scootcli 0.4.0__tar.gz → 0.5.0__tar.gz

{scootcli-0.4.0/src/scootcli.egg-info → scootcli-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scootcli
-Version: 0.4.0
+Version: 0.5.0
 Summary: A tiny coding agent that goes where you point it
 Author: Sergey Nes
 License-Expression: MIT
@@ -206,6 +206,8 @@ scoot --no-panel --no-dock           # plain prompt, no status bar (also what yo
 /model     list or switch model     /approve   set mode (always|auto-read|auto-edits|yolo)
 /yolo      auto-approve all         /worktree  isolate work in a git worktree
 /auth      provider keys            /logo      show or toggle the mascot
+/scope     where file tools may go   /hooks     configured hooks and results
+/route     how auto picks a model
 /sessions  list saved sessions      /resume    resume a saved session ([id])
 /forget    delete session(s)        /panel     toggle the bottom status bar
 /verbosity feed detail (full|compact|quiet)
@@ -223,7 +225,11 @@ Without a TTY, scoot falls back to a plain prompt with no bar and no dock.
 ### Tools and approvals
 
 The agent has eight tools: `read_file`, `list_dir`, `search`, `write_file`, `edit_file`, `run_shell`, `open_editor` (hands a file to IntelliJ IDEA's `idea -e` or to VS Code, `SCOOT_EDITOR` picks), and `update_plan` (a progress checklist for multi-step work).
-Every tool is sandboxed to the workspace root.
+Paths are resolved against the workspace root, and `~` works.
+
+The workspace is where the agent works, not a wall.
+When a tool needs a file outside it, in `~/.config`, another repo, `/etc`, scoot asks once: allow this path `[a]`, allow that directory for the session `[d]`, allow anywhere for the session `[A]`, skip `[s]`, or quit `[q]`.
+`--scope anywhere`, `SCOOT_SCOPE=anywhere`, or `/scope anywhere` skip the question; `/scope` shows what has been granted.
 
 When a call needs approval you can approve once `[a]`, trust that tool for the session `[t]`, approve everything this session `[A]`, edit the arguments `[e]`, skip `[s]`, or quit `[q]`.
 `/approve <mode>` sets how much runs without asking: `always` prompts for everything, `auto-read` auto-approves reads, `auto-edits` also auto-approves file edits, `yolo` runs everything.
@@ -275,6 +281,8 @@ git clone https://github.com/sergenes/scootcli && cd scootcli && pip install -e
 ```
 
 The install script needs only `curl` and Python 3.9+. `SCOOT_VERSION=v0.2.0` pins a release and `SCOOT_INSTALL_DIR` changes the target; read it before you run it, it is sixty lines.
+**Upgrading.** `pipx upgrade scootcli`, or `pip install --upgrade scootcli`, or rerun the curl line, which always fetches the latest release; `scoot --version` shows what you have.
+
 Both pipx and the script install into `~/.local/bin`. On a fresh Linux account that directory is added to PATH at login only if it already exists, so after the very first install either open a new login shell or run `pipx ensurepath`; the installer prints the exact line for your shell.
 
 Requirements: Python 3.9 or newer on macOS or Linux.

{scootcli-0.4.0 → scootcli-0.5.0}/README.md

@@ -181,6 +181,8 @@ scoot --no-panel --no-dock           # plain prompt, no status bar (also what yo
 /model     list or switch model     /approve   set mode (always|auto-read|auto-edits|yolo)
 /yolo      auto-approve all         /worktree  isolate work in a git worktree
 /auth      provider keys            /logo      show or toggle the mascot
+/scope     where file tools may go   /hooks     configured hooks and results
+/route     how auto picks a model
 /sessions  list saved sessions      /resume    resume a saved session ([id])
 /forget    delete session(s)        /panel     toggle the bottom status bar
 /verbosity feed detail (full|compact|quiet)
@@ -198,7 +200,11 @@ Without a TTY, scoot falls back to a plain prompt with no bar and no dock.
 ### Tools and approvals
 
 The agent has eight tools: `read_file`, `list_dir`, `search`, `write_file`, `edit_file`, `run_shell`, `open_editor` (hands a file to IntelliJ IDEA's `idea -e` or to VS Code, `SCOOT_EDITOR` picks), and `update_plan` (a progress checklist for multi-step work).
-Every tool is sandboxed to the workspace root.
+Paths are resolved against the workspace root, and `~` works.
+
+The workspace is where the agent works, not a wall.
+When a tool needs a file outside it, in `~/.config`, another repo, `/etc`, scoot asks once: allow this path `[a]`, allow that directory for the session `[d]`, allow anywhere for the session `[A]`, skip `[s]`, or quit `[q]`.
+`--scope anywhere`, `SCOOT_SCOPE=anywhere`, or `/scope anywhere` skip the question; `/scope` shows what has been granted.
 
 When a call needs approval you can approve once `[a]`, trust that tool for the session `[t]`, approve everything this session `[A]`, edit the arguments `[e]`, skip `[s]`, or quit `[q]`.
 `/approve <mode>` sets how much runs without asking: `always` prompts for everything, `auto-read` auto-approves reads, `auto-edits` also auto-approves file edits, `yolo` runs everything.
@@ -250,6 +256,8 @@ git clone https://github.com/sergenes/scootcli && cd scootcli && pip install -e
 ```
 
 The install script needs only `curl` and Python 3.9+. `SCOOT_VERSION=v0.2.0` pins a release and `SCOOT_INSTALL_DIR` changes the target; read it before you run it, it is sixty lines.
+**Upgrading.** `pipx upgrade scootcli`, or `pip install --upgrade scootcli`, or rerun the curl line, which always fetches the latest release; `scoot --version` shows what you have.
+
 Both pipx and the script install into `~/.local/bin`. On a fresh Linux account that directory is added to PATH at login only if it already exists, so after the very first install either open a new login shell or run `pipx ensurepath`; the installer prints the exact line for your shell.
 
 Requirements: Python 3.9 or newer on macOS or Linux.

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/__init__.py

@@ -1,4 +1,4 @@
 """scoot: a tiny coding agent that goes where you point it."""
 
-__version__ = "0.4.0"
+__version__ = "0.5.0"
 

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/agent.py

@@ -70,6 +70,12 @@ class HeadlessUI:
         self.events.append(("approve", tool.name, args))
         return Approval(self.decision, args)
 
+    scope_decision = "dir"  # what this headless UI answers to a scope question (tests override)
+
+    def approve_scope(self, tool, path, ctx) -> str:
+        self.events.append(("scope", tool.name, str(path)))
+        return self.scope_decision
+
     def auto_approved(self, tool, args) -> None:
         self.events.append(("auto", tool.name, args))
 
@@ -345,7 +351,16 @@ class Agent:
     # ── tool execution ───────────────────────────────────────────────────────────
     def _run_tools(self, session, tool_calls, ui, cancel_event, cfg=None) -> Optional[str]:
         cfg = cfg or getattr(session, "config", None) or self.config
-        ctx = ToolContext(root=cfg.root, config=cfg, cancel_event=cancel_event)
+        scope = getattr(session, "scope", None)
+        if scope is None:
+            from .tools.base import Scope
+
+            scope = Scope(cfg.root, everything=(getattr(cfg, "scope", "workspace") == "anywhere"))
+            try:
+                session.scope = scope
+            except Exception:
+                pass
+        ctx = ToolContext(root=cfg.root, config=cfg, cancel_event=cancel_event, scope=scope)
         mode = getattr(session, "approval_mode", "always")
         # Session trust-list: tools the user chose to auto-approve for the rest of the session.
         trusted = getattr(session, "trusted_tools", None)
@@ -368,6 +383,17 @@ class Agent:
                 self._append_tool(session, tc_id, f"error: unknown tool '{name}'")
                 continue
 
+            # Paths outside the workspace: ask the user once (this path, its directory, or anywhere).
+            outside = self._outside_paths(tool, args, ctx)
+            if outside:
+                verdict = self._ask_scope(session, tool, outside, ctx, ui)
+                if verdict == "abort":
+                    self._append_tool(session, tc_id, "user aborted the operation")
+                    return "abort"
+                if verdict == "deny":
+                    self._append_tool(session, tc_id, f"user declined access outside the workspace: {outside[0]}")
+                    ui.tool_result(name, ToolResult(ok=False, summary="outside the workspace: declined"))
+                    continue
             # A PreToolUse hook may deny (skip the tool), allow (skip the prompt), or ask (force it).
             hook_action, hook_reason = self._pre_tool_hook(session, tool, args, cancel_event)
             if hook_action == "deny":
@@ -419,6 +445,46 @@ class Agent:
             self._append_tool(session, tc_id, payload or "(no output)")
         return None
 
+    @staticmethod
+    def _outside_paths(tool, args, ctx) -> "list":
+        from .tools.base import resolve_path
+
+        scope = ctx.scope
+        found = []
+        for raw in tool.paths(args):
+            try:
+                p = resolve_path(ctx.root, raw)
+            except Exception:
+                continue
+            if scope is None or not scope.allows(p):
+                found.append(p)
+        return found
+
+    def _ask_scope(self, session, tool, paths, ctx, ui) -> str:
+        """Ask for the first outside path; grant per the answer. Returns once|dir|all|deny|abort."""
+        scope = ctx.scope
+        if getattr(session, "config", None) is not None and getattr(session.config, "scope", "") == "anywhere":
+            scope.grant_all()
+            return "all"
+        asker = getattr(ui, "approve_scope", None)
+        if asker is None:
+            return "deny"
+        from .hooks import notify
+
+        notify(session, "scope", f"{tool.name} wants {paths[0]} outside the workspace")
+        verdict = asker(tool, paths[0], ctx)
+        if verdict == "once":
+            for p in paths:
+                scope.grant(p)
+        elif verdict == "dir":
+            for p in paths:
+                scope.grant_dir(p)
+            ui.assistant(f"allowing {scope.granted[-1]} for the rest of this session.")
+        elif verdict == "all":
+            scope.grant_all()
+            ui.assistant("allowing access anywhere on this machine for the rest of this session.")
+        return verdict
+
     @staticmethod
     def _handle_result(session, name: str, result: ToolResult, ui) -> None:
         """Surface a tool result: render a plan update specially, else the generic result line."""

