agentnode-sdk 0.19.0__tar.gz → 0.21.0__tar.gz

{agentnode_sdk-0.19.0 → agentnode_sdk-0.21.0}/CHANGELOG.md

@@ -1,5 +1,76 @@
 # Changelog
 
+## 0.21.0 — Community agents run sandboxed by default
+
+### Changed
+
+- **`agent_sandbox.enabled` now defaults to ON.** Community agents
+  (`verified`/`unverified`/unknown) run **sandbox-or-refuse**, consistent with
+  toolpacks and MCP servers: in an isolated container when a container runtime
+  and the pinned image are present, otherwise **refused cleanly** — never a host
+  fallback. Set `agent_sandbox.enabled=false` (or `AGENTNODE_AGENT_SANDBOX=0`)
+  to restore the previous behavior (community agents refused outright).
+- `trusted`/`curated` agents are **unchanged**: they still run on the host under
+  the `default` host-trust policy. `sandbox.host_trust_policy` can still tighten
+  this (`curated_only`, `none`).
+- The setup wizard's sandbox screen now states community agents are isolated by
+  default and offers to disable, instead of prompting to opt in.
+
+### Security
+
+- Agent containers are regression-locked to the hardened profile: CPU, memory
+  and PID limits, read-only rootfs, all Linux capabilities dropped,
+  `no-new-privileges`, a non-root user, `noexec`/`nosuid` `/tmp`, a clean
+  ephemeral HOME, and `network=none`. The container env carries only
+  `PYTHONPATH` — no host secret reaches the container in the environment or on
+  the argv; the LLM key stays host-side behind the broker.
+- The in-container agent wrapper installs a fork/exec/subprocess guard before
+  loading agent code (defense-in-depth; the container flags are the real
+  boundary).
+- End-to-end verified on a real container host: a community agent runs isolated
+  with tool calls brokered host-side (allowlist enforced), LLM calls through the
+  host broker, and no host env/filesystem/network/key leakage — with no host
+  fallback when the sandbox is unavailable.
+
+### Fixed
+
+- The gated agent-sandbox end-to-end test now injects the real container backend
+  past the test-suite's fake, so it actually exercises the real
+  `run_agent → run_agent_sandboxed` path on a Docker host.
+
+## 0.20.0 — Credentialed toolpacks (bring your own API key)
+
+### Added
+
+- Toolpacks can declare the credentials they need (`env_requirements` in the
+  manifest: names, required flag, description — never values). The declaration
+  and the publisher's `permissions.network.allowed_domains` egress allowlist
+  are sealed into the lockfile at install (integrity-covered; tampering with
+  either breaks lockfile integrity).
+- `agentnode install` lists the declared environment variables with their
+  set/not-set status and tells you to set required ones before running.
+- Sandboxed community toolpacks can now receive user-provided API keys under
+  a fail-closed regime mirroring credentialed MCPs: a consent prompt (or a
+  stored grant) bound to the exact package identity
+  (slug + version + artifact hash + key names + domains), an enforced egress
+  proxy restricted to the sealed `allowed_domains`, and name-only key
+  pass-through (`--env NAME` — the value never appears on argv, in the
+  process spec, or in logs).
+
+### Changed
+
+- Running a toolpack with a missing *required* environment variable now fails
+  before dispatch with an actionable, value-free message
+  (`mode_used="credentials_missing"`) instead of a cryptic tool error.
+
+### Security
+
+- A credentialed toolpack without a valid, non-empty `allowed_domains`
+  allowlist is refused — a secret never rides an open or unrestricted
+  network. Consent cannot transfer between packages, versions, artifacts,
+  key sets, or domain sets. There is no fallback run without these
+  protections. Non-credentialed toolpacks behave exactly as before.
+
 ## 0.19.0 — Full setup wizard coverage
 
 ### Added

{agentnode_sdk-0.19.0 → agentnode_sdk-0.21.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentnode-sdk
-Version: 0.19.0
+Version: 0.21.0
 Summary: Python SDK for AgentNode — the open upgrade and discovery infrastructure for AI agents.
 Project-URL: Homepage, https://agentnode.net
 Project-URL: Repository, https://github.com/agentnode-ai/agentnode

{agentnode_sdk-0.19.0 → agentnode_sdk-0.21.0}/agentnode.lock

@@ -1,236 +1,236 @@
-{
-  "lockfile_version": "0.1",
-  "updated_at": "2026-05-28T19:20:23.936900+00:00",
-  "packages": {
-    "word-counter-pack": {
-      "version": "1.0.0",
-      "package_type": "toolpack",
-      "runtime": "python",
-      "entrypoint": "word_counter_pack.tool",
-      "capability_ids": [
-        "data_cleaning"
-      ],
-      "tools": [
-        {
-          "name": "count_words",
-          "entrypoint": "word_counter_pack.tool:count_words"
-        }
-      ],
-      "artifact_hash": "sha256:445388c86aa2b20c3e748f58b2d221548f1f3f71ff5c715a64cdc80966fab03c",
-      "installed_at": "2026-03-18T02:18:53.827396+00:00",
-      "source": "sdk",
-      "trust_level": "trusted",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "none",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "never"
-      }
-    },
-    "pdf-reader-pack": {
-      "version": "1.0.0",
-      "package_type": "toolpack",
-      "runtime": "python",
-      "entrypoint": "pdf_reader_pack.tool",
-      "capability_ids": [
-        "pdf_extraction"
-      ],
-      "tools": [],
-      "artifact_hash": "sha256:4635316cb5f8ee477f41ccad570c3bcd5026fc7cd1fbf402a12df575be54ae20",
-      "installed_at": "2026-04-15T23:53:44.341323+00:00",
-      "source": "sdk",
-      "trust_level": "trusted",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "temp",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "never"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null
-    },
-    "web-search-pack": {
-      "version": "1.0.0",
-      "package_type": "toolpack",
-      "runtime": "python",
-      "entrypoint": "web_search_pack.tool",
-      "capability_ids": [
-        "web_search"
-      ],
-      "tools": [],
-      "artifact_hash": "sha256:3e667ba523ceddf6137a1a15f4103d48a59085d1d277750f30addf2758228d12",
-      "installed_at": "2026-04-16T13:48:00.554169+00:00",
-      "source": "sdk",
-      "trust_level": "trusted",
-      "permissions": {
-        "network_level": "restricted",
-        "filesystem_level": "none",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "never"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null
-    },
-    "web-design-pack": {
-      "version": "1.0.0",
-      "package_type": "toolpack",
-      "runtime": "python",
-      "entrypoint": "web_design_pack.tool",
-      "capability_ids": [
-        "web_design"
-      ],
-      "tools": [],
-      "artifact_hash": "sha256:bf90bc3e2fb78682bc3df5f53d7a195675c564f0f3ede8dddfce403b59b73525",
-      "installed_at": "2026-04-16T13:48:58.751523+00:00",
-      "source": "sdk",
-      "trust_level": "trusted",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "temp",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "never"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null
-    },
-    "csv-analyzer-pack": {
-      "version": "1.0.0",
-      "package_type": "toolpack",
-      "runtime": "python",
-      "entrypoint": "csv_analyzer_pack.tool",
-      "capability_ids": [
-        "csv_analysis"
-      ],
-      "tools": [],
-      "artifact_hash": "sha256:62cfe9be62e97174ab41eff190e356d1c512b11ac88cb566d7c75e5f5e0f8d42",
-      "installed_at": "2026-04-24T13:59:54.295800+00:00",
-      "source": "sdk",
-      "trust_level": "trusted",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "temp",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "never"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null
-    },
-    "data-visualizer-pack": {
-      "version": "1.0.0",
-      "package_type": "toolpack",
-      "runtime": "python",
-      "entrypoint": "data_visualizer_pack.tool",
-      "capability_ids": [
-        "data_visualization"
-      ],
-      "tools": [],
-      "artifact_hash": "sha256:bc9485ae4d4eec2644fb0b5dc0d8108293142db673e877b30f64dd335298822b",
-      "installed_at": "2026-05-05T10:30:55.275916+00:00",
-      "source": "sdk",
-      "trust_level": "trusted",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "temp",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "never"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null
-    },
-    "mcp-filesystem": {
-      "version": "0.1.0",
-      "package_type": "toolpack",
-      "runtime": "mcp",
-      "entrypoint": "",
-      "capability_ids": [
-        "file_read",
-        "file_write",
-        "file_read"
-      ],
-      "tools": [],
-      "artifact_hash": "",
-      "installed_at": "2026-05-28T19:19:36.026966+00:00",
-      "source": "sdk",
-      "trust_level": "unverified",
-      "last_trust_check": "2026-05-28T19:19:36.026975+00:00",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "none",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "once"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null,
-      "publisher_slug": "agentnode-community",
-      "mcp_command": [
-        "npx",
-        "-y",
-        "@modelcontextprotocol/server-filesystem@2025.3.28"
-      ],
-      "_integrity": {
-        "algorithm": "sha256",
-        "canonical_version": 3,
-        "hash": "e328410426cb56408c78c3a8b4ca3e5149b0f9a69e209755a2473c5596344e77"
-      }
-    },
-    "mcp-brave-search": {
-      "version": "0.1.0",
-      "package_type": "toolpack",
-      "runtime": "mcp",
-      "entrypoint": "",
-      "capability_ids": [
-        "web_search"
-      ],
-      "tools": [],
-      "artifact_hash": "",
-      "installed_at": "2026-05-28T19:20:23.929529+00:00",
-      "source": "sdk",
-      "trust_level": "unverified",
-      "last_trust_check": "2026-05-28T19:20:23.929538+00:00",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "none",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "once"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null,
-      "publisher_slug": "agentnode-community",
-      "mcp_command": [
-        "npx",
-        "-y",
-        "@modelcontextprotocol/server-brave-search@2025.3.28"
-      ],
-      "mcp_env_keys": [
-        "BRAVE_API_KEY"
-      ],
-      "_integrity": {
-        "algorithm": "sha256",
-        "canonical_version": 3,
-        "hash": "6971a6e31fc7b6364c7378cde6d6a2f86712aa7cc80ab53ddbcedf731b03632f"
