aicortexpy 0.2.0__tar.gz → 0.2.2__tar.gz

{aicortexpy-0.2.0 → aicortexpy-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: aicortexpy
-Version: 0.2.0
+Version: 0.2.2
 Summary: AICortex Python CLI and local agent runtime daemon (Go CLI compatible)
 Author: AICortex
 License: Apache-2.0
@@ -26,20 +26,23 @@ aicortex daemon start
 aicortex issue list --output json
 ```
 
-也可用 `python -m aicortexpy`（与 `aicortex` / `aicortexpy` 入口等价）。
+等价入口：`python -m aicortex`（推荐）/ `python -m aicortexpy` / `aicortexpy`。
 
 | | |
 |--|--|
-| PyPI / 模块 | `aicortexpy` |
-| Console scripts | `aicortex`、`aicortexpy`（`aicortex` 刻意同名，供 Agent 提示词零改动） |
+| PyPI 包名 | `aicortexpy` |
+| 模块 | `aicortex`（`-m`）、`aicortexpy` |
+| PATH 命令 | Windows：`aicortex.cmd` → `python -m aicortex`（**不**生成 `aicortex.exe`，避免与 Go 安装器 / `.exe` 探测冲突）；另有 `aicortexpy.exe` |
 | 配置 | 与 Go 共用 `~/.aicortex/config.json` |
 
 ## 安装
 
 ```powershell
 pip install -U aicortexpy
+# 若以前装过会留下 Scripts\aicortex.exe，可手动删掉，让 aicortex.cmd 生效：
+#   Remove-Item "$env:LOCALAPPDATA\Programs\Python\Python3*\Scripts\aicortex.exe" -ErrorAction SilentlyContinue
 # 源码：
-cd python-daemon
+cd python-aicortex
 pip install -e .
 ```
 
@@ -73,7 +76,7 @@ Health 默认端口 **19514**。不要与 Go daemon 同时跑。
 ## 发布
 
 ```powershell
-cd python-daemon
+cd python-aicortex
 python -m build
 python -m twine upload dist/*
 ```
@@ -84,4 +87,4 @@ python -m twine upload dist/*
 
 已覆盖 Agent/日常平台命令（issue/workspace/agent/squad/project/label/attachment/autopilot/meeting/skill/memory/graph/runtime/repo/auth/config/daemon）。
 
-尚未：浏览器 OAuth login、`update` 二进制自更新（请用 `pip install -U aicortexpy`）。
+相对 Go：`setup` / `update`(pip) / OAuth login / 平台命令已对齐；二进制自更新请用 `pip install -U aicortexpy`。

{aicortexpy-0.2.0 → aicortexpy-0.2.2}/README.md

@@ -9,20 +9,23 @@ aicortex daemon start
 aicortex issue list --output json
 ```
 
-也可用 `python -m aicortexpy`（与 `aicortex` / `aicortexpy` 入口等价）。
+等价入口：`python -m aicortex`（推荐）/ `python -m aicortexpy` / `aicortexpy`。
 
 | | |
 |--|--|
-| PyPI / 模块 | `aicortexpy` |
-| Console scripts | `aicortex`、`aicortexpy`（`aicortex` 刻意同名，供 Agent 提示词零改动） |
+| PyPI 包名 | `aicortexpy` |
+| 模块 | `aicortex`（`-m`）、`aicortexpy` |
+| PATH 命令 | Windows：`aicortex.cmd` → `python -m aicortex`（**不**生成 `aicortex.exe`，避免与 Go 安装器 / `.exe` 探测冲突）；另有 `aicortexpy.exe` |
 | 配置 | 与 Go 共用 `~/.aicortex/config.json` |
 
 ## 安装
 
 ```powershell
 pip install -U aicortexpy
+# 若以前装过会留下 Scripts\aicortex.exe，可手动删掉，让 aicortex.cmd 生效：
+#   Remove-Item "$env:LOCALAPPDATA\Programs\Python\Python3*\Scripts\aicortex.exe" -ErrorAction SilentlyContinue
 # 源码：
-cd python-daemon
+cd python-aicortex
 pip install -e .
 ```
 
@@ -56,7 +59,7 @@ Health 默认端口 **19514**。不要与 Go daemon 同时跑。
 ## 发布
 
 ```powershell
-cd python-daemon
+cd python-aicortex
 python -m build
 python -m twine upload dist/*
 ```
@@ -67,4 +70,4 @@ python -m twine upload dist/*
 
 已覆盖 Agent/日常平台命令（issue/workspace/agent/squad/project/label/attachment/autopilot/meeting/skill/memory/graph/runtime/repo/auth/config/daemon）。
 
-尚未：浏览器 OAuth login、`update` 二进制自更新（请用 `pip install -U aicortexpy`）。
+相对 Go：`setup` / `update`(pip) / OAuth login / 平台命令已对齐；二进制自更新请用 `pip install -U aicortexpy`。

aicortexpy-0.2.2/aicortex/__init__.py

@@ -0,0 +1,9 @@
+"""Top-level alias package so `python -m aicortex` works after install.
+
+The implementation lives in ``aicortexpy``; this package exists only as the
+``-m aicortex`` / PATH shim target (especially on Windows via ``aicortex.cmd``).
+"""
+
+from aicortexpy import __version__
+
+__all__ = ["__version__"]

aicortexpy-0.2.2/aicortex/__main__.py

@@ -0,0 +1,5 @@
+"""Allow `python -m aicortex` (same as `python -m aicortexpy`)."""
+
+from aicortexpy.cli import main
+
+raise SystemExit(main())

{aicortexpy-0.2.0 → aicortexpy-0.2.2}/aicortexpy/__init__.py

@@ -1,3 +1,3 @@
 """AICortex Python CLI + local agent runtime daemon."""
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"

{aicortexpy-0.2.0 → aicortexpy-0.2.2}/aicortexpy/acp_client.py

@@ -51,7 +51,15 @@ class _PendingTool:
 class ACPClient:
     """Thread-safe JSON-RPC client for one ACP child process."""
 
-    def __init__(self, stdin: TextIO, *, tool_name_fn: Callable[[str, str], str] | None = None) -> None:
+    def __init__(
+        self,
+        stdin: TextIO,
+        *,
+        tool_name_fn: Callable[[str, str], str] | None = None,
+        security_policy: Any = None,
+        permissions: Any = None,
+        task_id: str = "",
+    ) -> None:
         self._stdin = stdin
         self._write_lock = threading.Lock()
         self._mu = threading.Lock()
@@ -60,6 +68,9 @@ class ACPClient:
         self._tool_mu = threading.Lock()
         self._pending_tools: dict[str, _PendingTool] = {}
         self.tool_name_fn = tool_name_fn or default_tool_name
+        self.security_policy = security_policy
+        self.permissions = permissions
+        self.task_id = task_id
         self.session_id = ""
         self.on_message: MessageCB | None = None
         self.on_prompt_done: PromptDoneCB | None = None
@@ -155,9 +166,9 @@ class ACPClient:
         method = str(raw.get("method") or "")
         req_id = raw.get("id")
         if method == "session/request_permission":
-            option_id = _select_permission_option_id(raw.get("params"))
+            params = raw.get("params")
+            option_id = self._resolve_permission_option(params)
             result = {"outcome": {"outcome": "selected", "optionId": option_id}}
-            log.debug("auto-approved permission option_id=%s", option_id)
         elif method == "cursor/ask_question":
             result = {
                 "outcome": {
@@ -194,6 +205,83 @@ class ACPClient:
         except OSError as e:
             log.warning("write agent-request response failed: %s", e)
 
+    def _resolve_permission_option(self, params: Any) -> str:
+        from .permission import (
+            DEFAULT_PERMISSION_TIMEOUT,
+            extract_tool_meta,
+            parse_permission_options,
+        )
+        from .security import (
+            extract_permission_paths,
+            permission_should_deny,
+            select_reject_permission_option_id,
+        )
+
+        policy = self.security_policy
+        if policy is not None and permission_should_deny(policy, params):
+            option_id = select_reject_permission_option_id(params)
+            log.info("denied permission outside allowed roots option_id=%s", option_id)
+            return option_id
+
+        permit_all = True if policy is None else bool(getattr(policy, "permit_all", True))
+        if permit_all or self.permissions is None:
+            option_id = _select_permission_option_id(params)
+            log.debug("auto-approved permission option_id=%s", option_id)
+            return option_id
+
+        title, tool_call_id = extract_tool_meta(params)
+        options = parse_permission_options(params)
+        permission_id, wait_ev = self.permissions.register("")
+        paths = extract_permission_paths(params)
+        input_payload = {
+            "permission_id": permission_id,
+            "task_id": self.task_id,
+            "options": [o.to_dict() for o in options],
+            "paths": paths,
+            "tool_call_id": tool_call_id,
+        }
+        if self.on_message is not None:
+            self.on_message(
+                {
+                    "type": "permission-request",
+                    "tool": title,
+                    "call_id": permission_id,
+                    "content": title,
+                    "input": input_payload,
+                }
+            )
+
+        option_id = self.permissions.wait(
+            permission_id, wait_ev, DEFAULT_PERMISSION_TIMEOUT
+        )
+        if not option_id:
+            option_id = select_reject_permission_option_id(params)
+            log.info(
+                "permission request timed out or cancelled; denying permission_id=%s option_id=%s",
+                permission_id,
+                option_id,
+            )
+        else:
+            log.info(
+                "permission resolved by user permission_id=%s option_id=%s",
+                permission_id,
+                option_id,
+            )
+        if self.on_message is not None:
+            self.on_message(
+                {
+                    "type": "permission-result",
+                    "tool": title,
+                    "call_id": permission_id,
+                    "content": option_id,
+                    "input": {
+                        "permission_id": permission_id,
+                        "option_id": option_id,
+                    },
+                }
+            )
+        return option_id
+
     def _handle_notification(self, raw: dict[str, Any]) -> None:
         method = str(raw.get("method") or "")
         if method not in ("session/update", "session/notification"):
@@ -236,7 +324,9 @@ class ACPClient:
             if self.on_message:
                 self.on_message(
                     {
-                        "type": "tool-use",
+                        # Server/UI wire format uses underscores (Go daemon maps
+                        # internal "tool-use" → "tool_use" before ReportTaskMessages).
+                        "type": "tool_use",
                         "tool": tool_name,
                         "call_id": call_id,
                         "input": raw_input,
@@ -271,8 +361,18 @@ class ACPClient:
         output = str(data.get("rawOutput") or data.get("output") or "")
         if not output:
             output = _extract_tool_call_text(content)
+        tool_name = ""
+        if pending is not None:
+            tool_name = pending.tool_name or ""
         if self.on_message:
-            self.on_message({"type": "tool-result", "call_id": call_id, "output": output})
+            self.on_message(
+                {
+                    "type": "tool_result",
+                    "tool": tool_name or "tool",
+                    "call_id": call_id,
+                    "output": output,
+                }
+            )
 
     def _emit_deferred_tool_use(self, pending: _PendingTool | None, call_id: str, data: dict) -> None:
         if pending is not None and pending.emitted:
@@ -300,7 +400,12 @@ class ACPClient:
             inp = {}
         if self.on_message:
             self.on_message(
-                {"type": "tool-use", "tool": tool_name, "call_id": call_id, "input": inp}
+                {
+                    "type": "tool_use",
+                    "tool": tool_name,
+                    "call_id": call_id,
+                    "input": inp,
+                }
             )
 
     def _track_tool(self, call_id: str, p: _PendingTool) -> None:
@@ -397,6 +502,7 @@ def _select_permission_option_id(params: Any) -> str:
     return fallback
 
 
+
 def _normalize_update(data: Any) -> tuple[str, Any]:
     if not isinstance(data, dict):
         return "", data

{aicortexpy-0.2.0 → aicortexpy-0.2.2}/aicortexpy/acp_conn.py

@@ -25,6 +25,7 @@ from .acp_client import (
 )
 from .acp_errors import ACPProviderErrorSniffer, promote_acp_result_on_provider_error
 from .procutil import kill_process_tree, popen_kwargs_for_killable_group
+from .security import SecurityPolicy, build_cursor_acp_global_flags, default_security_policy
 
 log = logging.getLogger("aicortexpy.acp")
 
@@ -203,6 +204,8 @@ class _BaseACPConn:
         on_message: MessageCB | None = None,
         idle_watchdog: float = 0,
         cancel_event: threading.Event | None = None,
+        permissions: Any = None,
+        task_id: str = "",
     ) -> ACPPromptResult:
         if self._closed or not self._client or not self._session_id:
             return ACPPromptResult(
@@ -211,6 +214,10 @@ class _BaseACPConn:
                 error=f"{self.provider} acp connection closed",
             )
         client = self._client
+        if permissions is not None:
+            client.permissions = permissions
+        if task_id:
+            client.task_id = task_id
         output_parts: list[str] = []
         messages: list[dict[str, Any]] = []
         prompt_done = threading.Event()
@@ -226,9 +233,9 @@ class _BaseACPConn:
             typ = msg.get("type")
             if typ == "text":
                 output_parts.append(str(msg.get("content") or ""))
-            elif typ == "tool-use":
+            elif typ in ("tool_use", "tool-use"):
                 in_flight_tools["n"] += 1
-            elif typ == "tool-result":
+            elif typ in ("tool_result", "tool-result"):
                 in_flight_tools["n"] = max(0, in_flight_tools["n"] - 1)
             messages.append(msg)
             if on_message:
@@ -368,6 +375,7 @@ class _BaseACPConn:
         env: dict[str, str] | None,
         *,
         tool_name_fn: Callable[[str, str], str],
+        security_policy: SecurityPolicy | None = None,
     ) -> None:
         kwargs = popen_kwargs_for_killable_group()
         kwargs.update(_hide_window())
@@ -393,7 +401,11 @@ class _BaseACPConn:
             write_through=True,
             line_buffering=True,
         )
-        self._client = ACPClient(self._stdin_text, tool_name_fn=tool_name_fn)
+        self._client = ACPClient(
+            self._stdin_text,
+            tool_name_fn=tool_name_fn,
+            security_policy=security_policy or default_security_policy(),
+        )
         threading.Thread(target=self._read_stdout, name=f"{self.provider}-acp-out", daemon=True).start()
         threading.Thread(target=self._read_stderr, name=f"{self.provider}-acp-err", daemon=True).start()
         log.info("%s acp started pid=%s cwd=%s", self.provider, self._proc.pid, cwd)
@@ -557,16 +569,26 @@ class CursorACPConn(_BaseACPConn):
         timeout: float = 0,
         env: dict[str, str] | None = None,
         allow_resume: bool = False,
+        security_policy: SecurityPolicy | None = None,
     ) -> CursorACPConn:
         path = shutil.which(executable) or executable
+        policy = security_policy or default_security_policy()
         blocked = {"acp", "--yolo", "--force", "--sandbox", "--trust"}
         filtered = _filter_blocked(list(custom_args or []), blocked, {"--sandbox"})
-        acp_args = ["--yolo", "--trust", "--sandbox", "disabled", "acp", *filtered]
+        acp_args = [*build_cursor_acp_global_flags(policy), "acp", *filtered]
         argv0, cmd_args = choose_cursor_invocation(path, acp_args)
         argv = [argv0, *cmd_args]
         conn = cls()
         work = cwd or str(Path.cwd())
-        conn._start_process(argv, work, env, tool_name_fn=hermes_tool_name_from_title)
+        if policy.allowed_roots_enabled and work and work not in policy.allowed_roots:
+            policy.allowed_roots = [*policy.allowed_roots, work]
+        conn._start_process(
+            argv,
+            work,
+            env,
+            tool_name_fn=hermes_tool_name_from_title,
+            security_policy=policy,
+        )
         hs = HANDSHAKE_TIMEOUT
         if timeout > 0:
             hs = min(hs, timeout)
@@ -600,16 +622,29 @@ class KiroACPConn(_BaseACPConn):
         custom_args: list[str] | None = None,
         timeout: float = 0,
         env: dict[str, str] | None = None,
+        security_policy: SecurityPolicy | None = None,
     ) -> KiroACPConn:
         path = shutil.which(executable) or executable
+        policy = security_policy or default_security_policy()
         blocked = {"acp", "-a", "--trust-all-tools", "--trust-tools"}
         filtered = _filter_blocked(
             list(custom_args or []), blocked, {"--trust-tools"}
         )
-        argv = [path, "acp", "--trust-all-tools", *filtered]
+        argv = [path, "acp"]
+        if policy.permit_all:
+            argv.append("--trust-all-tools")
+        argv.extend(filtered)
         conn = cls()
         work = cwd or str(Path.cwd())
-        conn._start_process(argv, work, env, tool_name_fn=kiro_tool_name)
+        if policy.allowed_roots_enabled and work and work not in policy.allowed_roots:
+            policy.allowed_roots = [*policy.allowed_roots, work]
+        conn._start_process(
+            argv,
+            work,
+            env,
+            tool_name_fn=kiro_tool_name,
+            security_policy=policy,
+        )
         hs = timeout if timeout > 0 else HANDSHAKE_TIMEOUT
         try:
             conn._handshake(
@@ -754,6 +789,7 @@ def open_acp_conn(
     custom_args: list[str] | None = None,
     timeout: float = 0,
     env: dict[str, str] | None = None,
+    security_policy: SecurityPolicy | None = None,
 ) -> _BaseACPConn:
     if provider == "cursor":
         return CursorACPConn.open(
@@ -765,6 +801,7 @@ def open_acp_conn(
             timeout=timeout,
             env=env,
             allow_resume=False,
+            security_policy=security_policy,
         )
     if provider == "kiro":
         return KiroACPConn.open(
@@ -775,6 +812,7 @@ def open_acp_conn(
             custom_args=custom_args,
             timeout=timeout,
             env=env,
+            security_policy=security_policy,
         )
     if provider == "hermes":
         return HermesACPConn.open(
@@ -824,6 +862,9 @@ def run_acp_oneshot(
     on_message: MessageCB | None = None,
     cancel_event: threading.Event | None = None,
     idle_watchdog: float = 0,
+    security_policy: SecurityPolicy | None = None,
+    permissions: Any = None,
+    task_id: str = "",
 ) -> ACPPromptResult:
     """One-shot ACP turn (open → prompt → close). Used for non-chat kiro/hermes/kimi/dsh."""
     t = timeout if timeout > 0 else PROMPT_TIMEOUT
@@ -837,6 +878,7 @@ def run_acp_oneshot(
             custom_args=custom_args,
             timeout=t,
             env=env,
+            security_policy=security_policy,
         )
     except Exception as e:
         return ACPPromptResult(status="failed", output="", error=f"{provider} acp open failed: {e}")
@@ -848,6 +890,8 @@ def run_acp_oneshot(
             on_message=on_message,
             idle_watchdog=idle_watchdog,
             cancel_event=cancel_event,
+            permissions=permissions,
+            task_id=task_id,
         )
     finally:
         conn.close()

{aicortexpy-0.2.0 → aicortexpy-0.2.2}/aicortexpy/agent_env.py

@@ -51,7 +51,11 @@ def _aicortex_bin_dir() -> str | None:
 
 
 def ensure_cli_shim_dir(state_dir: Path) -> Path | None:
-    """Write a tiny aicortex shim so agents resolve to python -m aicortexpy."""
+    """Write a tiny aicortex shim so agents resolve to `python -m aicortex`.
+
+    Prefer .cmd on Windows so PATH resolution does not depend on aicortex.exe
+    (pip console_scripts launcher / Go installer binary detection).
+    """
     shim_dir = state_dir / "py-cli-shim"
     try:
         shim_dir.mkdir(parents=True, exist_ok=True)
@@ -63,12 +67,19 @@ def ensure_cli_shim_dir(state_dir: Path) -> Path | None:
     if sys.platform == "win32":
         cmd = shim_dir / "aicortex.cmd"
         cmd.write_text(
-            f'@echo off\r\n"{py}" -m aicortexpy %*\r\n',
+            f'@echo off\r\n"{py}" -m aicortex %*\r\n',
             encoding="utf-8",
         )
+        # Drop a stale pip console_scripts aicortex.exe in this shim dir if any.
+        stale = shim_dir / "aicortex.exe"
+        if stale.is_file():
+            try:
+                stale.unlink()
+            except OSError:
+                pass
     else:
         sh = shim_dir / "aicortex"
-        sh.write_text(f'#!/bin/sh\nexec "{py}" -m aicortexpy "$@"\n', encoding="utf-8")
+        sh.write_text(f'#!/bin/sh\nexec "{py}" -m aicortex "$@"\n', encoding="utf-8")
         try:
             sh.chmod(0o755)
         except OSError:

{aicortexpy-0.2.0 → aicortexpy-0.2.2}/aicortexpy/attachments.py

@@ -61,7 +61,9 @@ def materialize_attachments(
         if not att_id:
             continue
         try:
-            body, header_name = client.fetch_attachment_bytes(att_id)
+            body, header_name = client.fetch_attachment_bytes(
+                att_id, task.workspace_id
+            )
         except Exception as e:
             log.warning("fetch attachment failed id=%s: %s", att_id, e)
             continue

{aicortexpy-0.2.0 → aicortexpy-0.2.2}/aicortexpy/chat_acp_pool.py

@@ -17,6 +17,7 @@ from .acp_conn import (
     kiro_acp_supported,
 )
 from .config import AgentEntry, Config
+from .security import SecurityPolicy
 
 log = logging.getLogger("aicortexpy.acp_pool")
 
@@ -101,6 +102,9 @@ class ChatACPPool:
         on_message: Any | None = None,
         idle_watchdog: float = 0,
         system_prompt: str = "",
+        security_policy: SecurityPolicy | None = None,
+        permissions: Any = None,
+        task_id: str = "",
     ) -> ACPPromptResult:
         key = pool_key(provider, chat_session_id, agent_id, work_dir)
         entry = self._get_or_create(key, provider, chat_session_id, agent_id, work_dir, model)
@@ -121,6 +125,7 @@ class ChatACPPool:
                         custom_args=custom_args,
                         timeout=timeout,
                         env=env,
+                        security_policy=security_policy,
                     )
                     entry.model = model
                     log.info("%s chat acp pool miss chat=%s", provider, chat_session_id[:8])
@@ -144,6 +149,8 @@ class ChatACPPool:
                 on_message=on_message,
                 idle_watchdog=idle_watchdog,
                 cancel_event=cancel_event,
+                permissions=permissions,
+                task_id=task_id,
             )
 
             if not result.session_id and entry.conn.session_id():
@@ -173,6 +180,7 @@ class ChatACPPool:
         custom_args: list[str],
         timeout: float,
         env: dict[str, str] | None,
+        security_policy: SecurityPolicy | None = None,
     ) -> ACPChatConn:
         entry = self._agents.get(provider)
         if not entry:
@@ -186,6 +194,7 @@ class ChatACPPool:
                 custom_args=custom_args,
                 timeout=timeout,
                 env=env,
+                security_policy=security_policy,
             )
         if provider == "kiro":
             return KiroACPConn.open(
@@ -196,6 +205,7 @@ class ChatACPPool:
                 custom_args=custom_args,
                 timeout=timeout,
                 env=env,
+                security_policy=security_policy,
             )
         raise RuntimeError(f"chat acp pool: unsupported provider {provider!r}")
 

{aicortexpy-0.2.0 → aicortexpy-0.2.2}/aicortexpy/cli.py

@@ -22,8 +22,10 @@ from .commands import (
     project_cmd,
     repo_cmd,
     runtime_cmd,
+    setup_cmd,
     skill_cmd,
     squad_cmd,
+    update_cmd,
     version_cmd,
     workspace_cmd,
 )
@@ -41,12 +43,31 @@ _LEGACY_DAEMON = {
 }
 
 
-def _setup_logging(verbose: bool = False) -> None:
-    level = logging.DEBUG if verbose else logging.WARNING
+def _setup_logging(
+    verbose: bool = False,
+    *,
+    log_level: str = "",
+    daemon_mode: bool = False,
+) -> None:
+    """Configure root logging.
+
+    - CLI one-shots default to WARNING (quiet).
+    - Daemon run defaults to INFO (useful in python-aicortex.log).
+    - `-v` or `--log-level DEBUG` enables DEBUG.
+    """
+    if log_level:
+        level = getattr(logging, log_level.upper(), logging.INFO)
+    elif verbose:
+        level = logging.DEBUG
+    elif daemon_mode:
+        level = logging.INFO
+    else:
+        level = logging.WARNING
     logging.basicConfig(
         level=level,
         format="%(asctime)s %(levelname)s %(name)s: %(message)s",
         datefmt="%H:%M:%S",
+        force=True,
     )
 
 
@@ -80,6 +101,8 @@ def build_parser() -> argparse.ArgumentParser:
     config_cmd.add_parser(sub)
     daemon_cmd.add_parser(sub)
     runtime_cmd.add_parser(sub)
+    setup_cmd.add_parser(sub)
+    update_cmd.add_parser(sub)
     version_cmd.add_parser(sub)
     return p
 
@@ -100,8 +123,15 @@ def main(argv: list[str] | None = None) -> int:
     except SystemExit as e:
         return int(e.code) if isinstance(e.code, int) else 1
 
-    _setup_logging(getattr(ns, "verbose", False))
     cmd = ns.command
+    _setup_logging(
+        getattr(ns, "verbose", False),
+        log_level=str(getattr(ns, "log_level", "") or ""),
+        daemon_mode=(
+            cmd == "daemon"
+            and getattr(ns, "daemon_command", "") in {"start", "run", "restart"}
+        ),
+    )
 
     handlers = {
         "issue": issue_cmd.run,
@@ -123,6 +153,8 @@ def main(argv: list[str] | None = None) -> int:
         "version": version_cmd.run,
         "login": auth_cmd.run_login,
         "auth": auth_cmd.run_auth,
+        "setup": setup_cmd.run,
+        "update": update_cmd.run,
     }
     handler = handlers.get(cmd)
     if not handler:

{aicortexpy-0.2.0 → aicortexpy-0.2.2}/aicortexpy/client.py

@@ -422,10 +422,17 @@ class DaemonClient:
         data = self.get(f"/api/daemon/workspaces/{workspace_id}/repos")
         return data if isinstance(data, dict) else {}
 
-    def fetch_attachment_bytes(self, attachment_id: str) -> tuple[bytes, str]:
+    def fetch_attachment_bytes(
+        self, attachment_id: str, workspace_id: str = ""
+    ) -> tuple[bytes, str]:
         path = f"/api/daemon/attachments/{attachment_id}/bytes"
         url = self.base_url + path
-        req = urllib.request.Request(url, headers=self._headers(), method="GET")
+        headers = self._headers()
+        wid = (workspace_id or "").strip()
+        if wid:
+            # PAT/JWT daemon auth has no workspace in context; server requires it.
+            headers["X-Workspace-ID"] = wid
+        req = urllib.request.Request(url, headers=headers, method="GET")
         try:
             with urllib.request.urlopen(req, timeout=self.timeout, context=self._ctx) as resp:
                 body = resp.read(MAX_ATTACHMENT_BYTES + 1)