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/approvals.py

@@ -126,6 +126,40 @@ def _edit_args(args: dict) -> dict:
     return args
 
 
+SCOPE_CHOICES = ("once", "dir", "all", "deny", "abort")
+
+
+def request_scope(tool: Tool, path, ctx: ToolContext) -> str:
+    """Ask once about a path outside the workspace. Returns one of ``SCOPE_CHOICES``."""
+    from pathlib import Path as _P
+
+    p = _P(str(path))
+    where = p if p.is_dir() else p.parent
+    print(color(f"  ⌂ {tool.name} wants {p}", "yellow") + color("  (outside the workspace)", "gray"))
+    while True:
+        print(
+            "  "
+            + color("allow this path", "green") + " [a]  "
+            + color(f"allow {where} this session", "green") + " [d]  "
+            + color("allow anywhere this session", "green") + " [A]  "
+            + color("skip", "yellow") + " [s]  "
+            + color("quit", "red") + " [q] › ",
+            end="", flush=True,
+        )
+        key = read_key()
+        print(key)
+        if key in ("a", "y", "\r", "\n", ""):
+            return "once"
+        if key == "d":
+            return "dir"
+        if key == "A":
+            return "all"
+        if key == "s":
+            return "deny"
+        if key == "q":
+            return "abort"
+
+
 def request_approval(tool: Tool, args: dict, ctx: ToolContext) -> Approval:
     """Show the pending tool call and read the user's decision (with optional arg editing)."""
     while True:

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/cli.py

@@ -59,6 +59,8 @@ def _build_parser() -> argparse.ArgumentParser:
                         help="Don't inject the repo map (git + file tree) into the agent prompt.")
     parser.add_argument("--no-labels", action="store_true",
                         help="Hide the role labels/gutters (❯ you / ⏺ scoot) in the REPL transcript.")
+    parser.add_argument("--scope", choices=["workspace", "anywhere"],
+                        help="Where file tools may go: workspace (default; the first access outside it asks once) or anywhere.")
     parser.add_argument("--headless", action="store_true",
                         help="Line-delimited JSON on stdin/stdout instead of the REPL (see docs/headless-protocol.md).")
     parser.add_argument("--no-logo", action="store_true",
@@ -92,6 +94,7 @@ def _config_from_args(args: argparse.Namespace) -> Config:
         proxy=args.proxy,
         root=args.root,
         approval="yolo" if (args.yolo or args.yes) else args.approval,
+        scope="anywhere" if args.yes else args.scope,
         verbose=True if args.verbose else None,
         stream=False if args.no_stream else None,
         panel=False if args.no_panel else None,

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/commands/__init__.py

@@ -53,6 +53,7 @@ def load_builtins() -> None:
     from . import logo as _logo  # noqa: F401
     from . import route as _route  # noqa: F401
     from . import hooks as _hooks  # noqa: F401
+    from . import scope as _scope  # noqa: F401
 
     _loaded = True
 

scootcli-0.5.0/src/scootcli/commands/scope.py

@@ -0,0 +1,33 @@
+"""/scope — where file tools may go: the workspace, plus what you allowed, or anywhere."""
+
+from __future__ import annotations
+
+from ..rendering import color, eprint
+from . import register
+from .base import SlashCommand
+
+
+def _run(session, args: str):
+    scope = getattr(session, "scope", None)
+    if scope is None:
+        eprint(color("scope is not available in this context.", "yellow"))
+        return
+    want = (args or "").strip().lower()
+    if want in ("anywhere", "all", "everywhere"):
+        scope.grant_all()
+        print(color("file tools may now go anywhere on this machine for this session.", "gray"))
+    elif want == "workspace":
+        scope.everything = False
+        scope.granted.clear()
+        print(color("back to the workspace only; the next access outside it will ask.", "gray"))
+    elif want:
+        scope.grant_dir(want)
+        print(color(f"allowed {scope.granted[-1]} for this session.", "gray"))
+    print(color("scope: ", "bold") + scope.describe())
+    for g in scope.granted:
+        print(f"  {color('+', 'green')} {g}")
+    print(color("  usage: /scope anywhere · /scope workspace · /scope <dir>   (also --scope, SCOOT_SCOPE)", "gray"))
+
+
+register(SlashCommand("scope", "where file tools may go (workspace | anywhere | <dir>)", _run,
+                      usage="[anywhere|workspace|<dir>]"))

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/commands/status.py

@@ -25,6 +25,7 @@ def _run(session, args: str):
         ("env files", ", ".join(getattr(cfg, "env_files", ()) or ()) or "none"),
         ("root", str(cfg.root)),
         ("approval", session.approval_mode),
+        ("scope", getattr(session, "scope", None).describe() if getattr(session, "scope", None) else "workspace"),
         ("streaming", "on" if getattr(cfg, "stream", True) else "off"),
         ("panel", "on" if getattr(session, "status_bar", None) and session.status_bar.enabled
                   else "off"),

