feat: SCRIPTCOMMANDS setting to turn script-driven commands off

A saved user preference (on by default) toggled by the SCRIPTCOMMANDS command
gates HostApi::run_command; Cancel stays allowed so a waiting command is never
stranded. The runner refuses the SCRIPTCOMMANDS command itself, so a script
cannot change it. Documents why no helper-thread or stack-growing dependency was
added: native builds link with at least 8 MiB, the nesting depth is fixed, and the
deepest step found needs 2 to 4 MiB in a debug build.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

src/app/commands/styleprops.rs

@@ -2894,6 +2894,25 @@ impl OpenCADStudio {
                     _ => self.command_line.push_error(crate::t!("Requires 0 or 1").as_ref()),
                 }
             }
+            cmd if cmd == "SCRIPTCOMMANDS" || cmd.starts_with("SCRIPTCOMMANDS ") => {
+                // A user setting, deliberately outside the script's reach: it is refused by
+                // the script command runner, so only the command line can change it.
+                let arg = cmd.trim_start_matches("SCRIPTCOMMANDS").trim();
+                match arg {
+                    "" => {}
+                    "1" | "ON" | "YES" => self.script_commands = true,
+                    "0" | "OFF" | "NO" => self.script_commands = false,
+                    _ => {
+                        self.command_line.push_error("SCRIPTCOMMANDS takes 1 (scripts may run commands) or 0 (they may not)");
+                        return Some(Task::none());
+                    }
+                }
+                if !arg.is_empty() {
+                    self.persist_settings_if_changed();
+                }
+                let state = if self.script_commands { 1 } else { 0 };
+                self.command_line.push_output(&format!("SCRIPTCOMMANDS = {state}"));
+            }
             "SAVETIME" => {
                 use crate::command::ValuePromptCommand;
                 let c = ValuePromptCommand::new(

src/app/mod.rs

@@ -616,6 +616,8 @@ pub(super) struct OpenCADStudio {
     /// Minutes between autosaves to a `.sv$` recovery file (SAVETIME command);
     /// 0 disables autosave.
     pub savetime_min: i32,
+    /// SCRIPTCOMMANDS: scripts may run OCS commands (see `UserSettings`).
+    pub script_commands: bool,
     /// Persisted default viewport background, restored from settings and applied
     /// to every drawing tab (new and opened) so a chosen background survives
     /// restarts (#188). `None` = the built-in dark-grey / off-white defaults.
@@ -3956,6 +3958,7 @@ impl OpenCADStudio {
             constraint_bar_display: 3,
             constraint_bar_mode: 4095,
             savetime_min: 10,
+            script_commands: true,
             default_bg_color: None,
             default_paper_bg_color: None,
             cliprompt_lines: 3,

src/app/plugin_host.rs

@@ -1291,7 +1291,7 @@ impl<'a> HostSession<'a> {
             let first = line.split_whitespace().next()?.trim_start_matches(['\'', '_']).to_uppercase();
             const DENIED: &[&str] = &[
                 "QUIT", "EXIT", "CLOSE", "CLOSEALL", "NEW", "QNEW", "OPEN", "SAVE", "QSAVE", "SAVEAS",
-                "SAVEALL", "RECOVER", "SCRIPT", "RUNSCRIPT",
+                "SAVEALL", "RECOVER", "SCRIPT", "RUNSCRIPT", "SCRIPTCOMMANDS",
             ];
             if DENIED.contains(&first.as_str()) || first.starts_with("PY_") {
                 Some(format!("the command {first} cannot be run from a script"))
@@ -1299,6 +1299,11 @@ impl<'a> HostSession<'a> {
                 None
             }
         };
+        // Cancel stays allowed: if the user turns scripts off mid-run, a command a script left
+        // waiting must still be closable rather than stranded.
+        if !self.app.script_commands && !matches!(request, R::Cancel) {
+            return Err("running commands from a script is turned off (SCRIPTCOMMANDS = 0); turn it on at the command line with SCRIPTCOMMANDS 1".to_owned());
+        }
         let active = self.app.tabs[tab].active_cmd.is_some();
         let before = self.document().entities().count() as i64;
         let error_revision = self.app.command_line.error_revision;
@@ -8265,6 +8270,39 @@ step('undo_move', lambda: M.move([u], (0, 0, 0), (7, 0, 0)))
         drop(process);
     }
 
