（追加反馈）/ Stop（通知型，不与 harness 续跑冲突）。不做：SessionEnd（无注入点）、Notification/SubagentStop/PreCompact、`updatedInput` 参数改写、hook allow 跳过权限弹窗。
 
 支持的 provider：
 | provider_id | 说明 | 协议 |
@@ -298,9 +306,13 @@ coderio
 coderio --provider bigmodel_coding_plan --model glm-5.2
 
 # headless 单次运行（CI / 脚本 / benchmark 接入）
-coderio run "写一个 hello-world 脚本并测试"
-coderio run "修复 tests/foo.py 里失败的测试" --quiet        # 只输出最终结果
-coderio run "继续" --session-id <id>                        # 续跑会话
+coderio run "写一个 hello-world 脚本并测试"                     # 默认 plan（只读）
+coderio run "修复 tests/foo.py 里失败的测试" --quiet            # 只输出最终结果
+coderio run "继续" --session-id <id>                            # 续跑会话
+coderio run "跑任意命令" --dangerously-skip-permissions         # full 权限（显式选择加入）
+coderio run "任务" --timeout 600                                # 墙钟超时（CI 建议）
+
+# headless 退出码：0 成功 / 1 配置错误 / 2 agent 执行失败 / 124 超时
 
 # 管理 skill（install 从 GitHub 拉取，需要 git 在 PATH）
 coderio skills list

{coderio-0.4.1 → coderio-0.4.2}/README_en.md

@@ -36,7 +36,7 @@ Core philosophy: **skills are the playbook, the harness is the discipline, tools
 - **SSRF-protected web_fetch**: scheme allowlist (http/https only), private/loopback/link-local IP blocking (incl. cloud metadata endpoints), per-hop redirect validation, and a 1 MB response cap.
 - **Multi-layer OS sandbox** (Linux real isolation): `sandbox_mode = "job" | "write"` — Job Object resource limits on Windows; bubblewrap namespace isolation on Linux (read-only root, read-write workspace, optional network cutoff, Claude-Code-compatible filesystem 4-tuple `allow_write`/`deny_write`/`deny_read`/`allow_read`).
 - **MCP support**: connect external MCP servers via `.mcp.json` (Claude Code-compatible format); stdio and HTTP transports; project-level config overrides user-level. `coderio mcp` CLI manages entries; MCP tools are gated by the permission system like built-in tools.
-- **Repo-config trust confirmation**: first time a repository's `.coderio/config.toml` or `.mcp.json` is seen, coderio shows what it contains (permission mode, base_url, MCP commands) and requires explicit confirmation — content-hashed, so upstream edits re-trigger the prompt. Cloning a hostile repo no longer means silent arbitrary code execution.
+- **Repo-config trust confirmation**: first time a repository's `.coderio/config.toml`, `.mcp.json`, **or project-layer skills** (with tools.py markers) is seen, coderio shows what it contains (permission mode, base_url, hook/MCP commands) and requires explicit confirmation — content-hashed, so upstream edits re-trigger the prompt. Cloning a hostile repo no longer means silent arbitrary code execution.
 - **Multiple providers + named profiles**: Zhipu GLM / StepFun coding plans (Anthropic protocol) + OpenAI-compatible endpoints; multiple profiles with runtime `/profile` switching.
 - **Headless mode**: `coderio run "task"` for one-shot, non-interactive runs (CI, scripting, benchmark harnesses).
 
@@ -269,7 +269,15 @@ command = "cat .hooks/conventions.txt"
 
 **Honest positioning**: hooks are an EXTENSIBILITY point, not a security boundary — timeout/crash/non-2 exits all fail-open (a broken hook must never brick the agent loop). Hard policy belongs to the permission gate + command blacklist. Repo-level hooks live in config.toml and ride the existing repo-config trust gate (cloning a hostile repo does not silently run its hooks).
 
-**v1 event set and non-goals**: SessionStart (once per session, resume included) / UserPromptSubmit (reject or inject) / PreToolUse (deny) / PostToolUse (append feedback) / Stop (notification-only — never fights the harness force-continue). Not in v1: SessionEnd (no injection point), Notification/SubagentStop/PreCompact, `updatedInput` rewriting, hook-allow skipping the permission prompt, parallel execution (v1 is serial; with multiple hooks the first blocker's reason wins but all hooks run).
+**Execution semantics**:
+- **Timeouts**: 60s per hook by default (`timeout` configurable); **30s per-event total budget** — when all matching hooks together exceed it, the rest are skipped (fail-open); one slow hook can't eat the whole turn
+- **Serial execution**: multiple hooks run in config order; the first blocker's reason wins, but every hook still runs (side effects preserved)
+- **Environment inheritance**: hooks inherit the full environment (including API keys) — only configure hook commands you trust
+- **Subagents are covered too**: research / general-purpose subagents both carry HooksMiddleware — `task()` delegation cannot bypass PreToolUse
+- **Merge semantics**: user-level `[[hooks]]` + project-level `[[hooks]]` **append** (user first — under first-blocker-wins, the user's protective hook's reason takes priority); a repo's config never drops the user's protections
+- Windows grandchild leak on timeout is a known limitation (the turn is no longer hostage; the root fix awaits the CREATE_SUSPENDED approach)
+
+**v1 event set and non-goals**: SessionStart (once per session, resume included) / UserPromptSubmit (reject or inject) / PreToolUse (deny) / PostToolUse (append feedback) / Stop (notification-only — never fights the harness force-continue). Not in v1: SessionEnd (no injection point), Notification/SubagentStop/PreCompact, `updatedInput` rewriting, hook-allow skipping the permission prompt.
 
 Supported providers:
 | provider_id | Description | Protocol |
@@ -298,9 +306,13 @@ coderio
 coderio --provider bigmodel_coding_plan --model glm-5.2
 
 # Headless one-shot run (CI / scripting / benchmarks)
-coderio run "write a hello-world script and test it"
-coderio run "fix the failing test in tests/foo.py" --quiet        # final result only
+coderio run "write a hello-world script and test it"              # default: plan (read-only)
+coderio run "fix the failing test in tests/foo.py" --quiet         # final result only
 coderio run "continue" --session-id <id>                           # resume a session
+coderio run "run any command" --dangerously-skip-permissions       # full access (explicit opt-in)
+coderio run "task" --timeout 600                                   # wall-clock timeout (recommended for CI)
+
+# headless exit codes: 0 success / 1 config error / 2 agent failure / 124 timeout
 
 # Manage skills (install pulls from GitHub; needs git on PATH)
 coderio skills list

{coderio-0.4.1 → coderio-0.4.2}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "coderio"
-version = "0.4.1"
+version = "0.4.2"
 description = "A skill-driven coding agent — structural harness, foldable thinking TUI, deepagents engine."
 readme = "README_en.md"
 license = "MIT"

{coderio-0.4.1 → coderio-0.4.2}/src/coderio/agent/_deepagents_compat.py

@@ -97,22 +97,48 @@ class _ToolWhitelistMiddleware(AgentMiddleware):
 
     Wraps the same ModelRequest.override + filter mechanism as
     ``_ToolExclusionMiddleware`` but inverts the predicate.
+
+    Runtime failures degrade to an EMPTY tool set (deny-all), never to the
+    unfiltered original — a broken research subagent is preferable to a
+    research subagent that can suddenly see write/execute tools (v3 audit #11
+    reversed the old fail-open direction).
     """
 
     def __init__(self, *, allowed: frozenset[str]) -> None:
         self._allowed = allowed
 
     def wrap_model_call(self, request, handler):
-        if self._allowed:
+        try:
             filtered = [t for t in request.tools if _tool_name(t) in self._allowed]
-            request = request.override(tools=filtered)
-        return handler(request)
+            return handler(request.override(tools=filtered))
+        except Exception as e:  # noqa: BLE001 — degrade to deny-all, never fail-open
+            _log.warning("tool whitelist failed at runtime (degrading to NO tools): %s", e)
+            return handler(request.override(tools=[]))
 
     async def awrap_model_call(self, request, handler):
-        if self._allowed:
+        try:
             filtered = [t for t in request.tools if _tool_name(t) in self._allowed]
-            request = request.override(tools=filtered)
-        return await handler(request)
+            return await handler(request.override(tools=filtered))
+        except Exception as e:  # noqa: BLE001 — degrade to deny-all, never fail-open
+            _log.warning("tool whitelist failed at runtime (degrading to NO tools): %s", e)
+            return await handler(request.override(tools=[]))
+
+
+class _DenyAllToolsMiddleware(AgentMiddleware):
+    """Last-resort middleware: the model sees ZERO tools.
+
+    Returned when the whitelist middleware itself cannot be constructed — the
+    research subagent becomes useless but stays harmless (v3 audit #11: the
+    old fallback was an EMPTY middleware list, i.e. the subagent inherited
+    EVERY tool including write/execute — fail-open in the most dangerous
+    direction).
+    """
+
+    def wrap_model_call(self, request, handler):
+        return handler(request.override(tools=[]))
+
+    async def awrap_model_call(self, request, handler):
+        return await handler(request.override(tools=[]))
 
 
 def make_research_subagent_middleware():
@@ -126,8 +152,8 @@ def make_research_subagent_middleware():
 
     Returns a list with a _ToolWhitelistMiddleware. If the deepagents
     AgentMiddleware base class API is unavailable (very old or very new
-    version), returns an empty list — the subagent will inherit all tools
-    (less safe, but won't crash).
+    version), falls back to _DenyAllToolsMiddleware — the subagent sees no
+    tools rather than all of them (fail-closed; v3 audit #11).
     """
     # Read-only tools the research subagent is allowed to use. Add new tools
     # here ONLY after confirming they're safe for a read-only agent.
@@ -135,5 +161,8 @@ def make_research_subagent_middleware():
     try:
         return [_ToolWhitelistMiddleware(allowed=allowed)]
     except Exception as e:  # noqa: BLE001 — AgentMiddleware API may differ
-        _log.warning("Could not build _ToolWhitelistMiddleware: %s", e)
-        return []
+        _log.warning("Could not build _ToolWhitelistMiddleware (deny-all fallback): %s", e)
+        try:
+            return [_DenyAllToolsMiddleware()]
+        except Exception:  # noqa: BLE001 — even the fallback construction failed
+            return []

{coderio-0.4.1 → coderio-0.4.2}/src/coderio/agent/deep_loop.py

@@ -298,14 +298,38 @@ def _build_extra_tools(tools, skill_store, active_skills):
     return extra
 
 
-def _build_research_subagent():
+def _build_research_subagent(gate=None, command_policy=None, hook_runner=None):
     """Return the research subagent spec (read-only, physically isolated).
 
     Tool exclusion uses the compat layer (_deepagents_compat) so that a
     deepagents API change degrades gracefully instead of crashing.
+
+    HooksMiddleware (2026-08-14 v3 audit #12): without it, ``task()``-delegated
+    work bypassed the user's PreToolUse/PostToolUse hooks entirely. The runner
+    is shared with the main agent (stateless across fire() calls).
+
+    Permission + CommandReview (v3 audit #11): execution-time enforcement on
+    top of the model-visibility whitelist — the whitelist filters what the
+    model SEES, these middlewares gate what actually RUNS. Belt and braces:
+    a whitelist bug or a future tool name collision can no longer turn the
+    "read-only" subagent into a writing one.
     """
     from coderio.agent._deepagents_compat import make_research_subagent_middleware
 
+    middleware = make_research_subagent_middleware()
+    if hook_runner is not None and hook_runner.specs:
+        from coderio.agent.hooks import HooksMiddleware
+
+        middleware.insert(0, HooksMiddleware(hook_runner))
+    if gate is not None:
+        from coderio.agent.permission_middleware import PermissionMiddleware
+
+        middleware.append(PermissionMiddleware(gate))
+    from coderio.agent.command_review import CommandReviewMiddleware
+    from coderio.tools.command_policy import CommandPolicy
+
+    policy = command_policy or CommandPolicy.default()
+    middleware.append(CommandReviewMiddleware(policy, gate=gate))
     return {
         "name": "research",
         "description": (
@@ -330,11 +354,11 @@ def _build_research_subagent():
             "- The calling agent only sees your final message, not your "
             "intermediate tool calls — make sure your answer is complete."
         ),
-        "middleware": make_research_subagent_middleware(),
+        "middleware": middleware,
     }
 
 
-def _build_general_purpose_subagent(gate, command_policy, stream=None):
+def _build_general_purpose_subagent(gate, command_policy, stream=None, hook_runner=None):
     """Return the general-purpose subagent spec with coderio's security middleware.
 
     SECURITY FIX (2026-08-14 report P0-2): deepagents auto-injects a
@@ -359,13 +383,23 @@ def _build_general_purpose_subagent(gate, command_policy, stream=None):
     is per-agent, not shared — the main gate can't see subagent tool calls
     anyway), whose force-continue applies inside the subagent's loop. This
     makes the subagent itself refuse to say "done" with unverified writes.
+
+    2026-08-14 v3 audit #12: also inject HooksMiddleware (outermost, same as
+    the main agent) — without it, task()-delegated work bypassed the user's
+    PreToolUse/PostToolUse hooks. The runner is shared (stateless fire()).
     """
     from coderio.agent.command_review import CommandReviewMiddleware
     from coderio.agent.harness_middleware import HarnessMiddleware
     from coderio.tools.command_policy import CommandPolicy
 
     middleware = []
-    # Harness first (same order as the main agent — see run_deep_agent): it
+    # Hooks OUTERMOST (same order as the main agent): a hook deny happens
+    # before any other layer — including this subagent's permission prompts.
+    if hook_runner is not None and hook_runner.specs:
+        from coderio.agent.hooks import HooksMiddleware
+
+        middleware.append(HooksMiddleware(hook_runner))
+    # Harness next (same order as the main agent — see run_deep_agent): it
     # observes every tool call the permission/command layers let through.
     middleware.append(HarnessMiddleware(stream=stream))
     if gate is not None:
@@ -553,8 +587,8 @@ def run_deep_agent(
         "middleware": middleware,
         "backend": backend,
         "subagents": [
-            _build_research_subagent(),
-            _build_general_purpose_subagent(gate, command_policy, stream=stream),
+            _build_research_subagent(gate=gate, command_policy=command_policy, hook_runner=hook_runner),
+            _build_general_purpose_subagent(gate, command_policy, stream=stream, hook_runner=hook_runner),
         ],
     }
     if sp:

{coderio-0.4.1 → coderio-0.4.2}/src/coderio/agent/hooks.py

@@ -50,6 +50,11 @@ _TOOL_EVENTS = frozenset({"PreToolUse", "PostToolUse"})
 
 DEFAULT_TIMEOUT = 60  # seconds; generous for linters, short enough not to brick a turn
 
+# Per-EVENT total budget (v3 audit P1: serial hooks × 60s each would hang every
+# tool call). Covers ALL matching hooks for one event fire; exhaustion skips
+# the rest (fail-open). Overridable per HookRunner for tests.
+DEFAULT_EVENT_BUDGET = 30.0
+
 # stdout beyond this is dropped rather than injected (context budget guard).
 _MAX_CONTEXT_CHARS = 10_000
 
@@ -108,12 +113,18 @@ class HookRunner:
     _sessions_started: set[str] = set()
 
     def __init__(
-        self, specs: list[HookSpec] | None, project_dir: str, session_id: str = "", permission_mode: str = ""
+        self,
+        specs: list[HookSpec] | None,
+        project_dir: str,
+        session_id: str = "",
+        permission_mode: str = "",
+        event_budget: float = DEFAULT_EVENT_BUDGET,
     ) -> None:
         self.specs = [s for s in (specs or []) if s.event in HOOK_EVENTS]
         self.project_dir = project_dir
         self.session_id = session_id
         self.permission_mode = permission_mode
+        self.event_budget = event_budget
 
     def has_event(self, event: str) -> bool:
         return any(s.event == event for s in self.specs)
@@ -125,16 +136,41 @@ class HookRunner:
         multi-hook semantics non-deterministic; determinism wins for a coding
         agent. First blocker wins; later hooks still run (their side effects
         are the point — e.g. logging — even when the event is already denied).
+
+        A per-EVENT budget (v3 audit P1: N hooks × 60s hanging on EVERY tool
+        call) caps the total time all matching hooks may take; when exhausted,
+        remaining hooks are skipped with an error note (fail-open — consistent
+        with the module's positioning: budget exhaustion never blocks).
         """
+        import time
+
         tool_name = str(payload.get("tool_name", ""))
         outcome = HookOutcome()
+        deadline = time.monotonic() + self.event_budget
         try:
-            for spec in self.specs:
+            for i, spec in enumerate(self.specs):
                 if spec.event != event:
                     continue
                 if event in _TOOL_EVENTS and not spec.matches(tool_name):
                     continue
-                self._run_one(spec, event, payload, outcome)
+                remaining = deadline - time.monotonic()
+                if remaining <= 0:
+                    # Count the matching hooks NOT yet reached (self-audit
+                    # 2026-08-18: the old slice self.specs[len(self.specs):]
+                    # was always empty — the count never appeared). Filter by
+                    # matcher too: a same-event hook whose matcher wouldn't
+                    # have run anyway is not "skipped" (third-party audit
+                    # caught the overcount).
+                    pending = [
+                        s
+                        for s in self.specs[i:]
+                        if s.event == event and (event not in _TOOL_EVENTS or s.matches(tool_name))
+                    ]
+                    outcome.error += (
+                        f"event budget ({self.event_budget}s) exhausted — {len(pending)} hook(s) skipped (fail-open); "
+                    )
+                    break
+                self._run_one(spec, event, payload, outcome, remaining)
         except Exception as e:  # noqa: BLE001 — a hook-layer bug must never break the turn
             outcome.error += f"hook engine error (fail-open): {e}; "
         # CONSUME the error (2026-08-14 v3 audit P1): a broken hook (missing
@@ -147,7 +183,14 @@ class HookRunner:
 
     # ------------------------------------------------------------------ execution
 
-    def _run_one(self, spec: HookSpec, event: str, payload: dict[str, Any], outcome: HookOutcome) -> None:
+    def _run_one(
+        self,
+        spec: HookSpec,
+        event: str,
+        payload: dict[str, Any],
+        outcome: HookOutcome,
+        remaining: float,
+    ) -> None:
         stdin_json = json.dumps(
             {
                 "session_id": self.session_id,
@@ -159,13 +202,13 @@ class HookRunner:
             default=str,
         )
         try:
-            exit_code, stdout, stderr, timed_out = self._spawn(spec, stdin_json)
+            exit_code, stdout, stderr, timed_out, effective_timeout = self._spawn(spec, stdin_json, remaining)
         except Exception as e:  # noqa: BLE001 — a broken hook must never crash the agent
             outcome.error += f"hook {spec.command!r} failed to run: {e} (fail-open); "
             return
 
         if timed_out:
-            outcome.error += f"hook {spec.command!r} timed out after {spec.timeout}s (fail-open); "
+            outcome.error += f"hook {spec.command!r} timed out after {effective_timeout}s (fail-open); "
             return
 
         # New names, not reusing stdout/stderr: mypy pins a variable's type to
@@ -196,12 +239,16 @@ class HookRunner:
             else:
                 outcome.context += ("\n" if outcome.context else "") + text
 
-    def _spawn(self, spec: HookSpec, stdin_json: str) -> tuple[int, bytes, bytes, bool]:
-        """Run the hook command with JSON on stdin. Returns (exit_code, stdout, stderr, timed_out).
+    def _spawn(self, spec: HookSpec, stdin_json: str, remaining: float) -> tuple[int, bytes, bytes, bool, int]:
+        """Run the hook command with JSON on stdin.
+
+        Returns (exit_code, stdout, stderr, timed_out, effective_timeout).
+        effective_timeout = min(spec.timeout, event-budget remaining) — the
+        per-event budget tightens each hook so one slow hook can't starve the
+        rest of the turn (v3 audit P1).
 
         On Windows prefers Git Bash (via detect_shell, same as the bash tool)
-        so POSIX-style commands behave; POSIX uses /bin/sh. Timeout kills the
-        whole process tree (kill_process_tree) so piped children don't linger.
+        so POSIX-style commands behave; POSIX uses /bin/sh.
         """
         import os
 
@@ -235,16 +282,29 @@ class HookRunner:
             env=env,
             start_new_session=(sys.platform != "win32"),
         )
+        # ceil, not int(): remaining ≈ budget-ε on the first hook, and int()
+        # truncation would cut a 2s budget to 1s (caught by the CI OS matrix —
+        # deterministic on POSIX, timing-jitter-lucky on Windows).
+        import math
+
+        effective_timeout = max(1, min(spec.timeout, math.ceil(remaining)))
         try:
-            stdout, stderr = proc.communicate(input=stdin_json.encode("utf-8"), timeout=spec.timeout)
-            return proc.returncode, stdout or b"", stderr or b"", False
+            stdout, stderr = proc.communicate(input=stdin_json.encode("utf-8"), timeout=effective_timeout)
+            return proc.returncode, stdout or b"", stderr or b"", False, effective_timeout
         except subprocess.TimeoutExpired:
             kill_process_tree(proc)
+            # One-second grace, then abandon (v3 audit P1: the old 10s drain
+            # waited out pipe EOF that never comes when a pre-kill grandchild
+            # holds the write end on Windows — a timeout=2 hook took 12s). The
+            # output of a TIMED-OUT hook is never consumed anyway (hardcoded
+            # empty return), so there is nothing to wait for. Known limitation:
+            # kill_process_tree may miss Windows grandchildren forked before
+            # the job assignment; they leak but can no longer stall the turn.
             try:
-                proc.communicate(timeout=10)
-            except Exception:  # noqa: S110 — the kill already ran; drain best-effort
+                proc.communicate(timeout=1)
+            except Exception:  # noqa: S110 — grace expired; the kill already ran
                 pass
-            return 124, b"", b"", True
+            return 124, b"", b"", True, effective_timeout
 
 
 class HooksMiddleware(AgentMiddleware):

{coderio-0.4.1 → coderio-0.4.2}/src/coderio/cli/app.py

@@ -183,19 +183,32 @@ def run_cmd(
     provider: str = typer.Option(None, "--provider", help="Override provider_id."),
     model: str = typer.Option(None, "--model", help="Override model name."),
     permission: str = typer.Option(
-        "full",
+        "plan",
         "--permission",
         "-p",
-        help="Permission tier: full (default, headless can't answer prompts), plan, confirm, auto_edit.",
+        help="Permission tier: plan (default, read-only) or full (needs --dangerously-skip-permissions).",
     ),
     session_id: str = typer.Option(None, "--session-id", help="Resume a prior session by id."),
     quiet: bool = typer.Option(False, "--quiet", "-q", help="Print only the final result."),
+    skip_permissions: bool = typer.Option(
+        False,
+        "--dangerously-skip-permissions",
+        help="Run with full permissions (no prompts). Explicit opt-in — headless default is read-only plan mode.",
+    ),
+    timeout: int = typer.Option(
+        0,
+        "--timeout",
+        help="Wall-clock limit in seconds (0 = unlimited). On timeout: exit 124. Recommended for CI.",
+    ),
 ):
     """One-shot headless agent run (CI / scripting / benchmarks).
 
     Streams tokens to stdout by default; tool progress goes to stderr. Never
     prompts interactively — untrusted repo config or missing credentials are
-    hard errors. The command blacklist still applies in full mode.
+    hard errors. Default permission is plan (read-only); use
+    --dangerously-skip-permissions for full access. Exit codes: 0 success,
+    1 config error, 2 agent failure, 124 timeout. The command blacklist
+    still applies in every mode.
     """
     from coderio.cli.run_cmd import run_headless
 
@@ -206,6 +219,8 @@ def run_cmd(
         permission=permission,
         session_id=session_id,
         quiet=quiet,
+        skip_permissions=skip_permissions,
+        timeout=timeout,
     )