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/config.py

@@ -179,6 +179,7 @@ class Config:
     vision_model: str = "auto"  # provider/model for image descriptions, or "auto" → pick a capable one
     image_max_bytes: int = 4 * 1024 * 1024  # per-image cap (no downscale without a 3rd-party lib)
     editor: str = "idea"  # external editor for the open_editor tool: idea | vscode
+    scope: str = "workspace"  # where file tools may go: workspace (ask once outside it) | anywhere
     env_files: Tuple[str, ...] = ()  # the .env files that were read, in load order (shown by /status)
     logo: bool = True  # mascot in the launch banner + status-bar face (--no-logo / SCOOT_LOGO / /logo)
     emoji: bool = True  # 🛴 transcript label; off → ⏺ for terminals without an emoji font (--no-emoji)
@@ -216,6 +217,7 @@ class Config:
             vision_model=get("SCOOT_VISION_MODEL", "auto"),
             image_max_bytes=int(get("SCOOT_IMAGE_MAX_BYTES", str(4 * 1024 * 1024))),
             editor=get("SCOOT_EDITOR", "idea").strip().lower(),
+            scope=get("SCOOT_SCOPE", "workspace").strip().lower(),
             logo=_resolve_logo_setting(get("SCOOT_LOGO")),
             emoji=_as_bool(get("SCOOT_EMOJI", "true")),
         )

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/headless.py

@@ -136,6 +136,32 @@ class HeadlessUI:
                              auto_approved=False, decision=str(msg.get("decision")).lower())
             return Approval(decision, new_args)
 
+    def approve_scope(self, tool, path, ctx) -> str:
+        req = self._call_id()
+        self.writer.emit("scope_request", id=req, name=tool.name, path=str(path),
+                         options=["allow_once", "allow_dir", "allow_all", "deny", "abort"], timeout_s=self.timeout)
+        mapping = {"allow_once": "once", "allow_dir": "dir", "allow_all": "all", "deny": "deny", "abort": "abort"}
+        deadline = time.time() + self.timeout
+        while True:
+            remaining = deadline - time.time()
+            if remaining <= 0:
+                self.writer.emit("notice", message=f"scope request {req} timed out after {self.timeout:g}s; denied")
+                return "deny"
+            if self.cancel_event is not None and self.cancel_event.is_set():
+                return "abort"
+            try:
+                msg = self.answers.get(timeout=min(0.2, remaining))
+            except queue.Empty:
+                continue
+            if msg.get("id") not in (None, "", req):
+                self.writer.emit("error", message=f"answer for unknown request {msg.get('id')}", kind="protocol")
+                continue
+            verdict = mapping.get(str(msg.get("decision", "")).lower())
+            if verdict is None:
+                self.writer.emit("error", message=f"unknown scope decision {msg.get('decision')!r}; expected one of {list(mapping)}", kind="protocol")
+                continue
+            return verdict
+
     def plan(self, plan) -> None:
         self.writer.emit("plan", steps=plan)
 

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/prompts.py

@@ -23,7 +23,7 @@ You run inside the user's workspace and act through tools. Be concise, correct,
 ENVIRONMENT
 - Working directory (root): {{workspace_root}}
 - OS: {{os}}   Model: {{model}}
-- All file paths you use must stay inside the root. Never touch paths outside it.
+- The root is your workspace, not a wall: when the task needs files elsewhere on this machine (~/.config, another repo, /etc), use them with absolute paths (~ is fine). The first access outside the workspace asks the user once; never tell the user you are not allowed to leave the workspace, and never hand them a script to run in your place because of it.
 
 WORKSPACE (auto-generated map of the current repo — use it to orient before listing/reading files)
 {{workspace}}

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/repl.py

@@ -79,6 +79,9 @@ class ReplSession:
         self.mascot_state = "idle"  # drives the mascot's eyes in the status bar: idle | thinking | stopped
         self.usage_by_model: dict = {}  # qualified model -> {"prompt": n, "completion": n, "calls": n}
         self.provider_ready = True  # False until a provider can take a request (see refresh_readiness)
+        from .tools.base import Scope
+
+        self.scope = Scope(config.root, everything=(getattr(config, "scope", "workspace") == "anywhere"))
         self.setup_message = ""  # what to do about it, shown in the banner and after failures
         self.route_reason = ""  # why the router picked the active model (auto only)
         # Persistence (auto-save each turn; resume via --continue/--resume).
@@ -412,6 +415,12 @@ class ReplUI:
         self._commit_line()  # an approval prompt is interactive; don't let it clobber a transient
         return request_approval(tool, args, ctx)
 
+    def approve_scope(self, tool, path, ctx) -> str:
+        self._commit_line()
+        from .approvals import request_scope
+
+        return request_scope(tool, path, ctx)
+
     def auto_approved(self, tool, args) -> None:
         import json as _json
 

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/tools/base.py

@@ -56,6 +56,53 @@ class ToolContext:
     root: Path
     config: Any = None
     cancel_event: Optional[threading.Event] = None
+    scope: "Optional[Scope]" = None  # where file tools may go beyond the workspace root
+
+
+class Scope:
+    """Where file tools may operate: the workspace root plus what the user granted this session.
+
+    The workspace is always allowed. The first access elsewhere asks the user once, who can allow
+    that path, its directory for the session, or anywhere for the session (``everything``).
+    """
+
+    def __init__(self, root, everything: bool = False):
+        self.root = Path(root).resolve()
+        self.granted: List[Path] = []
+        self.everything = everything
+
+    def allows(self, path) -> bool:
+        p = Path(path).expanduser().resolve()
+        if self.everything or _inside(p, self.root):
+            return True
+        return any(_inside(p, g) for g in self.granted)
+
+    def grant(self, path) -> Path:
+        p = Path(path).expanduser().resolve()
+        if p not in self.granted:
+            self.granted.append(p)
+        return p
+
+    def grant_dir(self, path) -> Path:
+        p = Path(path).expanduser().resolve()
+        return self.grant(p if p.is_dir() else p.parent)
+
+    def grant_all(self) -> None:
+        self.everything = True
+
+    def describe(self) -> str:
+        if self.everything:
+            return "anywhere on this machine (for this session)"
+        extra = f" + {len(self.granted)} granted" if self.granted else ""
+        return f"workspace {self.root}{extra}"
+
+
+def _inside(path: Path, parent: Path) -> bool:
+    try:
+        path.relative_to(parent)
+        return True
+    except ValueError:
+        return False
 
 
 @dataclass
@@ -89,6 +136,13 @@ class Tool:
         """Optional rich preview shown at approval time (e.g. a diff). ``None`` = args-only."""
         return None
 
+    def paths(self, args: dict) -> "list[str]":
+        """The filesystem paths a call touches, for the scope check before it runs.
+
+        Default: the ``path`` and ``cwd`` arguments. A tool with other path arguments overrides this.
+        """
+        return [str(args[k]) for k in ("path", "cwd") if isinstance(args.get(k), str) and args.get(k)]
+
     def schema(self) -> dict:
         """OpenAI-style function schema for the ``tools`` request param."""
         return {
@@ -102,20 +156,31 @@ class Tool:
 
 
 # ── Sandboxing ─────────────────────────────────────────────────────────────────
-def safe_path(root: Path, raw: str) -> Path:
-    """Resolve ``raw`` against ``root`` and ensure it stays inside it. Raises PathEscapeError."""
+def resolve_path(root: Path, raw: str) -> Path:
+    """``raw`` as an absolute path: ``~`` expanded, relative paths taken from ``root``."""
     if raw is None:
         raise ToolError("missing 'path'")
-    root = root.resolve()
-    p = Path(raw)
+    p = Path(str(raw)).expanduser()
     if not p.is_absolute():
-        p = root / p
-    p = p.resolve()
-    try:
-        p.relative_to(root)
-    except ValueError:
-        raise PathEscapeError(f"path escapes workspace root: {raw}")
-    return p
+        p = Path(root).resolve() / p
+    return p.resolve()
+
+
+def safe_path(root: Path, raw: str, scope: "Optional[Scope]" = None) -> Path:
+    """Resolve ``raw`` and check it is inside the workspace or granted by ``scope``.
+
+    Raises :class:`PathEscapeError` (carrying ``.path``) otherwise; the agent turns that into a
+    question to the user rather than a refusal.
+    """
+    p = resolve_path(root, raw)
+    if scope is not None:
+        if scope.allows(p):
+            return p
+    elif _inside(p, Path(root).resolve()):
+        return p
+    exc = PathEscapeError(f"outside the workspace: {p} (the user can allow it)")
+    exc.path = p
+    raise exc
 
 
 # ── Truncation ─────────────────────────────────────────────────────────────────

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/tools/edit_file.py

@@ -25,7 +25,7 @@ class EditFile(Tool):
 
     def _compute(self, args, ctx):
         """Return (path, old_text, new_text). Raises ToolError on any problem."""
-        path = safe_path(ctx.root, args.get("path"))
+        path = safe_path(ctx.root, args.get("path"), ctx.scope)
         if not path.exists() or not path.is_file():
             raise ToolError(f"no such file: {args.get('path')}")
         old_string = args.get("old_string")

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/tools/list_dir.py

@@ -23,7 +23,7 @@ class ListDir(Tool):
     def run(self, args: dict, ctx: ToolContext) -> ToolResult:
         raw = args.get("path") or "."
         try:
-            path = safe_path(ctx.root, raw)
+            path = safe_path(ctx.root, raw, ctx.scope)
         except ToolError as exc:
             return ToolResult.fail(str(exc))
         if not path.exists():

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/tools/open_editor.py

@@ -88,7 +88,7 @@ class OpenEditor(Tool):
         if not raw:
             return ToolResult.fail("missing 'path'")
         try:
-            path = safe_path(ctx.root, raw)
+            path = safe_path(ctx.root, raw, ctx.scope)
         except ToolError as exc:
             return ToolResult.fail(str(exc))
         if not path.exists():

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/tools/read_file.py

@@ -25,7 +25,7 @@ class ReadFile(Tool):
 
     def run(self, args: dict, ctx: ToolContext) -> ToolResult:
         try:
-            path = safe_path(ctx.root, args.get("path"))
+            path = safe_path(ctx.root, args.get("path"), ctx.scope)
         except ToolError as exc:
             return ToolResult.fail(str(exc))
         if not path.exists():

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/tools/run_shell.py

@@ -28,7 +28,7 @@ class RunShell(Tool):
         "type": "object",
         "properties": {
             "command": {"type": "string", "description": "The shell command to run."},
-            "cwd": {"type": "string", "description": "Working dir relative to root (optional)."},
+            "cwd": {"type": "string", "description": "Working directory (optional): relative to the workspace, or absolute."},
         },
         "required": ["command"],
     }
@@ -45,7 +45,7 @@ class RunShell(Tool):
         cwd = ctx.root
         if args.get("cwd"):
             try:
-                cwd = safe_path(ctx.root, args["cwd"])
+                cwd = safe_path(ctx.root, args["cwd"], ctx.scope)
             except ToolError as exc:
                 return ToolResult.fail(str(exc))
             if not cwd.is_dir():

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli/tools/write_file.py

@@ -21,7 +21,7 @@ class WriteFile(Tool):
     }
 
     def _old_new(self, args, ctx):
-        path = safe_path(ctx.root, args.get("path"))
+        path = safe_path(ctx.root, args.get("path"), ctx.scope)
         old = path.read_text("utf-8", "replace") if path.exists() and path.is_file() else ""
         new = args.get("content") or ""
         return path, old, new

{scootcli-0.4.0 → scootcli-0.5.0/src/scootcli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scootcli
-Version: 0.4.0
+Version: 0.5.0
 Summary: A tiny coding agent that goes where you point it
 Author: Sergey Nes
 License-Expression: MIT
@@ -206,6 +206,8 @@ scoot --no-panel --no-dock           # plain prompt, no status bar (also what yo
 /model     list or switch model     /approve   set mode (always|auto-read|auto-edits|yolo)
 /yolo      auto-approve all         /worktree  isolate work in a git worktree
 /auth      provider keys            /logo      show or toggle the mascot
+/scope     where file tools may go   /hooks     configured hooks and results
+/route     how auto picks a model
 /sessions  list saved sessions      /resume    resume a saved session ([id])
 /forget    delete session(s)        /panel     toggle the bottom status bar
 /verbosity feed detail (full|compact|quiet)
@@ -223,7 +225,11 @@ Without a TTY, scoot falls back to a plain prompt with no bar and no dock.
 ### Tools and approvals
 
 The agent has eight tools: `read_file`, `list_dir`, `search`, `write_file`, `edit_file`, `run_shell`, `open_editor` (hands a file to IntelliJ IDEA's `idea -e` or to VS Code, `SCOOT_EDITOR` picks), and `update_plan` (a progress checklist for multi-step work).
-Every tool is sandboxed to the workspace root.
+Paths are resolved against the workspace root, and `~` works.
+
+The workspace is where the agent works, not a wall.
+When a tool needs a file outside it, in `~/.config`, another repo, `/etc`, scoot asks once: allow this path `[a]`, allow that directory for the session `[d]`, allow anywhere for the session `[A]`, skip `[s]`, or quit `[q]`.
+`--scope anywhere`, `SCOOT_SCOPE=anywhere`, or `/scope anywhere` skip the question; `/scope` shows what has been granted.
 
 When a call needs approval you can approve once `[a]`, trust that tool for the session `[t]`, approve everything this session `[A]`, edit the arguments `[e]`, skip `[s]`, or quit `[q]`.
 `/approve <mode>` sets how much runs without asking: `always` prompts for everything, `auto-read` auto-approves reads, `auto-edits` also auto-approves file edits, `yolo` runs everything.
@@ -275,6 +281,8 @@ git clone https://github.com/sergenes/scootcli && cd scootcli && pip install -e
 ```
 
 The install script needs only `curl` and Python 3.9+. `SCOOT_VERSION=v0.2.0` pins a release and `SCOOT_INSTALL_DIR` changes the target; read it before you run it, it is sixty lines.
+**Upgrading.** `pipx upgrade scootcli`, or `pip install --upgrade scootcli`, or rerun the curl line, which always fetches the latest release; `scoot --version` shows what you have.
+
 Both pipx and the script install into `~/.local/bin`. On a fresh Linux account that directory is added to PATH at login only if it already exists, so after the very first install either open a new login shell or run `pipx ensurepath`; the installer prints the exact line for your shell.
 
 Requirements: Python 3.9 or newer on macOS or Linux.

{scootcli-0.4.0 → scootcli-0.5.0}/src/scootcli.egg-info/SOURCES.txt

@@ -56,6 +56,7 @@ src/scootcli/commands/reset.py
 src/scootcli/commands/resume.py
 src/scootcli/commands/route.py
 src/scootcli/commands/save.py
+src/scootcli/commands/scope.py
 src/scootcli/commands/sessions.py
 src/scootcli/commands/status.py
 src/scootcli/commands/verbosity.py
@@ -97,6 +98,7 @@ tests/test_readiness.py
 tests/test_repl.py
 tests/test_resilience.py
 tests/test_router.py
+tests/test_scope.py
 tests/test_sessions.py
 tests/test_smoke.py
 tests/test_streaming.py

scootcli-0.5.0/tests/test_scope.py

@@ -0,0 +1,225 @@
+"""Scope: the workspace is the default, not a wall. Outside paths ask once and can be granted."""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+
+from scootcli import tools
+from scootcli.agent import Agent, HeadlessUI
+from scootcli.config import Config
+from scootcli.providers import ChatResult
+from scootcli.tools.base import PathEscapeError, Scope, ToolContext, resolve_path, safe_path
+
+
+def test_scope_allows_workspace_grants_and_everything(tmp_path):
+    ws = tmp_path / "ws"
+    ws.mkdir()
+    other = tmp_path / "other"
+    other.mkdir()
+    s = Scope(ws)
+    assert s.allows(ws / "a.txt") and not s.allows(other / "b.txt")
+    s.grant(other / "b.txt")
+    assert s.allows(other / "b.txt") and not s.allows(other / "c.txt")
+    s.grant_dir(other / "c.txt")
+    assert s.allows(other / "c.txt") and s.allows(other / "deep" / "d.txt")
+    assert "granted" in s.describe()
+    s.grant_all()
+    assert s.allows("/etc/hosts") and "anywhere" in s.describe()
+
+
+def test_safe_path_expands_home_and_honours_scope(tmp_path, monkeypatch):
+    ws = tmp_path / "ws"
+    ws.mkdir()
+    monkeypatch.setenv("HOME", str(tmp_path))
+    assert resolve_path(ws, "~/x.txt") == (tmp_path / "x.txt").resolve()
+    assert safe_path(ws, "inside.txt") == (ws / "inside.txt").resolve()
+    try:
+        safe_path(ws, "~/x.txt")
+        assert False
+    except PathEscapeError as exc:
+        assert exc.path == (tmp_path / "x.txt").resolve() and "user can allow" in str(exc)
+    scope = Scope(ws)
+    scope.grant_dir(tmp_path)
+    assert safe_path(ws, "~/x.txt", scope) == (tmp_path / "x.txt").resolve()
+    assert safe_path(ws, "../x.txt", Scope(ws, everything=True)) == (tmp_path / "x.txt").resolve()
+
+
+def _toolcall(name, args, cid):
+    return ChatResult(content="", model="m", tool_calls=[{"id": cid, "type": "function", "function": {"name": name, "arguments": json.dumps(args)}}])
+
+
+class _Provider:
+    def __init__(self, results):
+        self.results, self.i = results, 0
+
+    def chat(self, *a, **k):
+        r = self.results[min(self.i, len(self.results) - 1)]
+        self.i += 1
+        return r
+
+
+class _S:
+    def __init__(self, root, **cfg):
+        self.messages, self.model, self.active_model = [], "m", "m"
+        self.approval_mode = "yolo"
+        self.bad_models, self.trusted_tools = set(), set()
+        self.config = Config().override(root=str(root), stream=False, workspace_context=False, **cfg)
+        self.last_usage = {}
+
+    def resolved_model(self):
+        return "m"
+
+    def available_models(self):
+        return ["m"]
+
+    def account(self, usage, model=""):
+        pass
+
+
+def _run(root, results, decision="dir", **cfg):
+    tools.load_builtins()
+    s = _S(root, **cfg)
+    ui = HeadlessUI()
+    ui.scope_decision = decision
+    out = Agent(s.config, _Provider(results)).run_turn(s, ui)
+    return s, ui, out
+
+
+def test_agent_asks_once_then_reads_outside_the_workspace(tmp_path):
+    ws = tmp_path / "ws"
+    ws.mkdir()
+    secret = tmp_path / "elsewhere" / "notes.txt"
+    secret.parent.mkdir()
+    secret.write_text("outside content")
+    results = [_toolcall("read_file", {"path": str(secret)}, "c1"),
+               _toolcall("read_file", {"path": str(secret.parent / "other.txt")}, "c2"),
+               ChatResult(content="done", model="m")]
+    (secret.parent / "other.txt").write_text("second file")
+    s, ui, out = _run(ws, results, decision="dir")
+    scope_events = [e for e in ui.events if e[0] == "scope"]
+    assert len(scope_events) == 1 and scope_events[0][2] == str(secret)  # asked once, the dir was granted
+    tool_msgs = [m["content"] for m in s.messages if m["role"] == "tool"]
+    assert "outside content" in tool_msgs[0] and "second file" in tool_msgs[1]
+    assert s.scope.granted == [secret.parent.resolve()]
+
+
+def test_agent_deny_abort_once_and_all(tmp_path):
+    ws = tmp_path / "ws"
+    ws.mkdir()
+    target = tmp_path / "x" / "f.txt"
+    target.parent.mkdir()
+    target.write_text("x")
+    call = [_toolcall("read_file", {"path": str(target)}, "c1"), ChatResult(content="done", model="m")]
+    s, ui, out = _run(ws, call, decision="deny")
+    assert out.status == "done"
+    assert [m["content"] for m in s.messages if m["role"] == "tool"][0].startswith("user declined access outside the workspace")
+    s, ui, out = _run(ws, call, decision="abort")
+    assert out.status == "aborted"
+    s, ui, out = _run(ws, call, decision="once")
+    assert s.scope.granted == [target.resolve()] and not s.scope.allows(target.parent / "g.txt")
+    s, ui, out = _run(ws, call, decision="all")
+    assert s.scope.everything and s.scope.allows("/etc/hosts")
+
+
+def test_scope_anywhere_never_asks(tmp_path):
+    ws = tmp_path / "ws"
+    ws.mkdir()
+    target = tmp_path / "y.txt"
+    target.write_text("y")
+    call = [_toolcall("read_file", {"path": str(target)}, "c1"), ChatResult(content="done", model="m")]
+    s, ui, out = _run(ws, call, decision="deny", scope="anywhere")
+    assert not any(e[0] == "scope" for e in ui.events)
+    assert "y" in [m["content"] for m in s.messages if m["role"] == "tool"][0]
+    # write and shell cwd outside the workspace go through the same gate
+    out_file = tmp_path / "z" / "new.txt"
+    calls = [_toolcall("write_file", {"path": str(out_file), "content": "hi"}, "c1"),
+             _toolcall("run_shell", {"command": "pwd", "cwd": str(tmp_path / "z")}, "c2"),
+             ChatResult(content="done", model="m")]
+    s, ui, out = _run(ws, calls, decision="dir")
+    assert out_file.read_text() == "hi" and len([e for e in ui.events if e[0] == "scope"]) == 1
+    assert str((tmp_path / "z").resolve()) in [m["content"] for m in s.messages if m["role"] == "tool"][1]
+
+
+def test_yes_flag_implies_scope_anywhere_and_env_setting(monkeypatch, tmp_path):
+    from scootcli.cli import _build_parser, _config_from_args
+
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / "xdg"))
+    assert _config_from_args(_build_parser().parse_args(["--yes", "x"])).scope == "anywhere"
+    assert _config_from_args(_build_parser().parse_args(["--scope", "anywhere", "x"])).scope == "anywhere"
+    assert _config_from_args(_build_parser().parse_args(["x"])).scope == "workspace"
+    monkeypatch.setenv("SCOOT_SCOPE", "anywhere")
+    assert Config.load(cwd=tmp_path).scope == "anywhere"
+
+
+def test_prompt_no_longer_claims_a_wall():
+    from scootcli.prompts import AGENT_SYSTEM_PROMPT
+
+    assert "must stay inside the root" not in AGENT_SYSTEM_PROMPT
+    assert "asks the user once" in AGENT_SYSTEM_PROMPT
+
+
+def test_headless_scope_request_round_trip(tmp_path):
+    import queue
+    import threading
+    import time
+    import io
+
+    from scootcli.headless import Headless
+
+    ws = tmp_path / "ws"
+    ws.mkdir()
+    target = tmp_path / "far.txt"
+    target.write_text("far away")
+    provider = _Provider([_toolcall("read_file", {"path": str(target)}, "c1"), ChatResult(content="ok", model="m")])
+    s = _S(ws)
+    s.id, s.provider, s.resumed, s.autosave = "hl", provider, False, lambda: None
+
+    class _In:
+        def __init__(self):
+            self.q = queue.Queue()
+
+        def __iter__(self):
+            while True:
+                l = self.q.get()
+                if l is None:
+                    return
+                yield l + "\n"
+
+    class _Out:
+        def __init__(self):
+            self.lines, self.lock = [], threading.Lock()
+
+        def write(self, t):
+            with self.lock:
+                self.lines.append(t)
+
+        def flush(self):
+            pass
+
+        def events(self):
+            with self.lock:
+                return [json.loads(l) for l in "".join(self.lines).splitlines() if l.strip()]
+
+    inp, out = _In(), _Out()
+    h = Headless(s, Agent(s.config, provider), stdin=inp, stdout=out, approval_timeout_s=5, heartbeat_s=0)
+    threading.Thread(target=h.run, daemon=True).start()
+
+    def wait(t):
+        end = time.time() + 5
+        while time.time() < end:
+            for e in out.events():
+                if e["type"] == t:
+                    return e
+            time.sleep(0.02)
+        raise AssertionError(t)
+
+    wait("ready")
+    inp.q.put(json.dumps({"type": "prompt", "text": "read far.txt"}))
+    req = wait("scope_request")
+    assert req["name"] == "read_file" and req["path"] == str(target.resolve()) and "allow_dir" in req["options"]
+    inp.q.put(json.dumps({"type": "approve", "id": req["id"], "decision": "allow_dir"}))
+    end = wait("turn_end")
+    assert end["status"] == "done" and "far away" in wait("tool_result")["content"]
+    inp.q.put(None)