scootcli 0.9.0__tar.gz → 0.11.0__tar.gz

{scootcli-0.9.0/src/scootcli.egg-info → scootcli-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scootcli
-Version: 0.9.0
+Version: 0.11.0
 Summary: A tiny coding agent that goes where you point it
 Author: Sergey Nes
 License-Expression: MIT
@@ -321,10 +321,13 @@ New capability is a drop-in file: a tool in `tools/`, a slash command in `comman
 
 ## Security
 
-- API keys are read from the environment or from `~/.config/scoot/credentials.json` (directory `0700`, file `0600`), validated before saving, and never echoed; `rendering.redact()` masks key-shaped strings in all output.
-- Only allowlisted keys are imported from `.env` files.
-- All file and shell tools are sandboxed to the workspace root; destructive shell commands are always re-confirmed.
-- Saved sessions are owner-only with secrets redacted; `/forget all` removes them.
+What scoot protects, and what it does not.
+
+- **Your API keys.** Read from the environment or from `~/.config/scoot/credentials.json` (directory `0700`, file `0600`), validated before saving, never echoed, and removed from the environment of every hook scoot runs. Key-shaped strings are masked in error messages and in saved sessions (message text, tool arguments, and the text copies inside provider replay data; signed or encrypted replay fields are stored as received). Streamed model output is printed as it arrives and is not filtered.
+- **A cloned repository cannot reconfigure you.** A project `.env` may choose the model, effort, and how the terminal looks. It may not set provider base URLs or proxies (which would send your key elsewhere), the approval mode, the scope, the root, hooks, or scoot's config and state directories; those come from flags, your environment, or `~/.config/scoot/.env`, and a project value for them is ignored and reported at start. A project's `.scoot/hooks.json` runs only after you review it and run `/hooks trust`; the trust is bound to the file's content, so an edited file asks again.
+- **File tools are scoped, shell commands are not sandboxed.** `read_file`, `list_dir`, `search`, `write_file`, and `edit_file` stay inside the workspace plus the paths you grant, and never follow a symlink out of it. `run_shell` runs the command as you, with your normal access to files, network, and other programs; approving a command means exactly that. The denylist (`rm -rf`, `git push`, `sudo`, piping a download into a shell, and so on) is an accident guard that forces a confirmation in every mode, including when a project's hook says `allow` (a hook in your own global config can waive it, so an editor or phone bridge you installed still works); it is not a boundary.
+- **The default is `yolo`.** Tool calls run without asking, except the denylist and paths outside the workspace. Use `--approval always` or `auto-read` on code you do not trust yet, and `/worktree start` to keep autonomous edits out of your checkout.
+- **Saved sessions** are owner-only, keyed by workspace, and pruned to the last 20; `/forget all` removes them. Session ids are file names, never paths.
 - No third-party dependencies means no third-party code to audit.
 
 ## Contributing

{scootcli-0.9.0 → scootcli-0.11.0}/README.md

@@ -296,10 +296,13 @@ New capability is a drop-in file: a tool in `tools/`, a slash command in `comman
 
 ## Security
 
-- API keys are read from the environment or from `~/.config/scoot/credentials.json` (directory `0700`, file `0600`), validated before saving, and never echoed; `rendering.redact()` masks key-shaped strings in all output.
-- Only allowlisted keys are imported from `.env` files.
-- All file and shell tools are sandboxed to the workspace root; destructive shell commands are always re-confirmed.
-- Saved sessions are owner-only with secrets redacted; `/forget all` removes them.
+What scoot protects, and what it does not.
+
+- **Your API keys.** Read from the environment or from `~/.config/scoot/credentials.json` (directory `0700`, file `0600`), validated before saving, never echoed, and removed from the environment of every hook scoot runs. Key-shaped strings are masked in error messages and in saved sessions (message text, tool arguments, and the text copies inside provider replay data; signed or encrypted replay fields are stored as received). Streamed model output is printed as it arrives and is not filtered.
+- **A cloned repository cannot reconfigure you.** A project `.env` may choose the model, effort, and how the terminal looks. It may not set provider base URLs or proxies (which would send your key elsewhere), the approval mode, the scope, the root, hooks, or scoot's config and state directories; those come from flags, your environment, or `~/.config/scoot/.env`, and a project value for them is ignored and reported at start. A project's `.scoot/hooks.json` runs only after you review it and run `/hooks trust`; the trust is bound to the file's content, so an edited file asks again.
+- **File tools are scoped, shell commands are not sandboxed.** `read_file`, `list_dir`, `search`, `write_file`, and `edit_file` stay inside the workspace plus the paths you grant, and never follow a symlink out of it. `run_shell` runs the command as you, with your normal access to files, network, and other programs; approving a command means exactly that. The denylist (`rm -rf`, `git push`, `sudo`, piping a download into a shell, and so on) is an accident guard that forces a confirmation in every mode, including when a project's hook says `allow` (a hook in your own global config can waive it, so an editor or phone bridge you installed still works); it is not a boundary.
+- **The default is `yolo`.** Tool calls run without asking, except the denylist and paths outside the workspace. Use `--approval always` or `auto-read` on code you do not trust yet, and `/worktree start` to keep autonomous edits out of your checkout.
+- **Saved sessions** are owner-only, keyed by workspace, and pruned to the last 20; `/forget all` removes them. Session ids are file names, never paths.
 - No third-party dependencies means no third-party code to audit.
 
 ## Contributing

{scootcli-0.9.0 → scootcli-0.11.0}/src/scootcli/__init__.py

@@ -1,4 +1,4 @@
 """scoot: a tiny coding agent that goes where you point it."""
 
-__version__ = "0.9.0"
+__version__ = "0.11.0"
 

{scootcli-0.9.0 → scootcli-0.11.0}/src/scootcli/agent.py

@@ -18,7 +18,7 @@ from dataclasses import dataclass
 from typing import List, Optional
 
 from . import tools
-from .approvals import Approval, Decision, needs_prompt
+from .approvals import Approval, Decision, denylisted_reason, needs_prompt
 from .config import Config
 from .errors import ScootError, ContextLengthError, Interrupted, ModelUnavailableError
 from .prompts import build_agent_system_prompt
@@ -40,6 +40,8 @@ _CUT_OFF = {
     "incomplete": "the stream ended before the reply was complete",
 }
 
+_MAX_FALLBACKS = 6  # a turn's model-unavailable switches, so a bad router cannot spin forever
+
 
 def _strip_done(text: str) -> str:
     """Remove a trailing ``DONE`` sentinel line from the model's final message."""
@@ -112,6 +114,7 @@ class Agent:
         compacted = False
         stop_blocks = 0
         cut_off = 0  # tool batches the model could not finish (output limit); bounded retries
+        fallbacks = 0  # model-unavailable switches this turn; bounded independently of steps
         while True:
             if cancel_event.is_set():
                 return AgentOutcome("interrupted", steps=steps)
@@ -124,8 +127,9 @@ class Agent:
             except Interrupted:
                 return AgentOutcome("interrupted", steps=steps)
             except ModelUnavailableError as exc:
-                if self._fallback_model(session):
-                    ui.assistant(f"model unavailable — switching to {session.active_model}.")
+                fallbacks += 1
+                if fallbacks <= _MAX_FALLBACKS and self._fallback_model(session):
+                    ui.assistant(f"model unavailable, switching to {session.active_model}.")
                     steps -= 1  # don't count the failed attempt
                     continue
                 return AgentOutcome("error", error=_fmt_error(exc), steps=steps)
@@ -235,10 +239,10 @@ class Agent:
         decision = hooks.run("Stop", payload)
         return (decision.reason or "the Stop hook asked to continue") if decision.blocks else ""
 
