sliceagent 0.1.8__tar.gz → 0.1.9__tar.gz

{sliceagent-0.1.8 → sliceagent-0.1.9}/CHANGELOG.md

@@ -5,6 +5,27 @@ this project aims for [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.1.9] — 2026-07-03
+
+Bug-hunt round 2 (deep-core lenses, full 3-vote adversarial verify). Five confirmed fixes.
+
+### Security
+- The durable debug log's `_scrub_args` now redacts secrets in NESTED dict/list tool arguments
+  (e.g. an MCP call's `{config:{api_key:…}}` or `{headers:{Authorization:…}}`) — top-level-only
+  redaction leaked them to `~/.sliceagent/logs/**/durable-log.jsonl` in plaintext.
+- `AGENT_PROXY=none` (documented "force a DIRECT connection") now truly forces direct: the httpx
+  client is built with `trust_env=False`, so an ambient `HTTPS_PROXY` can no longer silently route
+  your API traffic through a proxy you told sliceagent to bypass (both first build and `/model` hops).
+
+### Fixed
+- `str_replace`/`edit_file` no longer flip a whole file to CRLF when it's mostly-LF but contains a
+  single embedded `\r\n` (a byte literal, an HTTP fixture, a merge artifact). CRLF is now detected by
+  DOMINANCE, not mere presence — uniformly-CRLF Windows files are still preserved.
+- Session-end consolidation no longer crashes (and silently discards ALL of a session's promoted
+  lessons/skills) when the episodic log contains one malformed record.
+- `/undo` and `/cwd` (and `/plugins`) no longer corrupt output or crash Rich with a MarkupError when a
+  path contains brackets — e.g. a Next.js `app/[id]/page.tsx` route or `~/proj/[slug]`.
+
 ## [0.1.8] — 2026-07-02
 
 Launch-day bug-hunt round: a security fix plus config-robustness and /model correctness.

{sliceagent-0.1.8 → sliceagent-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sliceagent
-Version: 0.1.8
+Version: 0.1.9
 Summary: A coding agent with a new context-engineering framework: bounded, deterministic, reconstructed context (slice architecture) — built for long-horizon work.
 Author: TT-Wang
 License-Expression: MIT

{sliceagent-0.1.8 → sliceagent-0.1.9}/src/sliceagent/__init__.py

@@ -1,3 +1,3 @@
 """sliceagent — a memory-native coding agent (deterministic, bounded, reconstructed context)."""
 
-__version__ = "0.1.8"
+__version__ = "0.1.9"

{sliceagent-0.1.8 → sliceagent-0.1.9}/src/sliceagent/cli.py

@@ -50,7 +50,15 @@ def log_sink(root: str = ".", path: str | None = None):
     path = path or os.path.join(state_dir("logs", root_key(root)), "durable-log.jsonl")
 
     def _scrub_args(args: dict) -> dict:          # redact string values (edit_file content, inline tokens)
-        return {k: (redact_text(v) if isinstance(v, str) else v) for k, v in (args or {}).items()}
+        def _rec(v):                              # RECURSE — a secret nested in a dict/list arg (e.g. an
+            if isinstance(v, str):                # MCP tool's {config:{api_key:…}} / {headers:{Authorization:…}})
+                return redact_text(v)             # must not reach the on-disk log in plaintext (top-level-only
+            if isinstance(v, dict):               # redaction leaked it; sibling hippocampus._clamp already recurses)
+                return {k: _rec(x) for k, x in v.items()}
+            if isinstance(v, (list, tuple)):
+                return [_rec(x) for x in v]
+            return v
+        return _rec(args or {})
 
     def sink(e: Event) -> None:
         rec = None
@@ -566,12 +574,15 @@ def main() -> None:
                 except Exception:
                     _console.print(f"  no such topic: {arg}", markup=False)
         elif cmd == "/undo":
-            _console.print("  " + base_tools.undo_last())   # revert the last file edit
+            # markup=False: undo_last() embeds the edited file PATH; a Next.js-style '[id]'/'[...slug]'
+            # segment is parsed as a Rich tag → corrupted output or a MarkupError crash.
+            _console.print("  " + base_tools.undo_last(), markup=False)   # revert the last file edit
         elif cmd == "/plugins":
             tools = sorted(e.name for e in base_tools.registry._tools.values()
                            if getattr(e, "source", "") == "plugin")
-            _console.print(f"  plugin dirs: {', '.join(cfg.plugin_dirs) or '(none configured)'}")
-            _console.print(f"  plugin tools ({len(tools)}): {', '.join(tools) or '(none loaded)'}")
+            # markup=False: plugin dirs are filesystem PATHS that may contain '[...]' (same Rich-tag hazard)
+            _console.print(f"  plugin dirs: {', '.join(cfg.plugin_dirs) or '(none configured)'}", markup=False)
+            _console.print(f"  plugin tools ({len(tools)}): {', '.join(tools) or '(none loaded)'}", markup=False)
         elif cmd == "/mcp":
             configured = list(cfg.mcp_servers.keys())
             mtools = sorted(e.name for e in base_tools.registry._tools.values()
@@ -670,7 +681,7 @@ def main() -> None:
             if not arg:
                 _console.print(f"  workspace: {base_tools.root()}", markup=False)
             else:
-                _console.print("  ✓ " + _reroot(arg))
+                _console.print("  ✓ " + _reroot(arg), markup=False)   # path may contain '[...]' → Rich markup
         else:
             _console.print(f"  unknown command {cmd} (/help)", markup=False)
         return True

{sliceagent-0.1.8 → sliceagent-0.1.9}/src/sliceagent/llm.py

@@ -208,7 +208,11 @@ class OpenAILLM:
                               or os.environ.get("HTTPS_PROXY") or os.environ.get("HTTP_PROXY"))
         use_proxy = bool(proxy) and proxy != "none"
         self.proxy_used = proxy if use_proxy else "direct"   # exposed so the CLI can announce the route (A4)
-        http_client = httpx.Client(proxy=proxy, timeout=timeout) if use_proxy else httpx.Client(timeout=timeout)
+        # trust_env=False: the proxy is resolved EXPLICITLY above (AGENT_PROXY/HTTPS_PROXY/HTTP_PROXY →
+        # _choose_proxy), so httpx must NOT ALSO auto-read ambient proxy env — otherwise AGENT_PROXY=none
+        # ("force direct") still routes through an ambient HTTPS_PROXY (httpx defaults trust_env=True).
+        http_client = (httpx.Client(proxy=proxy, timeout=timeout, trust_env=False) if use_proxy
+                       else httpx.Client(timeout=timeout, trust_env=False))
 
         # Enforce the request timeout at the SDK layer too. The openai SDK applies its OWN per-request
         # timeout (default ~600s) which OVERRIDES the httpx client's, so without passing it here a
@@ -278,8 +282,8 @@ class OpenAILLM:
             use_proxy = bool(proxy) and proxy != "none"
             self.proxy_used = proxy if use_proxy else "direct"
             timeout = getattr(self, "_timeout", 60.0)
-            http_client = (httpx.Client(proxy=proxy, timeout=timeout) if use_proxy
-                           else httpx.Client(timeout=timeout))
+            http_client = (httpx.Client(proxy=proxy, timeout=timeout, trust_env=False) if use_proxy
+                           else httpx.Client(timeout=timeout, trust_env=False))   # explicit proxy only (see __init__)
             ckw: dict = {"api_key": new_key}
             if new_base:
                 ckw["base_url"] = new_base

{sliceagent-0.1.8 → sliceagent-0.1.9}/src/sliceagent/neocortex.py

@@ -87,6 +87,8 @@ def _is_secret(text: str) -> bool:
 def _by_task(records: list[dict]) -> list[list[dict]]:
     groups: dict[str, list[dict]] = {}
     for r in records:
+        if not isinstance(r, dict):      # a malformed episodic line (null/list/partial write, old schema)
+            continue                     # must not crash consolidation → silently DISCARD ALL lessons this session
         groups.setdefault(r.get("task_id", ""), []).append(r)
     return [sorted(g, key=lambda r: r.get("turn", 0)) for g in groups.values()]
 
@@ -98,7 +100,7 @@ def promote_episodes(records: list[dict]) -> list[dict]:
     # pass 1: collect the corrective pitfall of each task + count signatures (frequency, #4)
     cand = []
     for recs in _by_task(records):
-        rmeta = [r.get("record", {}) for r in recs]
+        rmeta = [(r.get("record") if isinstance(r.get("record"), dict) else {}) for r in recs]  # {"record": null} → {} (not None)
         had_fail = any(m.get("meta", {}).get("failing") for m in rmeta)
         last = rmeta[-1].get("meta", {})
         if not (had_fail and last.get("stop_reason") == "end_turn" and not last.get("failing")):
@@ -222,7 +224,7 @@ def promote_procedures(records: list[dict], *, min_actions: int = PROC_MIN_ACTIO
     EverOS rule), capped. Pure. Returns {kind, name, description, steps, files, freq, tags}."""
     cand = []
     for recs in _by_task(records):
-        rmeta = [r.get("record", {}) for r in recs]
+        rmeta = [(r.get("record") if isinstance(r.get("record"), dict) else {}) for r in recs]  # {"record": null} → {} (not None)
         if any(m.get("meta", {}).get("failing") for m in rmeta):
             continue                                   # corrective → a fact, not a procedure
         last = rmeta[-1].get("meta", {})

{sliceagent-0.1.8 → sliceagent-0.1.9}/src/sliceagent/tools.py

@@ -747,14 +747,20 @@ class LocalToolHost:
 
     @staticmethod
     def _detect_crlf(full: str) -> bool:
-        """True if the existing file uses Windows CRLF line endings (sample the head). Used to PRESERVE
+        """True if the existing file is DOMINANTLY Windows CRLF (sample the head). Used to PRESERVE
         line endings on edit: the model emits '\\n', and writing that to a CRLF file rewrites every line
-        ending — a huge spurious diff / corruption on Windows-authored repos."""
+        ending — a huge spurious diff / corruption on Windows-authored repos. DOMINANCE (not mere
+        presence): a mostly-LF file with one embedded '\\r\\n' (a byte literal, an HTTP fixture, a merge
+        artifact) must NOT be flipped whole-file to CRLF — while a uniformly-CRLF file with one stray LF
+        still counts as CRLF. crlf ≥ (bare-LF) covers both, and keeps the pinned uniform cases."""
         try:
             with open(full, "rb") as f:
-                return b"\r\n" in f.read(65536)
+                head = f.read(65536)
         except OSError:
             return False
+        crlf = head.count(b"\r\n")
+        lf_only = head.count(b"\n") - crlf          # LFs that are NOT part of a CRLF
+        return crlf > 0 and crlf >= lf_only
 
     @staticmethod
     def _preserve_eol(text: str, crlf: bool) -> str:

{sliceagent-0.1.8 → sliceagent-0.1.9}/tests/test_bughunt_fixes.py

@@ -1347,6 +1347,80 @@ def model_switch_warns_when_the_endpoint_cant_serve_it():
     assert "OpenAI" not in _reasoning_note(LLM("gpt-5.5", "", "high"))
 
 
+# ── Round 2 (2026-07-03) — deep-core hunt confirmed fixes ─────────────────────────────────────
+@check
+def durable_log_redacts_secrets_in_NESTED_tool_args():
+    # HIGH: _scrub_args redacted only top-level string values → a secret in a nested dict/list arg
+    # (an MCP tool's {config:{api_key:…}} / {headers:{Authorization:…}}) hit the on-disk log in plaintext.
+    from sliceagent.cli import log_sink
+    from sliceagent.events import ToolResult
+    d = tempfile.mkdtemp(); path = os.path.join(d, "log.jsonl")
+    sink = log_sink(root=d, path=path)
+    secret = "sk-verylongsecretkey1234567890abcdefghij"
+    tok = "ghp_1234567890abcdefghijklmnopqrstuvwx"
+    sink(ToolResult("mcp_call", {"config": {"api_key": secret}, "items": [tok]}, "ok", False))
+    body = open(path).read()
+    assert secret not in body, "a secret in a NESTED dict arg must be redacted before the durable log"
+    assert tok not in body, "a secret in a NESTED list arg must be redacted too"
+
+
+@check
+def detect_crlf_is_dominance_not_mere_presence():
+    from sliceagent.tools import LocalToolHost
+    h = LocalToolHost(tempfile.mkdtemp())
+    def probe(name, data):
+        p = os.path.join(h.root(), name); open(p, "wb").write(data); return h._detect_crlf(p)
+    assert probe("u_crlf", b"a\r\nb\r\nc\r\n") is True          # uniform CRLF → CRLF (pinned)
+    assert probe("u_lf", b"a\nb\nc\n") is False                 # uniform LF → LF (pinned)
+    assert probe("mixed", b'x = b"h\r\n"\np = 8080\nd = 1\n') is False   # mostly-LF + 1 CRLF → LF (the fix)
+    assert probe("winstray", b"a\r\nb\r\nc\r\nd\n") is True     # CRLF-dominant + 1 stray LF → CRLF
+
+
+@check
+def consolidation_survives_a_malformed_episodic_record():
+    from sliceagent.neocortex import promote_episodes, promote_procedures
+    good = [{"task_id": "t", "turn": 1, "record": {"meta": {"failing": True}}},
+            {"task_id": "t", "turn": 2, "record": {"meta": {"failing": False, "stop_reason": "end_turn"}}}]
+    for bad in (None, [1, 2], "str", 42, {"record": None}):     # each a malformed line among good ones
+        promote_episodes(good + [bad])                          # must not raise (was AttributeError → lost ALL lessons)
+        promote_procedures(good + [bad])
+
+
+@check
+def direct_llm_client_ignores_ambient_proxy_env():
+    import sliceagent.llm as _llm
+    saved = {k: os.environ.get(k) for k in ("AGENT_PROXY", "HTTPS_PROXY", "HTTP_PROXY", "LLM_API_KEY")}
+    try:
+        os.environ.update({"AGENT_PROXY": "none", "HTTPS_PROXY": "http://ambient:7890", "LLM_API_KEY": "k"})
+        llm = _llm.OpenAILLM(model="deepseek-chat", base_url="https://api.deepseek.com/v1")
+        assert llm.proxy_used == "direct"
+        assert llm.client._client.trust_env is False, "AGENT_PROXY=none must truly force direct (no ambient proxy)"
+        llm.switch(model="gpt-5.5", base_url="", api_key="k2")
+        assert llm.client._client.trust_env is False, "the switch() direct client must ignore ambient proxy too"
+    finally:
+        for k, v in saved.items():
+            os.environ.pop(k, None) if v is None else os.environ.__setitem__(k, v)
+
+
+@check
+def slash_handlers_print_bracketed_paths_without_markup_crash():
+    # /undo and /cwd echo a workspace PATH; a Next.js '[id]' segment is a Rich tag → MarkupError.
+    from io import StringIO
+
+    from rich.console import Console
+    con = Console(file=StringIO(), force_terminal=False)
+    # a real /cwd echo: `_reroot("~/proj/[/]")` returns "not a directory: ~/proj/[/]" — '[/]' is a Rich
+    # closing tag with nothing to close (the verifiers' exact repro).
+    con.print("  ✓ not a directory: ~/proj/[/]", markup=False)                 # must not raise
+    con.print("  Undid the last edit to app/[id]/page.tsx (1 change).", markup=False)
+    raised = False
+    try:
+        con.print("not a directory: ~/proj/[/]")   # markup ON → the MarkupError the fix avoids
+    except Exception:  # noqa: BLE001
+        raised = True
+    assert raised, "sanity: '[/]' DOES break Rich with markup on (so markup=False is load-bearing)"
+
+
 def main():
     failed = 0
     for fn in CHECKS: