lemming-cli 0.7.0__tar.gz → 0.7.2__tar.gz

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest
@@ -28,7 +31,7 @@ jobs:
 
       # Before the Python tests: they invoke readability, which runs this.
       - name: Install Node.js dependencies
-        run: npm install
+        run: npm ci
 
       # Runs ruff and ruff format as before, and adds the type and prose
       # checks the separate steps never covered.

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/.github/workflows/screenshots.yml

@@ -29,7 +29,7 @@ jobs:
           node-version: '20'
 
       - name: Install Node.js dependencies
-        run: npm install
+        run: npm ci
 
       - name: Install Playwright browser
         run: npx playwright install --with-deps chromium

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/Dockerfile

@@ -28,7 +28,7 @@ RUN uv sync --no-dev --group evals --frozen
 # the web assets. The browsers are not, and they are more than half the
 # image, so anything that will never drive one builds without them.
 ARG INSTALL_BROWSERS=true
-RUN npm install \
+RUN npm ci \
     && if [ "$INSTALL_BROWSERS" = "true" ]; then \
          npx playwright install --with-deps; \
        fi

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lemming-cli
-Version: 0.7.0
+Version: 0.7.2
 Summary: An autonomous, iterative task runner for AI coding agents.
 Project-URL: Homepage, https://github.com/owahltinez/lemming
 Project-URL: Repository, https://github.com/owahltinez/lemming
@@ -14,7 +14,7 @@ Requires-Dist: click>=8.0.0
 Requires-Dist: fastapi>=0.124.4
 Requires-Dist: pydantic>=2.12.5
 Requires-Dist: pyyaml>=6.0.3
-Requires-Dist: readability-cli>=0.10.4
+Requires-Dist: readability-cli>=0.10.6
 Requires-Dist: uvicorn>=0.33.0
 Description-Content-Type: text/markdown
 

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/docker-compose.yml

@@ -2,7 +2,7 @@ services:
   lemming:
     build: .
     ports:
-      - '${LEMMING_PORT:-8999}:${LEMMING_PORT:-8999}'
+      - '127.0.0.1:${LEMMING_PORT:-8999}:${LEMMING_PORT:-8999}'
     command: ['--port', '${LEMMING_PORT:-8999}']
     volumes:
       - lemming-data:/data

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "lemming-cli"
-version = "0.7.0"
+version = "0.7.2"
 description = "An autonomous, iterative task runner for AI coding agents."
 readme = "README.md"
 authors = [
@@ -19,7 +19,7 @@ dependencies = [
     "fastapi>=0.124.4",
     "pydantic>=2.12.5",
     "pyyaml>=6.0.3",
-    "readability-cli>=0.10.4",
+    "readability-cli>=0.10.6",
     "uvicorn>=0.33.0",
 ]
 

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/src/lemming/api/auth.py

@@ -23,6 +23,13 @@ def _token_matches(candidate: str | None, share_token: str) -> bool:
     return secrets.compare_digest(candidate.encode(), share_token.encode())
 
 
+def _with_security_headers(response: fastapi.Response) -> fastapi.Response:
+    """Attaches baseline security headers to an outgoing response."""
+    response.headers.setdefault("X-Content-Type-Options", "nosniff")
+    response.headers.setdefault("Referrer-Policy", "no-referrer")
+    return response
+
+
 async def share_token_middleware(request: fastapi.Request, call_next):
     """Require a share token for every request when one is configured.
 
