scootcli 0.9.0__tar.gz → 0.10.0__tar.gz

{scootcli-0.9.0/src/scootcli.egg-info → scootcli-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scootcli
-Version: 0.9.0
+Version: 0.10.0
 Summary: A tiny coding agent that goes where you point it
 Author: Sergey Nes
 License-Expression: MIT
@@ -321,10 +321,13 @@ New capability is a drop-in file: a tool in `tools/`, a slash command in `comman
 
 ## Security
 
-- API keys are read from the environment or from `~/.config/scoot/credentials.json` (directory `0700`, file `0600`), validated before saving, and never echoed; `rendering.redact()` masks key-shaped strings in all output.
-- Only allowlisted keys are imported from `.env` files.
-- All file and shell tools are sandboxed to the workspace root; destructive shell commands are always re-confirmed.
-- Saved sessions are owner-only with secrets redacted; `/forget all` removes them.
+What scoot protects, and what it does not.
+
+- **Your API keys.** Read from the environment or from `~/.config/scoot/credentials.json` (directory `0700`, file `0600`), validated before saving, never echoed, and removed from the environment of every hook scoot runs. Key-shaped strings are masked in error messages and in saved sessions (message text, tool arguments, and the text copies inside provider replay data; signed or encrypted replay fields are stored as received). Streamed model output is printed as it arrives and is not filtered.
+- **A cloned repository cannot reconfigure you.** A project `.env` may choose the model, effort, and how the terminal looks. It may not set provider base URLs or proxies (which would send your key elsewhere), the approval mode, the scope, the root, hooks, or scoot's config and state directories; those come from flags, your environment, or `~/.config/scoot/.env`, and a project value for them is ignored and reported at start. A project's `.scoot/hooks.json` runs only after you review it and run `/hooks trust`; the trust is bound to the file's content, so an edited file asks again.
+- **File tools are scoped, shell commands are not sandboxed.** `read_file`, `list_dir`, `search`, `write_file`, and `edit_file` stay inside the workspace plus the paths you grant, and never follow a symlink out of it. `run_shell` runs the command as you, with your normal access to files, network, and other programs; approving a command means exactly that. The denylist (`rm -rf`, `git push`, `sudo`, piping a download into a shell, and so on) is an accident guard that forces a confirmation in every mode, including when a project's hook says `allow` (a hook in your own global config can waive it, so an editor or phone bridge you installed still works); it is not a boundary.
+- **The default is `yolo`.** Tool calls run without asking, except the denylist and paths outside the workspace. Use `--approval always` or `auto-read` on code you do not trust yet, and `/worktree start` to keep autonomous edits out of your checkout.
+- **Saved sessions** are owner-only, keyed by workspace, and pruned to the last 20; `/forget all` removes them. Session ids are file names, never paths.
 - No third-party dependencies means no third-party code to audit.
 
 ## Contributing

{scootcli-0.9.0 → scootcli-0.10.0}/README.md

@@ -296,10 +296,13 @@ New capability is a drop-in file: a tool in `tools/`, a slash command in `comman
 
 ## Security
 
-- API keys are read from the environment or from `~/.config/scoot/credentials.json` (directory `0700`, file `0600`), validated before saving, and never echoed; `rendering.redact()` masks key-shaped strings in all output.
-- Only allowlisted keys are imported from `.env` files.
-- All file and shell tools are sandboxed to the workspace root; destructive shell commands are always re-confirmed.
-- Saved sessions are owner-only with secrets redacted; `/forget all` removes them.
+What scoot protects, and what it does not.
+
+- **Your API keys.** Read from the environment or from `~/.config/scoot/credentials.json` (directory `0700`, file `0600`), validated before saving, never echoed, and removed from the environment of every hook scoot runs. Key-shaped strings are masked in error messages and in saved sessions (message text, tool arguments, and the text copies inside provider replay data; signed or encrypted replay fields are stored as received). Streamed model output is printed as it arrives and is not filtered.
+- **A cloned repository cannot reconfigure you.** A project `.env` may choose the model, effort, and how the terminal looks. It may not set provider base URLs or proxies (which would send your key elsewhere), the approval mode, the scope, the root, hooks, or scoot's config and state directories; those come from flags, your environment, or `~/.config/scoot/.env`, and a project value for them is ignored and reported at start. A project's `.scoot/hooks.json` runs only after you review it and run `/hooks trust`; the trust is bound to the file's content, so an edited file asks again.
+- **File tools are scoped, shell commands are not sandboxed.** `read_file`, `list_dir`, `search`, `write_file`, and `edit_file` stay inside the workspace plus the paths you grant, and never follow a symlink out of it. `run_shell` runs the command as you, with your normal access to files, network, and other programs; approving a command means exactly that. The denylist (`rm -rf`, `git push`, `sudo`, piping a download into a shell, and so on) is an accident guard that forces a confirmation in every mode, including when a project's hook says `allow` (a hook in your own global config can waive it, so an editor or phone bridge you installed still works); it is not a boundary.
+- **The default is `yolo`.** Tool calls run without asking, except the denylist and paths outside the workspace. Use `--approval always` or `auto-read` on code you do not trust yet, and `/worktree start` to keep autonomous edits out of your checkout.
+- **Saved sessions** are owner-only, keyed by workspace, and pruned to the last 20; `/forget all` removes them. Session ids are file names, never paths.
 - No third-party dependencies means no third-party code to audit.
 
