hx-cli 0.2.6__tar.gz → 0.2.7__tar.gz

{hx_cli-0.2.6 → hx_cli-0.2.7}/.github/workflows/ci.yml

@@ -36,8 +36,21 @@ jobs:
       - uses: actions/checkout@v4
       - uses: astral-sh/setup-uv@v3
       - run: uv sync --extra dev --python ${{ matrix.python }}
+      # bubblewrap, so the Linux sandbox tests run instead of skipping. Ubuntu
+      # 24.04 confines unprivileged user namespaces with AppArmor, which bwrap
+      # needs; the runner is throwaway, so lift that rather than ship a profile.
+      - if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update && sudo apt-get install -y bubblewrap
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
       # `live` needs an API key and real spend, so it never runs in CI.
       - run: uv run pytest -m "not live"
+      # What every end-to-end test saw, screen by screen - pass or fail.
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: e2e-report-${{ matrix.os }}-${{ matrix.python }}
+          path: e2e-report/
 
   install-script:
     runs-on: ubuntu-latest

{hx_cli-0.2.6 → hx_cli-0.2.7}/.gitignore

@@ -17,3 +17,4 @@ htmlcov/
 # and the rest - lives under $HX_HOME/projects/<slug>, outside the checkout
 # entirely, so there is nothing here left to hide.
 snapshot_report.html
+e2e-report/

{hx_cli-0.2.6 → hx_cli-0.2.7}/CHANGELOG.md

@@ -7,7 +7,7 @@ wheel, `hx changelog` prints it, and a session can answer "what's new?" or
 "which version added web search?" from it rather than from a guess. `hx docs`
 prints the manual next to it.
 
-The rules, enforced by `tests/test_docs.py` so a release cannot forget them:
+The rules, enforced by `tests/e2e/test_cli.py` so a release cannot forget them:
 
 - Every released version has a `## [x.y.z] - YYYY-MM-DD` section here, and the
   version in `src/hx/__init__.py` always has one. Bumping the version without
@@ -28,6 +28,66 @@ the project follows [semantic versioning](https://semver.org/).
 
 ---
 
+## [0.2.7] - 2026-09-27
+
+### Added
+
+- `HX_OPENROUTER_BASE_URL` points the OpenRouter route at any OpenAI-compatible
+  endpoint - a gateway, a recording proxy.
+- Pressing `esc` on a running turn leaves an "Interrupted" line in the transcript,
+  so a reply cut off mid-sentence no longer reads as a finished one.
+- A paste over 10 lines or 1000 characters shows in the prompt as
+  `[Pasted text #1 +40 lines]` and is sent in full; the token moves and deletes
+  as one character, and survives history recall and `ctrl+k`/`ctrl+y`.
+- `\` then `enter` inserts a newline in any terminal, including Apple's Terminal
+  and tmux without extended keys, where `shift+enter` cannot be told from `enter`. `\\` then
+  `enter` sends a message that ends in a backslash.
+
+### Fixed
+
+- `shift+enter` inserts a newline instead of sending the message in kitty, Ghostty,
+  WezTerm, iTerm2 and tmux (with `extended-keys on`): HX now asks the terminal for
+  the kitty keyboard protocol, falling back to xterm's modifyOtherKeys, and hands
+  it back on exit, `ctrl+z` and `/fullscreen`. `ctrl+shift+z` (redo) works there too.
+- `shift+enter` also inserts a newline on macOS in terminals that send it as a
+  plain `enter` (VS Code's, Apple's Terminal) or as `option+enter` (the Claude
+  desktop app's terminal panel): HX asks macOS which modifiers are held when the
+  key arrives. A real `option+enter` still steers, an `enter` hard on the heels of
+  a shifted character (`?` then `enter`) still sends, and `HX_MODIFIER_PROBE=0`
+  turns the check off.
+- A multi-line paste keeps its line breaks. Terminals send them as carriage
+  returns, which HX was deleting, so a pasted table arrived as one long line.
+- Lines typed with `shift+enter` stay separate lines in the transcript instead of
+  being joined into one paragraph.
+- On macOS the sandbox now refuses *writes* to credential paths (`~/.ssh`,
+  `~/.aws`, `~/.hx/auth.json`, ...) as well as reads, so a session opened in your
+  home directory cannot plant an `authorized_keys` entry.
+- On Linux the same holds for a credential path that does not exist yet: a
+  session opened in your home directory with no `~/.ssh` could create one and
+  plant an `authorized_keys` on the host. HX now creates such a path, empty and
+  private (`0700` for a directory, `0600` for a file), and mounts a read-only
+  shadow over it. Existing credential directories are shadowed read-only too, so
+  a write fails with "Read-only file system" instead of vanishing.
+- Shell commands the model runs show their output in the transcript again - the
+  last lines, with `ctrl+o` for the rest - instead of only "Took 12ms".
+- `/context` no longer fails with "'UsageLedger' object has no attribute
+  'total_tokens'"; it lists what fills the window.
+- `/copy` copies the last reply and says how it was copied, instead of failing.
+- `/theme light` reports "Theme: light" rather than "Theme: None".
+- `/compact` on a short session says only that there is nothing to compact, no
+  longer followed by a "Compacting…" that never finishes; a compaction that
+  saves nothing still reports that it finished, and the context gauge keeps
+  counting the system prompt afterwards.
+- `/help` lines its key descriptions up however long a binding is, and a long
+  row in `/agents`, `/cost` or any other command output wraps under its own
+  column instead of at the left edge.
+- The "always allow" option on an approval names where the rule is really
+  saved (`~/.hx`), and the answered approval shows a file relative to the
+  project rather than as an absolute path.
+- `/permissions` no longer says the same thing twice.
+
+---
+
 ## [0.2.6] - 2026-09-23
 
 ### Added
@@ -639,7 +699,8 @@ First release, published to PyPI as [`hx-cli`](https://pypi.org/project/hx-cli/)
 - `/configure` and `hx auth` for the OpenRouter key, `hx upgrade` for
   self-update, and `install.sh` bootstrapping uv with a pinned Python.
 
-[Unreleased]: https://github.com/aletisunil/hx/compare/v0.2.6...HEAD
+[Unreleased]: https://github.com/aletisunil/hx/compare/v0.2.7...HEAD
+[0.2.7]: https://github.com/aletisunil/hx/compare/v0.2.6...v0.2.7
 [0.2.6]: https://github.com/aletisunil/hx/compare/v0.2.5...v0.2.6
 [0.2.5]: https://github.com/aletisunil/hx/compare/v0.2.4...v0.2.5
 [0.2.4]: https://github.com/aletisunil/hx/compare/v0.2.3...v0.2.4

{hx_cli-0.2.6 → hx_cli-0.2.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hx-cli
-Version: 0.2.6
+Version: 0.2.7
 Summary: HX - an agent harness for the terminal
 Project-URL: Homepage, https://hx.sunilaleti.dev
 Project-URL: Documentation, https://hx.sunilaleti.dev
@@ -350,7 +350,7 @@ allowlist it if you would rather not be asked:
 ```
 
 `CHANGELOG.md` lists what each version added, and a release cannot skip it:
-`tests/test_docs.py` fails when `__version__` has no section (see
+`tests/e2e/test_cli.py` fails when `__version__` has no section (see
 [Releasing](#releasing)).
 
 ### Keys
@@ -362,7 +362,7 @@ be rebound (see [Keybindings](#keybindings)).
 | Key | Does |
 |---|---|
 | `enter` | send |
-| `ctrl+j` | newline (also `shift+enter`) |
+| `shift+enter` | newline (also `ctrl+j`; in a terminal that cannot send `shift+enter`, end the line with `\` and press `enter`) |
 | `esc` | interrupt the current turn |
 | `ctrl+c` | copy the selected text; with nothing selected, clear the prompt (twice on an empty prompt exits) |
 | `ctrl+d` | exit, when the prompt is empty |
@@ -664,8 +664,11 @@ merge: it is read per layer, and only from your own settings. See
 Environment overrides: `HX_MODEL`, `HX_SUBAGENT_MODEL`, `HX_MAX_TOKENS`,
 `HX_PERMISSION_MODE`, `HX_SANDBOX`, `HX_COMPACT_AT`, `HX_GIT_NOTICES`,
 `HX_THEME`, `HX_QUIET_STARTUP`. Also `HX_HOME` to relocate user state, `HX_TAVILY_API_KEY`
-for web search, and `HX_CA_BUNDLE` / `HX_SSL_NO_VERIFY` for TLS (see
-[Credentials](#credentials)).
+for web search, `HX_CA_BUNDLE` / `HX_SSL_NO_VERIFY` for TLS (see
+[Credentials](#credentials)), and `HX_OPENROUTER_BASE_URL` to point the OpenRouter
+route at another OpenAI-compatible endpoint - a gateway, or a recording proxy.
+`HX_MODIFIER_PROBE=0` stops HX asking macOS whether shift is held when an
+`enter` arrives (see [Keys](#keys)).
 
 ### The system prompt
 
@@ -774,7 +777,8 @@ confidence prompts rather than passing.
 **An OS sandbox** wraps command execution: Seatbelt on macOS, bubblewrap on
 Linux. The filesystem is readable, writes are confined to the project and the
 temp dir, credential paths (`~/.ssh`, `~/.aws`, and HX's own `auth.json`) are
-unreadable, and outbound network is off. If neither backend is present the
+unreadable and unwritable - even inside the project, and even before they
+exist - and outbound network is off. If neither backend is present the
 status bar says `no-sandbox` rather than implying protection that is not there.
 
 Modes cycle with shift+tab: `plan` (read-only — mutating tools are not even
@@ -1117,6 +1121,23 @@ uv run mypy                  # strict
 uv run hx                    # run from the checkout
 ```
 
+The suite is end-to-end. Each test in `tests/e2e/` starts the installed `hx`
+binary - on a real pseudo-terminal for the TUI, or as a plain subprocess for
+print mode and the other commands - in a private `$HOME` and `$HX_HOME`, and
+points it at a local OpenRouter stand-in with `HX_OPENROUTER_BASE_URL`.
+Everything between the keyboard and the socket is the shipped code; only the
+model's replies are scripted. The screen is read back through a VT emulator,
+so assertions are on the cells a terminal shows, not on the bytes HX meant to
+write.
+
+Every run writes `e2e-report/`: `index.html` shows each test's outcome and
+every screen it checked, rendered in colour, and one text file per screen lets
+two runs be compared with `diff -r`. CI uploads it from every test job as an
+`e2e-report-*` artifact. Set `HX_E2E_REPORT` to write it somewhere else.
+
+Tests that need the OS sandbox are skipped where there is no backend
+(`sandbox-exec` on macOS, `bwrap` on Linux).
+
 Tests marked `live` hit a real API. The OpenRouter ones cost money:
 
 ```sh
@@ -1133,17 +1154,7 @@ uv run pytest -m live tests/test_live_devin.py
 
 They are the only place the wire formats, streaming, tool use and a genuine
 cache hit are proven against a real service; everything else runs against the
-scripted provider.
-
-Tests marked `sandbox` exercise the real OS sandbox and are skipped where no
-backend exists.
-
-The TUI has SVG layout snapshots. Read the diff before accepting a change to
-them - they exist to catch a frame that quietly lost a row:
-
-```sh
-uv run pytest tests/tui/test_snapshots.py --snapshot-update
-```
+stand-in.
 
 ### Layout
 
@@ -1152,7 +1163,7 @@ src/hx/
   cli.py config.py paths.py frontmatter.py git.py
   core/         loop, context assembly, compaction, late injection, sessions, usage
   auth/         credential store, OAuth flows, per-route resolution
-  providers/    OpenRouter, Codex, Devin, the model catalogue, a scripted provider for tests
+  providers/    OpenRouter, Codex, Devin, the model catalogue
   tools/        Bash, Read, Write, Edit, Glob, Grep, Symbols, TodoWrite, Task,
                 WebSearch, WebFetch, line anchors, output capping
   permissions/  rule engine, shell decomposition, Seatbelt/bubblewrap
@@ -1189,12 +1200,12 @@ Each release:
 # 1. move CHANGELOG.md's [Unreleased] entries under the new version, dated,
 #    and leave a fresh empty [Unreleased] behind
 # 2. bump __version__ in src/hx/__init__.py
-# 3. uv run pytest tests/test_docs.py     # the version must have a section
+# 3. uv run pytest tests/e2e/test_cli.py  # the version must have a section
 git commit -am "release: X.Y.Z"
 git tag v$(uv run hx --version | cut -d' ' -f2) && git push origin main --tags
 ```
 
-Step 1 is not optional and is not a convention: `tests/test_docs.py` fails the
+Step 1 is not optional and is not a convention: `tests/e2e/test_cli.py` fails the
 whole suite when `__version__` has no `CHANGELOG.md` section, so a release that
 skips it cannot get past CI to the `publish` job. The file ships inside the
 wheel and `hx changelog` prints it, so a version with no section there reaches

{hx_cli-0.2.6 → hx_cli-0.2.7}/README.md

@@ -310,7 +310,7 @@ allowlist it if you would rather not be asked:
 ```
 
 `CHANGELOG.md` lists what each version added, and a release cannot skip it:
-`tests/test_docs.py` fails when `__version__` has no section (see
+`tests/e2e/test_cli.py` fails when `__version__` has no section (see
 [Releasing](#releasing)).
 
 ### Keys
@@ -322,7 +322,7 @@ be rebound (see [Keybindings](#keybindings)).
 | Key | Does |
 |---|---|
 | `enter` | send |
-| `ctrl+j` | newline (also `shift+enter`) |
+| `shift+enter` | newline (also `ctrl+j`; in a terminal that cannot send `shift+enter`, end the line with `\` and press `enter`) |
 | `esc` | interrupt the current turn |
 | `ctrl+c` | copy the selected text; with nothing selected, clear the prompt (twice on an empty prompt exits) |
 | `ctrl+d` | exit, when the prompt is empty |
@@ -624,8 +624,11 @@ merge: it is read per layer, and only from your own settings. See
 Environment overrides: `HX_MODEL`, `HX_SUBAGENT_MODEL`, `HX_MAX_TOKENS`,
 `HX_PERMISSION_MODE`, `HX_SANDBOX`, `HX_COMPACT_AT`, `HX_GIT_NOTICES`,
 `HX_THEME`, `HX_QUIET_STARTUP`. Also `HX_HOME` to relocate user state, `HX_TAVILY_API_KEY`
-for web search, and `HX_CA_BUNDLE` / `HX_SSL_NO_VERIFY` for TLS (see
-[Credentials](#credentials)).
+for web search, `HX_CA_BUNDLE` / `HX_SSL_NO_VERIFY` for TLS (see
+[Credentials](#credentials)), and `HX_OPENROUTER_BASE_URL` to point the OpenRouter
+route at another OpenAI-compatible endpoint - a gateway, or a recording proxy.
+`HX_MODIFIER_PROBE=0` stops HX asking macOS whether shift is held when an
+`enter` arrives (see [Keys](#keys)).
 
 ### The system prompt
 
@@ -734,7 +737,8 @@ confidence prompts rather than passing.
 **An OS sandbox** wraps command execution: Seatbelt on macOS, bubblewrap on
 Linux. The filesystem is readable, writes are confined to the project and the
 temp dir, credential paths (`~/.ssh`, `~/.aws`, and HX's own `auth.json`) are
-unreadable, and outbound network is off. If neither backend is present the
+unreadable and unwritable - even inside the project, and even before they
+exist - and outbound network is off. If neither backend is present the
 status bar says `no-sandbox` rather than implying protection that is not there.
 
 Modes cycle with shift+tab: `plan` (read-only — mutating tools are not even
@@ -1077,6 +1081,23 @@ uv run mypy                  # strict
 uv run hx                    # run from the checkout
 ```
 
