drydock-cli 2.6.82__tar.gz → 2.6.83__tar.gz

drydock_cli-2.6.83/.auto_release.lock

@@ -0,0 +1 @@
+1426724

{drydock_cli-2.6.82 → drydock_cli-2.6.83}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 2.6.82
+Version: 2.6.83
 Summary: Local-first CLI coding agent — tested with Gemma 4 26B via vLLM
 Project-URL: Homepage, https://github.com/fbobe321/drydock
 Project-URL: Repository, https://github.com/fbobe321/drydock

{drydock_cli-2.6.82 → drydock_cli-2.6.83}/drydock/cli/entrypoint.py

@@ -82,6 +82,17 @@ def parse_arguments() -> argparse.Namespace:
         "or custom from ~/.drydock/agents/NAME.toml)",
     )
     parser.add_argument("--setup", action="store_true", help="Setup API key and exit")
+    parser.add_argument(
+        "--doctor",
+        action="store_true",
+        help="Check ~/.drydock/config.toml for drift vs. package defaults and exit",
+    )
+    parser.add_argument(
+        "--fix",
+        action="store_true",
+        help="With --doctor: rewrite ~/.drydock/config.toml to union missing "
+        "defaults (writes .bak backup first). No effect without --doctor.",
+    )
     parser.add_argument(
         "--workdir",
         type=Path,
@@ -175,6 +186,12 @@ def check_and_resolve_trusted_folder() -> None:
 def main() -> None:
     args = parse_arguments()
 
+    if getattr(args, "doctor", False):
+        from drydock.core.config.harness_files import init_harness_files_manager
+        from drydock.core.config.doctor import run_doctor
+        init_harness_files_manager("user", "project")
+        sys.exit(run_doctor(apply=bool(getattr(args, "fix", False))))
+
     if args.workdir:
         workdir = args.workdir.expanduser().resolve()
         if not workdir.is_dir():

{drydock_cli-2.6.82 → drydock_cli-2.6.83}/drydock/core/agent_loop.py

@@ -195,6 +195,12 @@ class AgentLoop:
         self._empty_responses: int = 0
         self._successful_test_runs: int = 0
 
+        # Shared read-file state — used by write_file / search_replace to
+        # enforce Read-before-Write (per Claude Code's tool contract) and
+        # by read_file to dedup unchanged-mtime re-reads. Keyed by resolved
+        # absolute path; value is {"content", "timestamp", "offset", "limit"}.
+        self._read_file_state: dict[str, dict] = {}
+
         system_prompt = get_universal_system_prompt(
             self.tool_manager, self.config, self.skill_manager, self.agent_manager
         )
@@ -970,6 +976,7 @@ class AgentLoop:
                     sampling_callback=self._sampling_handler,
                     plan_file_path=self._plan_session.plan_file_path,
                     switch_agent_callback=self.switch_agent,
+                    read_file_state=self._read_file_state,
                 ),
                 **tool_call.args_dict,
             ):

drydock_cli-2.6.83/drydock/core/config/doctor.py

@@ -0,0 +1,222 @@
+"""Config drift diagnostics (Option C — `drydock doctor`).
+
+Reads the user's ~/.drydock/config.toml, compares each field against the
+pydantic default, and reports drift. Designed to complement the auto-merge
+behavior in Option A: even though list fields union with defaults at
+load time, the user's config.toml FILE still shows the old values —
+the merge is runtime-only. `drydock doctor --fix` rewrites the TOML with
+the merged values so the file matches what's actually loaded.
+
+Separately reports scalar drift (e.g., auto_compact_threshold=200000 when
+the sensible value for the active model is lower). Those are advisory —
+doctor prints them but won't change them without --fix.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+try:
+    import tomllib
+except ImportError:  # pragma: no cover
+    import tomli as tomllib  # type: ignore
+
+try:
+    import tomli_w
+except ImportError:  # pragma: no cover
+    tomli_w = None  # type: ignore
+
+
+# Fields known to be mergeable (user value unioned with package default).
+# When drift is detected on these, `--fix` unions them.
+MERGEABLE_LIST_FIELDS: dict[str, str] = {
+    # "section.field": "human_label"
+    "bash.allowlist": "bash allowlist (auto-approved commands)",
+    "bash.denylist": "bash denylist (blocked commands)",
+    "bash.denylist_standalone": "bash denylist_standalone",
+}
+
+
+@dataclass
+class DriftReport:
+    field: str
+    user_value: Any
+    default_value: Any
+    kind: str  # "list_merge" | "missing_in_user" | "scalar_stale"
+    fix_description: str
+
+    def to_row(self) -> tuple[str, str, str, str]:
+        u = str(self.user_value)
+        d = str(self.default_value)
+        if len(u) > 40:
+            u = u[:37] + "..."
+        if len(d) > 40:
+            d = d[:37] + "..."
+        return (self.field, u, d, self.kind)
+
+
+def _get_tool_section(toml_data: dict, section: str) -> dict | None:
+    """Walk `tools.bash` → toml_data.get('tools', {}).get('bash', {})."""
+    cur: Any = toml_data
+    for part in section.split("."):
+        if not isinstance(cur, dict):
+            return None
+        cur = cur.get(part)
+        if cur is None:
+            return None
+    return cur if isinstance(cur, dict) else None
+
+
+def _get_default_list(field_path: str) -> list[str]:
+    """Resolve the package-default factory for a dotted field path."""
+    section, field = field_path.rsplit(".", 1)
+    if section == "bash":
+        from drydock.core.tools.builtins.bash import (
+            _get_default_allowlist,
+            _get_default_denylist,
+            _get_default_denylist_standalone,
+        )
+        factories = {
+            "allowlist": _get_default_allowlist,
+            "denylist": _get_default_denylist,
+            "denylist_standalone": _get_default_denylist_standalone,
+        }
+        fn = factories.get(field)
+        return list(fn()) if fn else []
+    return []
+
+
+def analyze_config(config_path: Path) -> tuple[dict, list[DriftReport]]:
+    """Load the user's config.toml and compare each mergeable field against
+    its package default. Returns (raw_toml_data, drift_reports)."""
+    if not config_path.exists():
+        return {}, []
+    with config_path.open("rb") as f:
+        data = tomllib.load(f)
+
+    reports: list[DriftReport] = []
+
+    # Mergeable list fields — check for defaults missing from user config.
+    for field_path, _label in MERGEABLE_LIST_FIELDS.items():
+        section, field = field_path.rsplit(".", 1)
+        # Drydock TOML structure: [tools.bash] allowlist = [...]
+        user_section = _get_tool_section(data, f"tools.{section}")
+        user_value = user_section.get(field) if user_section else None
+        defaults = _get_default_list(field_path)
+        if user_value is None:
+            # User has no entry — pydantic uses full defaults. No drift.
+            continue
+        if not isinstance(user_value, list):
+            continue
+        if "__override__" in user_value:
+            continue  # explicit opt-out, respect it
+        missing = [d for d in defaults if d not in user_value]
+        if missing:
+            reports.append(DriftReport(
+                field=f"tools.{field_path}",
+                user_value=f"{len(user_value)} entries",
+                default_value=f"{len(defaults)} in package",
+                kind="list_merge",
+                fix_description=(
+                    f"Add {len(missing)} missing default(s): "
+                    + ", ".join(missing[:5])
+                    + (f" … (+{len(missing) - 5} more)" if len(missing) > 5 else "")
+                ),
+            ))
+
+    return data, reports
+
+
+def print_drift_report(reports: list[DriftReport]) -> None:
+    """Print a table of drift findings."""
+    from rich.console import Console
+    from rich.table import Table
+    console = Console()
+    if not reports:
+        console.print("[green]No config drift detected.[/green]")
+        console.print(
+            "Your ~/.drydock/config.toml is in sync with the package defaults."
+        )
+        return
+    table = Table(title="Config drift vs. package defaults", show_lines=True)
+    table.add_column("Field")
+    table.add_column("User", overflow="fold")
+    table.add_column("Package default", overflow="fold")
+    table.add_column("Kind")
+    for r in reports:
+        row = r.to_row()
+        table.add_row(*row)
+    console.print(table)
+    console.print("\n[bold]Details:[/bold]")
+    for r in reports:
+        console.print(f"  • [cyan]{r.field}[/cyan]: {r.fix_description}")
+    console.print(
+        "\nRun [bold]drydock --doctor --fix[/bold] to apply safe corrections "
+        "(writes a backup to config.toml.bak).\n"
+        "Auto-mergeable lists are ALREADY merged at runtime — fixing only "
+        "updates the FILE to reflect what's loaded.\n"
+    )
+
+
+def apply_fix(config_path: Path, data: dict, reports: list[DriftReport]) -> int:
+    """Union missing defaults into the user's TOML file. Returns count of fields updated."""
+    if tomli_w is None:
+        raise RuntimeError(
+            "tomli_w is not installed. Add `pip install tomli_w` to use --fix."
+        )
+    updated = 0
+    for r in reports:
+        if r.kind != "list_merge":
+            continue
+        # r.field is e.g. "tools.bash.allowlist"
+        parts = r.field.split(".")
+        cur: Any = data
+        for p in parts[:-1]:
+            if p not in cur or not isinstance(cur[p], dict):
+                cur[p] = {}
+            cur = cur[p]
+        final_field = parts[-1]
+        defaults_path = ".".join(parts[1:])  # strip leading "tools."
+        defaults = _get_default_list(defaults_path)
+        user_list = cur.get(final_field, [])
+        merged = list(user_list) if isinstance(user_list, list) else []
+        for d in defaults:
+            if d not in merged:
+                merged.append(d)
+        cur[final_field] = merged
+        updated += 1
+
+    if updated == 0:
+        return 0
+
+    # Write backup then new file.
+    backup = config_path.with_suffix(config_path.suffix + ".bak")
+    if config_path.exists():
+        backup.write_bytes(config_path.read_bytes())
+    with config_path.open("wb") as f:
+        tomli_w.dump(data, f)
+    return updated
+
+
+def run_doctor(apply: bool = False) -> int:
+    """Entry point for `drydock --doctor [--fix]`. Returns shell exit code."""
+    from drydock.core.config.harness_files import get_harness_files_manager
+    from rich.console import Console
+    console = Console()
+
+    mgr = get_harness_files_manager()
+    config_path = mgr.config_file
+    if config_path is None:
+        console.print("[yellow]No user config file found.[/yellow]")
+        return 0
+    console.print(f"Analyzing [bold]{config_path}[/bold] ...\n")
+    data, reports = analyze_config(config_path)
+    print_drift_report(reports)
+    if apply and reports:
+        updated = apply_fix(config_path, data, reports)
+        console.print(
+            f"\n[green]Applied fixes to {updated} field(s). "
+            f"Backup saved to {config_path}.bak[/green]"
+        )
+    return 0

{drydock_cli-2.6.82 → drydock_cli-2.6.83}/drydock/core/tools/base.py

@@ -51,6 +51,11 @@ class InvokeContext:
     entrypoint_metadata: EntrypointMetadata | None = field(default=None)
     plan_file_path: Path | None = field(default=None)
     switch_agent_callback: SwitchAgentCallback | None = field(default=None)
+    # Shared across all tool invocations within a session. The same dict
+    # reference lives on AgentLoop; write_file / read_file / search_replace
+    # mutate it to track what the model has observed (Read-before-Write
+    # + read dedup, per Claude Code's tool contract model).
+    read_file_state: dict[str, dict] | None = field(default=None)
 
 
 class ToolError(Exception):

{drydock_cli-2.6.82 → drydock_cli-2.6.83}/drydock/core/tools/builtins/bash.py

@@ -1,7 +1,8 @@
 from __future__ import annotations
 
 import asyncio
-from collections.abc import AsyncGenerator
+from collections.abc import AsyncGenerator, Callable
+from typing import Any
 from functools import lru_cache
 import os
 from pathlib import Path
@@ -9,7 +10,7 @@ import signal
 import sys
 from typing import ClassVar, Literal, final
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 from tree_sitter import Language, Node, Parser
 import tree_sitter_bash as tsbash
 
@@ -161,8 +162,25 @@ async def _kill_process_tree(proc: asyncio.subprocess.Process) -> None:
 
 
 def _get_default_allowlist() -> list[str]:
+    # Auto-accepted because they are read-only / non-destructive.
+    # Each entry is a prefix — commands starting with any of these are
+    # ALWAYS allowed. Parser splits at pipes/chains so `ls | rm` is
+    # checked as two separate commands.
     common = [
-        "echo", "find", "git diff", "git log", "git status", "tree", "whoami",
+        "echo", "find", "tree", "whoami",
+        # Git read-only subcommands
+        "git diff", "git log", "git status", "git show",
+        "git branch", "git ls-files", "git grep", "git remote",
+        "git rev-parse", "git blame", "git config --get",
+        "git tag", "git stash list",
+        # Search tools (read-only by design)
+        "grep", "rg", "fd", "fdfind", "ag",
+        # Text/file inspection
+        "diff", "cmp", "sort", "uniq", "awk", "cut", "tr",
+        "basename", "dirname", "realpath", "readlink",
+        # System info (read-only)
+        "date", "id", "hostname", "pwd", "env", "printenv",
+        "du", "df", "ps", "free", "uptime",
         # Python project management — safe read/install operations
         "pip install", "pip list", "pip show", "pip freeze", "pip check",
         "pip install -e", "pip install -r",
@@ -221,6 +239,26 @@ def _get_default_denylist_standalone() -> list[str]:
         return common + ["bash", "sh", "nohup", "vi", "vim", "emacs", "nano", "su"]
 
 
+def _merge_with_defaults(user_value: Any, defaults_fn: Callable[[], list[str]]) -> list[str]:
+    """Union user list with package defaults so `pip install -U` propagates
+    new defaults without clobbering user additions (Config Option A). If the
+    user list ends with an entry '__override__', their list is used verbatim
+    (escape hatch for anyone who needs to intentionally remove a default).
+    """
+    if user_value is None:
+        return defaults_fn()
+    if not isinstance(user_value, list):
+        return user_value  # pydantic will re-type-check and fail cleanly
+    if "__override__" in user_value:
+        return [v for v in user_value if v != "__override__"]
+    defaults = defaults_fn()
+    merged = list(defaults)
+    for item in user_value:
+        if item not in merged:
+            merged.append(item)
+    return merged
+
+
 class BashToolConfig(BaseToolConfig):
     permission: ToolPermission = ToolPermission.ASK
     max_output_bytes: int = Field(
@@ -231,17 +269,40 @@ class BashToolConfig(BaseToolConfig):
     )
     allowlist: list[str] = Field(
         default_factory=_get_default_allowlist,
-        description="Command prefixes that are automatically allowed",
+        description=(
+            "Command prefixes that are automatically allowed. User entries "
+            "are UNIONED with package defaults (new defaults auto-propagate "
+            "on pip install -U). Include '__override__' in the list to use "
+            "your list verbatim and skip defaults."
+        ),
     )
     denylist: list[str] = Field(
         default_factory=_get_default_denylist,
-        description="Command prefixes that are automatically denied",
+        description=(
+            "Command prefixes that are automatically denied. User entries "
+            "unioned with package defaults; see allowlist for override."
+        ),
     )
     denylist_standalone: list[str] = Field(
         default_factory=_get_default_denylist_standalone,
         description="Commands that are denied only when run without arguments",
     )
 
+    @field_validator("allowlist", mode="before")
+    @classmethod
+    def _merge_allowlist(cls, v: Any) -> list[str]:
+        return _merge_with_defaults(v, _get_default_allowlist)
+
+    @field_validator("denylist", mode="before")
+    @classmethod
+    def _merge_denylist(cls, v: Any) -> list[str]:
+        return _merge_with_defaults(v, _get_default_denylist)
+
+    @field_validator("denylist_standalone", mode="before")
+    @classmethod
+    def _merge_denylist_standalone(cls, v: Any) -> list[str]:
+        return _merge_with_defaults(v, _get_default_denylist_standalone)
+
 
 class BashArgs(BaseModel):
     command: str

{drydock_cli-2.6.82 → drydock_cli-2.6.83}/drydock/core/tools/builtins/read_file.py

@@ -92,63 +92,56 @@ class ReadFile(
             )
             return
 
+        # mtime-based read dedup (Claude Code tool-contract pattern).
+        # If the model reads a file it has already read this session and
+        # nothing has changed on disk since, return a compact stub
+        # pointing to the earlier tool_result. Saves context + kills the
+        # "re-read 50x for no reason" pattern. Also preserves Read-before-
+        # Write because the stub still counts as having read the file.
+        read_state = ctx.read_file_state if ctx else None
+        path_key = str(file_path)
+        try:
+            current_mtime = file_path.stat().st_mtime_ns
+        except OSError:
+            current_mtime = 0
+        prior = read_state.get(path_key) if read_state is not None else None
+        if (
+            prior is not None
+            and prior.get("timestamp") == current_mtime
+            and prior.get("offset") == args.offset
+            and prior.get("limit") == args.limit
+        ):
+            yield ReadFileResult(
+                path=path_key,
+                content=(
+                    "<system-reminder>\n"
+                    f"File unchanged since your earlier read this session "
+                    f"({file_path.name}, mtime unchanged, same offset/limit). "
+                    "Use the content from the earlier Read tool_result — "
+                    "do NOT re-read. If you need to take action, call "
+                    "search_replace or write_file on what you already have.\n"
+                    "</system-reminder>"
+                ),
+                lines_read=0,
+                was_truncated=True,
+            )
+            return
+
         read_result = await self._read_file(args, file_path)
         content = "".join(read_result.lines)
 
-        # Mechanical loop-breaker: if the model reads the SAME path with
-        # the SAME (offset, limit) 3+ times in a row and the content
-        # hasn't changed, replace the body with a compact notice so the
-        # loop is visible. The model keeps burning context on identical
-        # reads (confirmed: one session had 52 identical read_file calls
-        # on lang_interp/lexer.py). This makes the re-read USELESS so it
-        # stops being attractive.
-        state = self.state.__dict__.setdefault("_read_history", {})
-        key = (str(file_path), args.offset, args.limit)
-        entry = state.get(key)
-        now_hash = hash(content)
-        if entry and entry["hash"] == now_hash:
-            entry["count"] += 1
-            # Tier 2 (5th identical read): ToolError — notice alone is
-            # being ignored by Gemma 4. An error forces the model through
-            # the error-handling path, which it reacts to.
-            if entry["count"] >= 5:
-                from drydock.core.tools.base import ToolError as _TE
-                raise _TE(
-                    f"REFUSED: you have already read {file_path.name} "
-                    f"{entry['count']} times with no file changes in "
-                    f"between. The content is in your context already. "
-                    f"STOP re-reading and DO something: edit the file, "
-                    f"read a DIFFERENT file, or run the code. This read "
-                    f"is refused until a different action happens."
-                )
-            if entry["count"] >= 3:
-                notice = (
-                    f"[NOTICE: this is read_file call #{entry['count']} "
-                    f"for {file_path.name} with no file changes since the "
-                    f"previous reads. The content below is IDENTICAL to "
-                    f"what you already have. STOP re-reading — use the "
-                    f"content from your context. Either edit the file "
-                    f"with search_replace/write_file, or call a different "
-                    f"tool.]\n"
-                )
-                # Return only the first 10 lines + the notice, so the
-                # model isn't spending context on identical body.
-                short = content.split("\n", 10)
-                shortened = "\n".join(short[:10])
-                if len(short) > 10:
-                    shortened += f"\n... [body elided on repeat read #{entry['count']}]"
-                yield ReadFileResult(
-                    path=str(file_path),
-                    content=notice + shortened,
-                    lines_read=len(read_result.lines),
-                    was_truncated=True,
-                )
-                return
-        else:
-            state[key] = {"hash": now_hash, "count": 1}
+        # Record read state so Write/Edit can enforce Read-before-Write
+        # and so future re-reads can dedup against this one.
+        if read_state is not None:
+            read_state[path_key] = {
+                "content": content,
+                "timestamp": current_mtime,
+                "offset": args.offset,
+                "limit": args.limit,
+            }
 
         yield ReadFileResult(
-            path=str(file_path),
+            path=path_key,
             content=content,
             lines_read=len(read_result.lines),
             was_truncated=read_result.was_truncated,

{drydock_cli-2.6.82 → drydock_cli-2.6.83}/drydock/core/tools/builtins/search_replace.py

@@ -180,6 +180,53 @@ class SearchReplace(
                         return
             raise
 
+        # Read-before-Edit enforcement (Claude Code tool contract).
+        # Editing a file without having seen it is the #1 cause of the
+        # "SEARCH text not found" failure cascade. Require the model to
+        # have read this path (or just written it) this session.
+        # Structured rejection (not ToolError) — model sees guidance in
+        # the result content and pivots to read_file.
+        read_state = ctx.read_file_state if ctx else None
+        path_key = str(file_path)
+        if read_state is not None and file_path.exists():
+            prior = read_state.get(path_key)
+            if prior is None:
+                yield SearchReplaceResult(
+                    file=path_key,
+                    blocks_applied=0,
+                    lines_changed=0,
+                    warnings=[],
+                    content=(
+                        "<system-reminder>\n"
+                        f"{file_path.name} has not been read this session. "
+                        "Use read_file first so you can see the current "
+                        "contents — then search_replace with the actual "
+                        "text from the file. This edit was NOT applied.\n"
+                        "</system-reminder>"
+                    ),
+                )
+                return
+            try:
+                current_mtime = file_path.stat().st_mtime_ns
+            except OSError:
+                current_mtime = 0
+            if prior.get("timestamp") and current_mtime and current_mtime > prior["timestamp"]:
+                yield SearchReplaceResult(
+                    file=path_key,
+                    blocks_applied=0,
+                    lines_changed=0,
+                    warnings=[],
+                    content=(
+                        "<system-reminder>\n"
+                        f"{file_path.name} was modified on disk since your "
+                        "last read. Re-read before editing to avoid "
+                        "clobbering changes you haven't seen. This edit "
+                        "was NOT applied.\n"
+                        "</system-reminder>"
+                    ),
+                )
+                return
+
         # Injection guard: scan replacement content for suspicious patterns
         from drydock.core.tools.injection_guard import check_content_for_injection
         if warning := check_content_for_injection(args.content, args.file_path):
@@ -277,6 +324,20 @@ class SearchReplace(
 
             await self._write_file(file_path, modified_content)
 
+            # Update read_file_state so chained edits don't trip Read-
+            # before-Edit. We just wrote — we know disk state.
+            if read_state is not None:
+                try:
+                    new_mtime = file_path.stat().st_mtime_ns
+                except OSError:
+                    new_mtime = 0
+                read_state[path_key] = {
+                    "content": modified_content,
+                    "timestamp": new_mtime,
+                    "offset": 0,
+                    "limit": None,
+                }
+
             # Auto-verify syntax for Python files
             if file_path.suffix == ".py":
                 try: