lemming-cli 0.7.1__tar.gz → 0.8.0__tar.gz

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest
@@ -28,7 +31,7 @@ jobs:
 
       # Before the Python tests: they invoke readability, which runs this.
       - name: Install Node.js dependencies
-        run: npm install
+        run: npm ci
 
       # Runs ruff and ruff format as before, and adds the type and prose
       # checks the separate steps never covered.
@@ -46,7 +49,7 @@ jobs:
 
       - name: Run Web tests
         run: |
-          npx playwright install --with-deps
+          npx playwright install --with-deps chromium
           npm test
 
       - name: Build container image

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/.github/workflows/screenshots.yml

@@ -29,7 +29,7 @@ jobs:
           node-version: '20'
 
       - name: Install Node.js dependencies
-        run: npm install
+        run: npm ci
 
       - name: Install Playwright browser
         run: npx playwright install --with-deps chromium

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/Dockerfile

@@ -28,7 +28,7 @@ RUN uv sync --no-dev --group evals --frozen
 # the web assets. The browsers are not, and they are more than half the
 # image, so anything that will never drive one builds without them.
 ARG INSTALL_BROWSERS=true
-RUN npm install \
+RUN npm ci \
     && if [ "$INSTALL_BROWSERS" = "true" ]; then \
          npx playwright install --with-deps; \
        fi

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lemming-cli
-Version: 0.7.1
+Version: 0.8.0
 Summary: An autonomous, iterative task runner for AI coding agents.
 Project-URL: Homepage, https://github.com/owahltinez/lemming
 Project-URL: Repository, https://github.com/owahltinez/lemming
@@ -14,7 +14,7 @@ Requires-Dist: click>=8.0.0
 Requires-Dist: fastapi>=0.124.4
 Requires-Dist: pydantic>=2.12.5
 Requires-Dist: pyyaml>=6.0.3
-Requires-Dist: readability-cli>=0.10.4
+Requires-Dist: readability-cli>=0.10.6
 Requires-Dist: uvicorn>=0.33.0
 Description-Content-Type: text/markdown
 
@@ -139,7 +139,7 @@ lemming exec --review readability
 lemming -C ../review-worktree exec --review testing --scope main...HEAD
 
 # Do the work, then gate it
-lemming exec "Add pagination to the tasks API" --review all
+lemming exec "Add pagination to the tasks API" --review '*'
 ```
 
 `--scope` takes paths, which pass through untouched, or a git revision range,
@@ -265,9 +265,9 @@ tasks may not fully achieve the stated goal. **Orchestrator Hooks** address this
 by running custom agents or scripts after each task execution to evaluate
 results and adapt the roadmap.
 
-Lemming runs every hook it discovers on the filesystem (including the built-in
-`roadmap` hook). Hooks are plain Markdown files, and udev-style filename
-conventions control their behavior:
+Lemming runs the hooks enabled for the project, which by default is only the
+built-in `roadmap` hook; review hooks are opt-in. Hooks are plain Markdown
+files, and udev-style filename conventions control their behavior:
 
 - **Ordering**: A numeric prefix sets the execution order (e.g. `10-lint.md`
   runs before `90-roadmap.md`); files without a prefix default to priority 50.
@@ -276,15 +276,15 @@ conventions control their behavior:
 - **Oneshot tasks**: A task added with `--oneshot` skips all hooks once it
   completes, so mechanical work (a typo fix, a version bump) does not pay for
   the full review lifecycle. Failure hooks still run if it fails.
-- **Disabling**: An empty file masks (disables) the hook of the same name from a
-  lower-precedence layer.
+- **Masking**: An empty file hides the hook of the same name from a
+  lower-precedence layer, even where it is enabled.
 
 ```bash
-# Disable a hook for this project (writes an empty .lemming/hooks/50-lint.md)
-lemming hooks disable lint
+# Run the testing review after every task in this project
+lemming hooks enable testing
 
-# Re-enable it (removes the mask file)
-lemming hooks enable lint
+# Or pick the reviews for one task, replacing the project's ('' for none)
+lemming add "Redesign the settings page" --hooks ux,testing
 ```
 
 ### Built-in Hooks ⚓️
@@ -329,10 +329,14 @@ See [docs/HOOKS.md](docs/HOOKS.md) for more details.
 Use the `config` and `hooks` commands to manage your project's execution loop:
 
 ```bash
-# List all hooks in execution order, with source and status
+# List all hooks in execution order, marking the ones enabled by default
 lemming hooks list
 
-# View current project configuration (includes the active hooks)
+# Enable or disable hooks for the project (stored in tasks.yml)
+lemming hooks enable readability
+lemming hooks disable readability
+
+# View current project configuration (includes the enabled hooks)
 lemming config list
 
 # Persist configuration to tasks.yml
@@ -380,9 +384,10 @@ These come before the subcommand and apply to all of them.
 - **`goal [<text>]`**: Set or view the long-term goal shared by all tasks.
   Supports `-f/--file`.
 - **`add <desc>`**: Append a new task. Supports `--index`, `--runner`,
-  `--model`, and `--oneshot`.
-- **`edit <id>`**: Modify a task's description, runner, model, position, or
-  oneshot flag (`--oneshot/--no-oneshot`).
+  `--model`, `--oneshot`, and `--hooks` (the task's reviews, comma-separated;
+  inherited from `--parent` when omitted).
+- **`edit <id>`**: Modify a task's description, runner, model, position,
+  oneshot flag (`--oneshot/--no-oneshot`), or reviews (`--hooks`).
 - **`brief <id> [text]`**: View or set a task's long-form brief. Unlike the
   description it has no length cap, and it is appended to the runner prompt
   automatically — the right home for measured timings, exact failing selectors,
@@ -410,12 +415,9 @@ These come before the subcommand and apply to all of them.
   - `set <key> <value>`: Update a setting. `set model default` clears a pinned
     model without touching the runner.
 - **`hooks`**: Manage orchestrator hooks.
-  - `list`: View available and active hooks.
-  - `install`: Install built-in hooks to the global directory.
-  - `enable <name>...`: Activate one or more hooks.
-  - `disable <name>...`: Deactivate one or more hooks.
-  - `set <name>...`: Set the exact list of active hooks.
-  - `reset`: Restore default hooks (run all available).
+  - `list`: View available hooks and the ones enabled for the project.
+  - `enable <name>...`: Run one or more hooks after every task.
+  - `disable <name>...`: Stop running one or more hooks by default.
 - **`readability`**: Code quality tool for style guide adherence, wrapping the
   [readability](https://github.com/owahltinez/readability) package. Ruff and
   Pyrefly run with bundled Google-style defaults unless the target project

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/README.md

@@ -119,7 +119,7 @@ lemming exec --review readability
 lemming -C ../review-worktree exec --review testing --scope main...HEAD
 
 # Do the work, then gate it
-lemming exec "Add pagination to the tasks API" --review all
+lemming exec "Add pagination to the tasks API" --review '*'
 ```
 
 `--scope` takes paths, which pass through untouched, or a git revision range,
@@ -245,9 +245,9 @@ tasks may not fully achieve the stated goal. **Orchestrator Hooks** address this
 by running custom agents or scripts after each task execution to evaluate
 results and adapt the roadmap.
 
-Lemming runs every hook it discovers on the filesystem (including the built-in
-`roadmap` hook). Hooks are plain Markdown files, and udev-style filename
-conventions control their behavior:
+Lemming runs the hooks enabled for the project, which by default is only the
+built-in `roadmap` hook; review hooks are opt-in. Hooks are plain Markdown
+files, and udev-style filename conventions control their behavior:
 
 - **Ordering**: A numeric prefix sets the execution order (e.g. `10-lint.md`
   runs before `90-roadmap.md`); files without a prefix default to priority 50.
@@ -256,15 +256,15 @@ conventions control their behavior:
 - **Oneshot tasks**: A task added with `--oneshot` skips all hooks once it
   completes, so mechanical work (a typo fix, a version bump) does not pay for
   the full review lifecycle. Failure hooks still run if it fails.
-- **Disabling**: An empty file masks (disables) the hook of the same name from a
-  lower-precedence layer.
+- **Masking**: An empty file hides the hook of the same name from a
+  lower-precedence layer, even where it is enabled.
 
 ```bash
-# Disable a hook for this project (writes an empty .lemming/hooks/50-lint.md)
-lemming hooks disable lint
+# Run the testing review after every task in this project
+lemming hooks enable testing
 
-# Re-enable it (removes the mask file)
-lemming hooks enable lint
+# Or pick the reviews for one task, replacing the project's ('' for none)
+lemming add "Redesign the settings page" --hooks ux,testing
 ```
 
 ### Built-in Hooks ⚓️
@@ -309,10 +309,14 @@ See [docs/HOOKS.md](docs/HOOKS.md) for more details.
 Use the `config` and `hooks` commands to manage your project's execution loop:
 
 ```bash
-# List all hooks in execution order, with source and status
+# List all hooks in execution order, marking the ones enabled by default
 lemming hooks list
 
-# View current project configuration (includes the active hooks)
+# Enable or disable hooks for the project (stored in tasks.yml)
+lemming hooks enable readability
+lemming hooks disable readability
+
+# View current project configuration (includes the enabled hooks)
 lemming config list
 
 # Persist configuration to tasks.yml
@@ -360,9 +364,10 @@ These come before the subcommand and apply to all of them.
 - **`goal [<text>]`**: Set or view the long-term goal shared by all tasks.
   Supports `-f/--file`.
 - **`add <desc>`**: Append a new task. Supports `--index`, `--runner`,
-  `--model`, and `--oneshot`.
-- **`edit <id>`**: Modify a task's description, runner, model, position, or
-  oneshot flag (`--oneshot/--no-oneshot`).
+  `--model`, `--oneshot`, and `--hooks` (the task's reviews, comma-separated;
+  inherited from `--parent` when omitted).
+- **`edit <id>`**: Modify a task's description, runner, model, position,
+  oneshot flag (`--oneshot/--no-oneshot`), or reviews (`--hooks`).
 - **`brief <id> [text]`**: View or set a task's long-form brief. Unlike the
   description it has no length cap, and it is appended to the runner prompt
   automatically — the right home for measured timings, exact failing selectors,
@@ -390,12 +395,9 @@ These come before the subcommand and apply to all of them.
   - `set <key> <value>`: Update a setting. `set model default` clears a pinned
     model without touching the runner.
 - **`hooks`**: Manage orchestrator hooks.
-  - `list`: View available and active hooks.
-  - `install`: Install built-in hooks to the global directory.
-  - `enable <name>...`: Activate one or more hooks.
-  - `disable <name>...`: Deactivate one or more hooks.
-  - `set <name>...`: Set the exact list of active hooks.
-  - `reset`: Restore default hooks (run all available).
+  - `list`: View available hooks and the ones enabled for the project.
+  - `enable <name>...`: Run one or more hooks after every task.
+  - `disable <name>...`: Stop running one or more hooks by default.
 - **`readability`**: Code quality tool for style guide adherence, wrapping the
   [readability](https://github.com/owahltinez/readability) package. Ruff and
   Pyrefly run with bundled Google-style defaults unless the target project

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/SKILL.md

@@ -124,8 +124,8 @@ reviews run — against work that already exists.
 ```sh
 lemming exec --review readability            # uncommitted work
 lemming exec --review testing --scope main...HEAD
-lemming exec --review all --scope src/api/
-lemming exec "Add pagination" --review all   # do the work, then gate it
+lemming exec --review '*' --scope src/api/
+lemming exec "Add pagination" --review '*'   # do the work, then gate it
 
 # Someone else's branch, in a worktree so your own tree is untouched
 git worktree add /tmp/pr-123 && (cd /tmp/pr-123 && gh pr checkout 123)
@@ -162,12 +162,12 @@ The loop shares one workspace across all its tasks, so isolate the **whole run**
 — one branch or worktree created before `lemming run`, driven with
 `lemming -C <worktree> run` — never one per task.
 
-**Mark mechanical tasks `--oneshot`.** After every other task, review hooks run
-and a roadmap hook may revise the queue; each hook is a full agent run, so a
-typo fix, rename, version bump, or cleanup without `--oneshot` takes several
-times longer than the work itself. Reserve hooked tasks for changes in
-behavior. `lemming hooks list` shows the hooks; `lemming hooks disable <name>`
-turns one off for the project.
+**Mark mechanical tasks `--oneshot`.** After every other task, a roadmap hook
+may revise the queue and any enabled reviews run; each hook is a full agent
+run, so a typo fix, rename, version bump, or cleanup without `--oneshot` takes
+several times longer than the work itself. Reviews are opt-in: pick them for
+one task with `lemming add ... --hooks testing,ux`, or for every task with
+`lemming hooks enable <name>`. `lemming hooks list` shows which are enabled.
 
 ### Supervise in milestones
 

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/docker-compose.yml

@@ -2,7 +2,7 @@ services:
   lemming:
     build: .
     ports:
-      - '${LEMMING_PORT:-8999}:${LEMMING_PORT:-8999}'
+      - '127.0.0.1:${LEMMING_PORT:-8999}:${LEMMING_PORT:-8999}'
     command: ['--port', '${LEMMING_PORT:-8999}']
     volumes:
       - lemming-data:/data

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/docs/EVALS.md

@@ -153,6 +153,9 @@ running a constant policy in either direction should score 50% across the pair.
 `false-reuse-restraint` exists for exactly this reason: it is the inverse of
 `consolidate-or-report-live-duplication`, with two functions that share a shape
 but not a concept, and folding them together is the failure.
+`finding-is-not-a-task` is the roadmap suite's inverse of
+`follow-up-without-code-changes`: the finished task logs optional polish ideas
+rather than a bug, and scheduling them is the failure.
 
 The `task` suite carries the same idea into the code an agent writes rather than
 reviews. `minimal-change-restraint` hands it one well-specified function to add

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/docs/HOOKS.md

@@ -36,10 +36,10 @@ conventions control their behavior:
   failure hooks, so recovery is never skipped. Note that `roadmap` is skipped
   too: if a oneshot task is the last one in the queue, the run ends without a
   goal audit, so nothing is queued to carry the goal further.
-- **Masking**: An empty file disables the hook of the same name from a
-  lower-precedence layer (see below). For example, an empty
-  `.lemming/hooks/readability.md` disables the built-in `readability` hook for
-  that project.
+- **Masking**: An empty file hides the hook of the same name from a
+  lower-precedence layer (see below), even where a project or task enables it.
+  For example, an empty `.lemming/hooks/readability.md` hides the built-in
+  `readability` hook from that project.
 - **Overriding**: A non-empty file replaces the hook of the same name from a
   lower-precedence layer. The winning filename also determines the priority, so
   keep the `9x-` prefix when overriding a failure hook (e.g. `90-roadmap.md`),
@@ -47,6 +47,9 @@ conventions control their behavior:
 
 ## Built-in Hooks
 
+Only `roadmap` runs by default; the review hooks are opt-in per project or task
+(see [Enabling and Disabling](#enabling-and-disabling)).
+
 ### `roadmap` (Default)
 
 The primary mechanism for autonomous project management. It analyzes the results
@@ -175,25 +178,32 @@ are issues, add a new task to fix them.
 
 ### Enabling and Disabling
 
-Lemming runs every hook it discovers that is not masked. There is no hook
-configuration in `tasks.yml`; the filesystem is the single source of truth.
-
-The `hooks` command group provides shortcuts for managing project masks:
+Each project lists the hooks it runs in `tasks.yml` under `config.hooks`, which
+defaults to `[roadmap]`: review hooks are opt-in. Manage the list with:
 
 ```bash
-# Disable a hook for this project (writes an empty .lemming/hooks/50-lint.md)
+# Run the lint review after every task in this project
+lemming hooks enable lint
+
+# Stop running it by default
 lemming hooks disable lint
+```
 
-# Re-enable it (removes the mask file)
-lemming hooks enable lint
+A task can pick its own reviews, which replace the project's for that task:
+
+```bash
+lemming add "Redesign the settings page" --hooks ux,testing
+lemming edit <id> --hooks ''     # no reviews for this task
+lemming edit <id> --hooks '*'    # every review available now
 ```
 
-These commands validate the hook names before changing anything and refuse to
-touch files with content (a non-empty file is an override, not a mask). An empty
-file created by hand works just as well; the commands additionally keep the
-hook's priority in the mask filename so listings stay accurate.
+`--hooks` accepts only reviews (priority below 90). Hooks at 90 and above, such
+as `roadmap`, orchestrate the queue and always follow the project's list. A task
+added with `--parent` and no `--hooks` inherits its parent's choice, so a split
+keeps it. The same rules apply to built-in, global, and project hooks, and a
+masked or missing hook never runs whatever the lists say.
 
-Hooks are re-discovered on every task execution, so changes are picked up
+The selection is re-read every time hooks run, so changes are picked up
 dynamically by a running orchestrator loop.
 
 ### Available Variables
@@ -227,7 +237,7 @@ audit" describes the kind of review, not its extent.
 ### Listing Hooks
 
 You can see all hooks in execution order, with their priority, source layer, and
-status (disabled, runs on failure) using the CLI:
+status (enabled for the project, masked, runs on failure) using the CLI:
 
 ```bash
 lemming hooks list

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "lemming-cli"
-version = "0.7.1"
+version = "0.8.0"
 description = "An autonomous, iterative task runner for AI coding agents."
 readme = "README.md"
 authors = [
@@ -19,7 +19,7 @@ dependencies = [
     "fastapi>=0.124.4",
     "pydantic>=2.12.5",
     "pyyaml>=6.0.3",
-    "readability-cli>=0.10.4",
+    "readability-cli>=0.10.6",
     "uvicorn>=0.33.0",
 ]
 

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/src/lemming/api/auth.py

@@ -23,6 +23,13 @@ def _token_matches(candidate: str | None, share_token: str) -> bool:
     return secrets.compare_digest(candidate.encode(), share_token.encode())
 
 
+def _with_security_headers(response: fastapi.Response) -> fastapi.Response:
+    """Attaches baseline security headers to an outgoing response."""
+    response.headers.setdefault("X-Content-Type-Options", "nosniff")
+    response.headers.setdefault("Referrer-Policy", "no-referrer")
+    return response
+
+
 async def share_token_middleware(request: fastapi.Request, call_next):
     """Require a share token for every request when one is configured.
 
@@ -40,18 +47,24 @@ async def share_token_middleware(request: fastapi.Request, call_next):
     """
     share_token = getattr(request.app.state, "share_token", None)
     if not share_token:
-        return await call_next(request)
+        return _with_security_headers(await call_next(request))
 
     token = request.query_params.get("token")
     if _token_matches(token, share_token):
         response = await call_next(request)
         response.set_cookie(
-            key="lemming_share_token", value=token, httponly=True
+            key="lemming_share_token",
+            value=token,
+            httponly=True,
+            samesite="strict",
+            secure=request.url.scheme == "https",
         )
-        return response
+        return _with_security_headers(response)
 
     cookie_token = request.cookies.get("lemming_share_token")
     if _token_matches(cookie_token, share_token):
-        return await call_next(request)
+        return _with_security_headers(await call_next(request))
 
-    return fastapi.Response("Unauthorized", status_code=401)
+    return _with_security_headers(
+        fastapi.Response("Unauthorized", status_code=401)
+    )

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/src/lemming/api/auth_test.py

@@ -20,9 +20,17 @@ def test_share_token_middleware():
         # Valid token via query
         response = client.get("/api/data?token=secret123")
         assert response.status_code == 200
-        assert "lemming_share_token=secret123" in response.headers.get(
-            "set-cookie", ""
+        set_cookie = response.headers.get("set-cookie", "")
+        assert "lemming_share_token=secret123" in set_cookie
+        assert "samesite=strict" in set_cookie.lower()
+        assert response.headers.get("x-content-type-options") == "nosniff"
+        assert response.headers.get("referrer-policy") == "no-referrer"
+
+        https_client = fastapi.testclient.TestClient(
+            main.app, base_url="https://testserver"
         )
+        https_resp = https_client.get("/api/data?token=secret123")
+        assert "secure" in https_resp.headers.get("set-cookie", "").lower()
 
         # Valid token via cookie
         client.cookies.set("lemming_share_token", "secret123")

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/src/lemming/api/config.py

@@ -36,11 +36,14 @@ def update_config(
     config: models.RoadmapConfig,
     project: str | None = None,
 ):
-    """Replace the roadmap configuration and return the saved value."""
+    """Update the posted roadmap configuration fields and return the result."""
     tasks_file = context.resolve_tasks_file(request.app.state, project)
     with persistence.lock_tasks(tasks_file):
         data = persistence.load_tasks(tasks_file)
-        data.config = config
+        # Omitted fields keep their value; the dashboard posts a subset
+        data.config = data.config.model_copy(
+            update=config.model_dump(exclude_unset=True)
+        )
         persistence.save_tasks(tasks_file, data)
     return data.config
 
@@ -51,6 +54,18 @@ class RunRequest(pydantic.BaseModel):
     env: dict[str, str] | None = None
 
 
+_BLOCKED_ENV_VARS = frozenset(
+    {
+        "LD_PRELOAD",
+        "LD_LIBRARY_PATH",
+        "DYLD_INSERT_LIBRARIES",
+        "PYTHONSTARTUP",
+        "PYTHONPATH",
+        "NODE_OPTIONS",
+    }
+)
+
+
 @router.post("/api/run")
 def run_loop(
     request: fastapi.Request,
@@ -58,6 +73,15 @@ def run_loop(
     project: str | None = None,
 ):
     """Start the orchestrator loop as a detached background process."""
+    if run_request.env:
+        blocked = sorted(
+            key for key in run_request.env if key.upper() in _BLOCKED_ENV_VARS
+        )
+        if blocked:
+            raise fastapi.HTTPException(
+                400, f"Forbidden environment variable(s): {', '.join(blocked)}"
+            )
+
     tasks_file = context.resolve_tasks_file(request.app.state, project)
     project_dir = context.resolve_project_dir(request.app.state, project)
 

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/src/lemming/api/config_test.py

@@ -1,5 +1,6 @@
 from unittest.mock import patch
 
+from lemming import persistence
 from lemming.api import main
 
 
@@ -17,6 +18,25 @@ def test_run_loop(client, test_tasks):
         assert "--hook" not in args
 
 
+def test_update_config_keeps_omitted_fields(client, test_tasks):
+    """The dashboard posts a partial config; it must not reset the rest."""
+    data = persistence.load_tasks(test_tasks)
+    data.config.hooks = ["ux", "roadmap"]
+    data.config.model = "fast-model"
+    persistence.save_tasks(test_tasks, data)
+
+    response = client.post(
+        "/api/config", json={"runner": "codex", "retries": 5, "time_limit": 0}
+    )
+
+    assert response.status_code == 200
+    config = persistence.load_tasks(test_tasks).config
+    assert config.runner == "codex"
+    assert config.retries == 5
+    assert config.hooks == ["ux", "roadmap"]
+    assert config.model == "fast-model"
+
+
 def test_get_runners(client):
     response = client.get("/api/runners")
     assert response.status_code == 200
@@ -82,3 +102,18 @@ def test_run_loop_with_project_cwd(test_workspace, client):
         # Verify Popen was called with the correct cwd
         _, kwargs = mock_popen.call_args
         assert str(kwargs["cwd"]) == str(subproject_dir)
+
+
+def test_run_loop_blocks_dangerous_env_vars(client, test_tasks):
+    for var in (
+        "LD_PRELOAD",
+        "LD_LIBRARY_PATH",
+        "DYLD_INSERT_LIBRARIES",
+        "PYTHONSTARTUP",
+        "PYTHONPATH",
+        "NODE_OPTIONS",
+    ):
+        with patch("subprocess.Popen") as mock_popen:
+            response = client.post("/api/run", json={"env": {var: "evil"}})
+            assert response.status_code == 400, var
+            mock_popen.assert_not_called()

{lemming_cli-0.7.1 → lemming_cli-0.8.0}/src/lemming/api/hooks.py

@@ -5,7 +5,7 @@ import pathlib
 import fastapi
 import pydantic
 
-from .. import hooks
+from .. import hooks, persistence
 from . import context
 
 router = fastapi.APIRouter()
@@ -13,12 +13,14 @@ router = fastapi.APIRouter()
 
 def _hook_payload(tasks_file: pathlib.Path) -> list[dict]:
     """Serializes resolved hooks for API responses."""
+    enabled = persistence.load_tasks(tasks_file).config.hooks
     return [
         {
             "name": h.name,
             "priority": h.priority,
             "source": h.source,
             "masked": h.masked,
+            "enabled": not h.masked and h.name in enabled,
             "runs_on_failure": h.priority >= hooks.FAILURE_HOOK_PRIORITY,
         }
         for h in hooks.resolve_hooks(tasks_file)
@@ -45,7 +47,7 @@ def toggle_hook(
     toggle: HookToggle,
     project: str | None = None,
 ):
-    """Enable or disable a hook by removing or creating its project mask."""
+    """Add or remove a hook from those enabled for the project."""
     tasks_file = context.resolve_tasks_file(request.app.state, project)
     try:
         if toggle.enabled: