sliceagent 0.1.6__tar.gz → 0.1.8__tar.gz

{sliceagent-0.1.6 → sliceagent-0.1.8}/CHANGELOG.md

@@ -5,6 +5,38 @@ this project aims for [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.1.8] — 2026-07-02
+
+Launch-day bug-hunt round: a security fix plus config-robustness and /model correctness.
+
+### Security
+- `run_command` in the default *teenager* mode no longer auto-runs exec/write commands disguised as
+  "read-only": `env <program>`, `sort -o FILE`, `date -s`, `tree -o FILE`, `uniq IN OUT`, and
+  `git grep --open-files-in-pager` now take the confirm path (arbitrary code-exec / file-overwrite
+  confirm-bypass). Read-only siblings like `du -s` / `grep -o` still auto-run.
+
+### Fixed
+- Boot no longer cross-wires a prefs-pinned provider's key with the DEFAULT provider's endpoint (an
+  env `gpt-5.5` @ OpenAI pin on a DeepSeek-default config used to 401 every call on relaunch).
+- A prefs `provider`/model pin whose `[providers.<id>]` table was removed from config.toml is now
+  dropped at boot instead of forcing a model onto the wrong endpoint.
+- The wizard no longer silently ERASES other providers' API keys when config.toml is unparseable —
+  the old file is moved to a non-clobbering `.bak` first (keys recoverable).
+- `sliceagent config` / `config --use` / the init wizard no longer crash on a non-UTF-8 config.toml
+  or a scalar value under `[providers]` (they degrade).
+- `llm.switch()` (a `/model` provider hop) closes the replaced HTTP client — no more fd leak per hop.
+- The `/model` reasoning menu offers `high` (not a misleading `max`) for OpenRouter models, and offers
+  the levels the *target* provider supports when the pick rebinds the endpoint.
+- The wizard's typed provider fallback rejects an unknown choice instead of silently configuring
+  OpenRouter.
+
+## [0.1.7] — 2026-07-02
+
+### Fixed
+- `/model`: the current env-configured model row is now labeled `current (env)` instead of the
+  provider family name — it could masquerade as a configured provider (e.g. an env `gpt-5.5` on a
+  DeepSeek endpoint showed as "deepseek").
+
 ## [0.1.6] — 2026-07-02
 
 The clear config journey: one wizard, two doors, an honest /model.

{sliceagent-0.1.6 → sliceagent-0.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sliceagent
-Version: 0.1.6
+Version: 0.1.8
 Summary: A coding agent with a new context-engineering framework: bounded, deterministic, reconstructed context (slice architecture) — built for long-horizon work.
 Author: TT-Wang
 License-Expression: MIT

{sliceagent-0.1.6 → sliceagent-0.1.8}/src/sliceagent/__init__.py

@@ -1,3 +1,3 @@
 """sliceagent — a memory-native coding agent (deterministic, bounded, reconstructed context)."""
 
-__version__ = "0.1.6"
+__version__ = "0.1.8"

{sliceagent-0.1.6 → sliceagent-0.1.8}/src/sliceagent/cli.py

@@ -151,6 +151,21 @@ def _ws_name(path: str) -> str:
     return "~" if p == os.path.realpath(os.path.expanduser("~")) else (os.path.basename(p) or p)
 
 
+def _env_from_config(c, pid: str | None = None) -> None:
+    """Populate LLM_API_KEY/LLM_BASE_URL from config (ENV still wins). A prefs-pinned provider `pid`
+    binds AS A UNIT: its key with ITS OWN endpoint — an absent base_url means the SDK default (OpenAI),
+    NOT the default provider's base_url (that fallback cross-wired an openai key onto the deepseek
+    endpoint after `/model`-hop + restart when default_provider pointed elsewhere)."""
+    tbl = (c.providers() or {}).get(pid) if pid else None
+    if isinstance(tbl, dict) and tbl.get("api_key"):
+        key, base = tbl["api_key"], tbl.get("base_url") or ""
+    else:                                    # no/unusable pin → the default provider's own pairing
+        key, base = c.api_key, c.base_url
+    for _env, _val in (("LLM_API_KEY", key), ("LLM_BASE_URL", base)):
+        if not os.environ.get(_env) and _val:
+            os.environ[_env] = _val
+
+
 def main() -> None:
     # subcommands (onboarding / discovery) are handled BEFORE any key gate, so `sliceagent init` runs on a
     # machine with nothing configured yet. A bare `sliceagent` (or one with non-subcommand args) falls through.
@@ -165,14 +180,6 @@ def main() -> None:
     from .config import load_config, load_prefs
     _boot_prefs = load_prefs()   # the last /model choice may pin a PROVIDER (endpoint+key), not just a model
 
-    def _env_from_config(c, pid: str | None = None) -> None:
-        tbl = (c.providers() or {}).get(pid) if pid else None
-        key = (tbl or {}).get("api_key") or c.api_key
-        base = ((tbl or {}).get("base_url") if tbl and tbl.get("api_key") else None) or c.base_url
-        for _env, _val in (("LLM_API_KEY", key), ("LLM_BASE_URL", base)):
-            if not os.environ.get(_env) and _val:
-                os.environ[_env] = _val
-
     def _key_present() -> bool:
         return bool(os.environ.get("LLM_API_KEY") or os.environ.get("OPENAI_API_KEY")
                     or os.environ.get("ANTHROPIC_API_KEY") or os.environ.get("DEEPSEEK_API_KEY")
@@ -189,6 +196,14 @@ def main() -> None:
         return run_init() == 0
 
     cfg = load_config()
+    # A prefs `provider` pin whose [providers.<id>] table was since removed from config.toml is STALE:
+    # its key/endpoint already fall back to the default provider (see _env_from_config), but its pinned
+    # MODEL would still win at the resolution below and get sent to the wrong endpoint (model_not_found
+    # every turn). Drop the whole stale pin so model/endpoint resolve together from the live config.
+    if _boot_prefs.get("provider") and _boot_prefs["provider"] not in (cfg.providers() or {}):
+        from .config import save_prefs as _sp
+        _sp({"provider": None, "model": None})       # None DELETES (see save_prefs)
+        _boot_prefs.pop("provider", None); _boot_prefs.pop("model", None)
     _env_from_config(cfg, _boot_prefs.get("provider"))
     if not _key_present() and _first_run_setup("Welcome! No API key configured yet"):
         cfg = load_config()          # the wizard just wrote ~/.sliceagent/config.toml — pick it up
@@ -468,6 +483,18 @@ def main() -> None:
         ans = input(f"  ⚠ allow {name} {str(detail)[:60]!r}? ({reason}) [y]es/[n]o/[a]lways: ").strip().lower()
         return {"y": "yes", "yes": "yes", "a": "always", "always": "always"}.get(ans, "no")
 
+    def _live_pid():
+        """The configured provider the LIVE llm is actually bound to (endpoint+key match), or None.
+        Prefs must pin what's IN EFFECT, not the last menu pick — a typed `/model <name>` keeps the
+        endpoint, so blindly re-saving the old pin resurrected a dead endpoint+model pairing at boot."""
+        lbase = getattr(llm, "_base_url", "") or ""
+        lkey = getattr(llm.client, "api_key", None)
+        for p, t in (cfg.providers() or {}).items():
+            if isinstance(t, dict) and t.get("api_key") and t["api_key"] == lkey \
+                    and (t.get("base_url") or "") == lbase:
+                return p
+        return None
+
     def _handle_slash(line):  # TUI navigation palette — wired to existing session ops
         nonlocal cfg          # /config hot-reloads the config after the in-session wizard
         parts = line.split(maxsplit=1)
@@ -595,8 +622,9 @@ def main() -> None:
                             _kw = {"base_url": _tbl.get("base_url") or "", "api_key": _tbl["api_key"]}
                     llm.switch(model=_model, reasoning=_reasoning, **_kw)
                     _stats["model"] = llm.model
+                    # pin the provider ACTUALLY in effect (None DELETES a stale pin — see save_prefs)
                     save_prefs({"model": llm.model, "reasoning": llm.reasoning,
-                                **({"provider": _pid} if _pid else {})})
+                                "provider": _pid or _live_pid()})
                     note = _reasoning_note(llm)
                     _console.print(f"  ✓ model → [bold]{llm.model}[/]"
                                    + (f" @ [bold]{_pid}[/]" if _pid else "")
@@ -619,7 +647,9 @@ def main() -> None:
                     _console.print("  effort must be one of: fast | full | high | max"); return True
                 llm.switch(model=name, reasoning=eff)
                 _stats["model"] = llm.model
-                save_prefs({"model": llm.model, "reasoning": llm.reasoning})
+                # typed /model keeps the endpoint — re-resolve the pin against the LIVE binding so a
+                # stale provider pin can't resurrect the old endpoint under this model at next boot
+                save_prefs({"model": llm.model, "reasoning": llm.reasoning, "provider": _live_pid()})
                 note = _reasoning_note(llm)
                 _console.print(f"  ✓ model → [bold]{llm.model}[/]"
                                + (f" · reasoning [bold]{llm.reasoning}[/]" if eff else "")

{sliceagent-0.1.6 → sliceagent-0.1.8}/src/sliceagent/config.py

@@ -52,12 +52,17 @@ def load_prefs() -> dict:
 
 
 def save_prefs(updates: dict) -> None:
-    """Merge non-empty `updates` into the prefs sidecar (atomic write). Best-effort; never raises."""
+    """Merge non-empty `updates` into the prefs sidecar (atomic write); an explicit None DELETES the
+    key (a stale `provider` pin must be removable — merge-only let an old endpoint pin resurrect at
+    the next boot under a model it doesn't serve). Best-effort; never raises."""
     try:
         import json
         path = _prefs_path()
         os.makedirs(os.path.dirname(path), exist_ok=True)
         cur = load_prefs()
+        for k, v in updates.items():
+            if v is None:
+                cur.pop(k, None)
         cur.update({k: v for k, v in updates.items() if v})
         tmp = path + ".tmp"
         with open(tmp, "w", encoding="utf-8") as f:

{sliceagent-0.1.6 → sliceagent-0.1.8}/src/sliceagent/llm.py

@@ -283,7 +283,13 @@ class OpenAILLM:
             ckw: dict = {"api_key": new_key}
             if new_base:
                 ckw["base_url"] = new_base
+            old_client = getattr(self, "client", None)
             self.client = OpenAI(http_client=http_client, timeout=timeout, max_retries=2, **ckw)
+            if old_client is not None:       # close the replaced connection pool — /model hops leaked fds
+                try:
+                    old_client.close()
+                except Exception:  # noqa: BLE001 — cleanup must never break the switch
+                    pass
             self._base_url = new_base or ""
             self._drop_reasoning_effort = False
         if model:

{sliceagent-0.1.6 → sliceagent-0.1.8}/src/sliceagent/onboarding.py

@@ -140,10 +140,42 @@ def _read_config(path: str) -> dict:
     try:
         with open(path, "rb") as f:
             return tomllib.load(f)
-    except (OSError, tomllib.TOMLDecodeError):
+    except (OSError, tomllib.TOMLDecodeError, UnicodeDecodeError, ValueError):
+        # sibling parity with config.py:_read_toml — a non-UTF-8 or malformed config must DEGRADE, not
+        # crash `sliceagent config` / `config --use` / the init wizard with a traceback.
         return {}
 
 
+def _backup_if_corrupt(path: str) -> "str | None":
+    """A rewrite reads the existing config to MERGE into; but _read_config returns {} for BOTH 'missing'
+    and 'unparseable', so a rewrite over a corrupt file would silently ERASE every provider key + section
+    it couldn't parse. Guard the writers: if `path` exists and is non-empty but does NOT parse, move it
+    aside to a non-clobbering .bak first (the keys survive, recoverable) and return the backup path; else
+    None (absent / empty / valid — nothing to protect)."""
+    import tomllib
+    try:
+        with open(path, "rb") as f:
+            raw = f.read()
+    except OSError:
+        return None
+    if not raw.strip():
+        return None
+    try:
+        tomllib.loads(raw.decode("utf-8"))
+        return None                                  # parses fine → a normal merge is safe
+    except (tomllib.TOMLDecodeError, UnicodeDecodeError, ValueError):
+        pass
+    bak, n = path + ".bak", 0
+    while os.path.exists(bak):                        # never clobber an earlier backup
+        n += 1
+        bak = f"{path}.bak.{n}"
+    try:
+        os.replace(path, bak)
+        return bak
+    except OSError:
+        return None
+
+
 def _atomic_write(path: str, body: str) -> None:
     """ATOMIC 0600 write (the file holds an API key — never leave it half-written): write a temp in the same
     dir, fsync, then os.replace(); on ANY failure remove the temp so no key-bearing fragment is left behind."""
@@ -170,8 +202,10 @@ def _atomic_write(path: str, body: str) -> None:
                 pass
 
 
-def _save_provider(path: str, *, pid: str, model: str, api_key: str, base_url: str) -> None:
-    """Merge a provider into the config: add/update [providers.<pid>], set it as the default, keep the rest."""
+def _save_provider(path: str, *, pid: str, model: str, api_key: str, base_url: str) -> "str | None":
+    """Merge a provider into the config: add/update [providers.<pid>], set it as the default, keep the rest.
+    Returns the path of a backup taken when the existing config was unparseable (else None)."""
+    bak = _backup_if_corrupt(path)                   # never silently erase keys in a corrupt config
     data = _read_config(path)
     provs = data.setdefault("providers", {})
     if not isinstance(provs, dict):              # a corrupt non-dict providers must not crash on provs[pid]=
@@ -186,6 +220,7 @@ def _save_provider(path: str, *, pid: str, model: str, api_key: str, base_url: s
     agent["default_provider"] = pid
     agent["model"] = model                                     # keep top-level model in sync (back-compat)
     _atomic_write(path, _emit_toml(data))
+    return bak
 
 
 def _test_key(model: str, api_key: str, base_url: str, llm_factory) -> tuple[bool, str]:
@@ -250,8 +285,20 @@ def run_init(*, inp=input, getpw=None, llm_factory=None, home=None) -> int:
             for k in keys:
                 _id, label, _base, model0 = PROVIDERS[k]
                 out(f"    {k}. {label}" + (f"  ({model0})" if model0 else ""))
-            choice = inp("  > ").strip() or "1"
-        pid, label, base_url, model = PROVIDERS.get(choice, PROVIDERS["1"])
+            # an unrecognized answer must NOT silently become provider 1 (a typed "openai" used to
+            # configure OpenRouter without a word) — accept a number OR a provider id, else re-ask.
+            choice = None
+            for _attempt in range(3):
+                raw = inp("  > ").strip() or "1"
+                if raw in PROVIDERS:
+                    choice = raw; break
+                byname = next((k for k in keys if PROVIDERS[k][0] == raw.lower()), None)
+                if byname:
+                    choice = byname; break
+                out(f"  not a valid choice: {raw!r} — enter 1-{len(PROVIDERS)} or a provider name")
+            if choice is None:
+                out("  no valid choice — aborting."); return 1
+        pid, label, base_url, model = PROVIDERS[choice]
         if pid == "custom":
             base_url = inp("  Base URL (OpenAI-compatible, e.g. https://host/v1): ").strip()
         # RE-CONFIGURING an ALREADY-SAVED provider (re-running `sliceagent init` to update the model,
@@ -303,7 +350,9 @@ def run_init(*, inp=input, getpw=None, llm_factory=None, home=None) -> int:
         if cont not in ("y", "yes"):
             out("  Not saved. Re-run `sliceagent init` to try again."); return 1
 
-    _save_provider(path, pid=pid, model=model, api_key=key, base_url=base_url)
+    bak = _save_provider(path, pid=pid, model=model, api_key=key, base_url=base_url)
+    if bak:
+        out(f"  ⚠ the existing config didn't parse — moved it to {bak} (its keys are recoverable there).")
     out(f"\n  Saved provider '{pid}' (model {model}) → {path} (0600)")
     out("  Ready. Run:  sliceagent\n")
     return 0
@@ -356,7 +405,8 @@ def run_config(argv=None, *, home=None, env=None) -> int:
         out("  providers (* = default · `config --use <id>` to switch):")
         for pid, p in provs.items():
             mark = "*" if pid == default else " "
-            out(f"    {mark} {pid}  ({(p or {}).get('model', '?')})")
+            model = p.get("model", "?") if isinstance(p, dict) else "?"   # a scalar under [providers] must not crash
+            out(f"    {mark} {pid}  ({model})")
     out("  set values:")
     any_set = False
     for e in REGISTRY:

{sliceagent-0.1.6 → sliceagent-0.1.8}/src/sliceagent/policy.py

@@ -96,11 +96,30 @@ def ask_mutations(name: str, args: dict) -> Optional[ToolDecision]:
 # mode runs it without a confirm prompt. Deny-by-default: an unknown verb still asks. The catastrophic floor
 # (no_dangerous_commands) runs BEFORE this, so e.g. `cat /etc/passwd` is still denied.
 _RO_VERBS = frozenset((
-    "ls", "pwd", "cat", "head", "tail", "wc", "echo", "which", "type", "env", "printenv", "date",
+    "ls", "pwd", "cat", "head", "tail", "wc", "echo", "which", "type", "printenv", "date",
     "whoami", "hostname", "uname", "id", "groups", "tree", "stat", "file", "du", "df", "realpath",
-    "dirname", "basename", "grep", "rg", "egrep", "fgrep", "sort", "uniq", "nl", "cut", "column",
+    "dirname", "basename", "grep", "rg", "egrep", "fgrep", "sort", "nl", "cut", "column",
     "cksum", "md5", "md5sum", "sha1sum", "sha256sum", "true",
 ))
+# `env` and `uniq` were REMOVED from the allowlist: `env <program>` executes an arbitrary program, and
+# `uniq [IN] OUT` OVERWRITES its optional second positional — neither is provably read-only, so they now
+# take the normal confirm path. A few remaining allowlisted verbs stay read-only ONLY without a specific
+# WRITE/EXEC option; deny-by-default when that option is present (verb-scoped so read-only siblings like
+# `du -s` / `grep -o` keep auto-running). Value-taking flags match `-o`, `-o=…`, `-oFILE`, `--output=…`.
+_UNSAFE_OPTS = {
+    "sort": ("-o", "--output"),   # -o FILE / --output=FILE overwrite a file
+    "date": ("-s", "--set"),      # set the system clock (a mutation)
+    "tree": ("-o",),              # -o FILE writes the listing to a file
+}
+
+
+def _has_unsafe_opt(verb: str, toks: list) -> bool:
+    bad = _UNSAFE_OPTS.get(verb, ())
+    for t in toks[1:]:
+        for b in bad:
+            if t == b or t.startswith(b + "=") or (len(b) == 2 and len(t) > 2 and t.startswith(b)):
+                return True
+    return False
 # git subcommands with NO mutating form (excludes branch/tag/config/remote/stash/reflog, which can write).
 _RO_GIT_SUB = frozenset((
     "status", "log", "diff", "show", "rev-parse", "ls-files", "ls-tree", "describe", "blame",
@@ -127,10 +146,15 @@ def _is_readonly_command(cmd: str) -> bool:
     verb = os.path.basename(toks[0])
     if verb == "git":
         sub = next((t for t in toks[1:] if not t.startswith("-")), "")
-        return sub in _RO_GIT_SUB
+        if sub not in _RO_GIT_SUB:
+            return False
+        # `git grep --open-files-in-pager[=<cmd>]` / `-O[<cmd>]` runs a PAGER program (arbitrary exec).
+        if sub == "grep" and any(t.startswith("--open-files-in-pager") or t.startswith("-O") for t in toks):
+            return False
+        return True
     if verb == "find":
         return not any(t in _FIND_MUTATORS for t in toks)
-    return verb in _RO_VERBS
+    return verb in _RO_VERBS and not _has_unsafe_opt(verb, toks)
 
 
 def ask_commands(name: str, args: dict) -> Optional[ToolDecision]:

{sliceagent-0.1.6 → sliceagent-0.1.8}/src/sliceagent/tui.py

@@ -849,8 +849,7 @@ def _model_candidates(llm, cfg):
                     out.append((m, pid, pid))
         out.sort(key=lambda t: (t[1], t[0]))
         if all(m != llm.model for m, _, _ in out):   # an env-overridden current model still shows first
-            base = getattr(llm, "_base_url", "")
-            out.insert(0, (llm.model, capability(llm.model, base).family, None))
+            out.insert(0, (llm.model, "current (env)", None))  # not a configured provider — label honestly
     else:
         known = ["gpt-5.5", "gpt-5", "gpt-5-mini", "o3", "deepseek-chat", "kimi-k2-0905-preview",
                  "claude-sonnet-5"]
@@ -865,12 +864,16 @@ def _model_candidates(llm, cfg):
 
 def _reasoning_levels(model, base_url):
     """Reasoning levels valid for a model, derived from its capability (provider-aware). Effort-capable
-    models (gpt-5/o-series) expose all four; others only fast/full (high/max would degrade to default)."""
+    models (gpt-5/o-series) expose all four; OpenRouter exposes fast/full/high (its unified reasoning
+    object maps max→high, so offering max would be a lie); others only fast/full (high/max would
+    degrade to default)."""
     from .model_catalog import capability
     full4 = [("fast", "minimal reasoning — fastest, cheapest"),
              ("full", "provider default reasoning"),
              ("high", "deeper reasoning (effort=high, /v1/responses)"),
              ("max", "deepest reasoning (effort=xhigh)")]
+    if "openrouter" in (base_url or "").lower():   # unified reasoning object honors effort WITH tools
+        return full4[:2] + [("high", "deeper reasoning (unified reasoning, effort=high)")]
     if capability(model, base_url).supports_reasoning_effort:
         return full4
     return full4[:2]   # fast | full only — the model has no effort knob
@@ -889,7 +892,10 @@ def select_model_reasoning(llm, cfg, *, pt_input=None, pt_output=None):
     if pick is None:
         return None
     model, _grp, pid = cands[pick]
-    base = getattr(llm, "_base_url", "") if model == llm.model else ""
+    if pid:   # the pick will REBIND to this provider — offer the levels ITS endpoint supports
+        base = ((cfg.providers() or {}).get(pid) or {}).get("base_url") or ""
+    else:
+        base = getattr(llm, "_base_url", "") if model == llm.model else ""
     levels = _reasoning_levels(model, base)
     lvl_rows = [(name, desc) for name, desc in levels]
     lvl_cur = next((i for i, (n, _) in enumerate(levels) if n == llm.reasoning), -1)

{sliceagent-0.1.6 → sliceagent-0.1.8}/tests/test_bughunt_fixes.py

@@ -918,7 +918,10 @@ def cost_chart_renders_flat_vs_rising():
     import sys
     root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
     sys.path.insert(0, os.path.join(root, "evals"))
-    import realenv_multiturn as rem                                  # importable WITHOUT the heavy swebench dep
+    try:
+        import realenv_multiturn as rem                              # importable WITHOUT the heavy swebench dep
+    except ModuleNotFoundError:
+        return  # evals/ is a local-only dev tree, not shipped in the installed package (CI) — skip, don't fail
     rows = [{"turn": i, "peak_in": 6000, "transcript": 6000 * i} for i in range(1, 13)]
     chart = rem.render_cost_chart(rows)
     assert "sliceagent" in chart and "transcript" in chart and "12×" in chart, chart