+    /// The user's SCRIPTCOMMANDS setting gates the command runner, and a script cannot change it.
+    #[test]
+    fn script_commands_setting_gates_the_runner() {
+        use ocs_plugin_api::host::CommandRequest as R;
+        let mut app = OpenCADStudio::new_for_test();
+        app.tabs[0].is_start = false;
+        assert!(app.script_commands, "scripts may run commands by default");
+        let run = |app: &mut OpenCADStudio, line: &str| HostSession::new(app, 0).run_command(R::Run { line: line.into() });
+        assert!(run(&mut app, "LINE 0,0 10,0").is_ok());
+
+        // A script cannot touch the setting, on or off.
+        let refused = run(&mut app, "SCRIPTCOMMANDS 0").unwrap_err();
+        assert!(refused.contains("cannot be run from a script"), "{refused}");
+        assert!(app.script_commands);
+
+        // The user turns it off at the command line.
+        let reply = app.automation_op(r#"{"op":"run","cmd":"SCRIPTCOMMANDS 0"}"#);
+        assert_eq!(reply["ok"], true, "{reply}");
+        assert!(!app.script_commands);
+        let refused = run(&mut app, "LINE 0,0 20,0").unwrap_err();
+        assert!(refused.contains("turned off"), "{refused}");
+        let refused = HostSession::new(&mut app, 0).run_command(R::Start { name: "LINE".into() }).unwrap_err();
+        assert!(refused.contains("turned off"), "{refused}");
+        assert_eq!(app.tabs[0].scene.document.entities().count(), 1, "nothing ran while it was off");
+        assert!(HostSession::new(&mut app, 0).run_command(R::Cancel).is_ok(), "Cancel is still allowed while it is off");
+
+        // And back on.
+        app.automation_op(r#"{"op":"run","cmd":"SCRIPTCOMMANDS 1"}"#);
+        assert!(app.script_commands);
+        assert!(run(&mut app, "LINE 0,0 20,0").is_ok());
+        assert_eq!(app.tabs[0].scene.document.entities().count(), 2);
+    }
+
     /// Exploration harness (not a gate): prints how the real commands answer
     /// each step so the wrappers are written against observed prompts.
     #[test]

src/app/settings.rs

@@ -476,6 +476,10 @@ pub struct UserSettings {
     /// Minutes between autosaves to a `.sv$` recovery file (SAVETIME command).
     /// 0 disables autosave.
     pub savetime_min: i32,
+    /// SCRIPTCOMMANDS: whether a script (the Python plugin) may run OCS commands
+    /// through the host. On by default; a user turns it off with the
+    /// `SCRIPTCOMMANDS 0` command, and a script cannot change it.
+    pub script_commands: bool,
     /// File type and version used when a new/unsaved drawing is first saved.
     /// Existing drawings keep their own type and version.
     pub default_save_format: String,
@@ -676,6 +680,7 @@ impl Default for UserSettings {
             constraint_bar_display: 3,
             constraint_bar_mode: 4095,
             savetime_min: 10,
+            script_commands: true,
             default_save_format: crate::io::DEFAULT_SAVE_FORMAT.to_string(),
             pick_add: true,
             pick_drag_rect: false,
@@ -789,6 +794,19 @@ mod tests {
         assert_eq!(cfg.settings.savetime_min, 42);
     }
 
+    #[test]
+    fn script_commands_default_on_and_survive_a_round_trip() {
+        let missing: crate::app::config::AppConfig =
+            serde_json::from_str(r#"{"settings": {"pick_add": false}}"#).unwrap();
+        assert!(missing.settings.script_commands, "an old config keeps scripts allowed");
+        let off: crate::app::config::AppConfig =
+            serde_json::from_str(r#"{"settings": {"script_commands": false}}"#).unwrap();
+        assert!(!off.settings.script_commands);
+        let text = serde_json::to_string(&off).unwrap();
+        let back: crate::app::config::AppConfig = serde_json::from_str(&text).unwrap();
+        assert!(!back.settings.script_commands);
+    }
+
     #[test]
     fn isometric_drafting_never_persists_or_loads() {
         // A persisted On used to bring the isoplane crosshair (vertical +

src/app/update/file.rs

@@ -619,6 +619,7 @@ impl OpenCADStudio {
             constraint_bar_display: self.constraint_bar_display,
             constraint_bar_mode: self.constraint_bar_mode,
             savetime_min: self.savetime_min,
+            script_commands: self.script_commands,
             default_save_format: self.default_save_format.clone(),
             pick_add: self.pick_add,
             pick_drag_rect: self.pick_drag_rect,
@@ -723,6 +724,7 @@ impl OpenCADStudio {
         self.constraint_bar_display = s.constraint_bar_display.clamp(0, 3);
         self.constraint_bar_mode = s.constraint_bar_mode.clamp(0, 4095);
         self.savetime_min = s.savetime_min;
+        self.script_commands = s.script_commands;
         self.default_save_format =
             crate::io::canonical_save_format(&s.default_save_format).to_string();
         self.pick_add = s.pick_add;