-    def _pre_tool_hook(self, session, tool, args, cancel_event) -> "tuple[str, str]":
+    def _pre_tool_hook(self, session, tool, args, cancel_event) -> "tuple[str, str, bool]":
         hooks = self._hooks(session)
         if hooks is None or not hooks.has("PreToolUse"):
-            return "", ""
+            return "", "", False
         from .hooks import tool_kind
 
         from .hooks import tool_alias
@@ -246,7 +250,7 @@ class Agent:
         payload = hooks.payload(session, "PreToolUse", tool_name=tool.name, tool_input=args,
                                 tool_kind=tool_kind(tool), tool_alias=tool_alias(tool.name))
         decision = hooks.run("PreToolUse", payload, cancel_event)
-        return decision.action, decision.reason
+        return decision.action, decision.reason, decision.from_global
 
     def _post_tool_hook(self, session, tool, args, result: ToolResult) -> None:
         hooks = self._hooks(session)
@@ -288,10 +292,10 @@ class Agent:
         except Exception:
             available = []
         bad = getattr(session, "bad_models", None) or set()
-        available = [m for m in available if m not in bad] or available
+        available = [m for m in available if m not in bad]  # never re-pick a model that already failed
         hints = compute_hints(session)
         return router.choose(session, hints, available, session.resolved_model(),
-                             classify=self._classify_with_provider).model
+                             classify=self._classify_with_provider, excluded=bad).model
 
     def _classify_with_provider(self, model: str, prompt: str) -> str:
         """One small, non-streaming call used by a configured router classifier."""
@@ -300,18 +304,15 @@ class Agent:
         return result.content or ""
 
     def _fallback_model(self, session) -> bool:
-        """After a model-unavailable error, blacklist it and switch models. Returns False if stuck."""
-        bad = session.active_model
-        fallback = session.resolved_model()
-        if bad == fallback and session.model.lower() != "auto":
-            return False
+        """After a model-unavailable error, mark the failed model bad and switch. Returns False when
+        there is nothing new to try, so the loop cannot alternate forever between two dead models."""
+        failed = session.active_model
         if hasattr(session, "bad_models"):
-            session.bad_models.add(bad)
+            session.bad_models.add(failed)
+        bad = getattr(session, "bad_models", None) or set()
         new = self._pick_model(session)
-        if new == bad:
-            if bad == fallback:
-                return False
-            new = fallback
+        if not new or new in bad:
+            return False  # every candidate is already known unavailable this turn
         session.active_model = new
         return True
 
@@ -434,6 +435,8 @@ class Agent:
         for tc in tool_calls:
             if cancel_event.is_set():
                 return self._interrupted(session, tool_calls)
+            if scope is not None:
+                scope.clear_once()  # a prior call's one-shot path grant does not carry into this one
             tc_id = tc.get("id", "")
             fn = tc.get("function", {}) or {}
             name = fn.get("name", "")
@@ -461,7 +464,7 @@ class Agent:
                     ui.tool_result(name, ToolResult(ok=False, summary="outside the workspace: declined"))
                     continue
             # A PreToolUse hook may deny (skip the tool), allow (skip the prompt), or ask (force it).
-            hook_action, hook_reason = self._pre_tool_hook(session, tool, args, cancel_event)
+            hook_action, hook_reason, hook_from_global = self._pre_tool_hook(session, tool, args, cancel_event)
             if cancel_event.is_set():  # ESC while the hook ran
                 self._append_tool(session, tc_id, "not executed: the user interrupted the turn")
                 return self._interrupted(session, tool_calls)
@@ -471,7 +474,13 @@ class Agent:
                 continue
             # Approval policy: auto-approve when the mode/trust allows it, else prompt.
             must_prompt = needs_prompt(mode, tool, args, trusted)
-            if hook_action == "allow":
+            # A hook may waive scoot's own approval prompt. It may also waive the denylist confirmation,
+            # but only when it lives in the user's own global config: that is the user's machine-level
+            # delegation (an editor or a phone bridge approving on their behalf). A project's hook, even
+            # one trusted to run, is repo-authored and must not silently auto-run a catastrophic command.
+            waivable = hook_action == "allow" and (hook_from_global or not (
+                tool.name == "run_shell" and denylisted_reason(args.get("command", ""))))
+            if waivable:
                 must_prompt = None
             elif hook_action == "ask":
                 must_prompt = hook_reason or "hook asked for confirmation"
@@ -553,7 +562,7 @@ class Agent:
         verdict = asker(tool, paths[0], ctx)
         if verdict == "once":
             for p in paths:
-                scope.grant(p)
+                scope.grant_once(p)  # this call only; re-asked next time
         elif verdict == "dir":
             for p in paths:
                 scope.grant_dir(p)

{scootcli-0.9.0 → scootcli-0.11.0}/src/scootcli/approvals.py

@@ -46,9 +46,13 @@ MODES = ("always", "auto-read", "auto-edits", "yolo")
 
 # Catastrophic shell commands that are ALWAYS confirmed, even in yolo mode.
 _DENYLIST = [
-    (re.compile(r"\brm\s+-[a-z]*r[a-z]*f|\brm\s+-[a-z]*f[a-z]*r", re.I), "recursive force delete"),
+    # rm with a recursive flag and a force flag anywhere in the same command (``-rf``, ``-r -f``,
+    # ``-fR``, ``--recursive --force``); ``[^|;&]*`` keeps both lookaheads inside one command.
+    (re.compile(r"\brm\b(?=[^|;&]*\s-(?:[a-z]*r[a-z]*|-recursive)\b)(?=[^|;&]*\s-(?:[a-z]*f[a-z]*|-force)\b)", re.I),
+     "recursive force delete"),
     (re.compile(r":\(\)\s*\{.*\|.*&\s*\}\s*;", re.S), "fork bomb"),
-    (re.compile(r"\bgit\s+push\b", re.I), "git push"),
+    # git push with any options between ``git`` and ``push`` (``-C repo``, ``--git-dir=x``, ``-c k=v``).
+    (re.compile(r"\bgit\b(?:\s+-{1,2}[\w-]+(?:[= ]\S+)?)*\s+push\b", re.I), "git push"),
     (re.compile(r"\bsudo\b", re.I), "sudo"),
     (re.compile(r"\b(shutdown|reboot|halt|poweroff)\b", re.I), "power/shutdown"),
     (re.compile(r"\bmkfs\b|\bdd\s+.*of=/dev/", re.I), "disk/format command"),
@@ -101,8 +105,10 @@ def _render(tool: Tool, args: dict, ctx: ToolContext) -> None:
     except Exception as exc:  # a preview must never crash the loop
         preview = color(f"(preview unavailable: {exc})", "gray")
     if preview:
+        from .rendering import strip_controls
+
         for line in preview.splitlines():
-            print("  " + line)
+            print("  " + strip_controls(line))
 
 
 def _edit_args(args: dict) -> dict:
@@ -129,6 +135,14 @@ def _edit_args(args: dict) -> dict:
 SCOPE_CHOICES = ("once", "dir", "all", "deny", "abort")
 
 
+def _menu_key() -> str:
+    """One keypress for the approval menus: ``A`` (the session-wide choice) keeps its case, every other
+    key is lowercased so ``T`` still means trust. ``read_key`` used to lowercase everything, which made
+    the advertised ``[A]`` unreachable."""
+    key = read_key(keep_case=True)
+    return key if key == "A" else key.lower()
+
+
 def request_scope(tool: Tool, path, ctx: ToolContext) -> str:
     """Ask once about a path outside the workspace. Returns one of ``SCOPE_CHOICES``."""
     from pathlib import Path as _P
@@ -146,7 +160,7 @@ def request_scope(tool: Tool, path, ctx: ToolContext) -> str:
             + color("quit", "red") + " [q] › ",
             end="", flush=True,
         )
-        key = read_key()
+        key = _menu_key()
         print(key)
         if key in ("a", "y", "\r", "\n", ""):
             return "once"
@@ -181,7 +195,7 @@ def request_approval(tool: Tool, args: dict, ctx: ToolContext) -> Approval:
             end="",
             flush=True,
         )
-        key = read_key()
+        key = _menu_key()
         print(key)  # echo the choice for a clean transcript
 
         if key in ("a", "y", "\r", "\n", ""):

{scootcli-0.9.0 → scootcli-0.11.0}/src/scootcli/cli.py

@@ -15,6 +15,7 @@ Global flags override config: ``--model``, ``--proxy``, ``--root``,
 from __future__ import annotations
 
 import argparse
+from pathlib import Path
 import json as _json
 import sys
 from typing import List, Optional
@@ -23,7 +24,7 @@ from .providers import ProviderPool
 from . import __version__
 from .config import Config
 from .errors import ScootError
-from .rendering import color, eprint, redact
+from .rendering import color, eprint, redact, strip_controls
 
 
 def _build_parser() -> argparse.ArgumentParser:
@@ -89,7 +90,10 @@ def _build_parser() -> argparse.ArgumentParser:
 
 
 def _config_from_args(args: argparse.Namespace) -> Config:
-    return Config.load().override(
+    # The workspace decides which project .env applies, so resolve --root before loading; otherwise
+    # `scoot --root ~/other` would take the launch directory's settings into the other project.
+    start = Path(args.root).expanduser().resolve() if args.root else None
+    return Config.load(cwd=start).override(
         model=args.model,
         provider=args.provider,
         effort=args.effort,
@@ -146,30 +150,40 @@ def _run_once(config: Config, pool: ProviderPool, prompt: str, as_json: bool, re
     import threading
 
     from .agent import Agent
-    from .repl import ReplSession, ReplUI
+    from .repl import OneShotJsonUI, ReplSession, ReplUI
+
+    def _emit_json(status: str, *, model: str = "", steps: int = 0, content: str = "",
+                   error: str = "", usage=None, cost=None) -> None:
+        """The one and only object written to stdout in --json mode, on every exit path."""
+        print(_json.dumps({"status": status, "model": model, "steps": steps, "content": content,
+                           "error": error, "usage": usage or {}, "cost": cost}, indent=2))
 
     from .providers.registry import readiness
 
     ready, message = readiness(config)
     if not ready:  # fail fast with guidance instead of a connection error after retries
         if as_json:
-            print(_json.dumps({"status": "error", "model": "", "steps": 0, "content": "",
-                               "error": message, "usage": {}}, indent=2))
+            _emit_json("error", error=message)
         else:
             eprint(color(message, "yellow"))
         return 1
     session = ReplSession(config, pool)
     if resume is not None:
         session.apply_record(resume)
-    from .hooks import Hooks, session_event, submit_prompt
+    from .hooks import Hooks, session_event, startup_notices, submit_prompt
 
     session.hooks = Hooks(config.root)
+    for note in startup_notices(session):
+        eprint(color(f"⚠ {note}", "yellow"))
     session_event(session, "SessionStart", source="resume" if resume is not None else "startup")
     submitted = submit_prompt(session, prompt)
     if submitted is None:
         reason = getattr(session, "hook_block_reason", "") or "a UserPromptSubmit hook blocked it"
-        eprint(color(f"⏹ prompt not sent: {reason}", "yellow"))
         session_event(session, "SessionEnd", reason="blocked")
+        if as_json:
+            _emit_json("blocked", model=session.active_model, error=reason)
+        else:
+            eprint(color(f"⏹ prompt not sent: {reason}", "yellow"))
         return 1
     prompt = submitted
     # Fold any dropped image paths into the prompt (best-effort; no-op when none/disabled).
@@ -182,25 +196,20 @@ def _run_once(config: Config, pool: ProviderPool, prompt: str, as_json: bool, re
     session.messages.append({"role": "user", "content": prompt})
     # JSON output must be clean, so never stream tokens to stdout in that mode.
     agent_config = config.override(stream=False) if as_json else config
-    outcome = Agent(agent_config, pool).run_turn(session, ReplUI(), threading.Event())
+    ui = OneShotJsonUI() if as_json else ReplUI()
+    outcome = Agent(agent_config, pool).run_turn(session, ui, threading.Event())
     session.autosave()  # persist so `scoot -c` can continue this conversation
     session_event(session, "SessionEnd", reason=outcome.status)
 
     if as_json:
-        print(_json.dumps({
-            "status": outcome.status,
-            "model": session.active_model,
-            "steps": outcome.steps,
-            "content": outcome.content,
-            "error": outcome.error,
-            "usage": session.last_usage,
-            "cost": session.session_cost(),
-        }, indent=2))
+        _emit_json(outcome.status, model=session.active_model, steps=outcome.steps,
+                   content=outcome.content, error=outcome.error, usage=session.last_usage,
+                   cost=session.session_cost())
         return 0 if outcome.status == "done" else 1
 
     if outcome.status == "done":
         if outcome.content.strip() and not outcome.streamed:
-            print(outcome.content.strip())
+            print(strip_controls(outcome.content.strip()))
         if config.verbose:
             from .pricing import fmt
 
@@ -211,7 +220,7 @@ def _run_once(config: Config, pool: ProviderPool, prompt: str, as_json: bool, re
                          f"cost={fmt(session.session_cost())}", "gray"))
         return 0
     if outcome.status == "incomplete" and outcome.content.strip() and not outcome.streamed:
-        print(outcome.content.strip())
+        print(strip_controls(outcome.content.strip()))
     eprint(color(f"⚠ {redact(outcome.error or outcome.status)}", "red"))
     return 1
 

{scootcli-0.9.0 → scootcli-0.11.0}/src/scootcli/commands/hooks.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from ..hooks import EVENTS, enabled, global_path, project_path
+from ..hooks import EVENTS, enabled, global_path, project_path, project_trust, trust_project, untrust_project
 from ..rendering import color
 from . import register
 from .base import SlashCommand
@@ -10,14 +10,29 @@ from .base import SlashCommand
 
 def _run(session, args: str):
     hooks = getattr(session, "hooks", None)
-    if (args or "").strip() == "reload" and hooks is not None:
+    sub = (args or "").strip().lower()
+    root = getattr(getattr(session, "config", None), "root", ".")
+    if sub == "trust":
+        if trust_project(root):
+            print(color(f"trusted {project_path(root)}; its hooks run from now on (until the file changes).", "gray"))
+        else:
+            print(color(f"no project hooks file at {project_path(root)}.", "yellow"))
+        sub = "reload"
+    elif sub == "untrust":
+        print(color("project hooks are off again." if untrust_project(root) else "project hooks were not trusted.", "gray"))
+        sub = "reload"
+    if sub == "reload" and hooks is not None:
         hooks.reload()
         print(color("hooks reloaded.", "gray"))
     print(color("hooks:", "bold"))
     if not enabled():
         print(color("  disabled by SCOOT_HOOKS=0", "yellow"))
-    root = getattr(getattr(session, "config", None), "root", ".")
     print(color(f"  files: {project_path(root)} (project), {global_path()} (global)", "gray"))
+    trust = project_trust(root)
+    if trust == "untrusted":
+        print(color("  project hooks: NOT trusted, not running. review the file, then /hooks trust", "yellow"))
+    elif trust == "trusted":
+        print(color("  project hooks: trusted (/hooks untrust to turn them off)", "gray"))
     if hooks is None or not hooks.config:
         print(color("  none configured", "gray"))
     else:
@@ -31,7 +46,8 @@ def _run(session, args: str):
             for r in hooks.history[-8:]:
                 detail = f"  {r.detail[:60]}" if r.detail else ""
                 print(f"    {r.event:<16} {r.outcome:<8} {r.seconds:>5.2f}s  {r.command[:40]}{detail}")
-    print(color("  usage: /hooks [reload]", "gray"))
+    print(color("  usage: /hooks [reload|trust|untrust]", "gray"))
 
 
-register(SlashCommand("hooks", "list configured hooks and recent results", _run, usage="[reload]"))
+register(SlashCommand("hooks", "list configured hooks and recent results; trust a project's hooks", _run,
+                      usage="[reload|trust|untrust]"))

{scootcli-0.9.0 → scootcli-0.11.0}/src/scootcli/config.py

@@ -12,6 +12,13 @@ Only scoot's own keys are imported from them: ``SCOOT_*``, the providers' API-ke
 (``OPENAI_API_KEY``, ...), and the proxy variables. A project's other secrets never enter scoot's
 process through a ``.env`` file.
 
+The project file gets a narrower allowlist than the global one. A repository is untrusted input:
+its ``.env`` may choose what the model is asked and how the terminal looks, but not where requests
+go (base URLs, proxies), what runs on this machine (hooks), what the tools may touch (approval,
+scope, root), or where scoot's own files live (config and state directories). Those keys come from
+flags, the real environment, or the user's global file; a project value for them is ignored and
+reported, never applied.
+
 The CLI-flag layer is applied by the caller (``cli.py``) via :meth:`Config.override`; this module
 handles the lower layers.
 """
@@ -21,6 +28,8 @@ from __future__ import annotations
 import os
 from dataclasses import dataclass, replace
 from pathlib import Path
+
+from .errors import ConfigError
 from typing import List, Optional, Tuple
 
 # No proxy by default (set HTTPS_PROXY / --proxy when one is required).
@@ -91,16 +100,37 @@ def allowed_env_key(key: str) -> bool:
         return False
 
 
-def load_dotenv(env_path: Path, allow=allowed_env_key) -> List[str]:
-    """Import allowed ``KEY=VALUE`` lines into ``os.environ`` (never overriding); return imported keys.
+# Keys a *project* .env may not set: they move requests, run code, widen what tools may touch, or
+# relocate scoot's own files. Anything a cloned repository must not be able to decide for you.
+_PROJECT_BLOCKED_KEYS = frozenset({
+    "SCOOT_APPROVAL", "SCOOT_SCOPE", "SCOOT_ROOT", "SCOOT_HOOKS", "SCOOT_CONFIG_DIR", "SCOOT_STATE_DIR",
+    *_PROXY_KEYS,
+})
+
+
+def project_env_key_allowed(key: str) -> bool:
+    """The project layer's allowlist: scoot's keys minus the ones that move data or grant power.
+
+    A base URL override (``SCOOT_<PROVIDER>_BASE_URL``) is the sharpest of them: with it a repository
+    could send the user's own API key to a host of its choosing on the first request.
+    """
+    if not allowed_env_key(key):
+        return False
+    if key in _PROJECT_BLOCKED_KEYS or (key.startswith("SCOOT_") and key.endswith("_BASE_URL")):
+        return False
+    return True
+
+
+def parse_dotenv(env_path: Path) -> List[Tuple[str, str]]:
+    """``(key, value)`` pairs from a ``.env`` file, in order; unreadable files yield nothing.
 
     Accepts an optional ``export`` prefix and single or double quotes around the value.
     """
-    imported: List[str] = []
+    pairs: List[Tuple[str, str]] = []
     try:
         lines = env_path.read_text().splitlines()
     except OSError:
-        return imported
+        return pairs
     for line in lines:
         line = line.strip()
         if not line or line.startswith("#") or "=" not in line:
@@ -109,17 +139,32 @@ def load_dotenv(env_path: Path, allow=allowed_env_key) -> List[str]:
             line = line[len("export "):].lstrip()
         key, _, value = line.partition("=")
         key = key.strip()
-        if not key or not allow(key):
+        if not key:
             continue
         value = value.strip()
         if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
             value = value[1:-1]
+        pairs.append((key, value))
+    return pairs
+
+
+def load_dotenv(env_path: Path, allow=allowed_env_key) -> List[str]:
+    """Import allowed ``KEY=VALUE`` lines into ``os.environ`` (never overriding); return imported keys."""
+    imported: List[str] = []
+    for key, value in parse_dotenv(env_path):
+        if not allow(key):
+            continue
         if key not in os.environ:
             os.environ[key] = value
             imported.append(key)
     return imported
 
 
+def rejected_project_keys(env_path: Path) -> List[str]:
+    """Keys in a project ``.env`` that scoot knows but will not take from a repository."""
+    return [k for k, _ in parse_dotenv(env_path) if allowed_env_key(k) and not project_env_key_allowed(k)]
+
+
 def _as_bool(value: str) -> bool:
     return value.strip().lower() not in ("false", "0", "no", "off", "")
 
@@ -192,6 +237,7 @@ class Config:
     editor: str = "idea"  # external editor for the open_editor tool: idea | vscode
     scope: str = "workspace"  # where file tools may go: workspace (ask once outside it) | anywhere
     env_files: Tuple[str, ...] = ()  # the .env files that were read, in load order (shown by /status)
+    ignored_project_keys: Tuple[str, ...] = ()  # keys the project .env tried to set that only the user may set
     logo: bool = True  # mascot in the launch banner + status-bar face (--no-logo / SCOOT_LOGO / /logo)
     emoji: bool = True  # 🛴 transcript label; off → ⏺ for terminals without an emoji font (--no-emoji)
 
@@ -201,22 +247,42 @@ class Config:
         """Load config from the ``.env`` files + environment variables, falling back to defaults."""
         cwd = (cwd or Path.cwd()).resolve()
         files = env_files(cwd)
+        project = find_project_env(cwd)
+        ignored: List[str] = []
         for env_file in files:
-            load_dotenv(env_file)
+            if env_file == project:
+                load_dotenv(env_file, allow=project_env_key_allowed)
+                ignored = rejected_project_keys(env_file)
+            else:
+                load_dotenv(env_file)
 
         get = os.environ.get
+
+        def _int(key: str, default: int, low: int, high: int) -> int:
+            raw = get(key)
+            if raw is None or raw.strip() == "":
+                return default
+            try:
+                value = int(raw.strip())
+            except ValueError:
+                raise ConfigError(f"{key} must be an integer, got {raw!r}")
+            if not (low <= value <= high):
+                raise ConfigError(f"{key} must be between {low} and {high}, got {value}")
+            return value
+
         root = Path(get("SCOOT_ROOT", str(cwd))).resolve()
         model, model_source = _resolve_model_setting(get("SCOOT_MODEL"), root)
         return cls(
             proxy=get("HTTPS_PROXY") or get("https_proxy") or DEFAULT_PROXY,
             env_files=tuple(str(f) for f in files),
+            ignored_project_keys=tuple(ignored),
             provider=get("SCOOT_PROVIDER", "").strip().lower(),
             model=model,
             model_source=model_source,
             effort=get("SCOOT_EFFORT", "medium").strip().lower(),
-            timeout=int(get("SCOOT_TIMEOUT", "120")),
-            max_steps=int(get("SCOOT_MAX_STEPS", "50")),
-            compact_at=int(get("SCOOT_COMPACT_AT", "100000")),
+            timeout=_int("SCOOT_TIMEOUT", 120, 1, 86_400),
+            max_steps=_int("SCOOT_MAX_STEPS", 50, 1, 10_000),
+            compact_at=_int("SCOOT_COMPACT_AT", 100_000, 1_000, 100_000_000),
             approval=get("SCOOT_APPROVAL", "yolo"),
             root=root,
             verbose=_as_bool(get("SCOOT_VERBOSE", "false")),
@@ -229,7 +295,7 @@ class Config:
             verbosity=get("SCOOT_VERBOSITY", "full").strip().lower(),
             images=_as_bool(get("SCOOT_IMAGES", "true")),
             vision_model=get("SCOOT_VISION_MODEL", "auto"),
-            image_max_bytes=int(get("SCOOT_IMAGE_MAX_BYTES", str(4 * 1024 * 1024))),
+            image_max_bytes=_int("SCOOT_IMAGE_MAX_BYTES", 4 * 1024 * 1024, 1024, 512 * 1024 * 1024),
             editor=get("SCOOT_EDITOR", "idea").strip().lower(),
             scope=get("SCOOT_SCOPE", "workspace").strip().lower(),
             logo=_resolve_logo_setting(get("SCOOT_LOGO")),

{scootcli-0.9.0 → scootcli-0.11.0}/src/scootcli/credentials.py

@@ -32,21 +32,9 @@ def _load() -> Dict[str, str]:
 
 
 def _write(keys: Dict[str, str]) -> Path:
-    directory = _file().parent
-    directory.mkdir(parents=True, exist_ok=True)
-    try:
-        os.chmod(directory, 0o700)
-    except OSError:
-        pass  # best-effort on exotic filesystems
-    # Open with a restrictive mode from the start so a key is never briefly world-readable.
-    fd = os.open(_file(), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
-    with os.fdopen(fd, "w") as fh:
-        json.dump({"keys": keys}, fh)
-    try:
-        os.chmod(_file(), 0o600)  # tighten in case the file pre-existed
-    except OSError:
-        pass
-    return _file()
+    from .store import write_json_atomic
+
+    return write_json_atomic(_file(), {"keys": keys})
 
 
 def load_key(provider: str) -> Optional[str]: