agentnode-sdk 0.16.0__tar.gz → 0.18.0__tar.gz

{agentnode_sdk-0.16.0 → agentnode_sdk-0.18.0}/CHANGELOG.md

@@ -1,5 +1,75 @@
 # Changelog
 
+## 0.18.0 — User-controlled host-trust policy
+
+### Added
+
+- **`sandbox.host_trust_policy`** — a new config key that lets you decide which
+  trust tiers may run directly on your host: `default` (curated + trusted on the
+  host, today's behavior), `curated_only` (trusted is sandboxed), or `none`
+  (everything is sandboxed). Set it with
+  `agentnode config set sandbox.host_trust_policy curated_only`. AgentNode trusting
+  a package's code is not the same as you trusting it with your machine — this
+  setting closes that gap.
+- **`agentnode sandbox doctor <slug>` is now host-trust-policy aware** — it explains
+  when a package is sandboxed by the policy and distinguishes "reinstall to rebuild
+  the sandbox volume" from "the publisher must pin this MCP" from a `none`/system-
+  package warning, and flags that a sandboxed agent runs the strict profile.
+- New `docs/security/host-trust-policy.md`.
+
+### Changed
+
+- Toolpacks, MCP servers, and agents all honor `sandbox.host_trust_policy` through
+  one shared decision. Under a stricter policy the installer builds the sealed
+  sandbox volume for trusted/curated packages at install time, and the lockfile
+  records `build_mode`, `pinnable`, and `effective_host_trust_policy_at_install`
+  (mutable metadata — the runtime still re-verifies the volume itself).
+
+### Hardened
+
+- A tier the active policy sandboxes is **fail-closed**: if it cannot actually be
+  isolated (no container runtime, no built volume, a non-pinnable MCP) it is
+  refused, never run on the host as a fallback.
+
+### BREAKING / Upgrade Notes
+
+- **Not breaking by default.** The default policy is `default`, which is exactly
+  today's behavior — nothing changes until you opt in.
+- **Opting into `curated_only`/`none` isolates more strongly and can break
+  trusted/curated packages** that expect the host filesystem, broad tools, host LLM
+  keys, or network — the sandbox has none of these. **Agents are the strictest
+  case:** a sandboxed agent runs the same strict community profile (declared tools
+  only, default-deny host-brokered LLM, `network=none`, read-only `/pack`), with no
+  special rights for trusted agents. After tightening the policy, **reinstall**
+  affected packages so their sealed volume is built (`agentnode install <slug>`);
+  run `agentnode sandbox doctor <slug>` to see what each package needs. Community
+  agents remain governed by the separate opt-in `agent_sandbox.enabled` flag.
+
+## 0.17.0 — MCP network isolation
+
+### Changed
+
+- Community MCP servers now run only when pinned and preinstalled into a sealed
+  volume. Preinstalled community MCPs run with no network by default, or behind a
+  sealed egress allowlist when `mcp_allowed_domains` are declared.
+
+### Hardened
+
+- Removed the open-network runtime-fetch path for community MCPs. Non-preinstalled
+  or floating community MCPs — including `npx`, `uvx`, `latest`, git, or URL-based
+  runtime fetches — are now refused fail-closed. The old `network_level`
+  open-network grant path is no longer honored for community MCP runtime execution.
+
+### BREAKING / Upgrade Notes
+
+- Community MCPs that ship only an `mcp_command` are now refused instead of running
+  with an open network. To migrate, declare an exact pinned `mcp_install` so the MCP
+  is preinstalled into a sealed volume. If runtime network access is required,
+  declare `mcp_allowed_domains`; without declared allowed domains, the MCP runs with
+  no network.
+- The credentialed MCP secret flow is unchanged. Curated/trusted MCP behavior is
+  unchanged.
+
 ## 0.16.0 — Registry providers in auth CLI and setup wizard
 
 ### Added

{agentnode_sdk-0.16.0 → agentnode_sdk-0.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentnode-sdk
-Version: 0.16.0
+Version: 0.18.0
 Summary: Python SDK for AgentNode — the open upgrade and discovery infrastructure for AI agents.
 Project-URL: Homepage, https://agentnode.net
 Project-URL: Repository, https://github.com/agentnode-ai/agentnode

{agentnode_sdk-0.16.0 → agentnode_sdk-0.18.0}/agentnode_sdk/__init__.py

@@ -38,7 +38,7 @@ from agentnode_sdk.runtime import AgentNodeRuntime
 Client = AgentNodeClient
 ToolError = AgentNodeToolError
 
-__version__ = "0.16.0"
+__version__ = "0.18.0"
 __all__ = [
     "AgentNode",
     "AsyncAgentNode",

{agentnode_sdk-0.16.0 → agentnode_sdk-0.18.0}/agentnode_sdk/cli/commands.py

@@ -878,11 +878,16 @@ def cmd_run(
     try:
         from agentnode_sdk.runner import run_tool
         from agentnode_sdk.guard import cli_confirmation_callback
+        from agentnode_sdk.cli.mcp_commands import cli_consent_callback
 
         is_interactive = os.environ.get("AGENTNODE_NON_INTERACTIVE", "").lower() not in ("true", "1")
         callback = cli_confirmation_callback if is_interactive else None
+        # Stage 3B-2b: dedicated consent callback for credentialed MCPs (separate from the guard
+        # bool callback). None when non-TTY ⇒ resolver requires a valid stored grant (fail-closed).
+        consent_cb = cli_consent_callback if is_interactive else None
 
-        result = run_tool(slug, tool_name=tool_name, confirmation_callback=callback, **data)
+        result = run_tool(slug, tool_name=tool_name, confirmation_callback=callback,
+                          mcp_consent_callback=consent_cb, **data)
 
         if result.mode_used == "policy_denied" and result.policy:
             _print_guard_block(slug, tool_name, result)
@@ -1148,11 +1153,15 @@ def _cmd_run_smart(
     try:
         from agentnode_sdk.runner import run_tool
         from agentnode_sdk.guard import cli_confirmation_callback
+        from agentnode_sdk.cli.mcp_commands import cli_consent_callback
 
         is_interactive_run = os.environ.get("AGENTNODE_NON_INTERACTIVE", "").lower() not in ("true", "1")
         callback = cli_confirmation_callback if is_interactive_run else None
+        # Stage 3B-2b: dedicated consent callback for credentialed MCPs (separate from guard bool).
+        consent_cb = cli_consent_callback if is_interactive_run else None
 
-        result = run_tool(target_slug, confirmation_callback=callback, **parsed.input_args)
+        result = run_tool(target_slug, confirmation_callback=callback,
+                          mcp_consent_callback=consent_cb, **parsed.input_args)
 
         if result.mode_used == "policy_denied" and result.policy:
             _print_guard_block(target_slug, None, result)