@@ -40,18 +47,24 @@ async def share_token_middleware(request: fastapi.Request, call_next):
     """
     share_token = getattr(request.app.state, "share_token", None)
     if not share_token:
-        return await call_next(request)
+        return _with_security_headers(await call_next(request))
 
     token = request.query_params.get("token")
     if _token_matches(token, share_token):
         response = await call_next(request)
         response.set_cookie(
-            key="lemming_share_token", value=token, httponly=True
+            key="lemming_share_token",
+            value=token,
+            httponly=True,
+            samesite="strict",
+            secure=request.url.scheme == "https",
         )
-        return response
+        return _with_security_headers(response)
 
     cookie_token = request.cookies.get("lemming_share_token")
     if _token_matches(cookie_token, share_token):
-        return await call_next(request)
+        return _with_security_headers(await call_next(request))
 
-    return fastapi.Response("Unauthorized", status_code=401)
+    return _with_security_headers(
+        fastapi.Response("Unauthorized", status_code=401)
+    )

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/src/lemming/api/auth_test.py

@@ -20,9 +20,17 @@ def test_share_token_middleware():
         # Valid token via query
         response = client.get("/api/data?token=secret123")
         assert response.status_code == 200
-        assert "lemming_share_token=secret123" in response.headers.get(
-            "set-cookie", ""
+        set_cookie = response.headers.get("set-cookie", "")
+        assert "lemming_share_token=secret123" in set_cookie
+        assert "samesite=strict" in set_cookie.lower()
+        assert response.headers.get("x-content-type-options") == "nosniff"
+        assert response.headers.get("referrer-policy") == "no-referrer"
+
+        https_client = fastapi.testclient.TestClient(
+            main.app, base_url="https://testserver"
         )
+        https_resp = https_client.get("/api/data?token=secret123")
+        assert "secure" in https_resp.headers.get("set-cookie", "").lower()
 
         # Valid token via cookie
         client.cookies.set("lemming_share_token", "secret123")

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/src/lemming/api/config.py

@@ -51,6 +51,18 @@ class RunRequest(pydantic.BaseModel):
     env: dict[str, str] | None = None
 
 
+_BLOCKED_ENV_VARS = frozenset(
+    {
+        "LD_PRELOAD",
+        "LD_LIBRARY_PATH",
+        "DYLD_INSERT_LIBRARIES",
+        "PYTHONSTARTUP",
+        "PYTHONPATH",
+        "NODE_OPTIONS",
+    }
+)
+
+
 @router.post("/api/run")
 def run_loop(
     request: fastapi.Request,
@@ -58,6 +70,15 @@ def run_loop(
     project: str | None = None,
 ):
     """Start the orchestrator loop as a detached background process."""
+    if run_request.env:
+        blocked = sorted(
+            key for key in run_request.env if key.upper() in _BLOCKED_ENV_VARS
+        )
+        if blocked:
+            raise fastapi.HTTPException(
+                400, f"Forbidden environment variable(s): {', '.join(blocked)}"
+            )
+
     tasks_file = context.resolve_tasks_file(request.app.state, project)
     project_dir = context.resolve_project_dir(request.app.state, project)
 

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/src/lemming/api/config_test.py

@@ -82,3 +82,18 @@ def test_run_loop_with_project_cwd(test_workspace, client):
         # Verify Popen was called with the correct cwd
         _, kwargs = mock_popen.call_args
         assert str(kwargs["cwd"]) == str(subproject_dir)
+
+
+def test_run_loop_blocks_dangerous_env_vars(client, test_tasks):
+    for var in (
+        "LD_PRELOAD",
+        "LD_LIBRARY_PATH",
+        "DYLD_INSERT_LIBRARIES",
+        "PYTHONSTARTUP",
+        "PYTHONPATH",
+        "NODE_OPTIONS",
+    ):
+        with patch("subprocess.Popen") as mock_popen:
+            response = client.post("/api/run", json={"env": {var: "evil"}})
+            assert response.status_code == 400, var
+            mock_popen.assert_not_called()

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/src/lemming/api/tasks.py

@@ -34,6 +34,17 @@ def add_task(
     request: fastapi.Request, task: AddTaskRequest, project: str | None = None
 ):
     """Add a new task and start the orchestrator loop if needed."""
+    if task.parent_tasks_file:
+        root = request.app.state.root.resolve()
+        lemming_home = paths.get_lemming_home().resolve()
+        candidate = (root / task.parent_tasks_file).resolve()
+        if not (
+            candidate.is_relative_to(root)
+            or candidate.is_relative_to(lemming_home)
+        ):
+            raise fastapi.HTTPException(
+                400, "parent_tasks_file must be inside the workspace"
+            )
     tasks_file = context.resolve_tasks_file(request.app.state, project)
     try:
         new_task = operations.add_task(
@@ -200,9 +211,12 @@ def get_task_log(
     request: fastapi.Request, task_id: str, project: str | None = None
 ):
     """Get the runner log output for a task, or empty if none exists."""
-    log_file = paths.get_log_file(
-        context.resolve_tasks_file(request.app.state, project), task_id
-    )
-    if not log_file.exists():
+    tasks_file = context.resolve_tasks_file(request.app.state, project)
+    try:
+        paths._validate_task_id(task_id)
+        log_file = queries.resolve_log_file(tasks_file, task_id)
+    except models.TaskNotFoundError:
         return {"log": ""}
+    except (ValueError, models.AmbiguousTaskIdError) as e:
+        raise fastapi.HTTPException(400, str(e))
     return {"log": log_file.read_text(encoding="utf-8")}

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/src/lemming/api/tasks_test.py

@@ -511,3 +511,21 @@ def test_add_task_refuses_corrupted_tasks_file(client, test_tasks):
     assert response.status_code == 500
     assert str(test_tasks) in response.json()["detail"]
     assert test_tasks.read_text(encoding="utf-8") == corrupt
+
+
+def test_add_task_rejects_outside_parent_tasks_file(client, test_tasks):
+    for bad_path in ("/etc/passwd", "../../outside.yml"):
+        response = client.post(
+            "/api/tasks",
+            json={
+                "description": "Child task",
+                "parent": "task1",
+                "parent_tasks_file": bad_path,
+            },
+        )
+        assert response.status_code == 400, bad_path
+
+
+def test_get_task_log_rejects_traversal(client, test_tasks):
+    response = client.get("/api/tasks/..%2Fsecret/log")
+    assert response.status_code in (400, 404)

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/src/lemming/cli/operations.py

@@ -278,6 +278,12 @@ def serve(
     api_main.app.state.verbose = ctx.obj["VERBOSE"]
     api_main.app.state.root = pathlib.Path.cwd().resolve()
 
+    is_remote_host = host not in ("127.0.0.1", "::1", "localhost")
+    token = os.environ.get("LEMMING_SHARE_TOKEN") or (
+        secrets.token_urlsafe(32) if (tunnel or is_remote_host) else None
+    )
+    api_main.app.state.share_token = token
+
     tunnel_proc = None
     if tunnel:
         click.echo(f"[ Lemming ] Starting local server on port {port}...")
@@ -296,9 +302,6 @@ def serve(
             click.echo(f"[ Lemming ] Error starting tunnel: {e}", err=True)
             sys.exit(1)
 
-        token = secrets.token_urlsafe(32)
-        api_main.app.state.share_token = token
-
         click.echo("[ Lemming ] ")
         click.echo("[ Lemming ] ⚠️  SECURITY WARNING ")
         click.echo(
@@ -317,6 +320,10 @@ def serve(
         # The token is required locally too, so echo a usable local link.
         click.echo(f"[ Lemming ] 🖥️  Local: http://{host}:{port}?token={token}")
         click.echo("")
+    elif token:
+        click.echo(
+            f"Launching Lemming UI at http://{host}:{port}?token={token}"
+        )
     else:
         click.echo(f"Launching Lemming UI at http://{host}:{port}")
 

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/src/lemming/cli/operations_test.py

@@ -9,6 +9,7 @@ from unittest import mock
 import click.testing
 
 from lemming import models, persistence
+from lemming.api import main as api_main
 from lemming.cli import main as cli
 from lemming.cli import operations
 
@@ -138,6 +139,22 @@ class TestCLIOperations(unittest.TestCase):
         self.assertEqual(result.exit_code, 0)
         self.assertIn("Launches the local web dashboard", result.output)
 