-      }
-    }
-  }
-}
+{
+  "lockfile_version": "0.1",
+  "updated_at": "2026-05-28T19:20:23.936900+00:00",
+  "packages": {
+    "word-counter-pack": {
+      "version": "1.0.0",
+      "package_type": "toolpack",
+      "runtime": "python",
+      "entrypoint": "word_counter_pack.tool",
+      "capability_ids": [
+        "data_cleaning"
+      ],
+      "tools": [
+        {
+          "name": "count_words",
+          "entrypoint": "word_counter_pack.tool:count_words"
+        }
+      ],
+      "artifact_hash": "sha256:445388c86aa2b20c3e748f58b2d221548f1f3f71ff5c715a64cdc80966fab03c",
+      "installed_at": "2026-03-18T02:18:53.827396+00:00",
+      "source": "sdk",
+      "trust_level": "trusted",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "none",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "never"
+      }
+    },
+    "pdf-reader-pack": {
+      "version": "1.0.0",
+      "package_type": "toolpack",
+      "runtime": "python",
+      "entrypoint": "pdf_reader_pack.tool",
+      "capability_ids": [
+        "pdf_extraction"
+      ],
+      "tools": [],
+      "artifact_hash": "sha256:4635316cb5f8ee477f41ccad570c3bcd5026fc7cd1fbf402a12df575be54ae20",
+      "installed_at": "2026-04-15T23:53:44.341323+00:00",
+      "source": "sdk",
+      "trust_level": "trusted",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "temp",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "never"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null
+    },
+    "web-search-pack": {
+      "version": "1.0.0",
+      "package_type": "toolpack",
+      "runtime": "python",
+      "entrypoint": "web_search_pack.tool",
+      "capability_ids": [
+        "web_search"
+      ],
+      "tools": [],
+      "artifact_hash": "sha256:3e667ba523ceddf6137a1a15f4103d48a59085d1d277750f30addf2758228d12",
+      "installed_at": "2026-04-16T13:48:00.554169+00:00",
+      "source": "sdk",
+      "trust_level": "trusted",
+      "permissions": {
+        "network_level": "restricted",
+        "filesystem_level": "none",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "never"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null
+    },
+    "web-design-pack": {
+      "version": "1.0.0",
+      "package_type": "toolpack",
+      "runtime": "python",
+      "entrypoint": "web_design_pack.tool",
+      "capability_ids": [
+        "web_design"
+      ],
+      "tools": [],
+      "artifact_hash": "sha256:bf90bc3e2fb78682bc3df5f53d7a195675c564f0f3ede8dddfce403b59b73525",
+      "installed_at": "2026-04-16T13:48:58.751523+00:00",
+      "source": "sdk",
+      "trust_level": "trusted",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "temp",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "never"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null
+    },
+    "csv-analyzer-pack": {
+      "version": "1.0.0",
+      "package_type": "toolpack",
+      "runtime": "python",
+      "entrypoint": "csv_analyzer_pack.tool",
+      "capability_ids": [
+        "csv_analysis"
+      ],
+      "tools": [],
+      "artifact_hash": "sha256:62cfe9be62e97174ab41eff190e356d1c512b11ac88cb566d7c75e5f5e0f8d42",
+      "installed_at": "2026-04-24T13:59:54.295800+00:00",
+      "source": "sdk",
+      "trust_level": "trusted",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "temp",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "never"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null
+    },
+    "data-visualizer-pack": {
+      "version": "1.0.0",
+      "package_type": "toolpack",
+      "runtime": "python",
+      "entrypoint": "data_visualizer_pack.tool",
+      "capability_ids": [
+        "data_visualization"
+      ],
+      "tools": [],
+      "artifact_hash": "sha256:bc9485ae4d4eec2644fb0b5dc0d8108293142db673e877b30f64dd335298822b",
+      "installed_at": "2026-05-05T10:30:55.275916+00:00",
+      "source": "sdk",
+      "trust_level": "trusted",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "temp",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "never"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null
+    },
+    "mcp-filesystem": {
+      "version": "0.1.0",
+      "package_type": "toolpack",
+      "runtime": "mcp",
+      "entrypoint": "",
+      "capability_ids": [
+        "file_read",
+        "file_write",
+        "file_read"
+      ],
+      "tools": [],
+      "artifact_hash": "",
+      "installed_at": "2026-05-28T19:19:36.026966+00:00",
+      "source": "sdk",
+      "trust_level": "unverified",
+      "last_trust_check": "2026-05-28T19:19:36.026975+00:00",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "none",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "once"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null,
+      "publisher_slug": "agentnode-community",
+      "mcp_command": [
+        "npx",
+        "-y",
+        "@modelcontextprotocol/server-filesystem@2025.3.28"
+      ],
+      "_integrity": {
+        "algorithm": "sha256",
+        "canonical_version": 3,
+        "hash": "e328410426cb56408c78c3a8b4ca3e5149b0f9a69e209755a2473c5596344e77"
+      }
+    },
+    "mcp-brave-search": {
+      "version": "0.1.0",
+      "package_type": "toolpack",
+      "runtime": "mcp",
+      "entrypoint": "",
+      "capability_ids": [
+        "web_search"
+      ],
+      "tools": [],
+      "artifact_hash": "",
+      "installed_at": "2026-05-28T19:20:23.929529+00:00",
+      "source": "sdk",
+      "trust_level": "unverified",
+      "last_trust_check": "2026-05-28T19:20:23.929538+00:00",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "none",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "once"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null,
+      "publisher_slug": "agentnode-community",
+      "mcp_command": [
+        "npx",
+        "-y",
+        "@modelcontextprotocol/server-brave-search@2025.3.28"
+      ],
+      "mcp_env_keys": [
+        "BRAVE_API_KEY"
+      ],
+      "_integrity": {
+        "algorithm": "sha256",
+        "canonical_version": 3,
+        "hash": "6971a6e31fc7b6364c7378cde6d6a2f86712aa7cc80ab53ddbcedf731b03632f"
+      }
+    }
+  }
+}

{agentnode_sdk-0.19.0 → agentnode_sdk-0.21.0}/agentnode_sdk/__init__.py

@@ -38,7 +38,7 @@ from agentnode_sdk.runtime import AgentNodeRuntime
 Client = AgentNodeClient
 ToolError = AgentNodeToolError
 
-__version__ = "0.19.0"
+__version__ = "0.21.0"
 __all__ = [
     "AgentNode",
     "AsyncAgentNode",

{agentnode_sdk-0.19.0 → agentnode_sdk-0.21.0}/agentnode_sdk/cli/commands.py

@@ -813,6 +813,7 @@ def cmd_install(capability: str, version: str | None = None, yes: bool = False)
                 _print_install_trust_summary(result.slug)
                 _print_install_guard_summary(result.slug)
                 _print_install_mcp_guidance(result.slug)
+                _print_install_env_guidance(result.slug)
                 print()
         else:
             print(f"\n  {result.message}\n")
@@ -1937,6 +1938,44 @@ def _print_install_mcp_guidance(slug: str) -> None:
         pass
 
 
+def _print_install_env_guidance(slug: str) -> None:
+    """Post-install guidance for toolpacks that declare env_requirements.
+
+    Names + set/missing status only — a credential VALUE is never read or
+    printed.
+    """
+    import os
+    from agentnode_sdk.installer import read_lockfile
+
+    try:
+        lock = read_lockfile()
+        pkg = lock.get("packages", {}).get(slug, {})
+        if not pkg or pkg.get("runtime") == "mcp":
+            return
+        reqs = pkg.get("env_requirements") or []
+        if not reqs:
+            return
+        print()
+        print("  This toolpack declares environment variables:")
+        for r in reqs:
+            if not isinstance(r, dict) or not r.get("name"):
+                continue
+            name = r["name"]
+            required = r.get("required", True)
+            status = "set" if name in os.environ else "not set"
+            tag = "required" if required else "optional"
+            print(f"    {name}  ({tag}, {status})")
+        missing_required = [
+            r["name"] for r in reqs
+            if isinstance(r, dict) and r.get("name")
+            and r.get("required", True) and r["name"] not in os.environ
+        ]
+        if missing_required:
+            print("  Set the required variable(s) before running this toolpack.")
+    except Exception:
+        pass
+
+
 def _severity(action: str) -> int:
     return {"allow": 0, "prompt": 1, "deny": 2}.get(action, 0)