limbo-code 0.1.14__tar.gz → 0.1.16__tar.gz

{limbo_code-0.1.14 → limbo_code-0.1.16}/AGENTS.md

@@ -2,7 +2,7 @@
 
 **Limbo** is a minimal terminal AI coding agent (Python 3.11+, Textual). Users converse with an LLM in a TUI to explore, read, edit, and write code via 7 tools.
 
-**Tools execute immediately — no confirmation flow.** Convenience guardrails (not a security boundary): a workdir scope on file tools (+ session-scoped grants from user-mentioned paths), a sensitive-file skip list shared by `read`/`grep`/`find`, and a heuristic dangerous-command filter on `bash` (best-effort, rejects matches outright; `bash` is otherwise not covered by any guardrail).
+**Tools execute immediately — no confirmation flow, no safety fences.** File tools are not scoped to the workdir (absolute paths and symlinks are honored as-is), there is no sensitive-file skip list, and `bash` runs every command as given (no dangerous-command filter).
 
 ## Quick Start
 
@@ -20,7 +20,7 @@ still works for a runtime-only install.
 ```
 src/limbo/
 ├── app.py            # CLI entry: args, config, launch
-├── config.py         # Pydantic config: llm/ui/safety/tools/compaction/providers
+├── config.py         # Pydantic config: llm/ui/tools/compaction/providers
 ├── models.py         # Message, Attachment, ToolResult, LLMEvent
 ├── agent.py          # Conversation loop (see below)
 ├── attachments.py    # Attachment policy: vision gate, inline vs path-reference degrade
@@ -36,12 +36,11 @@ src/limbo/
 ├── integrations/     # External mux/orchestrator lifecycle reporters: base.py (protocol
 │                     # + CompositeReporter + AgentState), herdr.py; create_reporters() fans out
 ├── skills.py         # SKILL.md discovery (user + project dirs)
-├── user_paths.py     # Fence grants from paths in user messages
 ├── llm/              # catalog.py (provider/model specs), factory.py (dialect→client),
 │                     # openai_client.py, anthropic_client.py, responses_client.py, retry.py, sse.py,
 │                     # usage.py (token accounting: usage normalization + prompt-size estimation),
 │                     # scaffold.py (plumbing shared by dialect clients: credentials, retry, images)
-├── tools/            # base.py (BaseTool + path guardrail + truncation), registry.py (dispatch, grants),
+├── tools/            # base.py (BaseTool + path resolution + truncation), registry.py (dispatch),
 │                     # mutation_queue.py (per-file locks), ignore.py (.gitignore),
 │                     # read/bash/edit/write/grep/find/ls.py
 └── ui/               # app.py + app.tcss (ALL styles here; theme vars only, no bare hex),
@@ -70,12 +69,11 @@ Providers/models live in `llm/catalog.py`; unknown models get generic OpenAI-com
 [tools]      # bash_enabled = true, parallel = true
 [compaction] # enabled, reserve_tokens = 16384, keep_recent_tokens = 20000
 [goal]       # max_rounds = 10, verify_timeout_ms = 600000
-[safety]     # dangerous_commands, sensitive_files, auto_grant_user_paths
 [ui]         # theme, show_banner
 [providers.<id>]  # base_url / api_key / api_key_env / headers
 ```
 
-`/model` rebuilds the client mid-session (refused while busy) and persists via tomlkit. Sessions resume via `--continue` / `--resume` / `/sessions`; resume repairs dangling tool calls and restores grants. Trace events: `session_start`, `user_message`, `llm_request` (full body), `llm_response`, `tool_call`, `tool_result`, `compaction*`, `error`, `turn_end`. `/export [path]` merges meta + trace + message snapshot (Markdown if `.md`).
+`/model` rebuilds the client mid-session (refused while busy) and persists via tomlkit. Sessions resume via `--continue` / `--resume` / `/sessions`; resume repairs dangling tool calls. Trace events: `session_start`, `user_message`, `llm_request` (full body), `llm_response`, `tool_call`, `tool_result`, `compaction*`, `error`, `turn_end`. `/export [path]` merges meta + trace + message snapshot (Markdown if `.md`).
 
 Skills: `~/.limbo/skills/<name>/SKILL.md` (user) and `<workdir>/.agents/skills/<name>/SKILL.md` (project, wins collisions) — injected as a `<available_skills>` catalog in the system prompt and invocable via `/<name> [args]`.
 

{limbo_code-0.1.14 → limbo_code-0.1.16}/CONTEXT.md

@@ -39,5 +39,7 @@ proposals should name modules with these terms.
 
 ## Safety
 
-- **Fence** — the workdir boundary on file tools, widened by session-scoped
-  **grants** (paths a real user mentions in a submitted message).
+Limbo has no safety fences: file tools are not scoped to the workdir,
+there is no sensitive-file list, and bash runs every command as given.
+Only run it with trusted models in repositories you can afford to modify
+or lose.

{limbo_code-0.1.14 → limbo_code-0.1.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: limbo-code
-Version: 0.1.14
+Version: 0.1.16
 Summary: A minimal terminal AI coding agent
 Requires-Python: >=3.11
 Requires-Dist: httpx>=0.27
@@ -234,25 +234,18 @@ flight.
 
 ## Safety
 
-Limbo executes every tool call immediately, without asking for confirmation.
-
-File tools (`read`, `edit`, `write`, `grep`, `find`, `ls`) are scoped to the
-current working directory plus any session grants (paths the user mentions in
-a message), and `read`/`grep`/`find` skip a small blocklist of sensitive files
-(`.env`, SSH keys) to avoid leaking secrets into the model context by accident.
-**These are convenience guardrails against accidents, not a security boundary.**
-The path check resolves the path before each operation, so a symlink swapped
-between the check and the operation (a time-of-check-to-time-of-use race) could
-escape it.
-
-Bash is an exception: it is started in the working directory but is **not**
-covered by any of these guardrails. Commands can `cd ..`, use absolute paths,
-and read or write outside the workdir. Commands that match dangerous patterns
-such as `rm` or `git reset --hard` are **rejected outright** by a best-effort
-heuristic filter — ordinary shell constructs can bypass it, so it only
-protects against accidents. The pattern list is configurable but cannot be
-disabled from the UI. Only run Limbo with trusted commands and in
-repositories you can afford to modify or lose.
+Limbo executes every tool call immediately, without asking for confirmation,
+and has **no safety fences**: file tools (`read`, `edit`, `write`, `grep`,
+`find`, `ls`) are not scoped to the working directory — absolute paths and
+symlink targets outside it are honored as-is — and there is no
+sensitive-file blocklist, so `.env`, SSH keys, and the like are read and
+searched like any other file.
+
+Bash is likewise unrestricted: it is started in the working directory but
+can `cd ..`, use absolute paths, read or write anywhere, and no command is
+filtered out — `rm -rf` and `git reset --hard` run exactly as given. Only
+run Limbo with trusted models and in repositories you can afford to modify
+or lose.
 
 If you need to work with untrusted projects, disable the bash tool entirely:
 

{limbo_code-0.1.14 → limbo_code-0.1.16}/README.md

@@ -220,25 +220,18 @@ flight.
 
 ## Safety
 
-Limbo executes every tool call immediately, without asking for confirmation.
-
-File tools (`read`, `edit`, `write`, `grep`, `find`, `ls`) are scoped to the
-current working directory plus any session grants (paths the user mentions in
-a message), and `read`/`grep`/`find` skip a small blocklist of sensitive files
-(`.env`, SSH keys) to avoid leaking secrets into the model context by accident.
-**These are convenience guardrails against accidents, not a security boundary.**
-The path check resolves the path before each operation, so a symlink swapped
-between the check and the operation (a time-of-check-to-time-of-use race) could
-escape it.
-
-Bash is an exception: it is started in the working directory but is **not**
-covered by any of these guardrails. Commands can `cd ..`, use absolute paths,
-and read or write outside the workdir. Commands that match dangerous patterns
-such as `rm` or `git reset --hard` are **rejected outright** by a best-effort
-heuristic filter — ordinary shell constructs can bypass it, so it only
-protects against accidents. The pattern list is configurable but cannot be
-disabled from the UI. Only run Limbo with trusted commands and in
-repositories you can afford to modify or lose.
+Limbo executes every tool call immediately, without asking for confirmation,
+and has **no safety fences**: file tools (`read`, `edit`, `write`, `grep`,
+`find`, `ls`) are not scoped to the working directory — absolute paths and
+symlink targets outside it are honored as-is — and there is no
+sensitive-file blocklist, so `.env`, SSH keys, and the like are read and
+searched like any other file.
+
+Bash is likewise unrestricted: it is started in the working directory but
+can `cd ..`, use absolute paths, read or write anywhere, and no command is
+filtered out — `rm -rf` and `git reset --hard` run exactly as given. Only
+run Limbo with trusted models and in repositories you can afford to modify
+or lose.
 
 If you need to work with untrusted projects, disable the bash tool entirely:
 

limbo_code-0.1.16/scripts/scroll_bench.py

@@ -0,0 +1,142 @@
+"""Benchmark: full cost of one scroll step in the real app layout.
+
+Measures scroll_to(immediate) + the scroll layout pass (reflow_visible) +
+compositor render + terminal-output build, for both a light chat and a
+"busy" chat (expanded tool bodies with long outputs).
+"""
+
+from __future__ import annotations
+
+import time
+
+from textual.app import App, ComposeResult
+
+from limbo.ui.widgets.chat import ChatWidget
+
+
+class BenchApp(App[None]):
+    CSS = """
+    Screen { layout: vertical; }
+    ChatWidget { width: 1fr; height: 1fr; }
+    """
+
+    def __init__(self, n_msgs: int = 120, heavy: bool = False) -> None:
+        super().__init__()
+        self.n_msgs = n_msgs
+        self.heavy = heavy
+        self.chat: ChatWidget | None = None
+        self._profiled = False
+
+    def compose(self) -> ComposeResult:
+        yield ChatWidget(id="chat")
+
+    async def on_mount(self) -> None:
+        self.chat = self.query_one("#chat", ChatWidget)
+        for i in range(self.n_msgs):
+            if i % 3 == 0:
+                self.chat.add_user_message(f"用户消息 #{i} " + "x" * 40)
+            elif i % 3 == 1:
+                self.chat.add_assistant_message(
+                    f"assistant #{i}\n\n- item one\n- item two\n\n```python\nprint({i})\n```"
+                )
+            else:
+                card = self.chat.add_tool_card(
+                    f"tool-{i}", "read", {"path": f"/tmp/file_{i}.py"}
+                )
+                card.set_success(
+                    "\n".join(f"line {j}: content {i}" for j in range(80))
+                )
+        await self.chat.mount_all(self.chat.children)
+        if self.heavy:
+            for card in self.chat.tool_cards.values():
+                card.toggle()
+        await self.pause(0.1)
+        self._bench()
+
+    async def pause(self, secs: float) -> None:
+        import asyncio
+
+        await asyncio.sleep(secs)
+
+    def _bench(self) -> None:
+        import gc
+
+        gc.disable()
+        chat = self.chat
+        assert chat is not None
+        max_y = chat.max_scroll_y
+        print(f"heavy={self.heavy} widgets={len(chat.children)} max_scroll_y={max_y:.0f}")
+
+        # Full scroll-step: immediate scroll (fires watch_scroll_y) then let
+        # the screen do its scroll-layout + compositor pass, then build the
+        # terminal output like _compositor_refresh does.
+        step = max(1.0, max_y / 200)
+        pos = max_y * 0.5
+        times: list[float] = []
+        seg_times: list[float] = []
+        phase_times: dict[str, list[float]] = {
+            "scroll_to": [],
+            "refresh_layout": [],
+            "render_update": [],
+            "render_segments": [],
+        }
+        for _ in range(30):
+            t0 = time.perf_counter()
+            chat.scroll_to(y=pos, animate=False, immediate=True)
+            phase_times["scroll_to"].append(time.perf_counter() - t0)
+            # what the screen timer does on _scroll_required:
+            t1 = time.perf_counter()
+            self.screen._refresh_layout(scroll=True)
+            layout_cost = time.perf_counter() - t1
+            phase_times["refresh_layout"].append(layout_cost)
+            if layout_cost > 0.05 and self._profiled is False:
+                self._profiled = True
+                import cProfile, pstats, io
+
+                pr = cProfile.Profile()
+                pr.enable()
+                self.screen._refresh_layout(scroll=True)
+                pr.disable()
+                s = io.StringIO()
+                ps = pstats.Stats(pr, stream=s).sort_stats("cumulative")
+                ps.print_stats(18)
+                print("=== SLOW LAYOUT PROFILE ===")
+                print(s.getvalue())
+            t2 = time.perf_counter()
+            update = self.screen._compositor.render_update()
+            phase_times["render_update"].append(time.perf_counter() - t2)
+            # build the terminal escape-sequence output (the part that shows
+            # up even in fast terminals; the write itself is excluded here)
+            seg_start = time.perf_counter()
+            update.render_segments(self.app.console)
+            phase_times["render_segments"].append(time.perf_counter() - seg_start)
+            times.append(time.perf_counter() - t0)
+            seg_times.append(time.perf_counter() - seg_start)
+            pos += step
+            if pos > max_y:
+                pos = 0.0
+        times.sort()
+        med = times[len(times) // 2]
+        seg_times.sort()
+        seg_med = seg_times[len(seg_times) // 2]
+        print(
+            f"  full scroll step: median={med * 1000:.2f} ms  "
+            f"p95={times[int(len(times) * 0.95)] * 1000:.2f} ms  "
+            f"-> ~{1.0 / med:.0f} fps"
+        )
+        print(f"  output-build (render_segments): median={seg_med * 1000:.2f} ms")
+        for name, vals in phase_times.items():
+            vals.sort()
+            print(
+                f"    {name}: median={vals[len(vals) // 2] * 1000:.2f} ms  "
+                f"max={vals[-1] * 1000:.2f} ms"
+            )
+        self.exit()
+
+
+if __name__ == "__main__":
+    import asyncio
+
+    for heavy in (False, True):
+        app = BenchApp(n_msgs=500, heavy=heavy)
+        asyncio.run(app.run_async(headless=True))

{limbo_code-0.1.14 → limbo_code-0.1.16}/src/limbo/agent.py

@@ -226,10 +226,6 @@ class Agent:
             self._meta, history, self._compactions = load_session(resume)
             self._session_file = resume
             self.messages.extend(repair_history(history))
-            # Restore session-scoped path grants recorded in the meta.
-            self.registry.add_allowed_roots(
-                Path(p) for p in self._meta.allowed_roots
-            )
             # Restore the iterative-summary chain across sessions.
             self._previous_summary = next(
                 (c.summary for c in reversed(self._compactions) if c.summary),
@@ -1272,8 +1268,6 @@ class Agent:
         # conversations.
         if not self._meta.title:
             self._meta.title = derive_title(self.messages)
-        # Persist the current grants so resume restores the same fence.
-        self._meta.allowed_roots = sorted(str(p) for p in self.registry.allowed_roots)
         save_session(self._session_file, self._meta, self.messages, self._compactions)
 
     async def _save_session(self) -> None:

{limbo_code-0.1.14 → limbo_code-0.1.16}/src/limbo/config.py

@@ -20,11 +20,6 @@ from toml import TomlDecodeError
 
 DEFAULT_CONFIG_PATH = Path.home() / ".limbo" / "config.toml"
 
-# Single source of truth for safety defaults; tools fall back to these when
-# constructed without explicit values.
-DEFAULT_DANGEROUS_COMMANDS = ["rm", "git reset --hard"]
-DEFAULT_SENSITIVE_FILES = [".env", "id_rsa", "id_ed25519", ".ssh"]
-
 
 class LLMConfig(BaseModel):
     api_key: str | None = None
@@ -174,19 +169,6 @@ class UIConfig(BaseModel):
     kitty_keyboard: KittyKeyboardMode = KittyKeyboardMode.AUTO
 
 
-class SafetyConfig(BaseModel):
-    dangerous_commands: list[str] = Field(
-        default_factory=lambda: list(DEFAULT_DANGEROUS_COMMANDS)
-    )
-    sensitive_files: list[str] = Field(
-        default_factory=lambda: list(DEFAULT_SENSITIVE_FILES)
-    )
-    # Implicit grants: paths a real user mentions in a submitted message
-    # widen the file-tool fence for the session (directories grant their
-    # subtree, files grant themselves; only existing paths count).
-    auto_grant_user_paths: bool = True
-
-
 class ToolsConfig(BaseModel):
     bash_enabled: bool = True
     # Execute multiple tool calls from one assistant turn concurrently.
@@ -235,7 +217,6 @@ class GoalSettings(BaseModel):
 class Config(BaseModel):
     llm: LLMConfig = Field(default_factory=LLMConfig)
     ui: UIConfig = Field(default_factory=UIConfig)
-    safety: SafetyConfig = Field(default_factory=SafetyConfig)
     tools: ToolsConfig = Field(default_factory=ToolsConfig)
     compaction: CompactionSettings = Field(default_factory=CompactionSettings)
     goal: GoalSettings = Field(default_factory=GoalSettings)

{limbo_code-0.1.14 → limbo_code-0.1.16}/src/limbo/goal.py

@@ -18,9 +18,7 @@ from pathlib import Path
 
 from pydantic import BaseModel
 
-from limbo.config import DEFAULT_DANGEROUS_COMMANDS
 from limbo.tools.base import truncate_tail
-from limbo.tools.bash import is_dangerous
 
 # -- state --------------------------------------------------------------------
 
@@ -83,13 +81,11 @@ def parse_goal_args(arg: str) -> GoalCommand:
 
 @dataclass(frozen=True)
 class VerifyResult:
-    # None when the command never produced an exit code (timeout / cancel /
-    # refused by the dangerous-command filter).
+    # None when the command never produced an exit code (timeout / cancel).
     exit_code: int | None
     output_tail: str = ""
     timed_out: bool = False
     cancelled: bool = False
-    refused: bool = False
 
 
 async def _kill_process_tree(proc: asyncio.subprocess.Process) -> None:
@@ -124,7 +120,6 @@ async def run_verify(
     workdir: Path,
     *,
     timeout_ms: int = 600_000,
-    dangerous_patterns: list[str] | None = None,
 ) -> VerifyResult:
     """Run the acceptance command; the exit code is the loop's gate.
 
@@ -133,13 +128,6 @@ async def run_verify(
     GoalDriver.cancel_verify) kills the process tree and re-raises so the
     caller can turn it into a ``cancelled`` result.
     """
-    patterns = (
-        list(dangerous_patterns)
-        if dangerous_patterns is not None
-        else list(DEFAULT_DANGEROUS_COMMANDS)
-    )
-    if is_dangerous(command, patterns):
-        return VerifyResult(exit_code=None, refused=True)
     # Same shell dialect as the bash tool: bash -c, own process group.
     proc = await asyncio.create_subprocess_exec(
         shutil.which("bash") or "/bin/bash",

{limbo_code-0.1.14 → limbo_code-0.1.16}/src/limbo/goal_driver.py

@@ -18,7 +18,6 @@ from dataclasses import dataclass
 from pathlib import Path
 
 from limbo.agent import Agent, AgentEvent, SteerEvent
-from limbo.config import DEFAULT_DANGEROUS_COMMANDS
 from limbo.goal import (
     STATUS_ACTIVE,
     STATUS_CLEARED,
@@ -93,18 +92,11 @@ class GoalDriver:
         *,
         max_rounds: int = 10,
         verify_timeout_ms: int = 600_000,
-        dangerous_patterns: list[str] | None = None,
     ) -> None:
         self._agent = agent
         self._workdir = workdir
         self._max_rounds = max_rounds
         self._verify_timeout_ms = verify_timeout_ms
-        # None falls back to the same default posture as the bash tool.
-        self._dangerous_patterns = (
-            list(dangerous_patterns)
-            if dangerous_patterns is not None
-            else list(DEFAULT_DANGEROUS_COMMANDS)
-        )
         self._running = False
         self._verify_task: asyncio.Task[VerifyResult] | None = None
         # Adopt the configured budget onto a restored goal (D4/D6: silent
@@ -261,14 +253,13 @@ class GoalDriver:
                     round=round_no,
                     timed_out=result.timed_out,
                     cancelled=result.cancelled,
-                    refused=result.refused,
                 )
                 yield GoalVerifyResultEvent(
                     result=result, round=round_no, max_rounds=state.max_rounds
                 )
-                if result.cancelled or result.refused:
-                    # User interrupt (Esc/clear) or a config change made the
-                    # command dangerous: stop the loop, goal stays active.
+                if result.cancelled:
+                    # User interrupt (Esc/clear): stop the loop, goal stays
+                    # active.
                     return
 
                 state = next_state(state, result)
@@ -303,7 +294,6 @@ class GoalDriver:
                 command,
                 self._workdir,
                 timeout_ms=self._verify_timeout_ms,
-                dangerous_patterns=self._dangerous_patterns,
             )
         )
         self._verify_task = task

{limbo_code-0.1.14 → limbo_code-0.1.16}/src/limbo/integrations/__init__.py

@@ -10,8 +10,11 @@ call sites ever touch.
 
 from __future__ import annotations
 
+import atexit
 import os
+import signal
 from collections.abc import Mapping
+from types import FrameType
 
 from limbo.integrations.base import (
     AgentState,
@@ -26,6 +29,7 @@ __all__ = [
     "HerdrReporter",
     "IntegrationReporter",
     "create_reporters",
+    "install_exit_hooks",
 ]
 
 
@@ -41,3 +45,30 @@ def create_reporters(env: Mapping[str, str] | None = None) -> CompositeReporter:
     if (herdr := HerdrReporter.from_env(env)) is not None:
         reporters.append(herdr)
     return CompositeReporter(reporters)
+
+
+def install_exit_hooks(reporters: CompositeReporter) -> None:
+    """Release integration authority on every process-exit path.
+
+    A clean Textual quit releases via ``MainScreen.on_unmount``, but that
+    never runs when the process dies by signal — e.g. the pane is closed
+    or killed (SIGHUP/SIGTERM) — and Herdr would keep showing the agent
+    forever. Covered here: normal interpreter exit (``atexit``, which also
+    catches ``SystemExit`` and unhandled exceptions) and SIGHUP/SIGTERM
+    (released, then re-raised with the default disposition so the process
+    still dies by the original signal). Reporters are idempotent, so
+    several hooks firing on one exit path is harmless.
+    """
+    if not reporters:
+        return
+    atexit.register(reporters.release)
+
+    def _release_and_reraise(signum: int, frame: FrameType | None) -> None:
+        reporters.release()
+        signal.signal(signum, signal.SIG_DFL)
+        os.kill(os.getpid(), signum)
+
+    for name in ("SIGHUP", "SIGTERM"):
+        signum = getattr(signal, name, None)
+        if signum is not None:  # SIGHUP does not exist on Windows
+            signal.signal(signum, _release_and_reraise)

{limbo_code-0.1.14 → limbo_code-0.1.16}/src/limbo/integrations/herdr.py

@@ -12,9 +12,12 @@ binary (``HERDR_BIN_PATH``, else PATH) are present.
 Reports are fire-and-forget CLI invocations — they must never block or
 break the UI, and a missing/broken ``herdr`` binary is silently ignored.
 
-``--source`` must stay stable and unique to this integration; ``--seq`` is
-strictly increasing so Herdr can drop reports that arrive out of order
-(turn-end and steer follow-up hand-offs race between workers).
+``--source`` must stay stable and unique to this integration; ``--seq``
+must be strictly increasing — Herdr keeps a per-(pane, source) watermark
+and silently drops anything at or below it, including ``release-agent``.
+The watermark survives process restarts, so the sequence starts from the
+wall clock (nanoseconds), not 1: a new Limbo process in a pane that
+previously ran one would otherwise never clear the old watermark.
 """
 
 from __future__ import annotations
@@ -22,6 +25,7 @@ from __future__ import annotations
 import os
 import shutil
 import subprocess
+import time
 from collections.abc import Mapping
 
 from limbo.integrations.base import AgentState
@@ -33,10 +37,13 @@ AGENT = "limbo"
 class HerdrReporter:
     """Fire-and-forget lifecycle reporter bound to one Herdr pane."""
 
-    def __init__(self, pane_id: str, bin_path: str):
+    def __init__(self, pane_id: str, bin_path: str, start_seq: int | None = None):
         self._pane_id = pane_id
         self._bin_path = bin_path
-        self._seq = 0
+        # Start from the wall clock so a later process in the same pane
+        # clears the previous one's watermark (see module docstring).
+        self._seq = start_seq if start_seq is not None else time.time_ns()
+        self._released = False
 
     @classmethod
     def from_env(cls, env: Mapping[str, str] | None = None) -> HerdrReporter | None:
@@ -109,7 +116,17 @@ class HerdrReporter:
         self._run(cmd)
 
     def release(self) -> None:
-        """Release this source's lifecycle authority (on agent exit)."""
+        """Release this source's lifecycle authority (on agent exit).
+
+        Idempotent: ``on_unmount``, ``atexit``, and signal handlers all
+        call this on the way out; only the first call reports.
+        """
+        if self._released:
+            return
+        self._released = True
+        # seq matters here: Herdr drops a release at or below this source's
+        # watermark, so a seq-less release after sequenced reports is
+        # silently ignored.
         self._run(
             [
                 self._bin_path,
@@ -120,6 +137,8 @@ class HerdrReporter:
                 SOURCE,
                 "--agent",
                 AGENT,
+                "--seq",
+                str(self._next_seq()),
             ]
         )
 

{limbo_code-0.1.14 → limbo_code-0.1.16}/src/limbo/sessions.py

@@ -18,7 +18,7 @@ from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel
 
 from limbo.compaction import is_summary_message, make_summary_message
 from limbo.goal import GoalState
@@ -55,9 +55,6 @@ class SessionMeta(BaseModel):
     title: str = ""
     created_at: str = ""
     updated_at: str = ""
-    # Session-scoped granted roots beyond the workdir (implicit user
-    # grants); restored on resume so the fence stays consistent.
-    allowed_roots: list[str] = Field(default_factory=list)
     # Active/finished closed-loop goal (LIM-40); restored on resume (D4/D6).
     goal: GoalState | None = None
     # Populated by list/load; not written to disk.