 ## Contributing

{scootcli-0.9.0 → scootcli-0.10.0}/src/scootcli/__init__.py

@@ -1,4 +1,4 @@
 """scoot: a tiny coding agent that goes where you point it."""
 
-__version__ = "0.9.0"
+__version__ = "0.10.0"
 

{scootcli-0.9.0 → scootcli-0.10.0}/src/scootcli/agent.py

@@ -18,7 +18,7 @@ from dataclasses import dataclass
 from typing import List, Optional
 
 from . import tools
-from .approvals import Approval, Decision, needs_prompt
+from .approvals import Approval, Decision, denylisted_reason, needs_prompt
 from .config import Config
 from .errors import ScootError, ContextLengthError, Interrupted, ModelUnavailableError
 from .prompts import build_agent_system_prompt
@@ -235,10 +235,10 @@ class Agent:
         decision = hooks.run("Stop", payload)
         return (decision.reason or "the Stop hook asked to continue") if decision.blocks else ""
 
-    def _pre_tool_hook(self, session, tool, args, cancel_event) -> "tuple[str, str]":
+    def _pre_tool_hook(self, session, tool, args, cancel_event) -> "tuple[str, str, bool]":
         hooks = self._hooks(session)
         if hooks is None or not hooks.has("PreToolUse"):
-            return "", ""
+            return "", "", False
         from .hooks import tool_kind
 
         from .hooks import tool_alias
@@ -246,7 +246,7 @@ class Agent:
         payload = hooks.payload(session, "PreToolUse", tool_name=tool.name, tool_input=args,
                                 tool_kind=tool_kind(tool), tool_alias=tool_alias(tool.name))
         decision = hooks.run("PreToolUse", payload, cancel_event)
-        return decision.action, decision.reason
+        return decision.action, decision.reason, decision.from_global
 
     def _post_tool_hook(self, session, tool, args, result: ToolResult) -> None:
         hooks = self._hooks(session)
@@ -461,7 +461,7 @@ class Agent:
                     ui.tool_result(name, ToolResult(ok=False, summary="outside the workspace: declined"))
                     continue
             # A PreToolUse hook may deny (skip the tool), allow (skip the prompt), or ask (force it).
-            hook_action, hook_reason = self._pre_tool_hook(session, tool, args, cancel_event)
+            hook_action, hook_reason, hook_from_global = self._pre_tool_hook(session, tool, args, cancel_event)
             if cancel_event.is_set():  # ESC while the hook ran
                 self._append_tool(session, tc_id, "not executed: the user interrupted the turn")
                 return self._interrupted(session, tool_calls)
@@ -471,7 +471,13 @@ class Agent:
                 continue
             # Approval policy: auto-approve when the mode/trust allows it, else prompt.
             must_prompt = needs_prompt(mode, tool, args, trusted)
-            if hook_action == "allow":
+            # A hook may waive scoot's own approval prompt. It may also waive the denylist confirmation,
+            # but only when it lives in the user's own global config: that is the user's machine-level
+            # delegation (an editor or a phone bridge approving on their behalf). A project's hook, even
+            # one trusted to run, is repo-authored and must not silently auto-run a catastrophic command.
+            waivable = hook_action == "allow" and (hook_from_global or not (
+                tool.name == "run_shell" and denylisted_reason(args.get("command", ""))))
+            if waivable:
                 must_prompt = None
             elif hook_action == "ask":
                 must_prompt = hook_reason or "hook asked for confirmation"

{scootcli-0.9.0 → scootcli-0.10.0}/src/scootcli/approvals.py

@@ -46,9 +46,13 @@ MODES = ("always", "auto-read", "auto-edits", "yolo")
 
 # Catastrophic shell commands that are ALWAYS confirmed, even in yolo mode.
 _DENYLIST = [
-    (re.compile(r"\brm\s+-[a-z]*r[a-z]*f|\brm\s+-[a-z]*f[a-z]*r", re.I), "recursive force delete"),
+    # rm with a recursive flag and a force flag anywhere in the same command (``-rf``, ``-r -f``,
+    # ``-fR``, ``--recursive --force``); ``[^|;&]*`` keeps both lookaheads inside one command.
+    (re.compile(r"\brm\b(?=[^|;&]*\s-(?:[a-z]*r[a-z]*|-recursive)\b)(?=[^|;&]*\s-(?:[a-z]*f[a-z]*|-force)\b)", re.I),
+     "recursive force delete"),
     (re.compile(r":\(\)\s*\{.*\|.*&\s*\}\s*;", re.S), "fork bomb"),
-    (re.compile(r"\bgit\s+push\b", re.I), "git push"),
+    # git push with any options between ``git`` and ``push`` (``-C repo``, ``--git-dir=x``, ``-c k=v``).
+    (re.compile(r"\bgit\b(?:\s+-{1,2}[\w-]+(?:[= ]\S+)?)*\s+push\b", re.I), "git push"),
     (re.compile(r"\bsudo\b", re.I), "sudo"),
     (re.compile(r"\b(shutdown|reboot|halt|poweroff)\b", re.I), "power/shutdown"),
     (re.compile(r"\bmkfs\b|\bdd\s+.*of=/dev/", re.I), "disk/format command"),
@@ -129,6 +133,14 @@ def _edit_args(args: dict) -> dict:
 SCOPE_CHOICES = ("once", "dir", "all", "deny", "abort")
 
 
+def _menu_key() -> str:
+    """One keypress for the approval menus: ``A`` (the session-wide choice) keeps its case, every other
+    key is lowercased so ``T`` still means trust. ``read_key`` used to lowercase everything, which made
+    the advertised ``[A]`` unreachable."""
+    key = read_key(keep_case=True)
+    return key if key == "A" else key.lower()
+
+
 def request_scope(tool: Tool, path, ctx: ToolContext) -> str:
     """Ask once about a path outside the workspace. Returns one of ``SCOPE_CHOICES``."""
     from pathlib import Path as _P
@@ -146,7 +158,7 @@ def request_scope(tool: Tool, path, ctx: ToolContext) -> str:
             + color("quit", "red") + " [q] › ",
             end="", flush=True,
         )
-        key = read_key()
+        key = _menu_key()
         print(key)
         if key in ("a", "y", "\r", "\n", ""):
             return "once"
@@ -181,7 +193,7 @@ def request_approval(tool: Tool, args: dict, ctx: ToolContext) -> Approval:
             end="",
             flush=True,
         )
-        key = read_key()
+        key = _menu_key()
         print(key)  # echo the choice for a clean transcript
 
         if key in ("a", "y", "\r", "\n", ""):

{scootcli-0.9.0 → scootcli-0.10.0}/src/scootcli/cli.py

@@ -15,6 +15,7 @@ Global flags override config: ``--model``, ``--proxy``, ``--root``,
 from __future__ import annotations
 
 import argparse
+from pathlib import Path
 import json as _json
 import sys
 from typing import List, Optional
@@ -89,7 +90,10 @@ def _build_parser() -> argparse.ArgumentParser:
 
 
 def _config_from_args(args: argparse.Namespace) -> Config:
-    return Config.load().override(
+    # The workspace decides which project .env applies, so resolve --root before loading; otherwise
+    # `scoot --root ~/other` would take the launch directory's settings into the other project.
+    start = Path(args.root).expanduser().resolve() if args.root else None
+    return Config.load(cwd=start).override(
         model=args.model,
         provider=args.provider,
         effort=args.effort,
@@ -161,9 +165,11 @@ def _run_once(config: Config, pool: ProviderPool, prompt: str, as_json: bool, re
     session = ReplSession(config, pool)
     if resume is not None:
         session.apply_record(resume)
-    from .hooks import Hooks, session_event, submit_prompt
+    from .hooks import Hooks, session_event, startup_notices, submit_prompt
 
     session.hooks = Hooks(config.root)
+    for note in startup_notices(session):
+        eprint(color(f"⚠ {note}", "yellow"))
     session_event(session, "SessionStart", source="resume" if resume is not None else "startup")
     submitted = submit_prompt(session, prompt)
     if submitted is None:

{scootcli-0.9.0 → scootcli-0.10.0}/src/scootcli/commands/hooks.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from ..hooks import EVENTS, enabled, global_path, project_path
+from ..hooks import EVENTS, enabled, global_path, project_path, project_trust, trust_project, untrust_project
 from ..rendering import color
 from . import register
 from .base import SlashCommand
@@ -10,14 +10,29 @@ from .base import SlashCommand
 
 def _run(session, args: str):
     hooks = getattr(session, "hooks", None)
-    if (args or "").strip() == "reload" and hooks is not None:
+    sub = (args or "").strip().lower()
+    root = getattr(getattr(session, "config", None), "root", ".")
+    if sub == "trust":
+        if trust_project(root):
+            print(color(f"trusted {project_path(root)}; its hooks run from now on (until the file changes).", "gray"))
+        else:
+            print(color(f"no project hooks file at {project_path(root)}.", "yellow"))
+        sub = "reload"
+    elif sub == "untrust":
+        print(color("project hooks are off again." if untrust_project(root) else "project hooks were not trusted.", "gray"))
+        sub = "reload"
+    if sub == "reload" and hooks is not None:
         hooks.reload()
         print(color("hooks reloaded.", "gray"))
     print(color("hooks:", "bold"))
     if not enabled():
         print(color("  disabled by SCOOT_HOOKS=0", "yellow"))
-    root = getattr(getattr(session, "config", None), "root", ".")
     print(color(f"  files: {project_path(root)} (project), {global_path()} (global)", "gray"))
+    trust = project_trust(root)
+    if trust == "untrusted":
+        print(color("  project hooks: NOT trusted, not running. review the file, then /hooks trust", "yellow"))
+    elif trust == "trusted":
+        print(color("  project hooks: trusted (/hooks untrust to turn them off)", "gray"))
     if hooks is None or not hooks.config:
         print(color("  none configured", "gray"))
     else:
@@ -31,7 +46,8 @@ def _run(session, args: str):
             for r in hooks.history[-8:]:
                 detail = f"  {r.detail[:60]}" if r.detail else ""
                 print(f"    {r.event:<16} {r.outcome:<8} {r.seconds:>5.2f}s  {r.command[:40]}{detail}")
-    print(color("  usage: /hooks [reload]", "gray"))
+    print(color("  usage: /hooks [reload|trust|untrust]", "gray"))
 
 
-register(SlashCommand("hooks", "list configured hooks and recent results", _run, usage="[reload]"))
+register(SlashCommand("hooks", "list configured hooks and recent results; trust a project's hooks", _run,
+                      usage="[reload|trust|untrust]"))

{scootcli-0.9.0 → scootcli-0.10.0}/src/scootcli/config.py

@@ -12,6 +12,13 @@ Only scoot's own keys are imported from them: ``SCOOT_*``, the providers' API-ke
 (``OPENAI_API_KEY``, ...), and the proxy variables. A project's other secrets never enter scoot's
 process through a ``.env`` file.
 
+The project file gets a narrower allowlist than the global one. A repository is untrusted input:
+its ``.env`` may choose what the model is asked and how the terminal looks, but not where requests
+go (base URLs, proxies), what runs on this machine (hooks), what the tools may touch (approval,
+scope, root), or where scoot's own files live (config and state directories). Those keys come from
+flags, the real environment, or the user's global file; a project value for them is ignored and
+reported, never applied.
+
 The CLI-flag layer is applied by the caller (``cli.py``) via :meth:`Config.override`; this module
 handles the lower layers.
 """
@@ -91,16 +98,37 @@ def allowed_env_key(key: str) -> bool:
         return False
 
 
-def load_dotenv(env_path: Path, allow=allowed_env_key) -> List[str]:
-    """Import allowed ``KEY=VALUE`` lines into ``os.environ`` (never overriding); return imported keys.
+# Keys a *project* .env may not set: they move requests, run code, widen what tools may touch, or
+# relocate scoot's own files. Anything a cloned repository must not be able to decide for you.
+_PROJECT_BLOCKED_KEYS = frozenset({
+    "SCOOT_APPROVAL", "SCOOT_SCOPE", "SCOOT_ROOT", "SCOOT_HOOKS", "SCOOT_CONFIG_DIR", "SCOOT_STATE_DIR",
+    *_PROXY_KEYS,
+})
+
+
+def project_env_key_allowed(key: str) -> bool:
+    """The project layer's allowlist: scoot's keys minus the ones that move data or grant power.
+
+    A base URL override (``SCOOT_<PROVIDER>_BASE_URL``) is the sharpest of them: with it a repository
+    could send the user's own API key to a host of its choosing on the first request.
+    """
+    if not allowed_env_key(key):
+        return False
+    if key in _PROJECT_BLOCKED_KEYS or (key.startswith("SCOOT_") and key.endswith("_BASE_URL")):
+        return False
+    return True
+
+
+def parse_dotenv(env_path: Path) -> List[Tuple[str, str]]:
+    """``(key, value)`` pairs from a ``.env`` file, in order; unreadable files yield nothing.
 
     Accepts an optional ``export`` prefix and single or double quotes around the value.
     """
-    imported: List[str] = []
+    pairs: List[Tuple[str, str]] = []
     try:
         lines = env_path.read_text().splitlines()
     except OSError:
-        return imported
+        return pairs
     for line in lines:
         line = line.strip()
         if not line or line.startswith("#") or "=" not in line:
@@ -109,17 +137,32 @@ def load_dotenv(env_path: Path, allow=allowed_env_key) -> List[str]:
             line = line[len("export "):].lstrip()
         key, _, value = line.partition("=")
         key = key.strip()
-        if not key or not allow(key):
+        if not key:
             continue
         value = value.strip()
         if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
             value = value[1:-1]
+        pairs.append((key, value))
+    return pairs
+
+
+def load_dotenv(env_path: Path, allow=allowed_env_key) -> List[str]:
+    """Import allowed ``KEY=VALUE`` lines into ``os.environ`` (never overriding); return imported keys."""
+    imported: List[str] = []
+    for key, value in parse_dotenv(env_path):
+        if not allow(key):
+            continue
         if key not in os.environ:
             os.environ[key] = value
             imported.append(key)
     return imported
 
 
+def rejected_project_keys(env_path: Path) -> List[str]:
+    """Keys in a project ``.env`` that scoot knows but will not take from a repository."""
+    return [k for k, _ in parse_dotenv(env_path) if allowed_env_key(k) and not project_env_key_allowed(k)]
+
+
 def _as_bool(value: str) -> bool:
     return value.strip().lower() not in ("false", "0", "no", "off", "")
 
@@ -192,6 +235,7 @@ class Config:
     editor: str = "idea"  # external editor for the open_editor tool: idea | vscode
     scope: str = "workspace"  # where file tools may go: workspace (ask once outside it) | anywhere
     env_files: Tuple[str, ...] = ()  # the .env files that were read, in load order (shown by /status)
+    ignored_project_keys: Tuple[str, ...] = ()  # keys the project .env tried to set that only the user may set
     logo: bool = True  # mascot in the launch banner + status-bar face (--no-logo / SCOOT_LOGO / /logo)
     emoji: bool = True  # 🛴 transcript label; off → ⏺ for terminals without an emoji font (--no-emoji)
 
@@ -201,8 +245,14 @@ class Config:
         """Load config from the ``.env`` files + environment variables, falling back to defaults."""
         cwd = (cwd or Path.cwd()).resolve()
         files = env_files(cwd)
+        project = find_project_env(cwd)
+        ignored: List[str] = []
         for env_file in files:
-            load_dotenv(env_file)
+            if env_file == project:
+                load_dotenv(env_file, allow=project_env_key_allowed)
+                ignored = rejected_project_keys(env_file)
+            else:
+                load_dotenv(env_file)
 
         get = os.environ.get
         root = Path(get("SCOOT_ROOT", str(cwd))).resolve()
@@ -210,6 +260,7 @@ class Config:
         return cls(
             proxy=get("HTTPS_PROXY") or get("https_proxy") or DEFAULT_PROXY,
             env_files=tuple(str(f) for f in files),
+            ignored_project_keys=tuple(ignored),
             provider=get("SCOOT_PROVIDER", "").strip().lower(),
             model=model,
             model_source=model_source,

{scootcli-0.9.0 → scootcli-0.10.0}/src/scootcli/headless.py

@@ -124,8 +124,9 @@ class HeadlessUI:
                 msg = self.answers.get(timeout=min(0.2, remaining))
             except queue.Empty:
                 continue
-            if msg.get("id") not in (None, "", req):
-                self.writer.emit("error", message=f"approval answer for unknown request {msg.get('id')}", kind="protocol")
+            if msg.get("id") != req:  # an unbound answer must never approve whatever comes next
+                self.writer.emit("error", message=f"approval answer must carry id {req!r}, got {msg.get('id')!r}",
+                                 kind="protocol")
                 continue
             decision = _DECISIONS.get(str(msg.get("decision", "")).lower())
             if decision is None:
@@ -153,8 +154,9 @@ class HeadlessUI:
                 msg = self.answers.get(timeout=min(0.2, remaining))
             except queue.Empty:
                 continue
-            if msg.get("id") not in (None, "", req):
-                self.writer.emit("error", message=f"answer for unknown request {msg.get('id')}", kind="protocol")
+            if msg.get("id") != req:
+                self.writer.emit("error", message=f"scope answer must carry id {req!r}, got {msg.get('id')!r}",
+                                 kind="protocol")
                 continue
             verdict = mapping.get(str(msg.get("decision", "")).lower())
             if verdict is None:
@@ -229,12 +231,14 @@ class Headless:
     # ── main loop ────────────────────────────────────────────────────────────────
     def run(self) -> int:
         from . import tools
-        from .hooks import session_event
+        from .hooks import session_event, startup_notices
 
         tools.load_builtins()
         threading.Thread(target=self._reader, daemon=True).start()
         if self.heartbeat_s > 0:
             threading.Thread(target=self._heartbeat, daemon=True).start()
+        for note in startup_notices(self.session):
+            self.writer.emit("notice", message=note)
         session_event(self.session, "SessionStart", source="resume" if getattr(self.session, "resumed", False) else "startup")
         self.writer.emit("ready", protocol=PROTOCOL, version=__version__, session_id=self.session.id,
                          model=self.session.active_model, cwd=str(self.session.config.root),

{scootcli-0.9.0 → scootcli-0.10.0}/src/scootcli/hooks.py

@@ -16,7 +16,11 @@ A hook answers with its exit code or with JSON on stdout:
   * exit 2: block or deny, stderr is the reason
   * anything else, or a timeout: logged and ignored
 Hooks run sequentially in configuration order; the first blocking decision wins.
-``SCOOT_HOOKS=0`` disables everything. Hooks never see API keys.
+``SCOOT_HOOKS=0`` disables everything. Provider API key variables are removed from a hook's
+environment. A project's ``.scoot/hooks.json`` runs only after the user trusted it with
+``/hooks trust``; the trust is bound to the file's content, so an edited file asks again. A hook's
+``allow`` waives scoot's approval prompt; it waives the denylist confirmation only when the hook lives
+in the user's global config (a machine-level delegate such as an editor or phone bridge), never a project.
 """
 
 from __future__ import annotations
@@ -48,6 +52,7 @@ class Decision:
     action: str = ""      # "" | allow | deny | ask | block
     reason: str = ""
     context: str = ""     # extra text a hook printed (UserPromptSubmit adds it to the prompt)
+    from_global: bool = False  # the deciding hook is in the user's global config, not a project file
 
     @property
     def blocks(self) -> bool:
@@ -80,6 +85,62 @@ def project_path(root) -> Path:
     return Path(root) / ".scoot" / "hooks.json"
 
 
+def file_digest(path: Path) -> Optional[str]:
+    """sha256 of the file's bytes, or ``None`` when it cannot be read."""
+    import hashlib
+
+    try:
+        return hashlib.sha256(path.read_bytes()).hexdigest()
+    except OSError:
+        return None
+
+
+def project_trust(root) -> str:
+    """``"trusted"``, ``"untrusted"`` (a project file exists and is not trusted, or changed since),
+    or ``"none"`` (no project hooks file)."""
+    path = project_path(root)
+    if not path.is_file():
+        return "none"
+    from .preferences import trusted_hooks_digest
+
+    digest = file_digest(path)
+    return "trusted" if digest and digest == trusted_hooks_digest(root) else "untrusted"
+
+
+def trust_project(root) -> bool:
+    """Record the current project hooks file as trusted. False when there is no such file."""
+    path = project_path(root)
+    digest = file_digest(path) if path.is_file() else None
+    if not digest:
+        return False
+    from .preferences import trust_hooks
+
+    trust_hooks(root, digest)
+    return True
+
+
+def untrust_project(root) -> bool:
+    from .preferences import untrust_hooks
+
+    return untrust_hooks(root)
+
+
+def _hook_env(payload: dict, event: str) -> dict:
+    """The child's environment: the process environment minus every provider key variable."""
+    env = dict(os.environ)
+    try:
+        from .providers import registry
+
+        for spec in registry.all_specs():
+            for key in spec.key_env:
+                env.pop(key, None)
+    except Exception:
+        pass
+    env["SCOOT_SESSION_ID"] = str(payload.get("session_id", ""))
+    env["SCOOT_HOOK_EVENT"] = event
+    return env
+
+
 def _load_file(path: Path) -> Dict[str, list]:
     try:
         data = json.loads(path.read_text())
@@ -129,13 +190,28 @@ class Hooks:
             self.reload()
 
     def reload(self) -> None:
+        """Read the global file, and the project file only when the user trusted this exact content.
+
+        An untrusted project file is remembered in ``self.untrusted`` so the front ends can say so.
+        """
         self.config = {}
         self.sources = []
-        for path in (project_path(self.root), global_path()):
+        self.untrusted: Optional[Path] = None
+        self.trust = project_trust(self.root)
+        paths = [global_path()]
+        if self.trust == "trusted":
+            paths.insert(0, project_path(self.root))
+        elif self.trust == "untrusted":
+            self.untrusted = project_path(self.root)
+        gpath = global_path()
+        for path in paths:
             if path.is_file():
                 loaded = _load_file(path)
                 self.sources.append(str(path))
+                origin = "global" if path == gpath else "project"
                 for event, entries in loaded.items():
+                    for entry in entries:
+                        entry["_source"] = origin  # so a decision can say whether it came from global config
                     self.config.setdefault(event, []).extend(entries)
 
     def has(self, event: str) -> bool:
@@ -160,10 +236,14 @@ class Hooks:
 
     # ── running ──────────────────────────────────────────────────────────────────
     def run(self, event: str, payload: dict, cancel_event: Optional[threading.Event] = None) -> Decision:
+        """Run every applicable hook and combine their answers: a deny or block wins over an ask,
+        an ask wins over an allow. An early ``allow`` from one file can no longer hide a ``deny``
+        from another; the first answer at the winning level supplies the reason."""
         if not self.has(event):
             return Decision()
         tool_name = str(payload.get("tool_name", ""))
         context: List[str] = []
+        decisions: List[Decision] = []
         for entry in self.config.get(event, []):
             matcher = entry.get("matcher")
             if matcher and event in ("PreToolUse", "PostToolUse"):
@@ -180,6 +260,13 @@ class Hooks:
                 if decision.context:
                     context.append(decision.context)
                 if decision.action:
+                    decision.from_global = entry.get("_source") == "global"
+                    decisions.append(decision)
+                if cancel_event is not None and cancel_event.is_set():
+                    break
+        for level in (("deny", "block"), ("ask",), ("allow",)):
+            for decision in decisions:
+                if decision.action in level:
                     decision.context = "\n".join(context)
                     return decision
         return Decision(context="\n".join(context))
@@ -188,9 +275,7 @@ class Hooks:
         from .errors import Interrupted
         from .tools.base import ToolError, run_subprocess
 
-        env = dict(os.environ)
-        env["SCOOT_SESSION_ID"] = str(payload.get("session_id", ""))
-        env["SCOOT_HOOK_EVENT"] = event
+        env = _hook_env(payload, event)
         started = time.time()
         try:
             # The same runner as the tools: its own process group, bounded waits, ESC honoured.
@@ -269,6 +354,22 @@ def for_session(session) -> Optional[Hooks]:
     return getattr(session, "hooks", None) if enabled() else None
 
 
+def startup_notices(session) -> List[str]:
+    """What a front end should tell the user once at start: an untrusted project hooks file, and
+    project ``.env`` keys that were ignored because only the user may set them."""
+    notes: List[str] = []
+    hooks = getattr(session, "hooks", None)
+    if hooks is not None and getattr(hooks, "untrusted", None) is not None:
+        notes.append(f"this project has hooks in {hooks.untrusted} that are not trusted, so they will not run; "
+                     f"review the file, then /hooks trust")
+    cfg = getattr(session, "config", None)
+    ignored = tuple(getattr(cfg, "ignored_project_keys", ()) or ())
+    if ignored:
+        notes.append(f"ignored from the project .env (only you may set these, in ~/.config/scoot/.env or the "
+                     f"environment): {', '.join(ignored)}")
+    return notes
+
+
 def submit_prompt(session, text: str, cancel_event=None) -> Optional[str]:
     """Fire ``UserPromptSubmit``. Returns the (possibly extended) prompt, or ``None`` when blocked."""
     hooks = for_session(session)

{scootcli-0.9.0 → scootcli-0.10.0}/src/scootcli/images.py

@@ -157,11 +157,12 @@ def _sniff_mime(path: Path, raw: bytes) -> str:
 def to_data_uri(path: Path, max_bytes: int = DEFAULT_MAX_BYTES) -> EncodedImage:
     """Read + base64-encode an image into a ``data:`` URI. Raises :class:`ImageTooLargeError` over cap."""
     path = Path(path)
-    raw = path.read_bytes()
-    if max_bytes and len(raw) > max_bytes:
+    size = path.stat().st_size  # check before reading, so an oversized file is never loaded
+    if max_bytes and size > max_bytes:
         raise ImageTooLargeError(
-            f"{path.name} is {len(raw) // 1024} KB, over the {max_bytes // 1024} KB limit"
+            f"{path.name} is {size // 1024} KB, over the {max_bytes // 1024} KB limit"
         )
+    raw = path.read_bytes()
     mime = _sniff_mime(path, raw)
     b64 = base64.b64encode(raw).decode("ascii")
     return EncodedImage(name=path.name, mime=mime, data_uri=f"data:{mime};base64,{b64}", size=len(raw))

{scootcli-0.9.0 → scootcli-0.10.0}/src/scootcli/keys.py

@@ -62,19 +62,21 @@ def query_cursor(timeout: float = 0.2) -> Optional[Tuple[int, int]]:
     return None
 
 
-def read_key() -> str:
-    """Read a single keypress (lowercased). Falls back to a line read on non-TTY (piped) input."""
+def read_key(keep_case: bool = False) -> str:
+    """Read a single keypress, lowercased unless ``keep_case`` (a menu that tells ``a`` from ``A``).
+    Falls back to a line read on non-TTY (piped) input."""
     if not (_HAVE_TERMIOS and sys.stdin.isatty()):
         line = sys.stdin.readline()
-        return (line.strip()[:1].lower() if line.strip() else "q")
-    fd = sys.stdin.fileno()
-    old = termios.tcgetattr(fd)
-    try:
-        tty.setcbreak(fd)
-        ch = sys.stdin.read(1)
-    finally:
-        termios.tcsetattr(fd, termios.TCSADRAIN, old)
-    return ch.lower()
+        ch = line.strip()[:1] if line.strip() else "q"
+    else:
+        fd = sys.stdin.fileno()
+        old = termios.tcgetattr(fd)
+        try:
+            tty.setcbreak(fd)
+            ch = sys.stdin.read(1)
+        finally:
+            termios.tcsetattr(fd, termios.TCSADRAIN, old)
+    return ch if keep_case else ch.lower()
 
 
 class InterruptibleSection: