limbo-code 0.1.9__tar.gz → 0.1.10__tar.gz

{limbo_code-0.1.9 → limbo_code-0.1.10}/.github/workflows/test.yml

@@ -25,6 +25,10 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
+      # grep hard-depends on ripgrep (no Python fallback since LIM-24).
+      - name: Install ripgrep
+        run: sudo apt-get install -y ripgrep
+
       # Install from uv.lock so CI renders snapshots with the exact same
       # textual/rich/syrupy versions the baselines were generated with.
       - name: Install dependencies

{limbo_code-0.1.9 → limbo_code-0.1.10}/AGENTS.md

@@ -2,7 +2,7 @@
 
 **Limbo** is a minimal terminal AI coding agent (Python 3.11+, Textual). Users converse with an LLM in a TUI to explore, read, edit, and write code via 7 tools.
 
-**Tools execute immediately — no confirmation flow.** Guardrails: a workdir fence on file tools (+ session-scoped grants from user-mentioned paths), a sensitive-file blocklist on `read`, and a heuristic dangerous-command filter on `bash` (rejects matches outright; bypassable via subshells/variables — documented in the tool description).
+**Tools execute immediately — no confirmation flow.** Convenience guardrails (not a security boundary): a workdir scope on file tools (+ session-scoped grants from user-mentioned paths), a sensitive-file skip list shared by `read`/`grep`/`find`, and a heuristic dangerous-command filter on `bash` (best-effort, rejects matches outright; `bash` is otherwise not covered by any guardrail).
 
 ## Quick Start
 
@@ -33,7 +33,7 @@ src/limbo/
 │                     # openai_client.py, anthropic_client.py, responses_client.py, retry.py, sse.py,
 │                     # usage.py (token accounting: usage normalization + prompt-size estimation),
 │                     # scaffold.py (plumbing shared by dialect clients: credentials, retry, images)
-├── tools/            # base.py (BaseTool + fence + truncation), registry.py (dispatch, grants),
+├── tools/            # base.py (BaseTool + path guardrail + truncation), registry.py (dispatch, grants),
 │                     # mutation_queue.py (per-file locks), ignore.py (.gitignore),
 │                     # read/bash/edit/write/grep/find/ls.py
 └── ui/               # app.py + app.tcss (ALL styles here; theme vars only, no bare hex),

{limbo_code-0.1.9 → limbo_code-0.1.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: limbo-code
-Version: 0.1.9
+Version: 0.1.10
 Summary: A minimal terminal AI coding agent
 Requires-Python: >=3.11
 Requires-Dist: httpx>=0.27
@@ -226,23 +226,24 @@ flight.
 ## Safety
 
 Limbo executes every tool call immediately, without asking for confirmation.
-File tools (`read`, `edit`, `write`, `grep`, `find`, `ls`) are bounded to the
-current working directory and reject paths that escape it, including via
-symlinks. The boundary check resolves the path before each operation, so a
-symlink swapped between the check and the operation (a time-of-check-to-time-of-use
-race) could escape the workdir. **This is a known limitation for the MVP.**
+
+File tools (`read`, `edit`, `write`, `grep`, `find`, `ls`) are scoped to the
+current working directory plus any session grants (paths the user mentions in
+a message), and `read`/`grep`/`find` skip a small blocklist of sensitive files
+(`.env`, SSH keys) to avoid leaking secrets into the model context by accident.
+**These are convenience guardrails against accidents, not a security boundary.**
+The path check resolves the path before each operation, so a symlink swapped
+between the check and the operation (a time-of-check-to-time-of-use race) could
+escape it.
 
 Bash is an exception: it is started in the working directory but is **not**
-sandboxed. Commands can `cd ..`, use absolute paths, and read or write outside
-the workdir. In addition, commands that match dangerous patterns such as `rm`
-or `git reset --hard` are **rejected outright**.
-The pattern list is configurable but cannot be disabled from the UI. Bash
-commands are filtered with a simple heuristic, but that filter can be bypassed
-by subshells (`bash -c 'rm -rf /'`), command substitution (`$(rm -rf /)`),
-variable indirection, options before the command name
-(`git -C /foo reset --hard`), variable assignments before the command name
-(`VAR=1 rm -rf /`), and similar shell constructs. Only run Limbo with
-trusted commands and in repositories you can afford to modify or lose.
+covered by any of these guardrails. Commands can `cd ..`, use absolute paths,
+and read or write outside the workdir. Commands that match dangerous patterns
+such as `rm` or `git reset --hard` are **rejected outright** by a best-effort
+heuristic filter — ordinary shell constructs can bypass it, so it only
+protects against accidents. The pattern list is configurable but cannot be
+disabled from the UI. Only run Limbo with trusted commands and in
+repositories you can afford to modify or lose.
 
 If you need to work with untrusted projects, disable the bash tool entirely:
 

{limbo_code-0.1.9 → limbo_code-0.1.10}/README.md

@@ -204,23 +204,24 @@ flight.
 ## Safety
 
 Limbo executes every tool call immediately, without asking for confirmation.
-File tools (`read`, `edit`, `write`, `grep`, `find`, `ls`) are bounded to the
-current working directory and reject paths that escape it, including via
-symlinks. The boundary check resolves the path before each operation, so a
-symlink swapped between the check and the operation (a time-of-check-to-time-of-use
-race) could escape the workdir. **This is a known limitation for the MVP.**
+
+File tools (`read`, `edit`, `write`, `grep`, `find`, `ls`) are scoped to the
+current working directory plus any session grants (paths the user mentions in
+a message), and `read`/`grep`/`find` skip a small blocklist of sensitive files
+(`.env`, SSH keys) to avoid leaking secrets into the model context by accident.
+**These are convenience guardrails against accidents, not a security boundary.**
+The path check resolves the path before each operation, so a symlink swapped
+between the check and the operation (a time-of-check-to-time-of-use race) could
+escape it.
 
 Bash is an exception: it is started in the working directory but is **not**
-sandboxed. Commands can `cd ..`, use absolute paths, and read or write outside
-the workdir. In addition, commands that match dangerous patterns such as `rm`
-or `git reset --hard` are **rejected outright**.
-The pattern list is configurable but cannot be disabled from the UI. Bash
-commands are filtered with a simple heuristic, but that filter can be bypassed
-by subshells (`bash -c 'rm -rf /'`), command substitution (`$(rm -rf /)`),
-variable indirection, options before the command name
-(`git -C /foo reset --hard`), variable assignments before the command name
-(`VAR=1 rm -rf /`), and similar shell constructs. Only run Limbo with
-trusted commands and in repositories you can afford to modify or lose.
+covered by any of these guardrails. Commands can `cd ..`, use absolute paths,
+and read or write outside the workdir. Commands that match dangerous patterns
+such as `rm` or `git reset --hard` are **rejected outright** by a best-effort
+heuristic filter — ordinary shell constructs can bypass it, so it only
+protects against accidents. The pattern list is configurable but cannot be
+disabled from the UI. Only run Limbo with trusted commands and in
+repositories you can afford to modify or lose.
 
 If you need to work with untrusted projects, disable the bash tool entirely:
 

{limbo_code-0.1.9 → limbo_code-0.1.10}/src/limbo/agent.py

@@ -246,6 +246,16 @@ class Agent:
             resolved=_resolved_llm_trace_fields(config),
         )
 
+    def close(self) -> None:
+        """Release owned resources (the trace log file handle).
+
+        Call when this agent is replaced (``/new``, resume) or torn down so
+        the append-only trace file descriptor is not leaked across sessions.
+        The LLM client is owned by the UI layer and closed separately.
+        Idempotent: safe to call more than once.
+        """
+        self.trace.close()
+
     def update_llm(self, llm_client: LLMClient) -> None:
         """Swap the LLM client after a /model switch.
 
@@ -661,9 +671,34 @@ class Agent:
         # Record results in assistant source order after the batch completes.
         for tc in tool_calls:
             result = results[tc["id"]]
-            self._history.record_result(
-                tc["id"], result.output or result.error or ""
-            )
+            content, attachments = self._gate_tool_attachments(result)
+            self._history.record_result(tc["id"], content, attachments)
+
+    def _gate_tool_attachments(
+        self, result: ToolResult
+    ) -> tuple[str, list[Attachment] | None]:
+        """Apply the vision gate to tool-result attachments.
+
+        Mirrors the user-attachment policy (limbo.attachments): image
+        payloads reach the model only when it supports vision; otherwise
+        they degrade to a path-reference note in the text content so the
+        model knows the file exists and where it is. Nothing is silently
+        dropped.
+        """
+        content = result.output or result.error or ""
+        images = [
+            a for a in (result.attachments or []) if a.kind == "image"
+        ]
+        if not images:
+            return content, None
+        if self._vision:
+            return content, result.attachments
+        notes = "\n".join(
+            f"[图片 {a.name} 位于 {a.path}；当前模型不支持图像输入，无法直接查看]"
+            for a in images
+        )
+        content = f"{content}\n{notes}" if content else notes
+        return content, None
 
     async def _execute_tool_safe(
         self,

{limbo_code-0.1.9 → limbo_code-0.1.10}/src/limbo/history.py

@@ -6,7 +6,7 @@ Owns the invariant that keeps the OpenAI API happy: every assistant
 
 from __future__ import annotations
 
-from limbo.models import Message
+from limbo.models import Attachment, Message
 
 INTERRUPTED_CONTENT = "[session restored: tool call interrupted]"
 
@@ -17,15 +17,32 @@ class ToolHistory:
     def __init__(self, messages: list[Message]):
         self.messages = messages
 
-    def record_result(self, tool_call_id: str, content: str) -> None:
-        """Replace the existing result for a call, or append a new one."""
+    def record_result(
+        self,
+        tool_call_id: str,
+        content: str,
+        attachments: list[Attachment] | None = None,
+    ) -> None:
+        """Replace the existing result for a call, or append a new one.
+
+        ``attachments`` carries image payloads from tools (e.g. read on an
+        image file); they are stored on the tool message and replayed as
+        multimodal blocks by the clients, same as user-message attachments.
+        """
         for idx, msg in enumerate(self.messages):
             if msg.role == "tool" and msg.tool_call_id == tool_call_id:
-                self.messages[idx] = msg.model_copy(update={"content": content})
+                self.messages[idx] = msg.model_copy(
+                    update={"content": content, "attachments": attachments}
+                )
                 break
         else:
             self.messages.append(
-                Message(role="tool", content=content, tool_call_id=tool_call_id)
+                Message(
+                    role="tool",
+                    content=content,
+                    tool_call_id=tool_call_id,
+                    attachments=attachments,
+                )
             )
 
 

{limbo_code-0.1.9 → limbo_code-0.1.10}/src/limbo/llm/anthropic_client.py

@@ -274,7 +274,7 @@ def _messages_to_anthropic(
             block = {
                 "type": "tool_result",
                 "tool_use_id": message.tool_call_id or "",
-                "content": message.content or "",
+                "content": _tool_result_content(message),
             }
             previous = converted[-1] if converted else None
             if previous is not None and previous.get("role") == "user" and isinstance(
@@ -287,8 +287,8 @@ def _messages_to_anthropic(
     return "\n\n".join(system_parts), converted
 
 
-def _user_content(message: Message) -> str | list[dict[str, Any]]:
-    """User content: plain string, or image blocks + text when attached.
+def _image_blocks(message: Message) -> list[dict[str, Any]]:
+    """Anthropic image blocks for a message's attachments.
 
     Missing image files (expired session attachments) are skipped so a
     restored session can still be replayed; the marker text in ``content``
@@ -312,6 +312,26 @@ def _user_content(message: Message) -> str | list[dict[str, Any]]:
                 },
             }
         )
+    return blocks
+
+
+def _user_content(message: Message) -> str | list[dict[str, Any]]:
+    """User content: plain string, or image blocks + text when attached."""
+    blocks = _image_blocks(message)
+    if not blocks:
+        return message.content or ""
+    blocks.append({"type": "text", "text": message.content or ""})
+    return blocks
+
+
+def _tool_result_content(message: Message) -> str | list[dict[str, Any]]:
+    """tool_result content: plain string, or image blocks + text.
+
+    A tool result carries attachments when a tool returned an image
+    payload (e.g. read on an image file); Anthropic accepts image blocks
+    inside tool_result content.
+    """
+    blocks = _image_blocks(message)
     if not blocks:
         return message.content or ""
     blocks.append({"type": "text", "text": message.content or ""})

{limbo_code-0.1.9 → limbo_code-0.1.10}/src/limbo/llm/openai_client.py

@@ -132,10 +132,11 @@ class OpenAICompatibleClient:
     ) -> AsyncIterator[LLMEvent]:
         """One streaming attempt: build the request and yield its events."""
         include_reasoning = self.spec.requires_reasoning_content
-        request_messages = [
-            _message_to_openai(m, include_reasoning=include_reasoning)
-            for m in messages
-        ]
+        request_messages = _messages_to_openai(
+            messages,
+            include_reasoning=include_reasoning,
+            vision=self.spec.vision,
+        )
         kwargs: dict[str, Any] = {
             "model": self.config.llm.model,
             "messages": request_messages,
@@ -258,6 +259,83 @@ def _is_stream_options_error(error: BadRequestError) -> bool:
     return "stream_options" in message or "include_usage" in message
 
 
+def _messages_to_openai(
+    messages: list[Message], *, include_reasoning: bool = False, vision: bool = True
+) -> list[dict[str, Any]]:
+    """Convert internal messages to chat-completions params, pi-style.
+
+    The chat completions API rejects ``image_url`` parts in tool messages,
+    so tool results stay text-only; images a tool returned (e.g. read on
+    an image file) are collected across each consecutive run of tool
+    messages and appended as ONE synthetic user message afterwards
+    (``"Attached image(s) from tool result:"`` + image_url blocks), the
+    same shape pi uses. Images are dropped entirely when the current
+    model lacks vision (possible after a mid-session /model switch).
+    """
+    params: list[dict[str, Any]] = []
+    pending_images: list[dict[str, Any]] = []
+
+    def flush_images() -> None:
+        if pending_images:
+            params.append(
+                {
+                    "role": "user",
+                    "content": [
+                        {
+                            "type": "text",
+                            "text": "Attached image(s) from tool result:",
+                        },
+                        *pending_images,
+                    ],
+                }
+            )
+            pending_images.clear()
+
+    for message in messages:
+        if message.role == "tool":
+            params.append(
+                _tool_message_to_openai(message, pending_images, vision=vision)
+            )
+            continue
+        flush_images()
+        params.append(
+            _message_to_openai(message, include_reasoning=include_reasoning)
+        )
+    flush_images()
+    return params
+
+
+def _tool_message_to_openai(
+    message: Message, images_out: list[dict[str, Any]], *, vision: bool
+) -> dict[str, Any]:
+    """Text-only tool message; its image blocks are collected into ``images_out``."""
+    has_images = False
+    for attachment in message.attachments or []:
+        if attachment.kind != "image":
+            continue
+        encoded = encode_image_data(attachment) if vision else None
+        if encoded is None:
+            continue
+        has_images = True
+        data, mime = encoded
+        images_out.append(
+            {
+                "type": "image_url",
+                "image_url": {"url": f"data:{mime};base64,{data}"},
+            }
+        )
+    content = message.content or ""
+    if not content:
+        # Placeholders keep the API contract (non-empty tool content) even
+        # for image-only or empty results.
+        content = "(see attached image)" if has_images else "(no tool output)"
+    return {
+        "role": "tool",
+        "content": content,
+        "tool_call_id": message.tool_call_id or "",
+    }
+
+
 def _message_to_openai(
     message: Message, *, include_reasoning: bool = False
 ) -> dict[str, Any]:

{limbo_code-0.1.9 → limbo_code-0.1.10}/src/limbo/llm/responses_client.py

@@ -316,32 +316,52 @@ def _messages_to_responses(
                 {
                     "type": "function_call_output",
                     "call_id": message.tool_call_id or "",
-                    "output": message.content or "",
+                    "output": _tool_output(message),
                 }
             )
 
     return "\n\n".join(system_parts), items
 
 
-def _user_content(message: Message) -> list[dict[str, Any]]:
+def _image_blocks(message: Message) -> list[dict[str, Any]]:
+    """input_image blocks for a message's attachments.
+
+    Missing files (expired session attachments) are skipped.
+    """
     blocks: list[dict[str, Any]] = []
-    if message.attachments:
-        # Multimodal user message: input_image blocks + text. Missing files
-        # (expired session attachments) are skipped.
-        for attachment in message.attachments:
-            if attachment.kind != "image":
-                continue
-            encoded = encode_image_data(attachment)
-            if encoded is None:
-                continue
-            data, mime = encoded
-            blocks.append(
-                {
-                    "type": "input_image",
-                    "detail": "auto",
-                    "image_url": f"data:{mime};base64,{data}",
-                }
-            )
+    for attachment in message.attachments or []:
+        if attachment.kind != "image":
+            continue
+        encoded = encode_image_data(attachment)
+        if encoded is None:
+            continue
+        data, mime = encoded
+        blocks.append(
+            {
+                "type": "input_image",
+                "detail": "auto",
+                "image_url": f"data:{mime};base64,{data}",
+            }
+        )
+    return blocks
+
+
+def _user_content(message: Message) -> list[dict[str, Any]]:
+    blocks = _image_blocks(message)
+    blocks.append({"type": "input_text", "text": message.content or ""})
+    return blocks
+
+
+def _tool_output(message: Message) -> str | list[dict[str, Any]]:
+    """function_call_output payload: plain string, or content parts.
+
+    A tool result carries attachments when a tool returned an image
+    payload (e.g. read on an image file); the Responses API accepts
+    input_image parts inside function call output.
+    """
+    blocks = _image_blocks(message)
+    if not blocks:
+        return message.content or ""
     blocks.append({"type": "input_text", "text": message.content or ""})
     return blocks
 

limbo_code-0.1.10/src/limbo/llm/sse.py

@@ -0,0 +1,49 @@
+"""Shared SSE parsing for the plain-httpx LLM clients."""
+
+from __future__ import annotations
+
+import json
+from collections.abc import AsyncIterator
+from typing import Any, cast
+
+import httpx
+
+
+async def iter_sse(resp: httpx.Response) -> AsyncIterator[dict[str, Any]]:
+    """Yield parsed ``data:`` payloads from an SSE stream.
+
+    ``event:``/``id:``/``retry:`` lines and comments (``: ping``) are
+    ignored; the payload's own ``type`` field drives dispatch. Both the
+    Anthropic Messages and OpenAI Responses streams follow this convention.
+
+    A final flush after the stream ends catches a trailing event that the
+    server closed without a terminating blank line — that last event often
+    carries ``usage`` / ``finish_reason``, so dropping it would desync the
+    compaction trigger and token counters.
+    """
+    data_lines: list[str] = []
+
+    def _flush() -> dict[str, Any] | None:
+        if not data_lines:
+            return None
+        payload = "\n".join(data_lines)
+        data_lines.clear()
+        try:
+            return cast(dict[str, Any], json.loads(payload))
+        except json.JSONDecodeError:
+            return None
+
+    async for line in resp.aiter_lines():
+        if not line:
+            event = _flush()
+            if event is not None:
+                yield event
+            continue
+        if line.startswith("data:"):
+            data_lines.append(line[len("data:"):].strip())
+    # The server may close the connection without a trailing blank line; a
+    # buffered event would otherwise be lost. Anthropic/OpenAI both put
+    # usage + finish_reason in this final event.
+    event = _flush()
+    if event is not None:
+        yield event

{limbo_code-0.1.9 → limbo_code-0.1.10}/src/limbo/models.py

@@ -65,11 +65,19 @@ class ToolCall(BaseModel):
 
 
 class ToolResult(BaseModel):
-    """Result of executing a tool."""
+    """Result of executing a tool.
+
+    ``attachments`` carries image payloads a tool wants the model to see
+    (e.g. read returning an image file). Only the path is persisted —
+    never bytes — same policy as user-message attachments, so restored
+    sessions may reference files that no longer exist; clients skip
+    missing images when replaying.
+    """
 
     success: bool
     output: str | None = None
     error: str | None = None
+    attachments: list[Attachment] | None = None
 
 
 @dataclass(frozen=True)

{limbo_code-0.1.9 → limbo_code-0.1.10}/src/limbo/prompt.py

@@ -25,7 +25,7 @@ _BASE_INTRO = (
 
 _GUIDELINES_TAIL = (
     "- Use read to examine files before editing\n"
-    "- Use edit for precise changes (old_text must match exactly)\n"
+    "- Use edit for precise changes (edits[].old_text must match exactly)\n"
     "- Use write only for new files or complete rewrites\n"
     "- Be concise in your responses\n"
     "- Show file paths clearly when working with files"

{limbo_code-0.1.9 → limbo_code-0.1.10}/src/limbo/tools/base.py

@@ -1,13 +1,20 @@
 """Base class and shared helpers for tools.
 
-The base module owns the rituals every tool used to repeat: workdir-safe
+The base module owns the rituals every tool used to repeat: workdir-scoped
 path resolution (raising ``ToolError`` instead of returning union types)
 and the output truncation policy.
+
+The workdir scope and the sensitive-file list are *convenience guardrails*,
+not a security boundary: they keep the model from wandering outside the
+project or pulling secrets into the context by accident, and the user can
+widen the scope by mentioning paths in a message (session-scoped grants).
+``bash`` is intentionally not covered by either guardrail.
 """
 
 from __future__ import annotations
 
 from abc import ABC, abstractmethod
+from collections.abc import Collection
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
@@ -59,11 +66,11 @@ class BaseTool(ABC):
     # -- path resolution -------------------------------------------------------
 
     def resolve(self, raw_path: str, *, strict: bool = True) -> Path:
-        """Resolve ``raw_path``, enforcing the workdir/allowed-roots boundary.
+        """Resolve ``raw_path`` against the workdir/allowed-roots guardrail.
 
         ``~`` is expanded and absolute paths are honored as-is; relative
         paths resolve under the workdir. Raises ``ToolError`` for paths
-        outside the boundary, unresolvable paths, and (when ``strict``)
+        outside the guardrail, unresolvable paths, and (when ``strict``)
         broken symlinks.
         """
         try:
@@ -80,7 +87,9 @@ class BaseTool(ABC):
         if not self.is_within_scope(target):
             raise ToolError(
                 f"Path is outside working directory ({self.workdir}). "
-                "Use bash to access paths outside the working directory."
+                "This scope is a convenience guardrail, not a security "
+                "boundary. If access is genuinely needed, ask the user to "
+                "mention the path in a message to grant it."
             )
 
         if strict and candidate.is_symlink() and not target.exists():
@@ -116,6 +125,17 @@ class BaseTool(ABC):
         """Resolve a path that may not exist yet (e.g. for writing)."""
         return self.resolve(raw_path, strict=False)
 
+def is_sensitive_path(path: Path, sensitive_files: Collection[str]) -> bool:
+    """True if ``path``'s name or any of its parts is on the sensitive list.
+
+    Convenience guardrail against accidentally pulling secrets (``.env``,
+    SSH keys) into the model context — not a security boundary (``bash``
+    is not covered by it). Shared by ``read``/``grep``/``find`` so the
+    guardrail behaves identically across file tools.
+    """
+    return any(part in sensitive_files for part in path.parts)
+
+
 def is_within_workdir(path: Path, workdir: Path) -> bool:
     """Return True if resolved path is inside or equal to workdir."""
     try: