coderio 0.4.4__tar.gz → 0.6.0__tar.gz

coderio-0.6.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,8 @@
+## What changed and why
+
+<!-- One focused change per PR. -->
+
+## Checklist
+
+- [ ] Tests pass (`pytest -q`)
+- [ ] I agree to the [Contribution terms](../CONTRIBUTING.md#contribution-terms)

{coderio-0.4.4 → coderio-0.6.0}/.github/workflows/ci.yml

@@ -1,5 +1,10 @@
 name: CI
 
+# Action SHAs are pinned to full commits (external review 2026-09-05, P1-3):
+# mutable tags held write/OIDC permissions, so an upstream re-point would
+# widen the supply-chain attack surface. Bump via a PR that updates the SHA
+# (and its version comment) together.
+
 on:
   push:
     branches: [main]
@@ -10,8 +15,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"
       - name: Install ruff
@@ -40,7 +45,7 @@ jobs:
       PYTHONUTF8: "1"
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # uv replaces pip for dependency installation (2026-08-14 migration).
       # uv.lock is a first-class lockfile for both uv and Dependabot: CI gets
@@ -48,7 +53,7 @@ jobs:
       # constraints AND regenerates uv.lock in its PRs — the two mechanisms
       # cooperate instead of fighting (the bare requirements-dev.txt approach
       # had Dependabot produce internally-inconsistent updates; see PR #6).
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           python-version: ${{ matrix.python-version }}
           enable-cache: true
@@ -67,9 +72,11 @@ jobs:
 
       - name: Audit dependencies for known vulnerabilities
         # Scans installed packages against the PyPI advisory database.
-        # Non-blocking (continue-on-error) — reports issues without failing CI.
+        # BLOCKING since 2026-08-28 (audit finding: continue-on-error made the
+        # scan decorative — known CVEs could never turn CI red). If a flagged
+        # vuln is a false positive / unfixable, add an explicit --ignore-vuln
+        # with a comment rather than re-adding continue-on-error.
         shell: bash
-        continue-on-error: true
         run: |
           uv pip install pip-audit
           uv run pip-audit
@@ -86,6 +93,20 @@ jobs:
         run: |
           uv run python -m pytest -q --cov=coderio --cov-report=term-missing --cov-fail-under=75
 
+      - name: MCP extra smoke (install + loader import)
+        # The mcp extra was never installed in CI (audit 2026-09-04 P1-17):
+        # `load_mcp_tools_sync` — the code path behind README's "MCP support"
+        # — was never executed anywhere, in tests or CI. Install the extra
+        # from the frozen lock and at least run the loader test module
+        # against the real adapters package. One matrix leg is enough (the
+        # loader is pure Python; this step exists so the import path can't
+        # rot silently).
+        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12'
+        run: |
+          uv sync --frozen --extra dev --extra mcp
+          uv run python -c "from coderio.mcp_loader import load_mcp_tools_sync; print('mcp loader import OK')"
+          uv run python -m pytest tests/test_mcp_loader.py -q
+
       - name: Type check (mypy)
         # HARD GATE for clean modules. pyproject.toml's [[tool.mypy.overrides]]
         # lists modules with known type issues (ignore_errors=true) — each is a

coderio-0.6.0/.github/workflows/release.yml

@@ -0,0 +1,189 @@
+name: Release
+
+# Triggered by pushing a tag like v0.4.0. Builds wheel + sdist, runs the test
+# suite, verifies both artifacts in a clean venv, publishes to PyPI (Trusted
+# Publishing, no token) and attaches both to a GitHub Release.
+#
+# To cut a release:
+#   git tag v0.4.0
+#   git push origin v0.4.0
+#
+# PyPI publishing uses Trusted Publishing (OIDC). One-time setup (repo owner):
+#   pypi.org → Account settings → Publishing → Add a new pending publisher:
+#     PyPI project name: coderio
+#     Owner: Lion-1209 / Repository: coderio
+#     Workflow name: release.yml / Environment: pypi
+#   Then create the "pypi" environment in the repo (Settings → Environments).
+
+# Action SHAs are pinned to full commits (external review 2026-09-05, P1-3):
+# mutable tags held write/OIDC permissions, so an upstream re-point would
+# widen the supply-chain attack surface. Bump via a PR that updates the SHA
+# (and its version comment) together.
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write  # needed to create the release + upload assets
+
+jobs:
+  # Test gate: a tag is a release — it must not ship broken code. The CI
+  # workflow covers pushes/PRs, but a tag could be cut from a commit that
+  # predates a fix; this gate makes the release itself fail loudly instead.
+  test:
+    # Runs on ubuntu AND windows: windows-latest is the priority platform and
+    # a tag could otherwise ship a Windows-only regression (2026-08-28 audit).
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    env:
+      # Mirror ci.yml: Windows runners default to cp1252 and CJK output
+      # crashes with UnicodeEncodeError (audit finding #11).
+      PYTHONIOENCODING: utf-8
+      PYTHONUTF8: "1"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - name: Run test suite
+        run: |
+          uv sync --frozen --extra dev
+          uv run python -m pytest -q
+
+  release:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+
+      - name: Verify tag matches package version
+        # External review (2026-09-05, P2-2): nothing stopped a mistyped tag
+        # (v0.5.1) from publishing artifacts still named 0.5.0. Gate 1 of 2:
+        # tag ↔ pyproject.toml.
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PYPROJECT_VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          echo "tag=${TAG_VERSION} pyproject=${PYPROJECT_VERSION}"
+          if [ "$TAG_VERSION" != "$PYPROJECT_VERSION" ]; then
+            echo "::error::tag v${TAG_VERSION} does not match pyproject.toml version ${PYPROJECT_VERSION}"
+            exit 1
+          fi
+
+      - name: Build wheel + sdist
+        run: |
+          pip install build
+          python -m build
+
+      - name: Verify wheel METADATA matches tag
+        # Gate 2 of 2: the built artifact itself carries the right version
+        # (tag ↔ pyproject ↔ wheel METADATA, external review 2026-09-05).
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          WHEEL_VERSION=$(python -c "
+          import glob, re, zipfile
+          whl = glob.glob('dist/*.whl')[0]
+          with zipfile.ZipFile(whl) as z:
+              meta = next(n for n in z.namelist() if n.endswith('METADATA'))
+              text = z.read(meta).decode('utf-8')
+          print(re.search(r'^Version: (.+)$', text, re.MULTILINE).group(1))
+          ")
+          echo "wheel METADATA=${WHEEL_VERSION}"
+          if [ "$TAG_VERSION" != "$WHEEL_VERSION" ]; then
+            echo "::error::wheel METADATA version ${WHEEL_VERSION} does not match tag v${TAG_VERSION}"
+            exit 1
+          fi
+
+      - name: Verify wheel in clean venv (full deps)
+        # Install the wheel WITH all dependencies (not --no-deps) to verify
+        # the full user install path. Then run --help + import the deepagents
+        # engine + verify bundled skills. This catches missing deps that the
+        # old --no-deps + manual 5-package approach missed.
+        run: |
+          python -m venv /tmp/wheel-test-venv
+          /tmp/wheel-test-venv/bin/pip install dist/*.whl
+          /tmp/wheel-test-venv/bin/coderio --help
+          /tmp/wheel-test-venv/bin/coderio run --help
+          # Verify the deepagents engine imports (the production path).
+          /tmp/wheel-test-venv/bin/python -c "
+          from coderio.agent.deep_loop import run_deep_agent
+          from coderio.agent.harness_middleware import HarnessMiddleware
+          from coderio.agent.permission_middleware import PermissionMiddleware
+          from coderio.cli.tui import CoderioTUI
+          print('deepagents engine imports OK')
+          "
+          # Verify bundled skills are importable from the installed package.
+          /tmp/wheel-test-venv/bin/python -c "
+          from coderio.skills.store import load_skill_store
+          from pathlib import Path
+          import coderio
+          pkg = Path(coderio.__file__).parent / 'skills'
+          store = load_skill_store(pkg, 0, None)
+          assert len(store.names()) > 0, 'no bundled skills found'
+          print(f'{len(store.names())} bundled skills OK')
+          "
+
+      - name: Verify sdist installs
+        # sdist is the source-of-truth artifact; verify it installs and runs
+        # too (a broken sdist — missing files, bad metadata — only shows up
+        # at install time).
+        run: |
+          python -m venv /tmp/sdist-test-venv
+          /tmp/sdist-test-venv/bin/pip install dist/*.tar.gz
+          /tmp/sdist-test-venv/bin/coderio --help
+
+      - name: Create GitHub Release + attach artifacts
+        # Restored (2026-08-28 audit #3): the artifact refactor
+        # accidentally dropped Release creation while the header still
+        # promised it. dist/ is still in this job's workspace; the publish
+        # job downloads the same artifacts separately.
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
+        with:
+          generate_release_notes: true
+          files: |
+            dist/*.whl
+            dist/*.tar.gz
+
+      - name: Upload verified artifacts for publishing
+        # Pass the EXACT artifacts that were verified in the clean venvs to
+        # the publish job — the old flow REBUILT in publish-pypi, so PyPI
+        # could receive a different byte stream than the one verified above
+        # (2026-08-28 audit: non-deterministic build gap).
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: dist
+          path: |
+            dist/*.whl
+            dist/*.tar.gz
+          if-no-files-found: error
+          retention-days: 3
+
+  publish-pypi:
+    # PyPI via Trusted Publishing (OIDC) — no API token to manage or leak.
+    # Requires the one-time pending-publisher setup described at the top.
+    needs: release
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write  # OIDC token for Trusted Publishing
+    steps:
+      - name: Download verified artifacts
+        # No rebuild: publish EXACTLY the wheel/sdist verified in the release
+        # job (2026-08-28 audit fix). No checkout needed either.
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: dist
+          path: dist
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          attestations: true

coderio-0.6.0/.gitignore

@@ -0,0 +1,64 @@
+# OS
+.DS_Store
+Thumbs.db
+desktop.ini
+
+# IDE / Editor
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# Node
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Python
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+*.egg-info/
+build/
+dist/
+
+# Testing / linting
+.pytest_cache/
+.mypy_cache/
+.coverage
+coverage.xml
+htmlcov/
+
+# coderio user data (project-local layer)
+.coderio/
+
+# Misc
+*.log
+.tmp/
+tmp/
+.zcode/
+
+# zcode workspace instructions — local only, not part of the project
+/AGENTS.md
+/AGENTS_EXAMPLE.md
+
+# Local audit/analysis artifacts — single-maintainer working notes (2026-09-02
+# review: 34 untracked items at repo root). Files stay on disk; git just
+# stops listing them. Delete manually when no longer wanted.
+/coderio-*analysis*.md
+/coderio-optimization-checklist-*.md
+/coderio-latest-test-report-*.md
+/coderio-detailed-analysis-*.md
+/coderio-project-analysis.md
+/coderio-vs-mainstream-agents-*.md
+/juejin-post-*.md
+/_test_subagent/
+/docs/blog/
+/hello.py
+/test.py
+
+# Local screenshots / assets at the repo root (not shipped docs images)
+/*.png
+!/docs/images/*.png