agentnode-sdk 0.20.0__tar.gz → 0.21.0__tar.gz

{agentnode_sdk-0.20.0 → agentnode_sdk-0.21.0}/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.21.0 — Community agents run sandboxed by default
+
+### Changed
+
+- **`agent_sandbox.enabled` now defaults to ON.** Community agents
+  (`verified`/`unverified`/unknown) run **sandbox-or-refuse**, consistent with
+  toolpacks and MCP servers: in an isolated container when a container runtime
+  and the pinned image are present, otherwise **refused cleanly** — never a host
+  fallback. Set `agent_sandbox.enabled=false` (or `AGENTNODE_AGENT_SANDBOX=0`)
+  to restore the previous behavior (community agents refused outright).
+- `trusted`/`curated` agents are **unchanged**: they still run on the host under
+  the `default` host-trust policy. `sandbox.host_trust_policy` can still tighten
+  this (`curated_only`, `none`).
+- The setup wizard's sandbox screen now states community agents are isolated by
+  default and offers to disable, instead of prompting to opt in.
+
+### Security
+
+- Agent containers are regression-locked to the hardened profile: CPU, memory
+  and PID limits, read-only rootfs, all Linux capabilities dropped,
+  `no-new-privileges`, a non-root user, `noexec`/`nosuid` `/tmp`, a clean
+  ephemeral HOME, and `network=none`. The container env carries only
+  `PYTHONPATH` — no host secret reaches the container in the environment or on
+  the argv; the LLM key stays host-side behind the broker.
+- The in-container agent wrapper installs a fork/exec/subprocess guard before
+  loading agent code (defense-in-depth; the container flags are the real
+  boundary).
+- End-to-end verified on a real container host: a community agent runs isolated
+  with tool calls brokered host-side (allowlist enforced), LLM calls through the
+  host broker, and no host env/filesystem/network/key leakage — with no host
+  fallback when the sandbox is unavailable.
+
+### Fixed
+
+- The gated agent-sandbox end-to-end test now injects the real container backend
+  past the test-suite's fake, so it actually exercises the real
+  `run_agent → run_agent_sandboxed` path on a Docker host.
+
 ## 0.20.0 — Credentialed toolpacks (bring your own API key)
 
 ### Added

{agentnode_sdk-0.20.0 → agentnode_sdk-0.21.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentnode-sdk
-Version: 0.20.0
+Version: 0.21.0
 Summary: Python SDK for AgentNode — the open upgrade and discovery infrastructure for AI agents.
 Project-URL: Homepage, https://agentnode.net
 Project-URL: Repository, https://github.com/agentnode-ai/agentnode

{agentnode_sdk-0.20.0 → agentnode_sdk-0.21.0}/agentnode.lock

@@ -1,236 +1,236 @@
-{
-  "lockfile_version": "0.1",
-  "updated_at": "2026-05-28T19:20:23.936900+00:00",
-  "packages": {
-    "word-counter-pack": {
-      "version": "1.0.0",
-      "package_type": "toolpack",
-      "runtime": "python",
-      "entrypoint": "word_counter_pack.tool",
-      "capability_ids": [
-        "data_cleaning"
-      ],
-      "tools": [
-        {
-          "name": "count_words",
-          "entrypoint": "word_counter_pack.tool:count_words"
-        }
-      ],
-      "artifact_hash": "sha256:445388c86aa2b20c3e748f58b2d221548f1f3f71ff5c715a64cdc80966fab03c",
-      "installed_at": "2026-03-18T02:18:53.827396+00:00",
-      "source": "sdk",
-      "trust_level": "trusted",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "none",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "never"
-      }
-    },
-    "pdf-reader-pack": {
-      "version": "1.0.0",
-      "package_type": "toolpack",
-      "runtime": "python",
-      "entrypoint": "pdf_reader_pack.tool",
-      "capability_ids": [
-        "pdf_extraction"
-      ],
-      "tools": [],
-      "artifact_hash": "sha256:4635316cb5f8ee477f41ccad570c3bcd5026fc7cd1fbf402a12df575be54ae20",
-      "installed_at": "2026-04-15T23:53:44.341323+00:00",
-      "source": "sdk",
-      "trust_level": "trusted",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "temp",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "never"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null
-    },
-    "web-search-pack": {
-      "version": "1.0.0",
-      "package_type": "toolpack",
-      "runtime": "python",
-      "entrypoint": "web_search_pack.tool",
-      "capability_ids": [
-        "web_search"
-      ],
-      "tools": [],
-      "artifact_hash": "sha256:3e667ba523ceddf6137a1a15f4103d48a59085d1d277750f30addf2758228d12",
-      "installed_at": "2026-04-16T13:48:00.554169+00:00",
-      "source": "sdk",
-      "trust_level": "trusted",
-      "permissions": {
-        "network_level": "restricted",
-        "filesystem_level": "none",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "never"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null
-    },
-    "web-design-pack": {
-      "version": "1.0.0",
-      "package_type": "toolpack",
-      "runtime": "python",
-      "entrypoint": "web_design_pack.tool",
-      "capability_ids": [
-        "web_design"
-      ],
-      "tools": [],
-      "artifact_hash": "sha256:bf90bc3e2fb78682bc3df5f53d7a195675c564f0f3ede8dddfce403b59b73525",
-      "installed_at": "2026-04-16T13:48:58.751523+00:00",
-      "source": "sdk",
-      "trust_level": "trusted",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "temp",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "never"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null
-    },
-    "csv-analyzer-pack": {
-      "version": "1.0.0",
-      "package_type": "toolpack",
-      "runtime": "python",
-      "entrypoint": "csv_analyzer_pack.tool",
-      "capability_ids": [
-        "csv_analysis"
-      ],
-      "tools": [],
-      "artifact_hash": "sha256:62cfe9be62e97174ab41eff190e356d1c512b11ac88cb566d7c75e5f5e0f8d42",
-      "installed_at": "2026-04-24T13:59:54.295800+00:00",
-      "source": "sdk",
-      "trust_level": "trusted",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "temp",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "never"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null
-    },
-    "data-visualizer-pack": {
-      "version": "1.0.0",
-      "package_type": "toolpack",
-      "runtime": "python",
-      "entrypoint": "data_visualizer_pack.tool",
-      "capability_ids": [
-        "data_visualization"
-      ],
-      "tools": [],
-      "artifact_hash": "sha256:bc9485ae4d4eec2644fb0b5dc0d8108293142db673e877b30f64dd335298822b",
-      "installed_at": "2026-05-05T10:30:55.275916+00:00",
-      "source": "sdk",
-      "trust_level": "trusted",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "temp",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "never"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null
-    },
-    "mcp-filesystem": {
-      "version": "0.1.0",
-      "package_type": "toolpack",
-      "runtime": "mcp",
-      "entrypoint": "",
-      "capability_ids": [
-        "file_read",
-        "file_write",
-        "file_read"
-      ],
-      "tools": [],
-      "artifact_hash": "",
-      "installed_at": "2026-05-28T19:19:36.026966+00:00",
-      "source": "sdk",
-      "trust_level": "unverified",
-      "last_trust_check": "2026-05-28T19:19:36.026975+00:00",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "none",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "once"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null,
-      "publisher_slug": "agentnode-community",
-      "mcp_command": [
-        "npx",
-        "-y",
-        "@modelcontextprotocol/server-filesystem@2025.3.28"
-      ],
-      "_integrity": {
-        "algorithm": "sha256",
-        "canonical_version": 3,
-        "hash": "e328410426cb56408c78c3a8b4ca3e5149b0f9a69e209755a2473c5596344e77"
-      }
-    },
-    "mcp-brave-search": {
-      "version": "0.1.0",
-      "package_type": "toolpack",
-      "runtime": "mcp",
-      "entrypoint": "",
-      "capability_ids": [
-        "web_search"
-      ],
-      "tools": [],
-      "artifact_hash": "",
-      "installed_at": "2026-05-28T19:20:23.929529+00:00",
-      "source": "sdk",
-      "trust_level": "unverified",
-      "last_trust_check": "2026-05-28T19:20:23.929538+00:00",
-      "permissions": {
-        "network_level": "none",
-        "filesystem_level": "none",
-        "code_execution_level": "none",
-        "data_access_level": "input_only",
-        "user_approval_level": "once"
-      },
-      "prompts": [],
-      "resources": [],
-      "connector": null,
-      "agent": null,
-      "publisher_slug": "agentnode-community",
-      "mcp_command": [
-        "npx",
-        "-y",
-        "@modelcontextprotocol/server-brave-search@2025.3.28"
-      ],
-      "mcp_env_keys": [
-        "BRAVE_API_KEY"
-      ],
-      "_integrity": {
-        "algorithm": "sha256",
-        "canonical_version": 3,
-        "hash": "6971a6e31fc7b6364c7378cde6d6a2f86712aa7cc80ab53ddbcedf731b03632f"
-      }
-    }
-  }
-}
+{
+  "lockfile_version": "0.1",
+  "updated_at": "2026-05-28T19:20:23.936900+00:00",
+  "packages": {
+    "word-counter-pack": {
+      "version": "1.0.0",
+      "package_type": "toolpack",
+      "runtime": "python",
+      "entrypoint": "word_counter_pack.tool",
+      "capability_ids": [
+        "data_cleaning"
+      ],
+      "tools": [
+        {
+          "name": "count_words",
+          "entrypoint": "word_counter_pack.tool:count_words"
+        }
+      ],
+      "artifact_hash": "sha256:445388c86aa2b20c3e748f58b2d221548f1f3f71ff5c715a64cdc80966fab03c",
+      "installed_at": "2026-03-18T02:18:53.827396+00:00",
+      "source": "sdk",
+      "trust_level": "trusted",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "none",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "never"
+      }
+    },
+    "pdf-reader-pack": {
+      "version": "1.0.0",
+      "package_type": "toolpack",
+      "runtime": "python",
+      "entrypoint": "pdf_reader_pack.tool",
+      "capability_ids": [
+        "pdf_extraction"
+      ],
+      "tools": [],
+      "artifact_hash": "sha256:4635316cb5f8ee477f41ccad570c3bcd5026fc7cd1fbf402a12df575be54ae20",
+      "installed_at": "2026-04-15T23:53:44.341323+00:00",
+      "source": "sdk",
+      "trust_level": "trusted",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "temp",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "never"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null
+    },
+    "web-search-pack": {
+      "version": "1.0.0",
+      "package_type": "toolpack",
+      "runtime": "python",
+      "entrypoint": "web_search_pack.tool",
+      "capability_ids": [
+        "web_search"
+      ],
+      "tools": [],
+      "artifact_hash": "sha256:3e667ba523ceddf6137a1a15f4103d48a59085d1d277750f30addf2758228d12",
+      "installed_at": "2026-04-16T13:48:00.554169+00:00",
+      "source": "sdk",
+      "trust_level": "trusted",
+      "permissions": {
+        "network_level": "restricted",
+        "filesystem_level": "none",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "never"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null
+    },
+    "web-design-pack": {
+      "version": "1.0.0",
+      "package_type": "toolpack",
+      "runtime": "python",
+      "entrypoint": "web_design_pack.tool",
+      "capability_ids": [
+        "web_design"
+      ],
+      "tools": [],
+      "artifact_hash": "sha256:bf90bc3e2fb78682bc3df5f53d7a195675c564f0f3ede8dddfce403b59b73525",
+      "installed_at": "2026-04-16T13:48:58.751523+00:00",
+      "source": "sdk",
+      "trust_level": "trusted",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "temp",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "never"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null
+    },
+    "csv-analyzer-pack": {
+      "version": "1.0.0",
+      "package_type": "toolpack",
+      "runtime": "python",
+      "entrypoint": "csv_analyzer_pack.tool",
+      "capability_ids": [
+        "csv_analysis"
+      ],
+      "tools": [],
+      "artifact_hash": "sha256:62cfe9be62e97174ab41eff190e356d1c512b11ac88cb566d7c75e5f5e0f8d42",
+      "installed_at": "2026-04-24T13:59:54.295800+00:00",
+      "source": "sdk",
+      "trust_level": "trusted",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "temp",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "never"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null
+    },
+    "data-visualizer-pack": {
+      "version": "1.0.0",
+      "package_type": "toolpack",
+      "runtime": "python",
+      "entrypoint": "data_visualizer_pack.tool",
+      "capability_ids": [
+        "data_visualization"
+      ],
+      "tools": [],
+      "artifact_hash": "sha256:bc9485ae4d4eec2644fb0b5dc0d8108293142db673e877b30f64dd335298822b",
+      "installed_at": "2026-05-05T10:30:55.275916+00:00",
+      "source": "sdk",
+      "trust_level": "trusted",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "temp",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "never"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null
+    },
+    "mcp-filesystem": {
+      "version": "0.1.0",
+      "package_type": "toolpack",
+      "runtime": "mcp",
+      "entrypoint": "",
+      "capability_ids": [
+        "file_read",
+        "file_write",
+        "file_read"
+      ],
+      "tools": [],
+      "artifact_hash": "",
+      "installed_at": "2026-05-28T19:19:36.026966+00:00",
+      "source": "sdk",
+      "trust_level": "unverified",
+      "last_trust_check": "2026-05-28T19:19:36.026975+00:00",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "none",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "once"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null,
+      "publisher_slug": "agentnode-community",
+      "mcp_command": [
+        "npx",
+        "-y",
+        "@modelcontextprotocol/server-filesystem@2025.3.28"
+      ],
+      "_integrity": {
+        "algorithm": "sha256",
+        "canonical_version": 3,
+        "hash": "e328410426cb56408c78c3a8b4ca3e5149b0f9a69e209755a2473c5596344e77"
+      }
+    },
+    "mcp-brave-search": {
+      "version": "0.1.0",
+      "package_type": "toolpack",
+      "runtime": "mcp",
+      "entrypoint": "",
+      "capability_ids": [
+        "web_search"
+      ],
+      "tools": [],
+      "artifact_hash": "",
+      "installed_at": "2026-05-28T19:20:23.929529+00:00",
+      "source": "sdk",
+      "trust_level": "unverified",
+      "last_trust_check": "2026-05-28T19:20:23.929538+00:00",
+      "permissions": {
+        "network_level": "none",
+        "filesystem_level": "none",
+        "code_execution_level": "none",
+        "data_access_level": "input_only",
+        "user_approval_level": "once"
+      },
+      "prompts": [],
+      "resources": [],
+      "connector": null,
+      "agent": null,
+      "publisher_slug": "agentnode-community",
+      "mcp_command": [
+        "npx",
+        "-y",
+        "@modelcontextprotocol/server-brave-search@2025.3.28"
+      ],
+      "mcp_env_keys": [
+        "BRAVE_API_KEY"
+      ],
+      "_integrity": {
+        "algorithm": "sha256",
+        "canonical_version": 3,
+        "hash": "6971a6e31fc7b6364c7378cde6d6a2f86712aa7cc80ab53ddbcedf731b03632f"
+      }
+    }
+  }
+}

{agentnode_sdk-0.20.0 → agentnode_sdk-0.21.0}/agentnode_sdk/__init__.py

@@ -38,7 +38,7 @@ from agentnode_sdk.runtime import AgentNodeRuntime
 Client = AgentNodeClient
 ToolError = AgentNodeToolError
 
-__version__ = "0.20.0"
+__version__ = "0.21.0"
 __all__ = [
     "AgentNode",
     "AsyncAgentNode",

{agentnode_sdk-0.20.0 → agentnode_sdk-0.21.0}/agentnode_sdk/cli/publish.py

@@ -324,6 +324,26 @@ def _extract_warnings(message: str) -> str:
     return text.strip()
 
 
+def _publish_outcome(resp: dict) -> tuple[bool, str, list[str]]:
+    """Normalize a publish response into (quarantined, reason, warnings).
+
+    Prefers the structured fields (quarantined / quarantine_reason / warnings);
+    falls back to parsing the message text for older backends that don't send
+    them yet.
+    """
+    if "quarantined" in resp:
+        quarantined = bool(resp.get("quarantined"))
+        warnings_list = [w for w in (resp.get("warnings") or []) if w]
+        reason = resp.get("quarantine_reason") or (
+            "; ".join(warnings_list) if warnings_list else ""
+        )
+        return quarantined, reason, warnings_list
+    msg = resp.get("message", "")
+    quarantined = "quarantine" in msg.lower()
+    reason = _extract_warnings(msg)
+    return quarantined, reason, ([reason] if reason else [])
+
+
 def cmd_publish(
     path_str: str,
     *,
@@ -496,8 +516,13 @@ def cmd_publish(
 
     slug = resp.get("slug", pkg_id)
     ver = resp.get("version", version)
-    msg = resp.get("message", "")
-    quarantined = "quarantine" in msg.lower()
+
+    # Prefer the structured publish outcome; fall back to parsing the message
+    # text for older backends that don't return the quarantined flag yet.
+    quarantined, reason, warnings_list = _publish_outcome(resp)
+    # For a quarantined result, the reason is shown on its own line; don't also
+    # repeat it in the generic warnings loop.
+    display_warnings = [] if quarantined else warnings_list
 
     print(f"  Published {slug}@{ver}")
     print()
@@ -507,15 +532,15 @@ def cmd_publish(
         # search and not installable until cleared. Frame it honestly instead
         # of printing the URL as if the package were already live.
         print("  Status: Under review — not yet public.")
-        reason = _extract_warnings(msg)
         if reason:
             print(f"  {reason}")
         print("  It won't appear in search or be installable until review clears it.")
         print()
         print(f"  Track status: https://agentnode.net/packages/{slug}")
     else:
-        if "warning" in msg.lower():
-            print(f"  {msg}")
+        for w in display_warnings:
+            print(f"  Warning: {w}")
+        if display_warnings:
             print()
         print(f"  Live: https://agentnode.net/packages/{slug}")
         print("  Verification runs automatically; its tier and score appear on the page shortly.")

{agentnode_sdk-0.20.0 → agentnode_sdk-0.21.0}/agentnode_sdk/cli/setup_wizard.py

@@ -342,19 +342,15 @@ def _sandbox_screen(cfg: dict) -> tuple[str, bool]:
         print()
         print("  Sandbox ready — community packages run isolated.")
         print()
-        print("  Sandboxed community agents are currently disabled (default).")
-        print("  Enabling lets verified/unverified community agents run isolated;")
-        print("  without it they are refused.")
+        print("  Sandboxed community agents are enabled by default: verified/")
+        print("  unverified community agents run isolated in the sandbox, or are")
+        print("  refused if it is unavailable — never on the host.")
         if sys.stdin.isatty():
-            en = _prompt("  Enable sandboxed community agents now? [y/N]: ", "n")
-            if en.lower() == "y":
-                cfg["agent_sandbox"]["enabled"] = True
-            else:
-                print(dim("  You can enable it later with "
-                          "`agentnode config set agent_sandbox.enabled true`."))
-        else:
-            print(dim("  Enable later with "
-                      "`agentnode config set agent_sandbox.enabled true`."))
+            dis = _prompt("  Disable sandboxed community agents? [y/N]: ", "n")
+            if dis.lower() == "y":
+                cfg["agent_sandbox"]["enabled"] = False
+                print(dim("  Disabled — community agents will be refused outright. "
+                          "Re-enable with `agentnode config set agent_sandbox.enabled true`."))
         return "ready", False
 
     from agentnode_sdk.cli.sandbox_commands import _first_failure

{agentnode_sdk-0.20.0 → agentnode_sdk-0.21.0}/agentnode_sdk/config.py

@@ -42,7 +42,13 @@ DEFAULTS: dict[str, Any] = {
         "unknown": "prompt",
     },
     "agent_sandbox": {
-        "enabled": False,
+        # Default ON (Slice B, SDK 0.21.0): community agents run sandbox-or-refuse,
+        # consistent with toolpacks and MCPs. On a host without a container runtime
+        # + pinned image they are refused cleanly (never a host fallback); with the
+        # sandbox present they run in the container (LLM key stays host-side behind
+        # the broker, tool calls via RPC). Set to false to restore the old behavior
+        # (community agents refused outright).
+        "enabled": True,
     },
     "sandbox": {
         "host_trust_policy": "default",