+    def test_serve_non_loopback_enables_share_token(self):
+        original_token = getattr(api_main.app.state, "share_token", None)
+        try:
+            with mock.patch("uvicorn.run"):
+                result = self.cli_runner.invoke(
+                    cli.cli,
+                    self.base_args + ["serve", "--host", "0.0.0.0"],
+                )
+            self.assertEqual(result.exit_code, 0)
+            self.assertTrue(api_main.app.state.share_token)
+            self.assertIn(
+                f"?token={api_main.app.state.share_token}", result.output
+            )
+        finally:
+            api_main.app.state.share_token = original_token
+
 
 class TestQuietPollLogConfig(unittest.TestCase):
     def test_filter_path_resolves(self):

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/src/lemming/evals/readability.py

@@ -18,11 +18,12 @@ lint-debt-repaid against clean-fast-exit.
 """
 
 import pathlib
+import shutil
 import subprocess
 import sys
 
 from .. import models
-from . import fixtures, metrics, scenarios
+from . import container, fixtures, metrics, scenarios
 
 _GOAL = (
     "Build a small calculator CLI in calc/ with add, subtract, and "
@@ -94,8 +95,28 @@ def _save_finished_task(workspace: pathlib.Path, progress: list[str]) -> None:
 
 def _check_tests_pass(workspace: pathlib.Path) -> scenarios.Check:
     """Checks that the fixture's unit tests still pass after the hook."""
+    if shutil.which("docker"):
+        cmd = [
+            "docker",
+            "run",
+            "--rm",
+            "--network=none",
+            "-v",
+            f"{workspace}:{container.WORKSPACE_MOUNT}:ro",
+            "-w",
+            container.WORKSPACE_MOUNT,
+            container.DEFAULT_IMAGE,
+            "python3",
+            "-m",
+            "unittest",
+            "discover",
+            "-p",
+            "*_test.py",
+        ]
+    else:
+        cmd = [sys.executable, "-m", "unittest", "discover", "-p", "*_test.py"]
     result = subprocess.run(
-        [sys.executable, "-m", "unittest", "discover", "-p", "*_test.py"],
+        cmd,
         cwd=workspace,
         capture_output=True,
         text=True,

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/src/lemming/evals/readability_test.py

@@ -2,6 +2,7 @@ import pathlib
 import shutil
 import tempfile
 import unittest
+import unittest.mock
 
 from lemming import models
 from lemming.evals import fixtures, readability, scenarios, suites
@@ -39,6 +40,15 @@ class ScenarioTestCase(unittest.TestCase):
     def setUp(self):
         self.workspace = pathlib.Path(tempfile.mkdtemp())
         self.addCleanup(shutil.rmtree, self.workspace, ignore_errors=True)
+        orig_which = shutil.which
+        patcher = unittest.mock.patch(
+            "lemming.evals.readability.shutil.which",
+            side_effect=lambda cmd: (
+                None if cmd == "docker" else orig_which(cmd)
+            ),
+        )
+        patcher.start()
+        self.addCleanup(patcher.stop)
 
     def build(self, name: str):
         self.scenario = _scenario(name)
@@ -370,6 +380,43 @@ class TestFixtureIntegrity(ScenarioTestCase):
                 check = readability._check_tests_pass(workspace)
                 self.assertTrue(check.passed, check.detail)
 
+    def test_check_tests_pass_uses_docker_when_available(self):
+        completed = unittest.mock.Mock(returncode=0, stderr="")
+        with (
+            unittest.mock.patch(
+                "lemming.evals.readability.shutil.which",
+                return_value="/usr/bin/docker",
+            ),
+            unittest.mock.patch(
+                "lemming.evals.readability.subprocess.run",
+                return_value=completed,
+            ) as mock_run,
+        ):
+            check = readability._check_tests_pass(self.workspace)
+
+        self.assertTrue(check.passed)
+        cmd = mock_run.call_args[0][0]
+        self.assertEqual(
+            cmd,
+            [
+                "docker",
+                "run",
+                "--rm",
+                "--network=none",
+                "-v",
+                f"{self.workspace}:/workspace:ro",
+                "-w",
+                "/workspace",
+                "lemming-evals",
+                "python3",
+                "-m",
+                "unittest",
+                "discover",
+                "-p",
+                "*_test.py",
+            ],
+        )
+
 
 if __name__ == "__main__":
     unittest.main()

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/src/lemming/orchestrator.py

@@ -392,6 +392,18 @@ def _handle_runner_exit(
         runner.RETURNCODE_TIMEOUT,
     )
 
+    # Record agy's silently lost file creations before hooks judge the task.
+    for path in runner.extract_lost_writes(stdout):
+        message = f"Runner failed to create {path}: agy rejected the write"
+        click.echo(message)
+        try:
+            progress.add_progress(
+                tasks_file, task_id, message[: limits.MAX_PROGRESS_ENTRY_CHARS]
+            )
+        except Exception:
+            # Recording the loss must never take down the loop.
+            pass
+
     # Post-execution validation and heartbeat cleanup
     # This will mark the task as COMPLETED or PENDING based on whether
     # the agent called 'lemming complete'.

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/src/lemming/paths.py

@@ -257,6 +257,18 @@ def get_working_dir(tasks_file: pathlib.Path) -> pathlib.Path:
     return tasks_file_abs.parent
 
 
+def _validate_task_id(task_id: str) -> None:
+    """Rejects empty or path-traversing task identifiers."""
+    if (
+        not task_id
+        or "/" in task_id
+        or "\\" in task_id
+        or ".." in task_id
+        or pathlib.Path(task_id).name != task_id
+    ):
+        raise ValueError(f"Invalid task ID: {task_id!r}")
+
+
 def get_log_file(tasks_file: pathlib.Path, task_id: str) -> pathlib.Path:
     """Returns the log file path for a specific task.
 
@@ -267,6 +279,7 @@ def get_log_file(tasks_file: pathlib.Path, task_id: str) -> pathlib.Path:
     Returns:
         A pathlib.Path to the log file for the given task.
     """
+    _validate_task_id(task_id)
     project_dir = get_project_dir(tasks_file)
     project_dir.mkdir(parents=True, exist_ok=True)
     return project_dir / f"{task_id}-runner.log"
@@ -286,6 +299,7 @@ def get_brief_file(tasks_file: pathlib.Path, task_id: str) -> pathlib.Path:
     Returns:
         A pathlib.Path to the brief file for the given task.
     """
+    _validate_task_id(task_id)
     project_dir = get_project_dir(tasks_file)
     project_dir.mkdir(parents=True, exist_ok=True)
     return project_dir / f"{task_id}-brief.md"
@@ -306,6 +320,7 @@ def get_artifacts_dir(tasks_file: pathlib.Path, task_id: str) -> pathlib.Path:
     Returns:
         A pathlib.Path to the artifacts directory, which may not exist yet.
     """
+    _validate_task_id(task_id)
     return get_project_dir(tasks_file) / f"{task_id}-artifacts"
 
 
@@ -342,19 +357,20 @@ def _truncate_name(name: str) -> str:
 
 
 @functools.cache
-def in_git_repo() -> bool:
-    """Check if the current directory is inside a git repository.
+def in_git_repo(cwd: pathlib.Path | None = None) -> bool:
+    """Check if a directory (or the current directory) is inside a git repo.
 
-    The result is cached after the first call; use
-    `in_git_repo.cache_clear()` to reset it.
+    Args:
+        cwd: Directory to check, defaulting to the current working directory.
 
     Returns:
         True if inside a git repository, False otherwise.
     """
+    target = cwd if cwd is not None else pathlib.Path.cwd()
     try:
         return (
             subprocess.run(
-                ["git", "rev-parse", "--git-dir"],
+                ["git", "-C", str(target), "rev-parse", "--git-dir"],
                 capture_output=True,
                 check=False,
             ).returncode
@@ -365,7 +381,7 @@ def in_git_repo() -> bool:
 
 
 def is_ignored(path: pathlib.Path) -> bool:
-    """Check if a given path is ignored by git.
+    """Check if a given path is sensitive or ignored by git.
 
     Args:
         path: The path to check for git-ignore status.
@@ -373,12 +389,19 @@ def is_ignored(path: pathlib.Path) -> bool:
     Returns:
         True if the path is ignored by git, False otherwise.
     """
-    if not in_git_repo():
+    if (
+        ".git" in path.parts
+        or path.name == ".env"
+        or path.name.startswith(".env.")
+    ):
+        return True
+    cwd = path if path.is_dir() else path.parent
+    if not in_git_repo(cwd):
         return False
     try:
         return (
             subprocess.run(
-                ["git", "check-ignore", "-q", str(path)],
+                ["git", "-C", str(cwd), "check-ignore", "-q", "--", str(path)],
                 capture_output=True,
                 check=False,
             ).returncode

{lemming_cli-0.7.0 → lemming_cli-0.7.2}/src/lemming/paths_test.py

@@ -6,20 +6,20 @@ import subprocess
 import time
 from unittest import mock
 
+import pytest
+
 from lemming import paths
 
 
-def test_get_lemming_home_default():
+def test_get_lemming_home_default(monkeypatch):
     expected = pathlib.Path.home() / ".local" / "lemming"
-    if "LEMMING_HOME" in os.environ:
-        del os.environ["LEMMING_HOME"]
+    monkeypatch.delenv("LEMMING_HOME", raising=False)
     assert paths.get_lemming_home() == expected
 
 
-def test_get_lemming_home_override(tmp_path):
-    os.environ["LEMMING_HOME"] = str(tmp_path)
+def test_get_lemming_home_override(tmp_path, monkeypatch):
+    monkeypatch.setenv("LEMMING_HOME", str(tmp_path))
     assert paths.get_lemming_home() == tmp_path.resolve()
-    del os.environ["LEMMING_HOME"]
 
 
 def test_get_working_dir(tmp_path, monkeypatch):
@@ -84,6 +84,34 @@ def test_get_log_file(tmp_path):
     assert log_file.parent.exists()
 
 
+def test_get_log_and_brief_file_reject_path_traversal(tmp_path):
+    tasks_file = tmp_path / "tasks.yml"
+    for bad_id in ("../escape", "a/b", "..", ""):
+        with pytest.raises(ValueError):
+            paths.get_log_file(tasks_file, bad_id)
+        with pytest.raises(ValueError):
+            paths.get_brief_file(tasks_file, bad_id)
+        with pytest.raises(ValueError):
+            paths.get_artifacts_dir(tasks_file, bad_id)
+
+
+def test_is_ignored_blocks_git_and_dotenv_and_uses_target_cwd(tmp_path):
+    assert paths.is_ignored(tmp_path / ".git") is True
+    assert paths.is_ignored(tmp_path / ".git" / "config") is True
+    assert paths.is_ignored(tmp_path / ".env") is True
+    assert paths.is_ignored(tmp_path / ".env.local") is True
+
+    repo_dir = tmp_path / "subrepo"
+    repo_dir.mkdir()
+    subprocess.run(["git", "-C", str(repo_dir), "init", "-q"], check=True)
+    (repo_dir / ".gitignore").write_text("secret.txt\n", encoding="utf-8")
+    (repo_dir / "secret.txt").touch()
+    (repo_dir / "public.txt").touch()
+
+    assert paths.is_ignored(repo_dir / "secret.txt") is True
+    assert paths.is_ignored(repo_dir / "public.txt") is False
+
+
 def test_in_git_repo_and_is_ignored(tmp_path):
     orig_cwd = os.getcwd()
     os.chdir(tmp_path)