coderio 0.4.1__tar.gz → 0.4.3__tar.gz

{coderio-0.4.1 → coderio-0.4.3}/CHANGELOG.md

@@ -6,6 +6,124 @@ All notable changes to coderio are documented here. The format follows
 `pyproject.toml`'s `[project].version` — `coderio.__version__` reads it via
 `importlib.metadata`.
 
+## [0.4.3] — 2026-08-21
+
+### Security — P1/P2 hardening (audit-verified, adversarial + mutation tested)
+- **command_policy**: replaced fragile `_RM_RECURSIVE_PREFIX` regex (failed on
+  `rm -fr /` and `--recursive --force`) with Python-level `_check_recursive_rm()`
+  that tokenizes the command and correctly detects recursive flags in any order.
+  All flag permutations now blocked: `rm -rf /`, `rm -fr /`, `rm -r -f /`,
+  `rm --recursive --force /`, `rm --RECURSIVE /`, `rm -rf ~/`, `rm -rf $HOME/`,
+  `rm -rf *`. False positives eliminated: `rm -f /etc/passwd`, `rm --Force /`,
+  `echo rm -rf /`.
+- **win_sandbox**: reverted `_dict_to_env_block` env-forwarding plumbing that
+  broke `CreateProcessAsUserW` on Win32. `lpEnvironment=None` preserves parent
+  env inheritance (safest path). Known limitation documented for future work.
+- **loader**: `_find_project_dir` now accepts `str | Path` (CLI may pass str).
+- **test_seams**: new 22-test seam suite covering command_policy↔middleware,
+  loader↔repl↔skills, deep_loop↔sandbox_runner↔win_sandbox boundaries.
+  All existing tests (884 passed) + seams (22 passed) green.
+
+## [0.4.2] — 2026-08-18
+
+### Security — v3 audit short-term batch (#7/#8/#9/#11/#14, all runtime-verified)
+- **#7 · headless default permission full → plan**: a headless entry that
+  silently allowed everything was a zero-confirmation door. `coderio run` now
+  defaults to read-only plan; full requires the explicit
+  `--dangerously-skip-permissions` flag (Claude Code's name for the same
+  escape hatch). confirm/auto_edit fail fast without a TTY (the gate is lazy,
+  so input() would otherwise EOFError mid-execution); invalid --permission
+  values are rejected up front.
+- **#8 · project-layer skills join the trust gate**: a repo shipping ONLY
+  `.coderio/skills` previously loaded them with zero confirmation — yet skills
+  enter the system prompt and may carry tools.py that exec's on activation.
+  Skills now participate in discovery + content fingerprint (per-file hash;
+  any skill edit re-triggers the prompt), and the confirmation summary marks
+  skills carrying tools.py with "⚠ executes code". tools.py load failures are
+  logged, no longer silent.
+- **#9 · trust store hardening**: the store gets owner-only permissions
+  (POSIX 0600 / Windows icacls, reusing the credentials helper); a corrupt
+  store is left untouched instead of being reset (the old reset destroyed
+  every other repo's trust entries); `SandboxFsConfig.deny_write` now
+  defaults to `["~/.coderio"]` so sandboxed commands can't rewrite the
+  config/credentials/trust store (explicit `deny_write = []` opts out;
+  Linux bwrap only — Windows sandbox is a no-op today).
+- **#11 · research subagent execution-time enforcement**: PermissionMiddleware
+  + CommandReviewMiddleware now ride the research subagent (the tool
+  whitelist filters what the model SEES; these gate what actually RUNS).
+  Failover direction reversed: a whitelist that cannot be constructed — or
+  fails at runtime — degrades to a DENY-ALL middleware (zero tools), not to
+  the old no-middleware state that inherited every tool including
+  write/execute.
+- **#14 · headless wall-clock timeout + exit codes**: `--timeout <seconds>`
+  (thread+join; SIGALRM doesn't exist on Windows) exits 124 on expiry;
+  agent execution failures exit 2 (distinct from config errors' 1); success
+  0. Documented in README for CI use.
+
+### Fixed — hooks completion (2026-08-14 v3 audit P1/P2 items)
+- **Timeout latency (v3 P1: timeout=2 hook took 12s)**: the post-kill pipe
+  drain waited 10s for an EOF that never comes on Windows (a pre-kill
+  grandchild holds the write end) — and the drained output was never consumed
+  anyway (hardcoded empty return). Now a 1s grace then abandon: a timeout=2
+  hook returns in ~3s. Windows grandchild leak documented as a known
+  limitation (the turn is no longer hostage; root fix = CREATE_SUSPENDED +
+  pre-assigned Job + stdin pipe through _create_process_with_token). Latency
+  regression test added (`elapsed < timeout + 2`), mutation-verified.
+- **Per-event budget (v3 P1: N hooks × 60s on every tool call)**: fire() now
+  enforces a 30s total budget per event (overridable on HookRunner for
+  tests). Each hook's timeout tightens to min(spec.timeout, budget
+  remaining); exhaustion skips the remaining hooks with an error note
+  (fail-open, consistent with the module's positioning).
+- **Subagents bypassed hooks (v3 #12)**: research and general-purpose
+  subagents both carry HooksMiddleware now (outermost, same order as the main
+  agent) — task() delegation can no longer sidestep PreToolUse/PostToolUse.
+  No middleware overhead when no hooks are configured.
+- **Repo [[hooks]] silently dropped user hooks (v3 P2)**: _merge replaces
+  lists wholesale, so a repo's hooks config wiped the user's protective
+  hooks. Hooks now APPEND across layers — user hooks first (first-blocker-
+  wins: the user's deny reason is what the model sees). The first and only
+  list-merge in the loader; every other key keeps replace semantics.
+- +7 tests (latency guard, budget skip/tighten, subagent middleware stacks ×3,
+  merge order). Mutation check: reintroducing the 10s drain turns the latency
+  test red (10.1s ≥ 4s bound) — the guard actually guards.
+
+### Fixed — 2026-08-18 self-audit (3 bugs + 3 warnings, all runtime-verified)
+- **BUG A · `--permission full` had no flag gate (claim vs code mismatch)**:
+  the 0.4.1 commit message and CHANGELOG claimed "full requires
+  --dangerously-skip-permissions" — no such gate existed; `--permission full`
+  alone ran with full access (verified end-to-end by an audit agent that
+  unintentionally ran three real model turns through it). The gate is real
+  now: full without the flag exits 1. +2 tests (negative and positive sides).
+  Fourth seam-class failure in project history (v1: deepagents↔coderio; v3:
+  config↔runtime, trust↔mcp_loader; this: message↔code) — new rule in the
+  audit report: every behavior claim in a commit message must have a
+  corresponding verified command output before release.
+- **BUG B · Windows NUL bypassed the confirm-mode TTY check**: `</dev/null`
+  (the classic CI idiom) makes `sys.stdin.isatty()` return True on Windows
+  (MSVCRT treats character devices as ttys) — the check passed, then
+  `input()` read NUL, EOFError'd, and crashed the agent mid-execution.
+  confirm/auto_edit are no longer valid headless values AT ALL (rejected
+  unconditionally); the interactive TUI is the only prompting surface.
+- **BUG C · the deny_write default was dead config for most users**:
+  SandboxFsConfig's `deny_write=["~/.coderio"]` default only applied when the
+  `[tools.sandbox_filesystem]` table EXISTED — users without the table got
+  fs_config=None, and bwrap's built-in layout had no deny_write, so sandboxed
+  commands could write ~/.coderio (config/credentials/TRUST STORE). The
+  sandbox runner now constructs the default config when fs_config is None;
+  explicit user configs (including `deny_write = []`) pass through unchanged.
+- **hooks budget skip-count was dead code**: `self.specs[len(self.specs):]`
+  is always the empty slice, so the "N hook(s) skipped" message always
+  printed "remaining" — the count never appeared (and no test asserted it).
+  Fixed with enumerate-indexed slicing (verified: 4 hooks skipped →
+  "4 hook(s) skipped").
+- **trust store `null` slipped the corruption guard**: JSON `null` parsed to
+  None and bypassed the `is not None` shape check, getting overwritten. All
+  non-dict JSON (including null) now leaves the store untouched.
+- **nested typer.Exit produced a misleading second error line**: typer.Exit
+  is a RuntimeError subclass, so the session-load failure's clean exit was
+  re-caught by "Runtime setup failed" and printed twice. Nested exits now
+  pass through with their original code and message.
+
 ## [0.4.1] — 2026-08-17
 
 ### Added
@@ -67,8 +185,6 @@ All notable changes to coderio are documented here. The format follows
   solely on the token stream; a non-streamed final message vanished. The
   final result is now always printed (after a separator in non-quiet mode).
 
-## [Unreleased]
-
 ## [0.4.0] — 2026-08-17
 
 ### Added

coderio-0.4.3/PKG-INFO

@@ -0,0 +1,148 @@
+Metadata-Version: 2.5
+Name: coderio
+Version: 0.4.3
+Summary: A skill-driven coding agent — structural harness, foldable thinking TUI, deepagents engine.
+Author: coderio contributors
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agent,ai-agent,cli,coding-agent,langchain,langgraph,llm,mcp,model-context-protocol,sandbox,skills,textual,tui
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Code Generators
+Requires-Python: >=3.11
+Requires-Dist: ddgs>=4.0
+Requires-Dist: deepagents>=0.6
+Requires-Dist: httpx>=0.27
+Requires-Dist: langchain-anthropic>=0.2
+Requires-Dist: langchain-core>=0.3
+Requires-Dist: langchain-openai>=0.2
+Requires-Dist: langchain>=0.3
+Requires-Dist: langgraph-checkpoint-sqlite>=2.0
+Requires-Dist: langgraph>=0.2
+Requires-Dist: pydantic>=2
+Requires-Dist: rich>=13
+Requires-Dist: textual>=0.40
+Requires-Dist: tomli-w>=1.0
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
+Requires-Dist: pytest-cov>=4; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.16; extra == 'dev'
+Provides-Extra: mcp
+Requires-Dist: langchain-mcp-adapters>=0.3.2; extra == 'mcp'
+Description-Content-Type: text/markdown
+
+# coderio
+
+[中文](README.md) | **English**
+
+> The agent claims "done" without running the tests? coderio's harness stops it.
+> A local coding agent with **native Zhipu GLM & StepFun Step coding-plan support** — four-tier permissions, layered sandbox, MCP, lifecycle hooks, and an interactive TUI.
+
+![demo](demo.gif)
+
+## Install
+
+```bash
+pip install coderio
+coderio    # onboarding wizard on first launch (pick provider, paste API key, auto context-window probe)
+```
+
+Requires Python 3.11+; Git Bash on Windows. Linux / macOS supported.
+
+## Why coderio
+
+The shared weakness of coding agents: **the model says "I'm done" and you just have to trust it**. coderio turns that sentence into a structural constraint—
+
+### The Four Gates: the agent can't lie to you
+
+| Gate | Behavior |
+|---|---|
+| **VerifyGate** | Wrote code, never ran it, wants to finish → intercepted, forced to continue. Parses real exit codes — **a failing test run does NOT count as verified** |
+| **CompletionGate** | Declares done with pending todos → intercepted |
+| **GroundingGate** | Cites files it never read → intercepted |
+| **PlanGate** | Writes code without a todo list → soft nudge |
+
+Not a prompt-level soft rule — a system-level control based on tool-call ground truth. Claude Code and Codex don't have this.
+
+### Native Chinese coding-plan support
+
+Zhipu **GLM Coding Plan** and StepFun **Step Plan** work out of the box (direct Anthropic-protocol connection) — your subscription quota runs a local agent, no proxies, no middle layer. Also supports OpenAI / Anthropic / Ollama / any OpenAI-compatible endpoint, with multi-profile switching.
+
+### Layered security, honestly stated
+
+- Four permission tiers (plan read-only / confirm per-action / auto_edit / full)
+- Command blacklist + whitelist (accident prevention); Linux bubblewrap OS sandbox (boundary enforcement)
+- First-use repo-config trust confirmation (hostile-repo protection); web_fetch SSRF protection
+- The blacklist/whitelist are **accident prevention, not adversarial defense** — adversarial protection comes from the sandbox + permissions; use a VM for hostile code
+
+## Feature highlights
+
+- **Interactive TUI**: streaming output, foldable thinking (Ctrl+O), collapsible TODO panel, vertical permission menu, task interruption (Esc), slash-command autocomplete, session management
+- **Headless mode**: `coderio run "task"` one-shot execution (CI / scripts / benchmarks) with graded exit codes
+- **MCP support**: connect external tools via `.mcp.json` (Claude Code-compatible format), managed with `coderio mcp`
+- **Lifecycle hooks**: `[[hooks]]` run your commands at PreToolUse / PostToolUse / UserPromptSubmit (exit 2 = block) — IO contract compatible with Claude Code
+- **Three-layer skills**: bundled + user + project, progressive disclosure saves context
+- **Context governance**: auto-compaction (60% window trigger), large-block offload, sqlite checkpoints across turns
+- **Subagents**: research (read-only, double-enforced) + general-purpose (inherits the main agent's full security stack)
+- **Engineering discipline**: 850+ tests, 80% coverage, mypy hard gate, uv.lock, 3 OS × 2 Python CI matrix
+
+<details>
+<summary><b>Config example</b> (click to expand)</summary>
+
+```toml
+# ~/.coderio/config.toml
+[model]
+provider_id = "bigmodel_coding_plan"   # Zhipu/StepFun coding plan, or openai/anthropic/ollama/custom
+default = "glm-5.2"
+
+[tools]
+permission_mode = "confirm"            # plan | confirm | auto_edit | full
+sandbox_mode = "off"                   # off | job (resource limits) | write (Linux file-write isolation)
+
+# Lifecycle hooks (Claude Code-compatible contract)
+[[hooks]]
+event = "PreToolUse"
+matcher = "write_file|edit_file"
+command = "python .hooks/protect.py"   # JSON on stdin; exit 2 = block
+```
+
+MCP, the sandbox 4-tuple, and more: [docs/coderio-architecture.md](docs/coderio-architecture.md).
+
+</details>
+
+## Common commands
+
+```bash
+coderio                                              # interactive TUI
+coderio run "fix the failing test" --quiet           # headless one-shot
+coderio run "task" --dangerously-skip-permissions    # full access (explicit opt-in)
+coderio mcp add github --type http --url ...          # manage MCP
+coderio skills install                               # install skill suites
+```
+
+Type `/` inside the TUI for all commands (/resume sessions, /mode permissions, /profile configs, /think unfold reasoning).
+
+## Known limitations
+
+- The Windows write-sandbox currently equals job mode (true isolation awaits the ACL work — documented honestly)
+- Blacklist/whitelist are accident-prevention by design (regex can be bypassed by obfuscation); use the sandbox / a VM for adversarial scenarios
+
+## Origin
+
+A spare-time project, open-sourced as a working reference for developers building their own coding agents. The name is **code + rio** (the author's English name is Lion; "codelion" sounded odd).
+
+## Contributing & License
+
+Issues and PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). MIT License.

coderio-0.4.3/README.md

@@ -0,0 +1,103 @@
+# coderio
+
+**中文** | [English](README_en.md)
+
+> 写了代码没跑过测试就说"完成"？coderio 的 harness 会拦住它。
+> 一个**原生支持智谱 GLM / 阶跃 StepFun Coding Plan** 的本地 coding agent——四级权限、多层沙箱、MCP、生命周期 hooks、交互式 TUI。
+
+![demo](demo.gif)
+
+## 安装
+
+```bash
+pip install coderio
+coderio    # 首次启动进入 onboarding 向导（选 provider、填 API key、自动探测上下文窗口）
+```
+
+要求：Python 3.11+；Windows 需 Git Bash。支持 Linux / macOS。
+
+## 为什么是 coderio
+
+市面上 coding agent 的共同软肋：**模型说"我做完了"，你就得信**。coderio 把这句话变成了结构约束——
+
+### 四道门：agent 骗不了你
+
+| 门 | 行为 |
+|---|---|
+| **VerifyGate** | 写了代码没跑验证就想结束 → 拦截、强制续跑。解析真实 exit code，**测试失败不算验证通过** |
+| **CompletionGate** | TODO 没清完就宣布完成 → 拦截 |
+| **GroundingGate** | 引用从未读过的文件下结论 → 拦截 |
+| **PlanGate** | 没 TODO 就动手写码 → 软提醒 |
+
+不是提示词软规则，是基于工具调用 ground truth 的系统级控制。Claude Code / Codex 都没有这个。
+
+### 原生支持中文 Coding Plan
+
+智谱 **GLM Coding Plan** 和阶跃 **StepFun Step Plan** 开箱即用（Anthropic 协议直连）——你的订阅额度跑本地 agent，不需要转发、不需要中间层。同时支持 OpenAI / Anthropic / Ollama / 任意 OpenAI 兼容端点，多 profile 一键切换。
+
+### 多层安全，诚实声明
+
+- 四级权限（plan 只读 / confirm 逐项确认 / auto_edit / full）
+- 命令黑名单 + 白名单（防手滑）；Linux bubblewrap OS 级沙箱（防越界写）
+- 仓库配置首次信任确认（防克隆恶意仓库）；web_fetch SSRF 防护
+- 黑白名单是**防手滑不是防对抗**——对抗性防护靠沙箱 + 权限，恶意代码请用 VM
+
+## 特性一览
+
+- **交互式 TUI**：流式输出、思考折叠（Ctrl+O）、可折叠 TODO 面板、纵向权限菜单、任务中断（Esc）、slash 命令补全、会话管理
+- **headless 模式**：`coderio run "任务"` 单次运行（CI / 脚本 / benchmark），退出码分级
+- **MCP 支持**：`.mcp.json`（Claude Code 兼容格式）接入外部工具，`coderio mcp` 命令行管理
+- **生命周期 hooks**：`[[hooks]]` 在 PreToolUse / PostToolUse / UserPromptSubmit 等事件执行你的命令（exit 2 = 阻断），IO 契约与 Claude Code 兼容
+- **skills 三层加载**：bundled + 用户 + 项目层，渐进披露省上下文
+- **上下文治理**：自动压缩（60% 窗口触发）、大块 offload、sqlite 检查点跨轮持久化
+- **子 agent**：research（只读，双重强制）+ general-purpose（继承主 agent 全部安全层）
+- **工程纪律**：850+ 测试、80% 覆盖率、mypy 硬门、uv.lock 锁定、3 OS × 2 Python CI 矩阵
+
+<details>
+<summary><b>配置示例</b>（点击展开）</summary>
+
+```toml
+# ~/.coderio/config.toml
+[model]
+provider_id = "bigmodel_coding_plan"   # 智谱/阶跃 coding plan，或 openai/anthropic/ollama/自定义
+default = "glm-5.2"
+
+[tools]
+permission_mode = "confirm"            # plan | confirm | auto_edit | full
+sandbox_mode = "off"                   # off | job（资源限制）| write（Linux 文件写隔离）
+
+# 生命周期 hooks（Claude Code 兼容契约）
+[[hooks]]
+event = "PreToolUse"
+matcher = "write_file|edit_file"
+command = "python .hooks/protect.py"   # stdin 收 JSON；exit 2 = 阻断
+```
+
+MCP、沙箱四元组、更多配置见 [docs/coderio-architecture.md](docs/coderio-architecture.md)。
+
+</details>
+
+## 常用命令
+
+```bash
+coderio                                              # 交互式 TUI
+coderio run "修复失败的测试" --quiet                   # headless 单次
+coderio run "任务" --dangerously-skip-permissions    # full 权限（显式选择）
+coderio mcp add github --type http --url ...          # 管理 MCP
+coderio skills install                               # 安装 skill 套件
+```
+
+TUI 内输入 `/` 查看全部命令（/resume 恢复会话、/mode 切权限、/profile 切配置、/think 展开思考）。
+
+## 已知限制
+
+- Windows 写沙箱当前等价于 job 档（真隔离待 ACL，文档如实标注）
+- 黑白名单为防手滑设计（正则可被混淆绕过），对抗性场景用沙箱 / VM
+
+## 起源
+
+业余项目，开源目的：给想自己搭 coding agent 的开发者一份能跑的参考。名字是 **code + rio**（作者英文名 Lion，本想叫 codelion）。
+
+## 贡献与 License
+
+欢迎 issue / PR，见 [CONTRIBUTING.md](CONTRIBUTING.md)。MIT License。

coderio-0.4.3/README_en.md

@@ -0,0 +1,103 @@
+# coderio
+
+[中文](README.md) | **English**
+
+> The agent claims "done" without running the tests? coderio's harness stops it.
+> A local coding agent with **native Zhipu GLM & StepFun Step coding-plan support** — four-tier permissions, layered sandbox, MCP, lifecycle hooks, and an interactive TUI.
+
+![demo](demo.gif)
+
+## Install
+
+```bash
+pip install coderio
+coderio    # onboarding wizard on first launch (pick provider, paste API key, auto context-window probe)
+```
+
+Requires Python 3.11+; Git Bash on Windows. Linux / macOS supported.
+
+## Why coderio
+
+The shared weakness of coding agents: **the model says "I'm done" and you just have to trust it**. coderio turns that sentence into a structural constraint—
+
+### The Four Gates: the agent can't lie to you
+
+| Gate | Behavior |
+|---|---|
+| **VerifyGate** | Wrote code, never ran it, wants to finish → intercepted, forced to continue. Parses real exit codes — **a failing test run does NOT count as verified** |
+| **CompletionGate** | Declares done with pending todos → intercepted |
+| **GroundingGate** | Cites files it never read → intercepted |
+| **PlanGate** | Writes code without a todo list → soft nudge |
+
+Not a prompt-level soft rule — a system-level control based on tool-call ground truth. Claude Code and Codex don't have this.
+
+### Native Chinese coding-plan support
+
+Zhipu **GLM Coding Plan** and StepFun **Step Plan** work out of the box (direct Anthropic-protocol connection) — your subscription quota runs a local agent, no proxies, no middle layer. Also supports OpenAI / Anthropic / Ollama / any OpenAI-compatible endpoint, with multi-profile switching.
+
+### Layered security, honestly stated
+
+- Four permission tiers (plan read-only / confirm per-action / auto_edit / full)
+- Command blacklist + whitelist (accident prevention); Linux bubblewrap OS sandbox (boundary enforcement)
+- First-use repo-config trust confirmation (hostile-repo protection); web_fetch SSRF protection
+- The blacklist/whitelist are **accident prevention, not adversarial defense** — adversarial protection comes from the sandbox + permissions; use a VM for hostile code
+
+## Feature highlights
+
+- **Interactive TUI**: streaming output, foldable thinking (Ctrl+O), collapsible TODO panel, vertical permission menu, task interruption (Esc), slash-command autocomplete, session management
+- **Headless mode**: `coderio run "task"` one-shot execution (CI / scripts / benchmarks) with graded exit codes
+- **MCP support**: connect external tools via `.mcp.json` (Claude Code-compatible format), managed with `coderio mcp`
+- **Lifecycle hooks**: `[[hooks]]` run your commands at PreToolUse / PostToolUse / UserPromptSubmit (exit 2 = block) — IO contract compatible with Claude Code
+- **Three-layer skills**: bundled + user + project, progressive disclosure saves context
+- **Context governance**: auto-compaction (60% window trigger), large-block offload, sqlite checkpoints across turns
+- **Subagents**: research (read-only, double-enforced) + general-purpose (inherits the main agent's full security stack)
+- **Engineering discipline**: 850+ tests, 80% coverage, mypy hard gate, uv.lock, 3 OS × 2 Python CI matrix
+
+<details>
+<summary><b>Config example</b> (click to expand)</summary>
+
+```toml
+# ~/.coderio/config.toml
+[model]
+provider_id = "bigmodel_coding_plan"   # Zhipu/StepFun coding plan, or openai/anthropic/ollama/custom
+default = "glm-5.2"
+
+[tools]
+permission_mode = "confirm"            # plan | confirm | auto_edit | full
+sandbox_mode = "off"                   # off | job (resource limits) | write (Linux file-write isolation)
+
+# Lifecycle hooks (Claude Code-compatible contract)
+[[hooks]]
+event = "PreToolUse"
+matcher = "write_file|edit_file"
+command = "python .hooks/protect.py"   # JSON on stdin; exit 2 = block
+```
+
+MCP, the sandbox 4-tuple, and more: [docs/coderio-architecture.md](docs/coderio-architecture.md).
+
+</details>
+
+## Common commands
+
+```bash
+coderio                                              # interactive TUI
+coderio run "fix the failing test" --quiet           # headless one-shot
+coderio run "task" --dangerously-skip-permissions    # full access (explicit opt-in)
+coderio mcp add github --type http --url ...          # manage MCP
+coderio skills install                               # install skill suites
+```
+
+Type `/` inside the TUI for all commands (/resume sessions, /mode permissions, /profile configs, /think unfold reasoning).
+
+## Known limitations
+
+- The Windows write-sandbox currently equals job mode (true isolation awaits the ACL work — documented honestly)
+- Blacklist/whitelist are accident-prevention by design (regex can be bypassed by obfuscation); use the sandbox / a VM for adversarial scenarios
+
+## Origin
+
+A spare-time project, open-sourced as a working reference for developers building their own coding agents. The name is **code + rio** (the author's English name is Lion; "codelion" sounded odd).
+
+## Contributing & License
+
+Issues and PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). MIT License.

{coderio-0.4.1 → coderio-0.4.3}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "coderio"
-version = "0.4.1"
+version = "0.4.3"
 description = "A skill-driven coding agent — structural harness, foldable thinking TUI, deepagents engine."
 readme = "README_en.md"
 license = "MIT"
@@ -201,10 +201,9 @@ fail_under = 60
 # real type errors (wrong arg counts, None where a value is expected) without
 # blocking on the many untyped third-party deps (langchain, deepagents, textual).
 #
-# CI runs mypy as a HARD GATE (no continue-on-error) for the modules NOT in
-# the override list below. The modules listed in [[tool.mypy.overrides]] have
-# `ignore_errors = true` until they're cleaned up — each ignore is a tracked
-# TODO, not a permanent pass. Remove entries as the files are fixed.
+# CI runs mypy as a HARD GATE for all modules except the override list below.
+# Modules with `ignore_errors = true` have known type issues — each entry is a
+# tracked TODO. Modules are removed from this list when they pass cleanly.
 python_version = "3.11"
 ignore_missing_imports = true
 warn_redundant_casts = true
@@ -218,6 +217,9 @@ exclude = ["tests/", "build/", "dist/", "\\.venv/"]
 # Per-module overrides: lenient modules (tracked cleanup TODOs).
 # Each entry here is a file with known type issues that would block CI if
 # enforced strictly. Remove entries as the files are cleaned up.
+#
+# Cleaned up 2026-08-21: removed coderio.agent.deep_loop and
+# coderio.mcp_loader (verified mypy clean — 0 errors, only notes).
 [[tool.mypy.overrides]]
 module = [
     "coderio.cli.tui",
@@ -227,10 +229,8 @@ module = [
     "coderio.cli.onboarding",
     "coderio.cli.stream",
     "coderio.cli.repl",
-    "coderio.agent.deep_loop",
     "coderio.tools.win_job",
     "coderio.tools.win_sandbox",
-    "coderio.mcp_loader",
     "coderio.session.store",
     "coderio.session.message",
     "coderio.llm.probe",

{coderio-0.4.1 → coderio-0.4.3}/src/coderio/agent/_deepagents_compat.py

@@ -97,22 +97,48 @@ class _ToolWhitelistMiddleware(AgentMiddleware):
 
     Wraps the same ModelRequest.override + filter mechanism as
     ``_ToolExclusionMiddleware`` but inverts the predicate.
+
+    Runtime failures degrade to an EMPTY tool set (deny-all), never to the
+    unfiltered original — a broken research subagent is preferable to a
+    research subagent that can suddenly see write/execute tools (v3 audit #11
+    reversed the old fail-open direction).
     """
 
     def __init__(self, *, allowed: frozenset[str]) -> None:
         self._allowed = allowed
 
     def wrap_model_call(self, request, handler):
-        if self._allowed:
+        try:
             filtered = [t for t in request.tools if _tool_name(t) in self._allowed]
-            request = request.override(tools=filtered)
-        return handler(request)
+            return handler(request.override(tools=filtered))
+        except Exception as e:  # noqa: BLE001 — degrade to deny-all, never fail-open
+            _log.warning("tool whitelist failed at runtime (degrading to NO tools): %s", e)
+            return handler(request.override(tools=[]))
 
     async def awrap_model_call(self, request, handler):
-        if self._allowed:
+        try:
             filtered = [t for t in request.tools if _tool_name(t) in self._allowed]
-            request = request.override(tools=filtered)
-        return await handler(request)
+            return await handler(request.override(tools=filtered))
+        except Exception as e:  # noqa: BLE001 — degrade to deny-all, never fail-open
+            _log.warning("tool whitelist failed at runtime (degrading to NO tools): %s", e)
+            return await handler(request.override(tools=[]))
+
+
+class _DenyAllToolsMiddleware(AgentMiddleware):
+    """Last-resort middleware: the model sees ZERO tools.
+
+    Returned when the whitelist middleware itself cannot be constructed — the
+    research subagent becomes useless but stays harmless (v3 audit #11: the
+    old fallback was an EMPTY middleware list, i.e. the subagent inherited
+    EVERY tool including write/execute — fail-open in the most dangerous
+    direction).
+    """
+
+    def wrap_model_call(self, request, handler):
+        return handler(request.override(tools=[]))
+
+    async def awrap_model_call(self, request, handler):
+        return await handler(request.override(tools=[]))
 
 
 def make_research_subagent_middleware():
@@ -126,8 +152,8 @@ def make_research_subagent_middleware():
 
     Returns a list with a _ToolWhitelistMiddleware. If the deepagents
     AgentMiddleware base class API is unavailable (very old or very new
-    version), returns an empty list — the subagent will inherit all tools
-    (less safe, but won't crash).
+    version), falls back to _DenyAllToolsMiddleware — the subagent sees no
+    tools rather than all of them (fail-closed; v3 audit #11).
     """
     # Read-only tools the research subagent is allowed to use. Add new tools
     # here ONLY after confirming they're safe for a read-only agent.
@@ -135,5 +161,8 @@ def make_research_subagent_middleware():
     try:
         return [_ToolWhitelistMiddleware(allowed=allowed)]
     except Exception as e:  # noqa: BLE001 — AgentMiddleware API may differ
-        _log.warning("Could not build _ToolWhitelistMiddleware: %s", e)
-        return []
+        _log.warning("Could not build _ToolWhitelistMiddleware (deny-all fallback): %s", e)
+        try:
+            return [_DenyAllToolsMiddleware()]
+        except Exception:  # noqa: BLE001 — even the fallback construction failed
+            return []