sliceagent 0.1.7__tar.gz → 0.1.9__tar.gz

{sliceagent-0.1.7 → sliceagent-0.1.9}/CHANGELOG.md

@@ -5,6 +5,52 @@ this project aims for [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.1.9] — 2026-07-03
+
+Bug-hunt round 2 (deep-core lenses, full 3-vote adversarial verify). Five confirmed fixes.
+
+### Security
+- The durable debug log's `_scrub_args` now redacts secrets in NESTED dict/list tool arguments
+  (e.g. an MCP call's `{config:{api_key:…}}` or `{headers:{Authorization:…}}`) — top-level-only
+  redaction leaked them to `~/.sliceagent/logs/**/durable-log.jsonl` in plaintext.
+- `AGENT_PROXY=none` (documented "force a DIRECT connection") now truly forces direct: the httpx
+  client is built with `trust_env=False`, so an ambient `HTTPS_PROXY` can no longer silently route
+  your API traffic through a proxy you told sliceagent to bypass (both first build and `/model` hops).
+
+### Fixed
+- `str_replace`/`edit_file` no longer flip a whole file to CRLF when it's mostly-LF but contains a
+  single embedded `\r\n` (a byte literal, an HTTP fixture, a merge artifact). CRLF is now detected by
+  DOMINANCE, not mere presence — uniformly-CRLF Windows files are still preserved.
+- Session-end consolidation no longer crashes (and silently discards ALL of a session's promoted
+  lessons/skills) when the episodic log contains one malformed record.
+- `/undo` and `/cwd` (and `/plugins`) no longer corrupt output or crash Rich with a MarkupError when a
+  path contains brackets — e.g. a Next.js `app/[id]/page.tsx` route or `~/proj/[slug]`.
+
+## [0.1.8] — 2026-07-02
+
+Launch-day bug-hunt round: a security fix plus config-robustness and /model correctness.
+
+### Security
+- `run_command` in the default *teenager* mode no longer auto-runs exec/write commands disguised as
+  "read-only": `env <program>`, `sort -o FILE`, `date -s`, `tree -o FILE`, `uniq IN OUT`, and
+  `git grep --open-files-in-pager` now take the confirm path (arbitrary code-exec / file-overwrite
+  confirm-bypass). Read-only siblings like `du -s` / `grep -o` still auto-run.
+
+### Fixed
+- Boot no longer cross-wires a prefs-pinned provider's key with the DEFAULT provider's endpoint (an
+  env `gpt-5.5` @ OpenAI pin on a DeepSeek-default config used to 401 every call on relaunch).
+- A prefs `provider`/model pin whose `[providers.<id>]` table was removed from config.toml is now
+  dropped at boot instead of forcing a model onto the wrong endpoint.
+- The wizard no longer silently ERASES other providers' API keys when config.toml is unparseable —
+  the old file is moved to a non-clobbering `.bak` first (keys recoverable).
+- `sliceagent config` / `config --use` / the init wizard no longer crash on a non-UTF-8 config.toml
+  or a scalar value under `[providers]` (they degrade).
+- `llm.switch()` (a `/model` provider hop) closes the replaced HTTP client — no more fd leak per hop.
+- The `/model` reasoning menu offers `high` (not a misleading `max`) for OpenRouter models, and offers
+  the levels the *target* provider supports when the pick rebinds the endpoint.
+- The wizard's typed provider fallback rejects an unknown choice instead of silently configuring
+  OpenRouter.
+
 ## [0.1.7] — 2026-07-02
 
 ### Fixed

{sliceagent-0.1.7 → sliceagent-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sliceagent
-Version: 0.1.7
+Version: 0.1.9
 Summary: A coding agent with a new context-engineering framework: bounded, deterministic, reconstructed context (slice architecture) — built for long-horizon work.
 Author: TT-Wang
 License-Expression: MIT

{sliceagent-0.1.7 → sliceagent-0.1.9}/src/sliceagent/__init__.py

@@ -1,3 +1,3 @@
 """sliceagent — a memory-native coding agent (deterministic, bounded, reconstructed context)."""
 
-__version__ = "0.1.7"
+__version__ = "0.1.9"

{sliceagent-0.1.7 → sliceagent-0.1.9}/src/sliceagent/cli.py

@@ -50,7 +50,15 @@ def log_sink(root: str = ".", path: str | None = None):
     path = path or os.path.join(state_dir("logs", root_key(root)), "durable-log.jsonl")
 
     def _scrub_args(args: dict) -> dict:          # redact string values (edit_file content, inline tokens)
-        return {k: (redact_text(v) if isinstance(v, str) else v) for k, v in (args or {}).items()}
+        def _rec(v):                              # RECURSE — a secret nested in a dict/list arg (e.g. an
+            if isinstance(v, str):                # MCP tool's {config:{api_key:…}} / {headers:{Authorization:…}})
+                return redact_text(v)             # must not reach the on-disk log in plaintext (top-level-only
+            if isinstance(v, dict):               # redaction leaked it; sibling hippocampus._clamp already recurses)
+                return {k: _rec(x) for k, x in v.items()}
+            if isinstance(v, (list, tuple)):
+                return [_rec(x) for x in v]
+            return v
+        return _rec(args or {})
 
     def sink(e: Event) -> None:
         rec = None
@@ -151,6 +159,21 @@ def _ws_name(path: str) -> str:
     return "~" if p == os.path.realpath(os.path.expanduser("~")) else (os.path.basename(p) or p)
 
 
+def _env_from_config(c, pid: str | None = None) -> None:
+    """Populate LLM_API_KEY/LLM_BASE_URL from config (ENV still wins). A prefs-pinned provider `pid`
+    binds AS A UNIT: its key with ITS OWN endpoint — an absent base_url means the SDK default (OpenAI),
+    NOT the default provider's base_url (that fallback cross-wired an openai key onto the deepseek
+    endpoint after `/model`-hop + restart when default_provider pointed elsewhere)."""
+    tbl = (c.providers() or {}).get(pid) if pid else None
+    if isinstance(tbl, dict) and tbl.get("api_key"):
+        key, base = tbl["api_key"], tbl.get("base_url") or ""
+    else:                                    # no/unusable pin → the default provider's own pairing
+        key, base = c.api_key, c.base_url
+    for _env, _val in (("LLM_API_KEY", key), ("LLM_BASE_URL", base)):
+        if not os.environ.get(_env) and _val:
+            os.environ[_env] = _val
+
+
 def main() -> None:
     # subcommands (onboarding / discovery) are handled BEFORE any key gate, so `sliceagent init` runs on a
     # machine with nothing configured yet. A bare `sliceagent` (or one with non-subcommand args) falls through.
@@ -165,14 +188,6 @@ def main() -> None:
     from .config import load_config, load_prefs
     _boot_prefs = load_prefs()   # the last /model choice may pin a PROVIDER (endpoint+key), not just a model
 
-    def _env_from_config(c, pid: str | None = None) -> None:
-        tbl = (c.providers() or {}).get(pid) if pid else None
-        key = (tbl or {}).get("api_key") or c.api_key
-        base = ((tbl or {}).get("base_url") if tbl and tbl.get("api_key") else None) or c.base_url
-        for _env, _val in (("LLM_API_KEY", key), ("LLM_BASE_URL", base)):
-            if not os.environ.get(_env) and _val:
-                os.environ[_env] = _val
-
     def _key_present() -> bool:
         return bool(os.environ.get("LLM_API_KEY") or os.environ.get("OPENAI_API_KEY")
                     or os.environ.get("ANTHROPIC_API_KEY") or os.environ.get("DEEPSEEK_API_KEY")
@@ -189,6 +204,14 @@ def main() -> None:
         return run_init() == 0
 
     cfg = load_config()
+    # A prefs `provider` pin whose [providers.<id>] table was since removed from config.toml is STALE:
+    # its key/endpoint already fall back to the default provider (see _env_from_config), but its pinned
+    # MODEL would still win at the resolution below and get sent to the wrong endpoint (model_not_found
+    # every turn). Drop the whole stale pin so model/endpoint resolve together from the live config.
+    if _boot_prefs.get("provider") and _boot_prefs["provider"] not in (cfg.providers() or {}):
+        from .config import save_prefs as _sp
+        _sp({"provider": None, "model": None})       # None DELETES (see save_prefs)
+        _boot_prefs.pop("provider", None); _boot_prefs.pop("model", None)
     _env_from_config(cfg, _boot_prefs.get("provider"))
     if not _key_present() and _first_run_setup("Welcome! No API key configured yet"):
         cfg = load_config()          # the wizard just wrote ~/.sliceagent/config.toml — pick it up
@@ -468,6 +491,18 @@ def main() -> None:
         ans = input(f"  ⚠ allow {name} {str(detail)[:60]!r}? ({reason}) [y]es/[n]o/[a]lways: ").strip().lower()
         return {"y": "yes", "yes": "yes", "a": "always", "always": "always"}.get(ans, "no")
 
+    def _live_pid():
+        """The configured provider the LIVE llm is actually bound to (endpoint+key match), or None.
+        Prefs must pin what's IN EFFECT, not the last menu pick — a typed `/model <name>` keeps the
+        endpoint, so blindly re-saving the old pin resurrected a dead endpoint+model pairing at boot."""
+        lbase = getattr(llm, "_base_url", "") or ""
+        lkey = getattr(llm.client, "api_key", None)
+        for p, t in (cfg.providers() or {}).items():
+            if isinstance(t, dict) and t.get("api_key") and t["api_key"] == lkey \
+                    and (t.get("base_url") or "") == lbase:
+                return p
+        return None
+
     def _handle_slash(line):  # TUI navigation palette — wired to existing session ops
         nonlocal cfg          # /config hot-reloads the config after the in-session wizard
         parts = line.split(maxsplit=1)
@@ -539,12 +574,15 @@ def main() -> None:
                 except Exception:
                     _console.print(f"  no such topic: {arg}", markup=False)
         elif cmd == "/undo":
-            _console.print("  " + base_tools.undo_last())   # revert the last file edit
+            # markup=False: undo_last() embeds the edited file PATH; a Next.js-style '[id]'/'[...slug]'
+            # segment is parsed as a Rich tag → corrupted output or a MarkupError crash.
+            _console.print("  " + base_tools.undo_last(), markup=False)   # revert the last file edit
         elif cmd == "/plugins":
             tools = sorted(e.name for e in base_tools.registry._tools.values()
                            if getattr(e, "source", "") == "plugin")
-            _console.print(f"  plugin dirs: {', '.join(cfg.plugin_dirs) or '(none configured)'}")
-            _console.print(f"  plugin tools ({len(tools)}): {', '.join(tools) or '(none loaded)'}")
+            # markup=False: plugin dirs are filesystem PATHS that may contain '[...]' (same Rich-tag hazard)
+            _console.print(f"  plugin dirs: {', '.join(cfg.plugin_dirs) or '(none configured)'}", markup=False)
+            _console.print(f"  plugin tools ({len(tools)}): {', '.join(tools) or '(none loaded)'}", markup=False)
         elif cmd == "/mcp":
             configured = list(cfg.mcp_servers.keys())
             mtools = sorted(e.name for e in base_tools.registry._tools.values()
@@ -595,8 +633,9 @@ def main() -> None:
                             _kw = {"base_url": _tbl.get("base_url") or "", "api_key": _tbl["api_key"]}
                     llm.switch(model=_model, reasoning=_reasoning, **_kw)
                     _stats["model"] = llm.model
+                    # pin the provider ACTUALLY in effect (None DELETES a stale pin — see save_prefs)
                     save_prefs({"model": llm.model, "reasoning": llm.reasoning,
-                                **({"provider": _pid} if _pid else {})})
+                                "provider": _pid or _live_pid()})
                     note = _reasoning_note(llm)
                     _console.print(f"  ✓ model → [bold]{llm.model}[/]"
                                    + (f" @ [bold]{_pid}[/]" if _pid else "")
@@ -619,7 +658,9 @@ def main() -> None:
                     _console.print("  effort must be one of: fast | full | high | max"); return True
                 llm.switch(model=name, reasoning=eff)
                 _stats["model"] = llm.model
-                save_prefs({"model": llm.model, "reasoning": llm.reasoning})
+                # typed /model keeps the endpoint — re-resolve the pin against the LIVE binding so a
+                # stale provider pin can't resurrect the old endpoint under this model at next boot
+                save_prefs({"model": llm.model, "reasoning": llm.reasoning, "provider": _live_pid()})
                 note = _reasoning_note(llm)
                 _console.print(f"  ✓ model → [bold]{llm.model}[/]"
                                + (f" · reasoning [bold]{llm.reasoning}[/]" if eff else "")
@@ -640,7 +681,7 @@ def main() -> None:
             if not arg:
                 _console.print(f"  workspace: {base_tools.root()}", markup=False)
             else:
-                _console.print("  ✓ " + _reroot(arg))
+                _console.print("  ✓ " + _reroot(arg), markup=False)   # path may contain '[...]' → Rich markup
         else:
             _console.print(f"  unknown command {cmd} (/help)", markup=False)
         return True

{sliceagent-0.1.7 → sliceagent-0.1.9}/src/sliceagent/config.py

@@ -52,12 +52,17 @@ def load_prefs() -> dict:
 
 
 def save_prefs(updates: dict) -> None:
-    """Merge non-empty `updates` into the prefs sidecar (atomic write). Best-effort; never raises."""
+    """Merge non-empty `updates` into the prefs sidecar (atomic write); an explicit None DELETES the
+    key (a stale `provider` pin must be removable — merge-only let an old endpoint pin resurrect at
+    the next boot under a model it doesn't serve). Best-effort; never raises."""
     try:
         import json
         path = _prefs_path()
         os.makedirs(os.path.dirname(path), exist_ok=True)
         cur = load_prefs()
+        for k, v in updates.items():
+            if v is None:
+                cur.pop(k, None)
         cur.update({k: v for k, v in updates.items() if v})
         tmp = path + ".tmp"
         with open(tmp, "w", encoding="utf-8") as f:

{sliceagent-0.1.7 → sliceagent-0.1.9}/src/sliceagent/llm.py

@@ -208,7 +208,11 @@ class OpenAILLM:
                               or os.environ.get("HTTPS_PROXY") or os.environ.get("HTTP_PROXY"))
         use_proxy = bool(proxy) and proxy != "none"
         self.proxy_used = proxy if use_proxy else "direct"   # exposed so the CLI can announce the route (A4)
-        http_client = httpx.Client(proxy=proxy, timeout=timeout) if use_proxy else httpx.Client(timeout=timeout)
+        # trust_env=False: the proxy is resolved EXPLICITLY above (AGENT_PROXY/HTTPS_PROXY/HTTP_PROXY →
+        # _choose_proxy), so httpx must NOT ALSO auto-read ambient proxy env — otherwise AGENT_PROXY=none
+        # ("force direct") still routes through an ambient HTTPS_PROXY (httpx defaults trust_env=True).
+        http_client = (httpx.Client(proxy=proxy, timeout=timeout, trust_env=False) if use_proxy
+                       else httpx.Client(timeout=timeout, trust_env=False))
 
         # Enforce the request timeout at the SDK layer too. The openai SDK applies its OWN per-request
         # timeout (default ~600s) which OVERRIDES the httpx client's, so without passing it here a
@@ -278,12 +282,18 @@ class OpenAILLM:
             use_proxy = bool(proxy) and proxy != "none"
             self.proxy_used = proxy if use_proxy else "direct"
             timeout = getattr(self, "_timeout", 60.0)
-            http_client = (httpx.Client(proxy=proxy, timeout=timeout) if use_proxy
-                           else httpx.Client(timeout=timeout))
+            http_client = (httpx.Client(proxy=proxy, timeout=timeout, trust_env=False) if use_proxy
+                           else httpx.Client(timeout=timeout, trust_env=False))   # explicit proxy only (see __init__)
             ckw: dict = {"api_key": new_key}
             if new_base:
                 ckw["base_url"] = new_base
+            old_client = getattr(self, "client", None)
             self.client = OpenAI(http_client=http_client, timeout=timeout, max_retries=2, **ckw)
+            if old_client is not None:       # close the replaced connection pool — /model hops leaked fds
+                try:
+                    old_client.close()
+                except Exception:  # noqa: BLE001 — cleanup must never break the switch
+                    pass
             self._base_url = new_base or ""
             self._drop_reasoning_effort = False
         if model:

{sliceagent-0.1.7 → sliceagent-0.1.9}/src/sliceagent/neocortex.py

@@ -87,6 +87,8 @@ def _is_secret(text: str) -> bool:
 def _by_task(records: list[dict]) -> list[list[dict]]:
     groups: dict[str, list[dict]] = {}
     for r in records:
+        if not isinstance(r, dict):      # a malformed episodic line (null/list/partial write, old schema)
+            continue                     # must not crash consolidation → silently DISCARD ALL lessons this session
         groups.setdefault(r.get("task_id", ""), []).append(r)
     return [sorted(g, key=lambda r: r.get("turn", 0)) for g in groups.values()]
 
@@ -98,7 +100,7 @@ def promote_episodes(records: list[dict]) -> list[dict]:
     # pass 1: collect the corrective pitfall of each task + count signatures (frequency, #4)
     cand = []
     for recs in _by_task(records):
-        rmeta = [r.get("record", {}) for r in recs]
+        rmeta = [(r.get("record") if isinstance(r.get("record"), dict) else {}) for r in recs]  # {"record": null} → {} (not None)
         had_fail = any(m.get("meta", {}).get("failing") for m in rmeta)
         last = rmeta[-1].get("meta", {})
         if not (had_fail and last.get("stop_reason") == "end_turn" and not last.get("failing")):
@@ -222,7 +224,7 @@ def promote_procedures(records: list[dict], *, min_actions: int = PROC_MIN_ACTIO
     EverOS rule), capped. Pure. Returns {kind, name, description, steps, files, freq, tags}."""
     cand = []
     for recs in _by_task(records):
-        rmeta = [r.get("record", {}) for r in recs]
+        rmeta = [(r.get("record") if isinstance(r.get("record"), dict) else {}) for r in recs]  # {"record": null} → {} (not None)
         if any(m.get("meta", {}).get("failing") for m in rmeta):
             continue                                   # corrective → a fact, not a procedure
         last = rmeta[-1].get("meta", {})

{sliceagent-0.1.7 → sliceagent-0.1.9}/src/sliceagent/onboarding.py

@@ -140,10 +140,42 @@ def _read_config(path: str) -> dict:
     try:
         with open(path, "rb") as f:
             return tomllib.load(f)
-    except (OSError, tomllib.TOMLDecodeError):
+    except (OSError, tomllib.TOMLDecodeError, UnicodeDecodeError, ValueError):
+        # sibling parity with config.py:_read_toml — a non-UTF-8 or malformed config must DEGRADE, not
+        # crash `sliceagent config` / `config --use` / the init wizard with a traceback.
         return {}
 
 
+def _backup_if_corrupt(path: str) -> "str | None":
+    """A rewrite reads the existing config to MERGE into; but _read_config returns {} for BOTH 'missing'
+    and 'unparseable', so a rewrite over a corrupt file would silently ERASE every provider key + section
+    it couldn't parse. Guard the writers: if `path` exists and is non-empty but does NOT parse, move it
+    aside to a non-clobbering .bak first (the keys survive, recoverable) and return the backup path; else
+    None (absent / empty / valid — nothing to protect)."""
+    import tomllib
+    try:
+        with open(path, "rb") as f:
+            raw = f.read()
+    except OSError:
+        return None
+    if not raw.strip():
+        return None
+    try:
+        tomllib.loads(raw.decode("utf-8"))
+        return None                                  # parses fine → a normal merge is safe
+    except (tomllib.TOMLDecodeError, UnicodeDecodeError, ValueError):
+        pass
+    bak, n = path + ".bak", 0
+    while os.path.exists(bak):                        # never clobber an earlier backup
+        n += 1
+        bak = f"{path}.bak.{n}"
+    try:
+        os.replace(path, bak)
+        return bak
+    except OSError:
+        return None
+
+
 def _atomic_write(path: str, body: str) -> None:
     """ATOMIC 0600 write (the file holds an API key — never leave it half-written): write a temp in the same
     dir, fsync, then os.replace(); on ANY failure remove the temp so no key-bearing fragment is left behind."""
@@ -170,8 +202,10 @@ def _atomic_write(path: str, body: str) -> None:
                 pass
 
 
-def _save_provider(path: str, *, pid: str, model: str, api_key: str, base_url: str) -> None:
-    """Merge a provider into the config: add/update [providers.<pid>], set it as the default, keep the rest."""
+def _save_provider(path: str, *, pid: str, model: str, api_key: str, base_url: str) -> "str | None":
+    """Merge a provider into the config: add/update [providers.<pid>], set it as the default, keep the rest.
+    Returns the path of a backup taken when the existing config was unparseable (else None)."""
+    bak = _backup_if_corrupt(path)                   # never silently erase keys in a corrupt config
     data = _read_config(path)
     provs = data.setdefault("providers", {})
     if not isinstance(provs, dict):              # a corrupt non-dict providers must not crash on provs[pid]=
@@ -186,6 +220,7 @@ def _save_provider(path: str, *, pid: str, model: str, api_key: str, base_url: s
     agent["default_provider"] = pid
     agent["model"] = model                                     # keep top-level model in sync (back-compat)
     _atomic_write(path, _emit_toml(data))
+    return bak
 
 
 def _test_key(model: str, api_key: str, base_url: str, llm_factory) -> tuple[bool, str]:
@@ -250,8 +285,20 @@ def run_init(*, inp=input, getpw=None, llm_factory=None, home=None) -> int:
             for k in keys:
                 _id, label, _base, model0 = PROVIDERS[k]
                 out(f"    {k}. {label}" + (f"  ({model0})" if model0 else ""))
-            choice = inp("  > ").strip() or "1"
-        pid, label, base_url, model = PROVIDERS.get(choice, PROVIDERS["1"])
+            # an unrecognized answer must NOT silently become provider 1 (a typed "openai" used to
+            # configure OpenRouter without a word) — accept a number OR a provider id, else re-ask.
+            choice = None
+            for _attempt in range(3):
+                raw = inp("  > ").strip() or "1"
+                if raw in PROVIDERS:
+                    choice = raw; break
+                byname = next((k for k in keys if PROVIDERS[k][0] == raw.lower()), None)
+                if byname:
+                    choice = byname; break
+                out(f"  not a valid choice: {raw!r} — enter 1-{len(PROVIDERS)} or a provider name")
+            if choice is None:
+                out("  no valid choice — aborting."); return 1
+        pid, label, base_url, model = PROVIDERS[choice]
         if pid == "custom":
             base_url = inp("  Base URL (OpenAI-compatible, e.g. https://host/v1): ").strip()
         # RE-CONFIGURING an ALREADY-SAVED provider (re-running `sliceagent init` to update the model,
@@ -303,7 +350,9 @@ def run_init(*, inp=input, getpw=None, llm_factory=None, home=None) -> int:
         if cont not in ("y", "yes"):
             out("  Not saved. Re-run `sliceagent init` to try again."); return 1
 
-    _save_provider(path, pid=pid, model=model, api_key=key, base_url=base_url)
+    bak = _save_provider(path, pid=pid, model=model, api_key=key, base_url=base_url)
+    if bak:
+        out(f"  ⚠ the existing config didn't parse — moved it to {bak} (its keys are recoverable there).")
     out(f"\n  Saved provider '{pid}' (model {model}) → {path} (0600)")
     out("  Ready. Run:  sliceagent\n")
     return 0
@@ -356,7 +405,8 @@ def run_config(argv=None, *, home=None, env=None) -> int:
         out("  providers (* = default · `config --use <id>` to switch):")
         for pid, p in provs.items():
             mark = "*" if pid == default else " "
-            out(f"    {mark} {pid}  ({(p or {}).get('model', '?')})")
+            model = p.get("model", "?") if isinstance(p, dict) else "?"   # a scalar under [providers] must not crash
+            out(f"    {mark} {pid}  ({model})")
     out("  set values:")
     any_set = False
     for e in REGISTRY:

{sliceagent-0.1.7 → sliceagent-0.1.9}/src/sliceagent/policy.py

@@ -96,11 +96,30 @@ def ask_mutations(name: str, args: dict) -> Optional[ToolDecision]:
 # mode runs it without a confirm prompt. Deny-by-default: an unknown verb still asks. The catastrophic floor
 # (no_dangerous_commands) runs BEFORE this, so e.g. `cat /etc/passwd` is still denied.
 _RO_VERBS = frozenset((
-    "ls", "pwd", "cat", "head", "tail", "wc", "echo", "which", "type", "env", "printenv", "date",
+    "ls", "pwd", "cat", "head", "tail", "wc", "echo", "which", "type", "printenv", "date",
     "whoami", "hostname", "uname", "id", "groups", "tree", "stat", "file", "du", "df", "realpath",
-    "dirname", "basename", "grep", "rg", "egrep", "fgrep", "sort", "uniq", "nl", "cut", "column",
+    "dirname", "basename", "grep", "rg", "egrep", "fgrep", "sort", "nl", "cut", "column",
     "cksum", "md5", "md5sum", "sha1sum", "sha256sum", "true",
 ))
+# `env` and `uniq` were REMOVED from the allowlist: `env <program>` executes an arbitrary program, and
+# `uniq [IN] OUT` OVERWRITES its optional second positional — neither is provably read-only, so they now
+# take the normal confirm path. A few remaining allowlisted verbs stay read-only ONLY without a specific
+# WRITE/EXEC option; deny-by-default when that option is present (verb-scoped so read-only siblings like
+# `du -s` / `grep -o` keep auto-running). Value-taking flags match `-o`, `-o=…`, `-oFILE`, `--output=…`.
+_UNSAFE_OPTS = {
+    "sort": ("-o", "--output"),   # -o FILE / --output=FILE overwrite a file
+    "date": ("-s", "--set"),      # set the system clock (a mutation)
+    "tree": ("-o",),              # -o FILE writes the listing to a file
+}
+
+
+def _has_unsafe_opt(verb: str, toks: list) -> bool:
+    bad = _UNSAFE_OPTS.get(verb, ())
+    for t in toks[1:]:
+        for b in bad:
+            if t == b or t.startswith(b + "=") or (len(b) == 2 and len(t) > 2 and t.startswith(b)):
+                return True
+    return False
 # git subcommands with NO mutating form (excludes branch/tag/config/remote/stash/reflog, which can write).
 _RO_GIT_SUB = frozenset((
     "status", "log", "diff", "show", "rev-parse", "ls-files", "ls-tree", "describe", "blame",
@@ -127,10 +146,15 @@ def _is_readonly_command(cmd: str) -> bool:
     verb = os.path.basename(toks[0])
     if verb == "git":
         sub = next((t for t in toks[1:] if not t.startswith("-")), "")
-        return sub in _RO_GIT_SUB
+        if sub not in _RO_GIT_SUB:
+            return False
+        # `git grep --open-files-in-pager[=<cmd>]` / `-O[<cmd>]` runs a PAGER program (arbitrary exec).
+        if sub == "grep" and any(t.startswith("--open-files-in-pager") or t.startswith("-O") for t in toks):
+            return False
+        return True
     if verb == "find":
         return not any(t in _FIND_MUTATORS for t in toks)
-    return verb in _RO_VERBS
+    return verb in _RO_VERBS and not _has_unsafe_opt(verb, toks)
 
 
 def ask_commands(name: str, args: dict) -> Optional[ToolDecision]:

{sliceagent-0.1.7 → sliceagent-0.1.9}/src/sliceagent/tools.py

@@ -747,14 +747,20 @@ class LocalToolHost:
 
     @staticmethod
     def _detect_crlf(full: str) -> bool:
-        """True if the existing file uses Windows CRLF line endings (sample the head). Used to PRESERVE
+        """True if the existing file is DOMINANTLY Windows CRLF (sample the head). Used to PRESERVE
         line endings on edit: the model emits '\\n', and writing that to a CRLF file rewrites every line
-        ending — a huge spurious diff / corruption on Windows-authored repos."""
+        ending — a huge spurious diff / corruption on Windows-authored repos. DOMINANCE (not mere
+        presence): a mostly-LF file with one embedded '\\r\\n' (a byte literal, an HTTP fixture, a merge
+        artifact) must NOT be flipped whole-file to CRLF — while a uniformly-CRLF file with one stray LF
+        still counts as CRLF. crlf ≥ (bare-LF) covers both, and keeps the pinned uniform cases."""
         try:
             with open(full, "rb") as f:
-                return b"\r\n" in f.read(65536)
+                head = f.read(65536)
         except OSError:
             return False
+        crlf = head.count(b"\r\n")
+        lf_only = head.count(b"\n") - crlf          # LFs that are NOT part of a CRLF
+        return crlf > 0 and crlf >= lf_only
 
     @staticmethod
     def _preserve_eol(text: str, crlf: bool) -> str:

{sliceagent-0.1.7 → sliceagent-0.1.9}/src/sliceagent/tui.py

@@ -864,12 +864,16 @@ def _model_candidates(llm, cfg):
 
 def _reasoning_levels(model, base_url):
     """Reasoning levels valid for a model, derived from its capability (provider-aware). Effort-capable
-    models (gpt-5/o-series) expose all four; others only fast/full (high/max would degrade to default)."""
+    models (gpt-5/o-series) expose all four; OpenRouter exposes fast/full/high (its unified reasoning
+    object maps max→high, so offering max would be a lie); others only fast/full (high/max would
+    degrade to default)."""
     from .model_catalog import capability
     full4 = [("fast", "minimal reasoning — fastest, cheapest"),
              ("full", "provider default reasoning"),
              ("high", "deeper reasoning (effort=high, /v1/responses)"),
              ("max", "deepest reasoning (effort=xhigh)")]
+    if "openrouter" in (base_url or "").lower():   # unified reasoning object honors effort WITH tools
+        return full4[:2] + [("high", "deeper reasoning (unified reasoning, effort=high)")]
     if capability(model, base_url).supports_reasoning_effort:
         return full4
     return full4[:2]   # fast | full only — the model has no effort knob
@@ -888,7 +892,10 @@ def select_model_reasoning(llm, cfg, *, pt_input=None, pt_output=None):
     if pick is None:
         return None
     model, _grp, pid = cands[pick]
-    base = getattr(llm, "_base_url", "") if model == llm.model else ""
+    if pid:   # the pick will REBIND to this provider — offer the levels ITS endpoint supports
+        base = ((cfg.providers() or {}).get(pid) or {}).get("base_url") or ""
+    else:
+        base = getattr(llm, "_base_url", "") if model == llm.model else ""
     levels = _reasoning_levels(model, base)
     lvl_rows = [(name, desc) for name, desc in levels]
     lvl_cur = next((i for i, (n, _) in enumerate(levels) if n == llm.reasoning), -1)

{sliceagent-0.1.7 → sliceagent-0.1.9}/tests/test_bughunt_fixes.py

@@ -918,7 +918,10 @@ def cost_chart_renders_flat_vs_rising():
     import sys
     root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
     sys.path.insert(0, os.path.join(root, "evals"))
-    import realenv_multiturn as rem                                  # importable WITHOUT the heavy swebench dep
+    try:
+        import realenv_multiturn as rem                              # importable WITHOUT the heavy swebench dep
+    except ModuleNotFoundError:
+        return  # evals/ is a local-only dev tree, not shipped in the installed package (CI) — skip, don't fail
     rows = [{"turn": i, "peak_in": 6000, "transcript": 6000 * i} for i in range(1, 13)]
     chart = rem.render_cost_chart(rows)
     assert "sliceagent" in chart and "transcript" in chart and "12×" in chart, chart
@@ -1344,6 +1347,80 @@ def model_switch_warns_when_the_endpoint_cant_serve_it():
     assert "OpenAI" not in _reasoning_note(LLM("gpt-5.5", "", "high"))
 
 
+# ── Round 2 (2026-07-03) — deep-core hunt confirmed fixes ─────────────────────────────────────
+@check
+def durable_log_redacts_secrets_in_NESTED_tool_args():
+    # HIGH: _scrub_args redacted only top-level string values → a secret in a nested dict/list arg
+    # (an MCP tool's {config:{api_key:…}} / {headers:{Authorization:…}}) hit the on-disk log in plaintext.
+    from sliceagent.cli import log_sink
+    from sliceagent.events import ToolResult
+    d = tempfile.mkdtemp(); path = os.path.join(d, "log.jsonl")
+    sink = log_sink(root=d, path=path)
+    secret = "sk-verylongsecretkey1234567890abcdefghij"
+    tok = "ghp_1234567890abcdefghijklmnopqrstuvwx"
+    sink(ToolResult("mcp_call", {"config": {"api_key": secret}, "items": [tok]}, "ok", False))
+    body = open(path).read()
+    assert secret not in body, "a secret in a NESTED dict arg must be redacted before the durable log"
+    assert tok not in body, "a secret in a NESTED list arg must be redacted too"
+
+
+@check
+def detect_crlf_is_dominance_not_mere_presence():
+    from sliceagent.tools import LocalToolHost
+    h = LocalToolHost(tempfile.mkdtemp())
+    def probe(name, data):
+        p = os.path.join(h.root(), name); open(p, "wb").write(data); return h._detect_crlf(p)
+    assert probe("u_crlf", b"a\r\nb\r\nc\r\n") is True          # uniform CRLF → CRLF (pinned)
+    assert probe("u_lf", b"a\nb\nc\n") is False                 # uniform LF → LF (pinned)
+    assert probe("mixed", b'x = b"h\r\n"\np = 8080\nd = 1\n') is False   # mostly-LF + 1 CRLF → LF (the fix)
+    assert probe("winstray", b"a\r\nb\r\nc\r\nd\n") is True     # CRLF-dominant + 1 stray LF → CRLF
+
+
+@check
+def consolidation_survives_a_malformed_episodic_record():
+    from sliceagent.neocortex import promote_episodes, promote_procedures
+    good = [{"task_id": "t", "turn": 1, "record": {"meta": {"failing": True}}},
+            {"task_id": "t", "turn": 2, "record": {"meta": {"failing": False, "stop_reason": "end_turn"}}}]
+    for bad in (None, [1, 2], "str", 42, {"record": None}):     # each a malformed line among good ones
+        promote_episodes(good + [bad])                          # must not raise (was AttributeError → lost ALL lessons)
+        promote_procedures(good + [bad])
+
+
+@check
+def direct_llm_client_ignores_ambient_proxy_env():
+    import sliceagent.llm as _llm
+    saved = {k: os.environ.get(k) for k in ("AGENT_PROXY", "HTTPS_PROXY", "HTTP_PROXY", "LLM_API_KEY")}
+    try:
+        os.environ.update({"AGENT_PROXY": "none", "HTTPS_PROXY": "http://ambient:7890", "LLM_API_KEY": "k"})
+        llm = _llm.OpenAILLM(model="deepseek-chat", base_url="https://api.deepseek.com/v1")
+        assert llm.proxy_used == "direct"
+        assert llm.client._client.trust_env is False, "AGENT_PROXY=none must truly force direct (no ambient proxy)"
+        llm.switch(model="gpt-5.5", base_url="", api_key="k2")
+        assert llm.client._client.trust_env is False, "the switch() direct client must ignore ambient proxy too"
+    finally:
+        for k, v in saved.items():
+            os.environ.pop(k, None) if v is None else os.environ.__setitem__(k, v)
+
+
+@check
+def slash_handlers_print_bracketed_paths_without_markup_crash():
+    # /undo and /cwd echo a workspace PATH; a Next.js '[id]' segment is a Rich tag → MarkupError.
+    from io import StringIO
+
+    from rich.console import Console
+    con = Console(file=StringIO(), force_terminal=False)
+    # a real /cwd echo: `_reroot("~/proj/[/]")` returns "not a directory: ~/proj/[/]" — '[/]' is a Rich
+    # closing tag with nothing to close (the verifiers' exact repro).
+    con.print("  ✓ not a directory: ~/proj/[/]", markup=False)                 # must not raise
+    con.print("  Undid the last edit to app/[id]/page.tsx (1 change).", markup=False)
+    raised = False
+    try:
+        con.print("not a directory: ~/proj/[/]")   # markup ON → the MarkupError the fix avoids
+    except Exception:  # noqa: BLE001
+        raised = True
+    assert raised, "sanity: '[/]' DOES break Rich with markup on (so markup=False is load-bearing)"
+
+
 def main():
     failed = 0
     for fn in CHECKS: