coderio 0.4.2__tar.gz → 0.4.4__tar.gz

{coderio-0.4.2 → coderio-0.4.4}/.github/workflows/ci.yml

@@ -76,13 +76,15 @@ jobs:
 
       - name: Run tests with coverage
         # Enforces a coverage floor so coverage can't silently regress.
-        # The 70% floor is conservative (current baseline is ~75%) — it catches
-        # gross regressions (a module losing its tests) without failing on
-        # minor fluctuations. pyproject.toml's [tool.coverage.report]
-        # fail_under=60 is the local-dev default; CI enforces the stricter 70%.
+        # Measured baseline 2026-08-24: 82% total (weakest: sandbox_runner 43%
+        # — POSIX-only branches skip on Windows). The 75% floor keeps real
+        # headroom for platform variance while catching gross regressions
+        # (a module losing its tests). pyproject.toml's
+        # [tool.coverage.report] fail_under=60 is the local-dev default;
+        # CI enforces the stricter 75%.
         shell: bash
         run: |
-          uv run python -m pytest -q --cov=coderio --cov-report=term-missing --cov-fail-under=70
+          uv run python -m pytest -q --cov=coderio --cov-report=term-missing --cov-fail-under=75
 
       - name: Type check (mypy)
         # HARD GATE for clean modules. pyproject.toml's [[tool.mypy.overrides]]

{coderio-0.4.2 → coderio-0.4.4}/CHANGELOG.md

@@ -6,6 +6,67 @@ All notable changes to coderio are documented here. The format follows
 `pyproject.toml`'s `[project].version` — `coderio.__version__` reads it via
 `importlib.metadata`.
 
+## [0.4.4] — 2026-08-24
+
+### Added — extensibility & safety-of-agency features (each adversarially reviewed, mutation-verified)
+- **Custom slash commands**: `.coderio/commands/*.md` (project layer overrides user layer)
+  turn prompt templates into `/commands` with `$ARGUMENTS` substitution and optional
+  frontmatter descriptions. Built-ins can never be shadowed — exact matches refused at
+  expansion, case variants dropped at discovery (Windows case-insensitive-FS spoof
+  surface). Bodies route straight to the engine, never re-enter built-in dispatch: a
+  repo file with body `/mode full` cannot flip the permission gate.
+- **Custom subagents**: `.coderio/agents/*.md` define personas invokable via
+  `task(subagent_type=...)`. Persona-only customization — every assembled spec rides
+  the same PLAN-gated read-only middleware stack as the built-in research agent;
+  reserved names dropped at discovery AND re-filtered at wiring time. Adversarially
+  verified end-to-end: write tools physically unbound, nested task() blocked on three
+  independent layers.
+- **File checkpoints + `/undo`**: every structured write (write_file/edit_file/
+  multi_edit) snapshots the target's pre-write state; `/undo` reverts step by step.
+  multi_edit is one undo step; error paths consume no depth; failed restores re-push
+  for retry; bounded at 50 entries / 64MB; deliberately survives /clear. Shell-side
+  writes (redirects) bypass it — OS sandboxing is the layer for that class.
+- **Plan artifact**: the todo list mirrors to `<project>/.coderio/plan.md` after every
+  successful write_todos; user edits between messages are adopted at next turn start
+  (human override wins) with an injected note so the model doesn't execute a stale plan.
+
+### Fixed
+- Three prompt surfaces (PlanGate nudge, CompletionGate force-continue, CODE-workflow)
+  directed the model to coderio's legacy `todo()` tool whose store is an orphan the
+  gates never check — completion instructions could loop forever. All now point at
+  `write_todos`, the canonical surface.
+- Custom-command discovery anchor joined at the caller after a runtime audit caught
+  production loading zero commands while globbing root-level *.md files as agents.
+- Subagent discovery anchors walk up to the project root like skills/config/trust
+  (launching from a repo subdirectory previously missed project-layer definitions).
+- Frontmatter descriptions are truncated to 1024 chars and control-char-stripped —
+  a 90KB description previously reached the main model verbatim every turn.
+
+### Changed
+- CI coverage floor raised 70% → 75% against a measured 82% baseline (gate verified
+  to trip); stale coverage comments corrected.
+- tui.py decomposed (1627 → 1332 lines): input dispatch + session lifecycle extracted
+  to testable TuiRuntime; behavior verified statement-equivalent by AST diff + real
+  Textual input-routing tests.
+
+## [0.4.3] — 2026-08-21
+
+### Security — P1/P2 hardening (audit-verified, adversarial + mutation tested)
+- **command_policy**: replaced fragile `_RM_RECURSIVE_PREFIX` regex (failed on
+  `rm -fr /` and `--recursive --force`) with Python-level `_check_recursive_rm()`
+  that tokenizes the command and correctly detects recursive flags in any order.
+  All flag permutations now blocked: `rm -rf /`, `rm -fr /`, `rm -r -f /`,
+  `rm --recursive --force /`, `rm --RECURSIVE /`, `rm -rf ~/`, `rm -rf $HOME/`,
+  `rm -rf *`. False positives eliminated: `rm -f /etc/passwd`, `rm --Force /`,
+  `echo rm -rf /`.
+- **win_sandbox**: reverted `_dict_to_env_block` env-forwarding plumbing that
+  broke `CreateProcessAsUserW` on Win32. `lpEnvironment=None` preserves parent
+  env inheritance (safest path). Known limitation documented for future work.
+- **loader**: `_find_project_dir` now accepts `str | Path` (CLI may pass str).
+- **test_seams**: new 22-test seam suite covering command_policy↔middleware,
+  loader↔repl↔skills, deep_loop↔sandbox_runner↔win_sandbox boundaries.
+  All existing tests (884 passed) + seams (22 passed) green.
+
 ## [0.4.2] — 2026-08-18
 
 ### Security — v3 audit short-term batch (#7/#8/#9/#11/#14, all runtime-verified)

coderio-0.4.4/PKG-INFO

@@ -0,0 +1,152 @@
+Metadata-Version: 2.5
+Name: coderio
+Version: 0.4.4
+Summary: A skill-driven coding agent — structural harness, foldable thinking TUI, deepagents engine.
+Author: coderio contributors
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agent,ai-agent,cli,coding-agent,langchain,langgraph,llm,mcp,model-context-protocol,sandbox,skills,textual,tui
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Code Generators
+Requires-Python: >=3.11
+Requires-Dist: ddgs>=4.0
+Requires-Dist: deepagents>=0.6
+Requires-Dist: httpx>=0.27
+Requires-Dist: langchain-anthropic>=0.2
+Requires-Dist: langchain-core>=0.3
+Requires-Dist: langchain-openai>=0.2
+Requires-Dist: langchain>=0.3
+Requires-Dist: langgraph-checkpoint-sqlite>=2.0
+Requires-Dist: langgraph>=0.2
+Requires-Dist: pydantic>=2
+Requires-Dist: rich>=13
+Requires-Dist: textual>=0.40
+Requires-Dist: tomli-w>=1.0
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
+Requires-Dist: pytest-cov>=4; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.16; extra == 'dev'
+Provides-Extra: mcp
+Requires-Dist: langchain-mcp-adapters>=0.3.2; extra == 'mcp'
+Description-Content-Type: text/markdown
+
+# coderio
+
+[中文](README.md) | **English**
+
+> The agent claims "done" without running the tests? coderio's harness stops it.
+> A local coding agent with **native Zhipu GLM & StepFun Step coding-plan support** — four-tier permissions, layered sandbox, MCP, lifecycle hooks, and an interactive TUI.
+
+![demo](demo.gif)
+
+## Install
+
+```bash
+pip install coderio
+coderio    # onboarding wizard on first launch (pick provider, paste API key, auto context-window probe)
+```
+
+Requires Python 3.11+; Git Bash on Windows. Linux / macOS supported.
+
+## Why coderio
+
+The shared weakness of coding agents: **the model says "I'm done" and you just have to trust it**. coderio turns that sentence into a structural constraint—
+
+### The Four Gates: the agent can't lie to you
+
+| Gate | Behavior |
+|---|---|
+| **VerifyGate** | Wrote code, never ran it, wants to finish → intercepted, forced to continue. Parses real exit codes — **a failing test run does NOT count as verified** |
+| **CompletionGate** | Declares done with pending todos → intercepted |
+| **GroundingGate** | Cites files it never read → intercepted |
+| **PlanGate** | Writes code without a todo list → soft nudge |
+
+Not a prompt-level soft rule — a system-level control based on tool-call ground truth. Claude Code and Codex don't have this.
+
+### Native Chinese coding-plan support
+
+Zhipu **GLM Coding Plan** and StepFun **Step Plan** work out of the box (direct Anthropic-protocol connection) — your subscription quota runs a local agent, no proxies, no middle layer. Also supports OpenAI / Anthropic / Ollama / any OpenAI-compatible endpoint, with multi-profile switching.
+
+### Layered security, honestly stated
+
+- Four permission tiers (plan read-only / confirm per-action / auto_edit / full)
+- Command blacklist + whitelist (accident prevention); Linux bubblewrap OS sandbox (boundary enforcement)
+- First-use repo-config trust confirmation (hostile-repo protection); web_fetch SSRF protection
+- The blacklist/whitelist are **accident prevention, not adversarial defense** — adversarial protection comes from the sandbox + permissions; use a VM for hostile code
+
+## Feature highlights
+
+- **Interactive TUI**: streaming output, foldable thinking (Ctrl+O), collapsible TODO panel, vertical permission menu, task interruption (Esc), slash-command autocomplete, session management
+- **Custom slash commands**: `.coderio/commands/*.md` (project/user layers) turn prompt templates into `/commands` with `$ARGUMENTS` substitution; built-ins can never be shadowed
+- **Custom subagents**: `.coderio/agents/*.md` define personas invokable via `task(subagent_type=...)` — you customize WHO the agent is, its capabilities stay on the read-only stack
+- **File rollback**: every structured agent write is auto-checkpointed; `/undo` reverts step by step (a bad edit is one command from gone)
+- **Plan artifact**: the task list auto-mirrors to `.coderio/plan.md`; edit it by hand and the agent adopts your version at the next turn
+- **Headless mode**: `coderio run "task"` one-shot execution (CI / scripts / benchmarks) with graded exit codes
+- **MCP support**: connect external tools via `.mcp.json` (Claude Code-compatible format), managed with `coderio mcp`
+- **Lifecycle hooks**: `[[hooks]]` run your commands at PreToolUse / PostToolUse / UserPromptSubmit (exit 2 = block) — IO contract compatible with Claude Code
+- **Three-layer skills**: bundled + user + project, progressive disclosure saves context
+- **Context governance**: auto-compaction (60% window trigger), large-block offload, sqlite checkpoints across turns
+- **Subagents**: research (read-only, double-enforced) + general-purpose (inherits the main agent's full security stack)
+- **Engineering discipline**: 950+ tests, 82% coverage (CI floor 75%), mypy hard gate, uv.lock, 3 OS × 2 Python CI matrix
+
+<details>
+<summary><b>Config example</b> (click to expand)</summary>
+
+```toml
+# ~/.coderio/config.toml
+[model]
+provider_id = "bigmodel_coding_plan"   # Zhipu/StepFun coding plan, or openai/anthropic/ollama/custom
+default = "glm-5.2"
+
+[tools]
+permission_mode = "confirm"            # plan | confirm | auto_edit | full
+sandbox_mode = "off"                   # off | job (resource limits) | write (Linux file-write isolation)
+
+# Lifecycle hooks (Claude Code-compatible contract)
+[[hooks]]
+event = "PreToolUse"
+matcher = "write_file|edit_file"
+command = "python .hooks/protect.py"   # JSON on stdin; exit 2 = block
+```
+
+MCP, the sandbox 4-tuple, and more: [docs/coderio-architecture.md](docs/coderio-architecture.md).
+
+</details>
+
+## Common commands
+
+```bash
+coderio                                              # interactive TUI
+coderio run "fix the failing test" --quiet           # headless one-shot
+coderio run "task" --dangerously-skip-permissions    # full access (explicit opt-in)
+coderio mcp add github --type http --url ...          # manage MCP
+coderio skills install                               # install skill suites
+```
+
+Type `/` inside the TUI for all commands (/resume sessions, /mode permissions, /undo file writes, /think unfold reasoning).
+
+## Known limitations
+
+- The Windows write-sandbox currently equals job mode (true isolation awaits the ACL work — documented honestly)
+- Blacklist/whitelist are accident-prevention by design (regex can be bypassed by obfuscation); use the sandbox / a VM for adversarial scenarios
+
+## Origin
+
+A spare-time project, open-sourced as a working reference for developers building their own coding agents. The name is **code + rio** (the author's English name is Lion; "codelion" sounded odd).
+
+## Contributing & License
+
+Issues and PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). MIT License.

coderio-0.4.4/README.md

@@ -0,0 +1,107 @@
+# coderio
+
+**中文** | [English](README_en.md)
+
+> 写了代码没跑过测试就说"完成"？coderio 的 harness 会拦住它。
+> 一个**原生支持智谱 GLM / 阶跃 StepFun Coding Plan** 的本地 coding agent——四级权限、多层沙箱、MCP、生命周期 hooks、交互式 TUI。
+
+![demo](demo.gif)
+
+## 安装
+
+```bash
+pip install coderio
+coderio    # 首次启动进入 onboarding 向导（选 provider、填 API key、自动探测上下文窗口）
+```
+
+要求：Python 3.11+；Windows 需 Git Bash。支持 Linux / macOS。
+
+## 为什么是 coderio
+
+市面上 coding agent 的共同软肋：**模型说"我做完了"，你就得信**。coderio 把这句话变成了结构约束——
+
+### 四道门：agent 骗不了你
+
+| 门 | 行为 |
+|---|---|
+| **VerifyGate** | 写了代码没跑验证就想结束 → 拦截、强制续跑。解析真实 exit code，**测试失败不算验证通过** |
+| **CompletionGate** | TODO 没清完就宣布完成 → 拦截 |
+| **GroundingGate** | 引用从未读过的文件下结论 → 拦截 |
+| **PlanGate** | 没 TODO 就动手写码 → 软提醒 |
+
+不是提示词软规则，是基于工具调用 ground truth 的系统级控制。Claude Code / Codex 都没有这个。
+
+### 原生支持中文 Coding Plan
+
+智谱 **GLM Coding Plan** 和阶跃 **StepFun Step Plan** 开箱即用（Anthropic 协议直连）——你的订阅额度跑本地 agent，不需要转发、不需要中间层。同时支持 OpenAI / Anthropic / Ollama / 任意 OpenAI 兼容端点，多 profile 一键切换。
+
+### 多层安全，诚实声明
+
+- 四级权限（plan 只读 / confirm 逐项确认 / auto_edit / full）
+- 命令黑名单 + 白名单（防手滑）；Linux bubblewrap OS 级沙箱（防越界写）
+- 仓库配置首次信任确认（防克隆恶意仓库）；web_fetch SSRF 防护
+- 黑白名单是**防手滑不是防对抗**——对抗性防护靠沙箱 + 权限，恶意代码请用 VM
+
+## 特性一览
+
+- **交互式 TUI**：流式输出、思考折叠（Ctrl+O）、可折叠 TODO 面板、纵向权限菜单、任务中断（Esc）、slash 命令补全、会话管理
+- **自定义 slash 命令**：`.coderio/commands/*.md`（项目级/用户级）把提示词模板变成 `/命令`，`$ARGUMENTS` 占位符替换，内置命令不可被遮蔽
+- **自定义子代理**：`.coderio/agents/*.md` 定义 `task(subagent_type=...)` 可调的专属人格——只定制"是谁"，能力恒为只读栈
+- **文件回滚**：agent 的每次结构化写盘自动快照，`/undo` 一键逐级恢复（改坏文件不再可怕）
+- **计划产物**：任务清单自动镜像到 `.coderio/plan.md`，你手动编辑它，下一轮 agent 自动采纳你的版本
+- **headless 模式**：`coderio run "任务"` 单次运行（CI / 脚本 / benchmark），退出码分级
+- **MCP 支持**：`.mcp.json`（Claude Code 兼容格式）接入外部工具，`coderio mcp` 命令行管理
+- **生命周期 hooks**：`[[hooks]]` 在 PreToolUse / PostToolUse / UserPromptSubmit 等事件执行你的命令（exit 2 = 阻断），IO 契约与 Claude Code 兼容
+- **skills 三层加载**：bundled + 用户 + 项目层，渐进披露省上下文
+- **上下文治理**：自动压缩（60% 窗口触发）、大块 offload、sqlite 检查点跨轮持久化
+- **子 agent**：research（只读，双重强制）+ general-purpose（继承主 agent 全部安全层）
+- **工程纪律**：950+ 测试、82% 覆盖率（CI 卡 75% 下限）、mypy 硬门、uv.lock 锁定、3 OS × 2 Python CI 矩阵
+
+<details>
+<summary><b>配置示例</b>（点击展开）</summary>
+
+```toml
+# ~/.coderio/config.toml
+[model]
+provider_id = "bigmodel_coding_plan"   # 智谱/阶跃 coding plan，或 openai/anthropic/ollama/自定义
+default = "glm-5.2"
+
+[tools]
+permission_mode = "confirm"            # plan | confirm | auto_edit | full
+sandbox_mode = "off"                   # off | job（资源限制）| write（Linux 文件写隔离）
+
+# 生命周期 hooks（Claude Code 兼容契约）
+[[hooks]]
+event = "PreToolUse"
+matcher = "write_file|edit_file"
+command = "python .hooks/protect.py"   # stdin 收 JSON；exit 2 = 阻断
+```
+
+MCP、沙箱四元组、更多配置见 [docs/coderio-architecture.md](docs/coderio-architecture.md)。
+
+</details>
+
+## 常用命令
+
+```bash
+coderio                                              # 交互式 TUI
+coderio run "修复失败的测试" --quiet                   # headless 单次
+coderio run "任务" --dangerously-skip-permissions    # full 权限（显式选择）
+coderio mcp add github --type http --url ...          # 管理 MCP
+coderio skills install                               # 安装 skill 套件
+```
+
+TUI 内输入 `/` 查看全部命令（/resume 恢复会话、/mode 切权限、/undo 回滚文件写入、/think 展开思考）。
+
+## 已知限制
+
+- Windows 写沙箱当前等价于 job 档（真隔离待 ACL，文档如实标注）
+- 黑白名单为防手滑设计（正则可被混淆绕过），对抗性场景用沙箱 / VM
+
+## 起源
+
+业余项目，开源目的：给想自己搭 coding agent 的开发者一份能跑的参考。名字是 **code + rio**（作者英文名 Lion，本想叫 codelion）。
+
+## 贡献与 License
+
+欢迎 issue / PR，见 [CONTRIBUTING.md](CONTRIBUTING.md)。MIT License。

coderio-0.4.4/README_en.md

@@ -0,0 +1,107 @@
+# coderio
+
+[中文](README.md) | **English**
+
+> The agent claims "done" without running the tests? coderio's harness stops it.
+> A local coding agent with **native Zhipu GLM & StepFun Step coding-plan support** — four-tier permissions, layered sandbox, MCP, lifecycle hooks, and an interactive TUI.
+
+![demo](demo.gif)
+
+## Install
+
+```bash
+pip install coderio
+coderio    # onboarding wizard on first launch (pick provider, paste API key, auto context-window probe)
+```
+
+Requires Python 3.11+; Git Bash on Windows. Linux / macOS supported.
+
+## Why coderio
+
+The shared weakness of coding agents: **the model says "I'm done" and you just have to trust it**. coderio turns that sentence into a structural constraint—
+
+### The Four Gates: the agent can't lie to you
+
+| Gate | Behavior |
+|---|---|
+| **VerifyGate** | Wrote code, never ran it, wants to finish → intercepted, forced to continue. Parses real exit codes — **a failing test run does NOT count as verified** |
+| **CompletionGate** | Declares done with pending todos → intercepted |
+| **GroundingGate** | Cites files it never read → intercepted |
+| **PlanGate** | Writes code without a todo list → soft nudge |
+
+Not a prompt-level soft rule — a system-level control based on tool-call ground truth. Claude Code and Codex don't have this.
+
+### Native Chinese coding-plan support
+
+Zhipu **GLM Coding Plan** and StepFun **Step Plan** work out of the box (direct Anthropic-protocol connection) — your subscription quota runs a local agent, no proxies, no middle layer. Also supports OpenAI / Anthropic / Ollama / any OpenAI-compatible endpoint, with multi-profile switching.
+
+### Layered security, honestly stated
+
+- Four permission tiers (plan read-only / confirm per-action / auto_edit / full)
+- Command blacklist + whitelist (accident prevention); Linux bubblewrap OS sandbox (boundary enforcement)
+- First-use repo-config trust confirmation (hostile-repo protection); web_fetch SSRF protection
+- The blacklist/whitelist are **accident prevention, not adversarial defense** — adversarial protection comes from the sandbox + permissions; use a VM for hostile code
+
+## Feature highlights
+
+- **Interactive TUI**: streaming output, foldable thinking (Ctrl+O), collapsible TODO panel, vertical permission menu, task interruption (Esc), slash-command autocomplete, session management
+- **Custom slash commands**: `.coderio/commands/*.md` (project/user layers) turn prompt templates into `/commands` with `$ARGUMENTS` substitution; built-ins can never be shadowed
+- **Custom subagents**: `.coderio/agents/*.md` define personas invokable via `task(subagent_type=...)` — you customize WHO the agent is, its capabilities stay on the read-only stack
+- **File rollback**: every structured agent write is auto-checkpointed; `/undo` reverts step by step (a bad edit is one command from gone)
+- **Plan artifact**: the task list auto-mirrors to `.coderio/plan.md`; edit it by hand and the agent adopts your version at the next turn
+- **Headless mode**: `coderio run "task"` one-shot execution (CI / scripts / benchmarks) with graded exit codes
+- **MCP support**: connect external tools via `.mcp.json` (Claude Code-compatible format), managed with `coderio mcp`
+- **Lifecycle hooks**: `[[hooks]]` run your commands at PreToolUse / PostToolUse / UserPromptSubmit (exit 2 = block) — IO contract compatible with Claude Code
+- **Three-layer skills**: bundled + user + project, progressive disclosure saves context
+- **Context governance**: auto-compaction (60% window trigger), large-block offload, sqlite checkpoints across turns
+- **Subagents**: research (read-only, double-enforced) + general-purpose (inherits the main agent's full security stack)
+- **Engineering discipline**: 950+ tests, 82% coverage (CI floor 75%), mypy hard gate, uv.lock, 3 OS × 2 Python CI matrix
+
+<details>
+<summary><b>Config example</b> (click to expand)</summary>
+
+```toml
+# ~/.coderio/config.toml
+[model]
+provider_id = "bigmodel_coding_plan"   # Zhipu/StepFun coding plan, or openai/anthropic/ollama/custom
+default = "glm-5.2"
+
+[tools]
+permission_mode = "confirm"            # plan | confirm | auto_edit | full
+sandbox_mode = "off"                   # off | job (resource limits) | write (Linux file-write isolation)
+
+# Lifecycle hooks (Claude Code-compatible contract)
+[[hooks]]
+event = "PreToolUse"
+matcher = "write_file|edit_file"
+command = "python .hooks/protect.py"   # JSON on stdin; exit 2 = block
+```
+
+MCP, the sandbox 4-tuple, and more: [docs/coderio-architecture.md](docs/coderio-architecture.md).
+
+</details>
+
+## Common commands
+
+```bash
+coderio                                              # interactive TUI
+coderio run "fix the failing test" --quiet           # headless one-shot
+coderio run "task" --dangerously-skip-permissions    # full access (explicit opt-in)
+coderio mcp add github --type http --url ...          # manage MCP
+coderio skills install                               # install skill suites
+```
+
+Type `/` inside the TUI for all commands (/resume sessions, /mode permissions, /undo file writes, /think unfold reasoning).
+
+## Known limitations
+
+- The Windows write-sandbox currently equals job mode (true isolation awaits the ACL work — documented honestly)
+- Blacklist/whitelist are accident-prevention by design (regex can be bypassed by obfuscation); use the sandbox / a VM for adversarial scenarios
+
+## Origin
+
+A spare-time project, open-sourced as a working reference for developers building their own coding agents. The name is **code + rio** (the author's English name is Lion; "codelion" sounded odd).
+
+## Contributing & License
+
+Issues and PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). MIT License.

{coderio-0.4.2 → coderio-0.4.4}/docs/coderio-architecture.md

@@ -39,12 +39,12 @@ coderio 是一个**技能驱动的编程 agent**：它的"骨架"是 Lion-Skills
 
 | 模块 | 行数 | 职责 | 关键文件 |
 |------|------|------|----------|
-| `agent/` | ~2500 | deepagents 引擎、harness/permission middleware、提示词构建、流式协议 | deep_loop.py, harness_middleware.py, permission_middleware.py, harness.py, prompts.py |
-| `cli/` | ~3800 | Typer 应用、Textual TUI、Rich 流式 UI、slash 命令、凭证/onboarding | tui.py, repl.py, stream.py, app.py, onboarding.py |
-| `tools/` | ~1100 | 工具集 + 权限门 + langchain 适配（路径隔离由 deepagents virtual_mode 处理） | bash.py, permission.py, base.py |
-| `config/` | ~400 | 三层 TOML 配置合并 + 用户目录 bootstrap | loader.py, models.py |
-| `skills/` | ~220 | SkillStore 三层加载（bundled < user < project） | store.py, parser.py, models.py |
-| `session/` | 260 | jsonl 追加式会话存储 + resume + 压缩截断 | store.py, message.py |
+| `agent/` | ~3600 | deepagents 引擎、harness/permission middleware、计划产物、自定义子代理、提示词构建、流式协议 | deep_loop.py, harness_middleware.py, permission_middleware.py, harness.py, plan_artifact.py, custom_agents.py, prompts.py |
+| `cli/` | ~5300 | Typer 应用、Textual TUI（渲染）+ TuiRuntime（输入分发/会话生命周期）、自定义 slash 命令、Rich 流式 UI、凭证/onboarding | tui.py, tui_runtime.py, repl.py, stream.py, app.py, commands.py, custom_commands.py, tui_onboarding.py |
+| `tools/` | ~3000 | 工具集 + 文件写入 checkpoint + 权限门 + 命令黑名单 + OS 沙箱 + langchain 适配 | bash.py, permission.py, command_policy.py, checkpoint.py, base.py |
+| `config/` | ~900 | 三层 TOML 配置合并 + 仓库信任门 + 用户目录 bootstrap | loader.py, models.py, trust.py |
+| `skills/` | ~255 | SkillStore 三层加载（bundled < user < project）+ 共享 frontmatter 解析 | store.py, parser.py, models.py |
+| `session/` | ~330 | jsonl 追加式会话存储 + resume + 压缩截断 | store.py, message.py |
 | `llm/` | 320 | 模型工厂 + provider context window 探测 | factory.py, probe.py |
 
 ### 依赖方向（关键约束）
@@ -268,12 +268,13 @@ is_interrupted()（用户中断检查，agent 线程在每轮开头调用）
 
 `NullStream` 全空实现，用于测试/headless。
 
-### 6.5 TUI 交互（`cli/tui.py`）
+### 6.5 TUI 交互（`cli/tui.py` + `cli/tui_runtime.py`）
 
 Textual 8.x App，核心设计：
 
-- **线程模型**：agent 在 Textual Worker 后台线程跑，UI 更新通过 `_render_q`（thread-safe deque）+ 60ms 定时器排空
-- **流式渲染**：dict 分派表（`_RENDER_DISPATCH`）映射 action → handler，每个 handler返回 streaming/final/none 决定滚动策略
+- **渲染与分发分离**（S3 拆分）：`CoderioTUI` 只管 widget 树与流式渲染；输入路由、slash 处理、会话生命周期在 `TuiRuntime`（两阶段构造：先建 runtime，`bind()` 时把带 TUI 引用的 gate 接上——confirm 模式否则会在 Textual 接管终端后死于 input() 死锁）
+- **线程模型**：agent 在后台线程跑，UI 更新通过 `_render_q`（thread-safe deque）+ 定时器排空
+- **流式渲染**：dict 分派表映射 action → handler，每个 handler 返回 streaming/final/none 决定滚动策略
 - **中断**：`Esc` / `⏹ 中断` 按钮 → `_interrupted` 标志位，agent 流循环检查 `is_interrupted()` → `InterruptedError` → 黄色"已中断"面板
 - **confirm 模式**：`TuiPermissionGate` 用 `ConfirmMenu`（纵向选择菜单）+ `threading.Event` 跨线程同步，↑↓ 选择 + Enter 确认
 - **可视化选择器**：`/mode`（ModePickerScreen）、`/profile`（ProfilePickerScreen）、`/resume`（SessionPickerScreen）
@@ -290,14 +291,18 @@ Textual 8.x App，核心设计：
 | 类别 | 工具 |
 |------|------|
 | 读 | read_file, list_dir, glob, grep |
-| 写 | write_file, edit_file, multi_edit |
+| 写 | write_file, edit_file, multi_edit（写前自动 checkpoint，`/undo` 可回滚）|
 | 执行 | bash（Git Bash，Windows 自动探测，.venv 自动激活，进程树超时杀）|
-| 计划 | todo（TodoStore，harness 读它）|
+| 计划 | write_todos（deepagents 原生，镜像到 `.coderio/plan.md` 供用户编辑）|
 | 外部 | web_search, web_fetch |
 | 记忆 | note（跨会话长期记忆）|
 
 **权限门**（`permission.py`）：plan / confirm / auto_edit / full 四模式。`DESTRUCTIVE_TOOLS`（write_file/edit_file/multi_edit/execute/web_fetch/note）在 plan 模式全挡、confirm 模式逐个问、auto_edit 自动放行文件编辑但仍问高危工具、full 全放。
 
+**文件 checkpoint**（`checkpoint.py`，S4）：三个结构化写工具落盘前快照进内存栈（50 条 / 64MB 上限），`/undo` 逐级回滚；bash 重定向等 shell 路径不覆盖——OS 级沙箱才是那一层的答案。
+
+**计划产物**（`plan_artifact.py`，S5）：write_todos 成功后任务清单镜像到 `<project>/.coderio/plan.md`；用户在两轮之间手改它，下一轮开始自动采纳其版本并注入提示。
+
 **命令审查层**（`command_review.py` + `command_policy.py`）：权限门只管"哪个工具能执行"，不管"命令内容是什么"。shell（execute）不受 virtual_mode 约束，所以额外加了一层 `CommandReviewMiddleware`——内置黑名单挡住 `rm -rf /`、`mkfs`、fork bomb、`dd of=/dev/`、`shutdown` 等破坏性命令。即使 FULL 模式也挡（安全优先于"full=全放行"字面语义）。用户可在 config.toml `[tools].blocked_commands` 追加正则黑名单。`network_allowed=false` 可禁用 web_fetch/web_search（离线模式）。
 
   **这不是真 OS 沙箱**：混淆命令（base64 解码、变量展开）可绕过正则。目标是挡住意外/粗心的破坏（占真实事故绝大多数），不是对抗性模型。真隔离需要容器/seccomp（未来工作）。

{coderio-0.4.2 → coderio-0.4.4}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "coderio"
-version = "0.4.2"
+version = "0.4.4"
 description = "A skill-driven coding agent — structural harness, foldable thinking TUI, deepagents engine."
 readme = "README_en.md"
 license = "MIT"
@@ -190,10 +190,11 @@ asyncio_mode = "auto"
 source = ["coderio"]
 
 [tool.coverage.report]
-# Local-dev coverage floor. CI enforces a stricter 70% via --cov-fail-under
+# Local-dev coverage floor. CI enforces a stricter 75% via --cov-fail-under
 # (see .github/workflows/ci.yml). This 60% is the "running tests in your
 # editor" safety net — lower than CI so local runs don't fail on partial
-# test selection. Current baseline: ~75% total, deep_loop 75%, middleware 80%+.
+# test selection. Measured baseline 2026-08-24: 82% total; known weakest
+# sandbox_runner 43% (POSIX-only branches skip on Windows).
 fail_under = 60
 
 [tool.mypy]
@@ -201,10 +202,9 @@ fail_under = 60
 # real type errors (wrong arg counts, None where a value is expected) without
 # blocking on the many untyped third-party deps (langchain, deepagents, textual).
 #
-# CI runs mypy as a HARD GATE (no continue-on-error) for the modules NOT in
-# the override list below. The modules listed in [[tool.mypy.overrides]] have
-# `ignore_errors = true` until they're cleaned up — each ignore is a tracked
-# TODO, not a permanent pass. Remove entries as the files are fixed.
+# CI runs mypy as a HARD GATE for all modules except the override list below.
+# Modules with `ignore_errors = true` have known type issues — each entry is a
+# tracked TODO. Modules are removed from this list when they pass cleanly.
 python_version = "3.11"
 ignore_missing_imports = true
 warn_redundant_casts = true
@@ -218,6 +218,9 @@ exclude = ["tests/", "build/", "dist/", "\\.venv/"]
 # Per-module overrides: lenient modules (tracked cleanup TODOs).
 # Each entry here is a file with known type issues that would block CI if
 # enforced strictly. Remove entries as the files are cleaned up.
+#
+# Cleaned up 2026-08-21: removed coderio.agent.deep_loop and
+# coderio.mcp_loader (verified mypy clean — 0 errors, only notes).
 [[tool.mypy.overrides]]
 module = [
     "coderio.cli.tui",
@@ -227,10 +230,8 @@ module = [
     "coderio.cli.onboarding",
     "coderio.cli.stream",
     "coderio.cli.repl",
-    "coderio.agent.deep_loop",
     "coderio.tools.win_job",
     "coderio.tools.win_sandbox",
-    "coderio.mcp_loader",
     "coderio.session.store",
     "coderio.session.message",
     "coderio.llm.probe",