+The suite is end-to-end. Each test in `tests/e2e/` starts the installed `hx`
+binary - on a real pseudo-terminal for the TUI, or as a plain subprocess for
+print mode and the other commands - in a private `$HOME` and `$HX_HOME`, and
+points it at a local OpenRouter stand-in with `HX_OPENROUTER_BASE_URL`.
+Everything between the keyboard and the socket is the shipped code; only the
+model's replies are scripted. The screen is read back through a VT emulator,
+so assertions are on the cells a terminal shows, not on the bytes HX meant to
+write.
+
+Every run writes `e2e-report/`: `index.html` shows each test's outcome and
+every screen it checked, rendered in colour, and one text file per screen lets
+two runs be compared with `diff -r`. CI uploads it from every test job as an
+`e2e-report-*` artifact. Set `HX_E2E_REPORT` to write it somewhere else.
+
+Tests that need the OS sandbox are skipped where there is no backend
+(`sandbox-exec` on macOS, `bwrap` on Linux).
+
 Tests marked `live` hit a real API. The OpenRouter ones cost money:
 
 ```sh
@@ -1093,17 +1114,7 @@ uv run pytest -m live tests/test_live_devin.py
 
 They are the only place the wire formats, streaming, tool use and a genuine
 cache hit are proven against a real service; everything else runs against the
-scripted provider.
-
-Tests marked `sandbox` exercise the real OS sandbox and are skipped where no
-backend exists.
-
-The TUI has SVG layout snapshots. Read the diff before accepting a change to
-them - they exist to catch a frame that quietly lost a row:
-
-```sh
-uv run pytest tests/tui/test_snapshots.py --snapshot-update
-```
+stand-in.
 
 ### Layout
 
@@ -1112,7 +1123,7 @@ src/hx/
   cli.py config.py paths.py frontmatter.py git.py
   core/         loop, context assembly, compaction, late injection, sessions, usage
   auth/         credential store, OAuth flows, per-route resolution
-  providers/    OpenRouter, Codex, Devin, the model catalogue, a scripted provider for tests
+  providers/    OpenRouter, Codex, Devin, the model catalogue
   tools/        Bash, Read, Write, Edit, Glob, Grep, Symbols, TodoWrite, Task,
                 WebSearch, WebFetch, line anchors, output capping
   permissions/  rule engine, shell decomposition, Seatbelt/bubblewrap
@@ -1149,12 +1160,12 @@ Each release:
 # 1. move CHANGELOG.md's [Unreleased] entries under the new version, dated,
 #    and leave a fresh empty [Unreleased] behind
 # 2. bump __version__ in src/hx/__init__.py
-# 3. uv run pytest tests/test_docs.py     # the version must have a section
+# 3. uv run pytest tests/e2e/test_cli.py  # the version must have a section
 git commit -am "release: X.Y.Z"
 git tag v$(uv run hx --version | cut -d' ' -f2) && git push origin main --tags
 ```
 
-Step 1 is not optional and is not a convention: `tests/test_docs.py` fails the
+Step 1 is not optional and is not a convention: `tests/e2e/test_cli.py` fails the
 whole suite when `__version__` has no `CHANGELOG.md` section, so a release that
 skips it cannot get past CI to the `publish` job. The file ships inside the
 wheel and `hx changelog` prints it, so a version with no section there reaches

{hx_cli-0.2.6 → hx_cli-0.2.7}/pyproject.toml

@@ -124,5 +124,5 @@ asyncio_mode = "auto"
 addopts = "-q --strict-markers -m 'not live'"
 markers = [
   "live: hits a real API (OpenRouter, or Tavily for the web search tools)",
-  "sandbox: requires sandbox-exec (macOS) or bwrap (Linux)",
+  "e2e: drives the installed hx binary against a local OpenRouter stand-in",
 ]

{hx_cli-0.2.6 → hx_cli-0.2.7}/src/hx/__init__.py

@@ -1,5 +1,5 @@
 """HX - an agent harness for the terminal."""
 
-__version__ = "0.2.6"
+__version__ = "0.2.7"
 
 __all__ = ["__version__"]

{hx_cli-0.2.6 → hx_cli-0.2.7}/src/hx/config.py

@@ -5,7 +5,7 @@ Precedence, lowest to highest::
     defaults
       < ~/.hx/settings.json
       < <cwd>/.hx/settings.json          (shared, check it in)
-      < <cwd>/.hx/settings.local.json    (this machine only, never checked in)
+      < ~/.hx/projects/<project>/settings.local.json   (this machine only)
       < environment
       < CLI flags
 

{hx_cli-0.2.6 → hx_cli-0.2.7}/src/hx/core/compaction.py

@@ -105,6 +105,12 @@ class Compactor:
 
         return list(messages[:boundary]), list(messages[boundary:])
 
+    def can_compact(self, messages: list[Message]) -> bool:
+        """Whether :meth:`compact` would summarise anything - checked before a
+        compaction is announced, so one is never started only to do nothing."""
+        dropped, _ = self.split(messages)
+        return len(dropped) >= self.MIN_MESSAGES_TO_COMPACT
+
     async def compact(
         self,
         messages: list[Message],

{hx_cli-0.2.6 → hx_cli-0.2.7}/src/hx/core/loop.py

@@ -790,8 +790,7 @@ class AgentLoop:
         fraction = self.session.usage.context_fraction
         if not self.compactor.should_compact(fraction, self.settings.context.compact_at):
             return
-        dropped, _ = self.compactor.split(self.session.active_messages())
-        if len(dropped) < self.compactor.MIN_MESSAGES_TO_COMPACT:
+        if not self.compactor.can_compact(self.session.active_messages()):
             return
         await self.compact(reason=f"context at {fraction:.0%} of the window")
 
@@ -805,6 +804,11 @@ class AgentLoop:
         """
         if self.compactor is None:
             return False
+        # Decided before anything is announced: "Compacting…" followed by
+        # nothing, beside the caller's "nothing to compact", reads as a
+        # compaction that started and never finished.
+        if not self.compactor.can_compact(self.session.active_messages()):
+            return False
 
         self.bus.publish(CompactionStarted(reason=reason))
         try:
@@ -813,16 +817,16 @@ class AgentLoop:
             self.bus.publish(ErrorRaised(message=f"Compaction failed: {exc}", recoverable=True))
             return False
 
-        if not result.dropped:
-            self.bus.publish(
-                CompactionFinished(
-                    tokens_before=result.tokens_before, tokens_after=result.tokens_after
-                )
-            )
-            return False
-
         self.session.record_compaction(result.dropped, result.kept, result.summary)
-        self.session.usage.context_tokens = result.tokens_after
+        # The estimates cover the conversation only; the system prompt and tools
+        # ahead of it are still sent, so they stay in the gauge - estimated the
+        # same way, rather than subtracted out of the provider's real count.
+        prefix = sum(
+            section.tokens
+            for section in (self.last_context.sections if self.last_context else [])
+            if section.name != "history"
+        )
+        self.session.usage.context_tokens = prefix + result.tokens_after
         self.bus.publish(
             CompactionFinished(tokens_before=result.tokens_before, tokens_after=result.tokens_after)
         )

{hx_cli-0.2.6 → hx_cli-0.2.7}/src/hx/permissions/engine.py

@@ -29,7 +29,7 @@ class GrantScope(StrEnum):
     ONCE = "once"
     SESSION = "session"
     ALWAYS = "always"
-    """Persisted to ``.hx/settings.local.json``."""
+    """Persisted to ``~/.hx/projects/<project>/settings.local.json``."""
 
 
 DEFAULT_MUTATING_TOOLS = frozenset({"Bash", "Write", "Edit", "Task"})

{hx_cli-0.2.6 → hx_cli-0.2.7}/src/hx/permissions/sandbox.py

@@ -27,27 +27,40 @@ class SandboxBackend(StrEnum):
 
 
 CREDENTIAL_PATHS = (
-    "~/.ssh",
-    "~/.aws",
-    "~/.gnupg",
-    "~/.kube",
+    "~/.ssh/",
+    "~/.aws/",
+    "~/.gnupg/",
+    "~/.kube/",
     "~/.docker/config.json",
-    "~/.config/gh",
+    "~/.config/gh/",
     "~/.netrc",
     "~/.npmrc",
     "~/.pypirc",
     "~/.hx/auth.json",
 )
-"""Denied even inside readable roots. A coding agent has no business reading
-these, and one prompt-injected `cat ~/.ssh/id_rsa` is all it takes."""
+"""Denied even inside readable and writable roots. A coding agent has no
+business reading these, and one prompt-injected `cat ~/.ssh/id_rsa` is all it
+takes - or writing them, where an `authorized_keys` line is a way back in.
+
+A trailing slash marks a directory. That matters only for one that does not
+exist yet: see :func:`build_bwrap_argv`."""
+
+
+@dataclass(frozen=True, slots=True)
+class DeniedPath:
+    path: Path
+    is_dir: bool
+    """What the path is meant to be, which is what it gets created as if it has
+    to be created - ``~/.ssh`` made as a file would break ssh as surely as
+    ``~/.netrc`` made as a directory would break curl."""
 
 
 @dataclass(slots=True)
 class SandboxPolicy:
     writable_paths: tuple[Path, ...] = ()
     readable_paths: tuple[Path, ...] = ()
-    deny_paths: tuple[Path, ...] = field(default_factory=tuple)
-    """Explicitly unreadable even inside readable roots - credential stores,
+    deny_paths: tuple[DeniedPath, ...] = field(default_factory=tuple)
+    """Unreadable and unwritable even inside allowed roots - credential stores,
     ``~/.ssh``, ``~/.aws``, and HX's own ``auth.json``."""
     allow_network: bool = False
     allow_subprocess: bool = True
@@ -127,7 +140,10 @@ def default_policy(cwd: Path, allow_network: bool = False) -> SandboxPolicy:
     return SandboxPolicy(
         writable_paths=tuple(dict.fromkeys(writable)),
         readable_paths=(Path("/"),),
-        deny_paths=tuple(_real(Path(p).expanduser()) for p in CREDENTIAL_PATHS),
+        deny_paths=tuple(
+            DeniedPath(_real(Path(p).expanduser()), is_dir=p.endswith("/"))
+            for p in CREDENTIAL_PATHS
+        ),
         allow_network=allow_network,
         cwd=cwd.resolve(),
     )
@@ -195,9 +211,13 @@ def build_seatbelt_profile(policy: SandboxPolicy) -> str:
     lines.append("(allow network*)" if policy.allow_network else "(deny network*)")
 
     if policy.deny_paths:
-        lines += ["", ";; Credentials - last match wins, so these override the read allowance"]
-        for path in policy.deny_paths:
-            lines.append(f"(deny file-read* (subpath {_sbpl_string(_real(path))}))")
+        # Writes too: a project opened in $HOME makes ~/.ssh writable, and a
+        # planted authorized_keys is worse than a leaked key.
+        lines += ["", ";; Credentials - last match wins, so these override both allowances"]
+        for denied in policy.deny_paths:
+            lines.append(
+                f"(deny file-read* file-write* (subpath {_sbpl_string(_real(denied.path))}))"
+            )
 
     return "\n".join(lines) + "\n"
 
@@ -229,7 +249,13 @@ def _sbpl_string(path: Path | str) -> str:
 
 def build_bwrap_argv(policy: SandboxPolicy, argv: list[str]) -> list[str]:
     """Generate the ``bwrap`` invocation: ``--ro-bind / /``, project bound
-    read-write, ``--unshare-net`` unless network is allowed."""
+    read-write, credential paths shadowed, ``--unshare-net`` unless network is
+    allowed.
+
+    Not quite side-effect free: a credential path that does not exist but sits
+    inside a writable root is created on the host first - see
+    :func:`_ensure_mountpoint`.
+    """
     command = [
         "bwrap",
         "--ro-bind",
@@ -241,20 +267,23 @@ def build_bwrap_argv(policy: SandboxPolicy, argv: list[str]) -> list[str]:
         "/proc",
         "--die-with-parent",
     ]
-    for path in policy.writable_paths:
-        command += ["--bind", str(_real(path)), str(_real(path))]
-    for path in policy.deny_paths:
-        if not path.exists():
+    writable = [_real(path) for path in policy.writable_paths]
+    for path in writable:
+        command += ["--bind", str(path), str(path)]
+    for denied in policy.deny_paths:
+        path = _real(denied.path)
+        if not path.exists() and not _ensure_mountpoint(denied, writable):
             continue
-        # There is no "deny read" in bwrap, so the path is shadowed instead -
-        # and what it is shadowed *with* has to match what is there. `--tmpfs`
+        # There is no "deny" in bwrap, so the path is shadowed instead - and
+        # what it is shadowed *with* has to match what is there. `--tmpfs`
         # mounts a directory, and aiming it at a regular file aborts bwrap
         # outright: the sandbox never starts, and the command it was wrapping
         # dies with it. Six of the credential paths are files, `~/.hx/auth.json`
         # among them - the one HX writes itself - so this was every Linux user
-        # who had ever logged in.
+        # who had ever logged in. Read-only either way, so a write fails the
+        # way it does under Seatbelt instead of vanishing into a tmpfs.
         if path.is_dir():
-            command += ["--tmpfs", str(path)]
+            command += ["--tmpfs", str(path), "--remount-ro", str(path)]
         else:
             command += ["--ro-bind", os.devnull, str(path)]
     if not policy.allow_network:
@@ -265,3 +294,36 @@ def build_bwrap_argv(policy: SandboxPolicy, argv: list[str]) -> list[str]:
     if policy.cwd is not None:
         command += ["--chdir", str(_real(policy.cwd))]
     return [*command, "--", *argv]
+
+
+def _ensure_mountpoint(denied: DeniedPath, writable: list[Path]) -> bool:
+    """Create a missing credential path on the host, so it can be shadowed.
+
+    bwrap can only deny a path by mounting over it, and a mount needs something
+    to mount on. Outside the writable roots, skipping a missing path is safe:
+    under ``--ro-bind / /`` the sandbox cannot create it either. Inside one it
+    is not - a session opened in ``$HOME`` with no ``~/.ssh`` yet could
+    ``mkdir ~/.ssh`` and plant an ``authorized_keys`` on the host.
+
+    So the path is created, empty and private, as what it is meant to be. It
+    stays: removing it after the command would race any other sandbox still
+    shadowing it, and an empty ``~/.ssh`` is what ssh itself would have made.
+    Left to bwrap, it would appear too - but a file as ``0444``, which the
+    user's own tools could not then write.
+
+    Returns whether the path now exists. A failure means the parent refuses
+    this user, and the sandbox runs as the same user, so it cannot create the
+    path either.
+    """
+    path = _real(denied.path)
+    if not any(path.is_relative_to(root) for root in writable):
+        return False
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        if denied.is_dir:
+            path.mkdir(mode=0o700, exist_ok=True)
+        else:
+            os.close(os.open(path, os.O_WRONLY | os.O_CREAT, 0o600))
+    except OSError:
+        return False
+    return path.exists()

{hx_cli-0.2.6 → hx_cli-0.2.7}/src/hx/providers/openrouter.py

@@ -16,6 +16,7 @@ from __future__ import annotations
 
 import asyncio
 import json
+import os
 import random
 import time
 from collections.abc import AsyncIterator
@@ -39,8 +40,17 @@ from hx.net import async_client
 from hx.providers.base import ProviderError, ProviderRequest, StreamDelta, StreamEnd, StreamItem
 
 API_BASE = "https://openrouter.ai/api/v1"
-CHAT_COMPLETIONS = f"{API_BASE}/chat/completions"
-MODELS = f"{API_BASE}/models"
+
+BASE_URL_VAR = "HX_OPENROUTER_BASE_URL"
+"""Points the OpenRouter route at another OpenAI-compatible endpoint: a
+gateway, a recording proxy, or the local stand-in the end-to-end suite runs."""
+
+
+def api_base() -> str:
+    """The endpoint the OpenRouter route talks to: ``HX_OPENROUTER_BASE_URL``
+    when set, otherwise OpenRouter itself."""
+    return (os.environ.get(BASE_URL_VAR) or "").strip().rstrip("/") or API_BASE
+
 
 DEFAULT_HEADERS = {
     "HTTP-Referer": "https://github.com/aletisunil/hx",
@@ -68,12 +78,12 @@ class OpenRouterProvider:
         self,
         api_key: str,
         *,
-        base_url: str = API_BASE,
+        base_url: str | None = None,
         timeout: float = 600.0,
         max_retries: int = 3,
     ) -> None:
         self.api_key = api_key
-        self.base_url = base_url.rstrip("/")
+        self.base_url = (base_url or api_base()).rstrip("/")
         self.max_retries = max_retries
         self._client = async_client(
             timeout=httpx.Timeout(timeout, connect=15.0),
@@ -437,11 +447,11 @@ def _error_message(status: int, body: str) -> str:
     return f"OpenRouter {status}: {message or body[:400]}"
 
 
-async def fetch_models(api_key: str, base_url: str = API_BASE) -> list[dict[str, Any]]:
+async def fetch_models(api_key: str, base_url: str | None = None) -> list[dict[str, Any]]:
     """GET ``/models``. Used by :class:`~hx.providers.models.ModelRegistry`."""
     async with async_client(timeout=30.0) as client:
         response = await client.get(
-            f"{base_url.rstrip('/')}/models",
+            f"{(base_url or api_base()).rstrip('/')}/models",
             headers={"Authorization": f"Bearer {api_key}", **DEFAULT_HEADERS},
         )
         if response.status_code >= 400: