overall security gaps hardening

Author: skundu42

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
   push:
     branches:
       - main
+    # Also run on version tags so the exact released ref is checked.
+    tags:
+      - "v*"
 
 permissions:
   contents: read
@@ -67,6 +70,31 @@ jobs:
       - name: Build distributions
         run: uv build --out-dir build-dist
 
+  integration:
+    name: Integration tests (network)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    # Integration-marked tests hit the live network and can flake for reasons
+    # unrelated to the code; keep the signal visible without blocking PRs.
+    continue-on-error: true
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          python-version: "3.12"
+
+      - name: Install locked dependencies
+        run: uv sync --locked --all-extras --dev
+
+      - name: Run integration tests
+        run: uv run pytest -m integration -q
+
   platform:
     name: ${{ matrix.name }} smoke test
     runs-on: ${{ matrix.runner }}
@@ -109,8 +137,18 @@ jobs:
           rg --version
 
       - name: Run tests
+        if: runner.os != 'macOS'
         run: uv run pytest tests -W error::pytest.PytestUnraisableExceptionWarning
 
+      - name: Run tests with coverage (macOS)
+        if: runner.os == 'macOS'
+        # Collect coverage on macOS too so mac-only paths are measured, but
+        # without a fail-under gate: per-platform coverage totals differ,
+        # and the 70% gate stays on the ubuntu quality job.
+        run: |
+          uv run pytest tests --cov=noah_code --cov-report=term \
+            -W error::pytest.PytestUnraisableExceptionWarning
+
       - name: Verify command entry point
         run: uv run noah --version
 

.github/workflows/release.yml

@@ -53,6 +53,9 @@ jobs:
           sudo apt-get install -y ripgrep
           rg --version
 
+      - name: Type check
+        run: uv run mypy src/noah_code
+
       - name: Run release checks
         run: |
           uv run ruff check src tests

.pre-commit-config.yaml

@@ -6,3 +6,16 @@ repos:
     hooks:
       - id: ruff-check
         args: [--fix]
+
+  - repo: local
+    hooks:
+      - id: mypy
+        name: mypy
+        entry: uv run mypy
+        language: system
+        pass_filenames: false
+      - id: uv-lock-check
+        name: uv lock --check
+        entry: uv lock --check
+        language: system
+        pass_filenames: false

README.md

@@ -123,6 +123,8 @@ Type `/` to search the full command and configuration reference. The most common
 | `Shift+Enter` | Insert a newline |
 | Drag, then `Cmd+C` / `Ctrl+Shift+C` | Select and copy TUI text |
 | `Ctrl+Shift+C` with no selection | Copy the latest Noah reply |
+| `Ctrl+G` | Open the searchable skills picker |
+| `Ctrl+]` | Return to live transcript output |
 | `Tab` | Switch between build and plan mode |
 | `F2` | Open execution activity |
 | `F3` | Open paginated conversation history |

docs/configuration.md

@@ -215,6 +215,10 @@ Inspect the resolved configuration from the CLI or inside an interactive session
 lists every nested path, while an optional path scopes the output. Values whose names look like
 credentials are redacted.
 
+Configuration is validated strictly: unknown keys (including typos such as `theem` under `[ui]`)
+and invalid values or TOML syntax fail every command with a one-line error naming the file and
+field, never a traceback. Fix the named key or remove it; `noah doctor` reports the same error.
+
 ```bash
 noah config show .
 ```
@@ -297,14 +301,19 @@ limits.
 | `plan` | Reads are allowed; file edits and mutating shell commands are denied. `self.plan.write` may pin `.noah-code/plan.md` |
 
 Switch modes with `--mode`, `/mode build`, or `/mode plan`. The agent can propose a switch with
-`self.plan.enter()` / `self.plan.exit_to_build()` after writing a plan. The active mode is stored with the
-session.
+`self.plan.enter()` / `self.plan.exit_to_build()` after writing a plan; the transition always asks
+for confirmation and is never auto-approved, so in `noah run --auto` it is refused and the session
+stays in plan mode. The active mode is stored with the session.
 
 Permission rules are evaluated in order, and the last matching rule wins. The default policy:
 
 - Allows ordinary reads.
-- Denies likely secrets, including `.env` variants, private keys, `.git` internals, and session
-  databases. `.env.example` remains readable.
+- Denies likely secrets, including `.env` variants, private keys, `.git` internals, credential
+  stores (`.npmrc`, `.pypirc`, `.netrc`, `.pgpass`, `.kube/config`, `.docker/config.json`,
+  `.aws/credentials`), Java/JCEKS key stores, and session databases. `.env.example` remains
+  readable. The same denials apply to Git object syntax (`git show HEAD:.env`) and to patch-output
+  Git commands with no path scope (`git log -p`, bare `git show`), which ask instead of being
+  auto-approved.
 - Allows workspace edits, read-only in-workspace shell inspection, web reads, skills, and
   delegated tasks without interrupting the turn.
 - Asks before arbitrary shell execution, external paths, MCP access, and remote mutations.
@@ -322,10 +331,12 @@ Permission rules are evaluated in order, and the last matching rule wins. The de
 
 `--auto` changes routine ask decisions to allow but never overrides an explicit deny.
 Elevated-risk commands such as file removal, downloads, and package installation still require
-explicit approval. Compound shell commands and mutating or unrecognized Git commands cannot be
-silently auto-approved. Interpreters, eval/source commands, and indirect execution wrappers, plus
-arguments hidden behind variable, command, ANSI-C, or brace expansion, are denied under `--auto`;
-run without `--auto` when one of these commands needs explicit approval.
+explicit approval: interactively they ask, and in non-interactive `noah run --auto` they are
+rejected outright instead of being silently approved. Compound shell commands and mutating or
+unrecognized Git commands cannot be silently auto-approved. Interpreters, eval/source commands, and
+indirect execution wrappers, plus arguments hidden behind variable, command, ANSI-C, or brace
+expansion, are denied under `--auto`; run without `--auto` when one of these commands needs
+explicit approval.
 
 ## Installation and updates
 

docs/development.md

@@ -12,7 +12,8 @@ uv run pytest tests
 uv build
 ```
 
-The default test suite is hermetic and does not require network access or provider keys. A single
+The default test suite is hermetic and does not require network access or provider keys; pytest-socket
+blocks network sockets outright (only local AF_UNIX sockets, e.g. asyncio's self-pipe, stay open). A single
 opt-in test performs a live HTTP fetch; run it explicitly on a connected machine:
 
 ```bash
@@ -25,7 +26,7 @@ Measure coverage (a 70% total gate runs in CI):
 uv run pytest tests --cov=noah_code --cov-report=term-missing
 ```
 
-Optional git hooks mirror the lint gate:
+Optional git hooks mirror the lint, type-check, and lockfile gates:
 
 ```bash
 uvx pre-commit install
@@ -37,16 +38,19 @@ tool output, and estimated cost.
 ## CI
 
 GitHub Actions runs the complete test suite on Python 3.12 and 3.13, plus platform smoke tests on
-Linux and macOS for arm64 and x86_64. Every pull request and push to `main` must pass lint, static
-type checking (mypy), tests with a 70% coverage floor, lockfile validation, and a package build.
-Concurrent runs for the same reference are cancelled automatically.
+Linux and macOS for arm64 and x86_64. Every pull request, push to `main`, and `v*` tag must pass lint,
+static type checking (mypy), tests with a 70% coverage floor (measured on Ubuntu; the macOS smoke jobs
+also collect coverage, without a gate, to include mac-only paths), lockfile validation, and a package
+build. A separate job runs the network-dependent integration tests and is allowed to fail, since live
+network calls can flake for reasons unrelated to the code. Concurrent runs for the same reference are
+cancelled automatically.
 
 ## Releases
 
 A `v*` tag starts the release pipeline, which:
 
 1. Verifies that the tag, `pyproject.toml`, and package versions match.
-2. Reruns tests and builds the wheel and source distribution.
+2. Reruns lint, type checks, and tests, then builds the wheel and source distribution.
 3. Validates distribution metadata and generates SHA-256 checksums.
 4. Publishes to PyPI using short-lived OIDC credentials.
 5. Creates provenance attestations and a GitHub release with the artifacts.

docs/extensions.md

@@ -20,7 +20,9 @@ test.
 ```
 
 Invoke it as `/fix the parser`. Commands support `$ARGUMENTS` and positional placeholders `$1`
-through `$9`. Front matter may also select a mode or model.
+through `$9`. Front matter may also select a mode or model — but only for trusted user commands:
+`mode` and `model` front matter in repository commands is ignored, so a checkout cannot switch the
+session out of plan mode or onto another model without confirmation.
 
 ## Subagents
 
@@ -57,7 +59,7 @@ configuration owned by the user.
 
 ## Skills
 
-Open the dedicated searchable picker with `/skills` or `Ctrl+K`. Selecting a document skill
+Open the dedicated searchable picker with `/skills` or `Ctrl+G`. Selecting a document skill
 inserts `$skill-name ` into the composer so you can add the task directly. Noah reads the standard
 `SKILL.md` directory format used by Codex and Claude, including companion `scripts/`, `references/`,
 and `assets/` folders.

docs/interactive-reference.md

@@ -8,15 +8,15 @@
 | `Shift+Enter` | Insert a newline without sending |
 | `Tab` | Toggle `build`/`plan` mode; accept the highlighted slash option while suggestions are open |
 | `Ctrl+P` | Open the command palette |
-| `Ctrl+K` | Open the searchable skills picker |
+| `Ctrl+G` | Open the searchable skills picker |
 | `Ctrl+O` | Open the session picker |
 | `Ctrl+N` | Start a new session |
 | `Ctrl+C` | Cancel the active turn and clear queued follow-ups; press twice while idle to quit |
 | `Ctrl+Q` | Quit |
 | `F1` or `?` | Show help |
 | `F2` | Open recent activity and full captured output |
 | `F3` | Open paginated persisted conversation history |
-| `End` | Return to live transcript output and clear the new-output counter |
+| `Ctrl+]` | Return to live transcript output and clear the new-output counter |
 
 At an approval prompt, press `1` to approve once, `2` to remember the approval for the current
 session, or `3`/`Esc` to reject it.
@@ -41,8 +41,9 @@ their transcript normally.
 
 Drag across transcript, activity, diff, or history text to select it. `Cmd+C` on macOS or
 `Ctrl+Shift+C` in other terminals copies the selection; when there is no selection, the same
-shortcut copies Noah's latest reply. `Ctrl+C` also copies an active selection before falling back
-to cancel-turn behavior. Selection uses a high-contrast highlight in every Noah theme.
+shortcut copies Noah's latest reply. Inside the composer, `Cmd+C`/`Ctrl+C` copies the composer's
+own selection; `Ctrl+C` with no composer selection keeps its cancel-turn behavior. Selection uses a
+high-contrast highlight in every Noah theme.
 
 ### Mid-turn follow-ups
 

docs/releases/v0.2.4.md

@@ -0,0 +1,94 @@
+# Noah Code v0.2.4
+
+This release is a security and reliability hardening pass across the permission engine, checkpoint
+capture, workspace edits, budgets, and the terminal interface, plus dependency and CI updates.
+
+## Security
+
+- Closed a hard secret-deny bypass through Git object syntax: `git show HEAD:.env` (and `:path`
+  forms generally) is now classified by the path component and denied like `cat .env`, in build,
+  plan, and `--auto` modes alike.
+- Unscoped patch-output Git commands (`git log -p`, bare `git show`/`git diff`) no longer ride the
+  read-only auto-allow bump; they ask, since they can dump committed secrets without naming a path.
+- Expanded secret classification to common credential stores: `.npmrc`, `.pypirc`, `.netrc`,
+  `.pgpass`, `.envrc`, `.kube/config`, `.docker/config.json`, `.aws/credentials`, and Java/JCEKS
+  key stores.
+- Joined short-flag values are now scanned as paths, so `grep -f/etc/passwd`, `rg -f.env`, and
+  `tail -F~/log` can no longer evade the external-path and secret checks.
+- Git checkpoint capture no longer stages secret-classified paths into `refs/noah-code/checkpoints/*`
+  and no longer executes repository clean filters — capture uses filter-free plumbing
+  (`hash-object --no-filters` + `update-index --cacheinfo`), preserving executable bits and storing
+  symlinks as links.
+- Non-interactive `noah run --auto` now rejects elevated-risk commands (file removal, downloads,
+  `find -delete`/`-exec`, and similar) instead of silently approving them; interactive behavior is
+  unchanged.
+- Plan mode can no longer be crossed without confirmation: `mode`/`model` front matter in
+  repository custom commands is ignored (user commands keep it), and `plan.exit_to_build()` is
+  never auto-approved.
+- `find -delete`/`-exec`/`-execdir` joined the elevated-risk floor, and `rg --hostname-bin` is no
+  longer treated as read-only.
+
+## Reliability and correctness
+
+- The main edit path (`replace`/`edit`) is now atomic and newline-preserving: byte-level splice,
+  exactly-one-match enforcement, and temp+fsync+rename writes — CRLF files no longer flip to LF
+  when one hunk changes, and a crash mid-edit cannot leave a truncated file.
+- Reads are bounded: whole-file reads above `max_file_bytes` require an explicit line range, ranged
+  reads stream instead of loading the file, binary files fail cleanly, and durable pre-images above
+  `undo_blob_limit` degrade to hash-only instead of ballooning the session database.
+- Background-job durable logs rotate at 4 MB keeping the newest lines, and log paging tail-reads
+  instead of loading the whole file.
+- Live model switches (`/model`, `/reasoning`, `/providers use`) now rebuild the full retry and
+  fallback pipeline — switches no longer silently drop transient retries and fallback models.
+- The WAIT path can no longer hang: background-job terminal events always fire even if the runtime
+  write fails, and the host wait is bounded with state re-checks; a job finishing between WAIT and
+  wake no longer fails the run spuriously.
+- Cost budgets work: per-response cost is recovered from provider-reported cost or LiteLLM's
+  pricing table, so `max_cost_usd` enforces real charges and `/tokens` reports real cost instead of
+  `$0.000000`.
+- Ctrl+C under `asyncio.run` exits cleanly with the designed double-press flow instead of a
+  traceback; one press at an idle prompt hints, a second exits, and mid-turn cancellation renders
+  once.
+- Configuration is validated strictly: unknown keys and invalid values or TOML fail every command
+  with a one-line error naming the file and field — no more tracebacks from `noah doctor`.
+- `noah run` no longer exits 0 without doing anything when an auto-update installs; non-interactive
+  runs print the update notice and proceed.
+- Fixed atomic-patch rollback ordering (fsync failure no longer strands a renamed file), new-file
+  permissions (umask default instead of `0600`), grep-harvested edit anchors after `cd`,
+  stale-anchor detection without a prior read, double-`close()` wiping the undo journal, stale
+  interrupted runs resurrecting, and checkpoint metadata clobbering newer session metadata.
+
+## Interface
+
+- Fixed priority keybindings that hijacked basic editing keys: Skills picker moved to `Ctrl+G`,
+  return-to-live moved to `Ctrl+]`, and `End`/`Ctrl+K` work normally inside the composer again.
+- `Cmd+C`/`Ctrl+C` in the composer copies the composer's own selection; keyboard (shift-arrow)
+  selections are copyable.
+- `@`-mention suggestions no longer rescan the whole workspace per keystroke: directory pruning
+  plus a short-lived cache keep the composer responsive in large repositories.
+- One Ctrl+C now renders a single "turn cancelled" entry, and question-modal "Other" collects a
+  free-text answer instead of submitting the literal string `other`.
+
+## Packaging and CI
+
+- LiteLLM re-pinned to `>=1.96.0,<1.99.0` (resolved 1.98.0): upstream restored macOS wheels, so
+  provider and security fixes from 1.92–1.98 now reach installs.
+- Added upper bounds for end-user installs (`textual`, `pydantic`, `click`, `rich`, `PyYAML`,
+  `packaging`), which resolve fresh and ignore `uv.lock`.
+- Unified the duplicated dev-dependency declarations into the single `dev` extra.
+- The default test suite is now hermetic by construction (pytest-socket blocks network sockets);
+  CI runs on `v*` tags, type-checks in the release pipeline, collects macOS coverage, and runs the
+  network integration tests as a non-blocking job.
+- Expanded the hermetic suite to 565 passing tests.
+
+## Upgrade
+
+Existing managed installations can run:
+
+```bash
+noah update
+```
+
+New installations can use the one-command installer from the README.
+
+**Full changelog:** https://github.com/skundu42/noah-code/compare/v0.2.3...v0.2.4

docs/reliability.md

@@ -59,7 +59,10 @@ on the next launch. This protection complements the persistent edit journal used
 Git checkpoints are enabled by default. Noah captures them at turn boundaries and before mutating
 shell commands, stores them under `refs/noah-code/checkpoints/<session>/`, and keeps the newest 50
 by default. Capturing uses a temporary Git index and does not move `HEAD` or disturb the user's
-index. Inspect and restore them with:
+index. Capture is filter-free plumbing (`hash-object --no-filters` + `update-index --cacheinfo`),
+so repository clean filters never execute during capture, and paths the permission engine
+classifies as secrets (`.env`, key stores, credential files) are never staged into checkpoint
+refs. Inspect and restore them with:
 
 ```text
 /checkpoints
@@ -110,14 +113,19 @@ The defaults favor long-running work while keeping growth finite:
 | --- | ---: | --- |
 | `processes.max_jobs` | `8` | Maximum managed background jobs |
 | `processes.max_runtime_seconds` | `86400` | Per-job runtime ceiling (24 hours) |
+| Background-job log cap | `4000000` bytes | Durable per-job JSONL log rotates, keeping the newest lines |
+| `max_file_bytes` | `512000` | Whole-file reads above this require an explicit line range |
+| `undo_blob_limit` | `2000000` | Per-file cap for undo/durable pre-images (larger edits are hash-only) |
 | `reliability.interaction_timeout_seconds` | `86400` | Approval/question timeout |
 | `reliability.artifact_max_bytes` | `2000000000` | Full-output artifact quota per session |
 | `reliability.session_max_bytes` | `5000000000` | Total session-storage ceiling |
 | `reliability.max_runtime_events` | `20000` | Retained operational events |
 | `checkpoints.max_per_session` | `50` | Rolling Git checkpoint count |
 
 Optional `[budget]` limits cap cumulative model tokens, estimated/provider-reported cost, or session
-wall-clock time. Counters persist across restarts:
+wall-clock time. Cost is computed per response from the provider's reported cost when present,
+falling back to LiteLLM's pricing table (`completion_cost`), so `max_cost_usd` is enforced against
+real charges. Counters persist across restarts:
 
 ```toml
 [budget]