akashcli 4.6.7__tar.gz → 4.6.9__tar.gz

{akashcli-4.6.7 → akashcli-4.6.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: akashcli
-Version: 4.6.7
+Version: 4.6.9
 Summary: Akash CLI — secure remote shell relay, file vault, and device management
 License-Expression: MIT
 Keywords: akash,cli,relay,remote-shell,vault

{akashcli-4.6.7 → akashcli-4.6.9}/akashcli/__init__.py

@@ -2,6 +2,6 @@ try:
     from importlib.metadata import version
     __version__ = version("akashcli")
 except Exception:
-    __version__ = "4.6.7"
+    __version__ = "4.6.9"
 
 AKASH_VERSION = __version__

{akashcli-4.6.7 → akashcli-4.6.9}/akashcli/cli.py

@@ -1,3 +1,4 @@
+import time
 import os
 import sys
 import json
@@ -14,6 +15,7 @@ from .client import AkashClient
 from .auth import AuthManager
 from .config import ConfigManager
 from .exceptions import AkashError
+from .exec import _device_fingerprint
 from .uploader import VaultUploader
 
 # ── ANSI palette (matches exec.py) ───────────────────────────────────────────
@@ -40,25 +42,37 @@ def _gr(s: str) -> str:          return f"{_GR}{s}{_RS}"
 
 # ── Spinner (single-line, no flicker) ────────────────────────────────────────
 class _Spin:
-    """Minimal inline spinner - uses \r, no alternate screen, no deps."""
+    """Minimal inline spinner with instant frame-0 rendering, smooth 350ms visibility, and clean cleanup."""
     _FRAMES = ("⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏")
 
-    def __init__(self, label: str):
+    def __init__(self, label: str, min_seconds: float = 0.35, disabled: bool = False):
         self._label = label
+        self._disabled = disabled or (not sys.stdout.isatty())
+        self._min_seconds = min_seconds
         self._i = 0
         self._active = False
         self._thread = None
+        self._t0 = 0.0
 
     def __enter__(self):
+        if self._disabled:
+            return self
         import threading, time
         self._active = True
+        self._t0 = time.monotonic()
+        cr = chr(13)
+        sys.stdout.write(cr + "  " + _C + self._FRAMES[0] + _RS + "  " + _DM + self._label + _RS + "  ")
+        sys.stdout.flush()
+
         def _spin():
+            time.sleep(0.04)
             while self._active:
                 f = self._FRAMES[self._i % len(self._FRAMES)]
-                sys.stdout.write(f"\r  {_C}{f}{_RS}  {_DM}{self._label}{_RS}  ")
+                sys.stdout.write(chr(13) + "  " + _C + f + _RS + "  " + _DM + self._label + _RS + "  ")
                 sys.stdout.flush()
                 self._i += 1
-                time.sleep(0.08)
+                time.sleep(0.07)
+
         self._thread = threading.Thread(target=_spin, daemon=True)
         self._thread.start()
         return self
@@ -67,22 +81,28 @@ class _Spin:
         self._label = label
 
     def __exit__(self, *_):
+        if self._disabled:
+            return
+        import time
+        elapsed = time.monotonic() - self._t0
+        if elapsed < self._min_seconds:
+            time.sleep(self._min_seconds - elapsed)
         self._active = False
         if self._thread:
-            self._thread.join(timeout=0.3)
-        sys.stdout.write("\r\033[2K")  # clear line
+            self._thread.join(timeout=0.2)
+        sys.stdout.write(chr(13) + chr(27) + "[2K")
         sys.stdout.flush()
 
-
-def _resolve_client(url_override: str = None, require_key: bool = False):
+def _resolve_client(url_override: str = None, require_key: bool = False, silent: bool = False):
     """
     Return (api_key_or_None, base_url).
+
     require_key=True  - hard-fail with a clear message if no key found
+                        (used by serve/devices which cannot work without server auth).
     require_key=False - return None for api_key if missing; caller shows warning
+                        and can offer a local/offline fallback.
     """
     import os as _os
-    from urllib.parse import urlparse as _up
-    from ._net import patch_dns_globally as _patch_dns
     config = ConfigManager.load()
     base = (
         url_override
@@ -90,19 +110,19 @@ def _resolve_client(url_override: str = None, require_key: bool = False):
         or config.get("api_url", "https://jstore.2bd.net")
     ).rstrip("/")
 
-    host = _up(base).hostname or ""
-    if host:
-        try: _patch_dns(host)
-        except Exception: pass
-
     api_key = _os.getenv("AKASH_API_KEY") or config.get("api_key") or None
 
     if not api_key and require_key:
-        print(f"  {_Y}!{_RS}  No API key found.")
-        print(f"  {_DM}Run {_C}akash login{_RS}{_DM} to save your key, or set {_C}AKASH_API_KEY{_RS}{_DM}.{_RS}")
+        if not silent:
+            print(f"  {_Y}!{_RS}  No API key found.")
+            print(f"  {_DM}Run {_C}akash login{_RS}{_DM} to save your key, or set {_C}AKASH_API_KEY{_RS}{_DM}.{_RS}")
+        import sys
+        if silent: sys.exit(1)
         raise typer.Exit(1)
 
     return api_key, base
+
+
 _GUEST_WARNING = (
     f"  {_Y}⚠{_RS}  {_Y}Running as guest{_RS} - not logged in.\n"
     f"  {_DM}Features are limited and your data won't be saved to the cloud.\n"
@@ -143,13 +163,6 @@ def _upload_with_progress(client: AkashClient, tmp_path: str, password=None) ->
 # `app`       - primary commands (backup / restore / pull / run / shell …)
 # `cloud_app` - file management (akash cloud upload/files/stream/delete/manage/bulk)
 
-
-def _version_callback(value: bool):
-    if value:
-        from . import __version__
-        print("akashcli v" + __version__)
-        raise typer.Exit(0)
-
 app = typer.Typer(
     invoke_without_command=True,
     rich_markup_mode=None,
@@ -166,11 +179,18 @@ def _print_version(value: bool):
         print(f"akashcli v{__version__}")
         raise typer.Exit(0)
 
+def _version_callback(value: bool):
+    if value:
+        from . import __version__
+        print(f"akashcli v{__version__}")
+        raise typer.Exit(0)
+
+def raise_exit():
+    raise typer.Exit(0)
+
 @app.callback(invoke_without_command=True)
 def _main(ctx: typer.Context,
-          version: bool = typer.Option(False, "--version", "-v", is_eager=True, expose_value=False,
-                                       callback=_print_version,
-                                       help="Show version and exit."),
+          version: Optional[bool] = typer.Option(None, "--version", "-v", callback=_version_callback, is_eager=True, help="Show version and exit."),
           help: bool = typer.Option(False, "--help", "-h", is_eager=True, expose_value=False,
                                     callback=lambda v: (_print_help(), raise_exit()) if v else None,
                                     help="Show this message and exit.")):
@@ -179,8 +199,6 @@ def _main(ctx: typer.Context,
         _print_help()
         raise typer.Exit(0)
 
-
-
 def _print_help():
     C, G, Y, DM, RS = _C, _G, _Y, _DM, _RS
     lines = [
@@ -190,6 +208,7 @@ def _print_help():
         f"  {DM}ACCOUNT{RS}",
         f"  {C}login{RS}    {DM}[--label NAME]{RS}      save your API key + name this device",
         f"  {C}whoami{RS}                        show account info and storage quota",
+        f"  {C}version{RS}                       show CLI and server version",
         f"  {C}logout{RS}                        clear saved credentials",
         f"",
         f"  {DM}TERMINAL BACKUP{RS}",
@@ -276,22 +295,24 @@ def login(
 
 # ── akash whoami ─────────────────────────────────────────────────────────────
 
-
 @app.command()
 def version(url: Optional[str] = typer.Option(None, "--url", help="Server URL to check")):
-    """Show akash CLI version and connected server version."""
+    """Show akash CLI and connected server version with animated status."""
     from . import __version__
     ver_tag = "v" + __version__
     print(f"\n  {_C}◈{_RS}  {_W}akashcli{_RS}  {_cy(ver_tag)}")
     try:
-        _, base = _resolve_client(url, require_key=False)
-        resp = httpx.get(f"{base}/health", timeout=3.0)
+        with _Spin("querying server status…"):
+            _, base = _resolve_client(url, require_key=False, silent=True)
+            resp = httpx.get(f"{base}/health", timeout=8.0)
         if resp.status_code == 200:
             s_ver = resp.json().get("version", "unknown")
-            srv_tag = "(" + s_ver + ")"
-            print(f"  {_DM}server   {_RS}{_cy(base)}  {_dim(srv_tag)}")
+            srv_str = "(" + s_ver + ")"
+            print(f"  {_DM}server   {_RS}{_cy(base)}  {_dim(srv_str)}")
+        else:
+            print(f"  {_DM}server   {_RS}{_cy(base)}  {_dim(f'(HTTP {resp.status_code})')}")
     except Exception:
-        pass
+        print(f"  {_DM}server   {_RS}{_cy(base)}  {_dim('(unreachable)')}")
     print()
 
 @app.command()
@@ -352,7 +373,8 @@ def cloud_files(raw: bool = typer.Option(False, "--json", help="Raw JSON output"
     """List all files stored in the cloud."""
     try:
         client = AkashClient()
-        file_list = client.list_files()
+        with _Spin("fetching cloud vault files…", disabled=raw):
+            file_list = client.list_files()
 
         if raw:
             print(json.dumps([f.__dict__ for f in file_list], indent=2))
@@ -724,7 +746,8 @@ def saves(raw: bool = typer.Option(False, "--json", help="Raw JSON output")):
 
     try:
         client = AkashClient()
-        snaps = list_snapshots(client)
+        with _Spin("querying cloud saves…", disabled=raw):
+            snaps = list_snapshots(client)
 
         if not snaps:
             _info("no saves found - run `akash backup` to create one")
@@ -790,7 +813,8 @@ def pull(
         params["password"] = password
 
     try:
-        resp = httpx.get(f"{base}/api/recover/{code}", params=params, timeout=15)
+        with _Spin(f"resolving snapshot {code}…"):
+            resp = httpx.get(f"{base}/api/recover/{code}", params=params, timeout=15)
     except Exception as e:
         _err(f"could not reach server: {e}")
         raise typer.Exit(1)
@@ -935,14 +959,15 @@ def check(
     """
     if seal:
         from .integrity import seal as _seal, _manifest_path
-        _info("sealing source integrity…")
-        hashes = _seal()
+        with _Spin("sealing package source files…"):
+            hashes = _seal()
         _ok(f"hashed {len(hashes)} source files")
         _ok(f"manifest → {_dim(str(_manifest_path()))}")
         _info("tamper detection active for backup, restore, and pull")
     else:
         from .integrity import status as _status
-        s = _status()
+        with _Spin("verifying source code integrity…"):
+            s = _status()
         if not s["sealed"]:
             _warn(f"not sealed yet - run {_cy('akash check --seal')} to enable tamper detection")
             return
@@ -1010,9 +1035,14 @@ def run(
             from .relay import connect_run
             _info(f"running on device  {_cy(device or 'auto')}:  {command}")
             _p()
-            with _Spin("connecting to relay…"):
-                pass
-            exit_code = connect_run(api_key, base, command, target=device or None)
+            spin = _Spin(f"connecting to relay ({device or 'auto'})…")
+            spin.__enter__()
+            try:
+                def _on_connected(dev):
+                    spin.__exit__(None, None, None)
+                exit_code = connect_run(api_key, base, command, target=device or None, on_connected=_on_connected)
+            finally:
+                spin.__exit__(None, None, None)
             _p()
             if exit_code == 0:
                 _info("exited 0")
@@ -1202,13 +1232,20 @@ def shell(
             label = device.strip() if device.strip() else None
             _p()
             _info(f"connecting to  {_cy(label or 'auto')}…")
+            spin = _Spin(f"connecting to relay ({label or 'auto'})…")
+            spin.__enter__()
             try:
-                exit_code = connect_shell(api_key, base, target=label)
+                def _on_connected(dev):
+                    spin.__exit__(None, None, None)
+                exit_code = connect_shell(api_key, base, target=label, on_connected=_on_connected)
             except RuntimeError as e:
+                spin.__exit__(None, None, None)
                 _err(str(e))
                 _p()
                 _info(f"Make sure the device is running:  {_cy('akash serve')}")
                 raise typer.Exit(1)
+            finally:
+                spin.__exit__(None, None, None)
             _p()
             _info("session closed")
             if exit_code != 0:
@@ -1272,7 +1309,7 @@ def devices(
       akash serve                     register it as reachable
     """
     try:
-        api_key, base = _resolve_client(require_key=False)
+        api_key, base = _resolve_client(url, require_key=False)
     except typer.Exit:
         raise
     except Exception as e:
@@ -2320,3 +2357,474 @@ def env_pull(
 
 if __name__ == "__main__":
     app()
+
+
+# =============================================================================
+# AKASH AGENT & DEVICE BINDING COMMANDS
+# =============================================================================
+
+agent_app = typer.Typer(help="Manage AI agents, client credentials & device approvals.")
+app.add_typer(agent_app, name="agent", help="agent credentials · device binding · approvals")
+
+def _render_inspection_card(r: dict) -> None:
+    print(f"\n  {_C}╭─ ⚡ INCOMING AGENT DEVICE REGISTRATION ────────────────────────────{_RS}")
+    print(f"  {_GR}│{_RS}  {_DM}Request ID     :{_RS} {_ye(r['request_id'])}")
+    print(f"  {_GR}│{_RS}  {_DM}Client Name    :{_RS} {_W}{r['client_name']}{_RS}")
+    print(f"  {_GR}│{_RS}  {_DM}Client ID      :{_RS} {_dim(r['client_id'])}")
+    print(f"  {_GR}│{_RS}  {_DM}Device Hostname:{_RS} {_W}{r['device_hostname']}{_RS}")
+    print(f"  {_GR}│{_RS}  {_DM}Hardware ID    :{_RS} {_C}{r['device_fingerprint'][:24]}…{_RS}")
+    print(f"  {_GR}│{_RS}  {_DM}IP Address     :{_RS} {_W}{r['ip_address']}{_RS}")
+    print(f"  {_GR}│{_RS}  {_DM}Location       :{_RS} {_W}{r['city']}, {r['country']}{_RS} {_dim('(' + r['isp'] + ')')}")
+    print(f"  {_GR}│{_RS}  {_DM}OS / Platform  :{_RS} {r['device_platform']}")
+    print(f"  {_GR}│{_RS}  {_DM}Target Device  :{_RS} {_ye(r['target_device'])}")
+    print(f"  {_GR}│{_RS}  {_DM}Scopes         :{_RS} {r['requested_scopes']}")
+    print(f"  {_GR}│{_RS}  {_DM}Timestamp      :{_RS} {_dim(r['created_at'])}")
+    print(f"  {_C}╰────────────────────────────────────────────────────────────────────{_RS}")
+
+@agent_app.command("create")
+def agent_create(
+    name: str = typer.Option("Cursor IDE", "--name", "-n", help="Name of the AI Agent / Application"),
+    ttl:  int = typer.Option(7, "--ttl", "-t", help="Validity in days (e.g. 7)"),
+    scopes: str = typer.Option("workspace:read,relay:exec", "--scopes", "-s", help="Comma-separated scopes"),
+    devices: str = typer.Option("*", "--devices", "-d", help="Allowed device labels (e.g. 'termux,laptop' or '*')"),
+    url: Optional[str] = typer.Option(None, "--url", help="Override server URL"),
+):
+    """Generate new Client ID and Client Secret with hardware binding."""
+    api_key, base = _resolve_client(url, require_key=False)
+    hdrs = {"Origin": "https://akash.cli", "x-device-id": _device_fingerprint()}
+    if api_key: hdrs["x-api-key"] = api_key
+    with _Spin("generating agent credentials…"):
+        res = httpx.post(
+            f"{base}/api/agent/app",
+            headers=hdrs,
+            json={"name": name, "ttl_days": ttl, "scopes": scopes, "allowed_devices": devices},
+            timeout=10.0
+        )
+    if res.status_code != 200:
+        _err(f"Failed to create agent credentials: {res.text}")
+        raise typer.Exit(1)
+
+    d = res.json()
+    
+    import json, os, secrets
+    from pathlib import Path
+    agents_file = Path.home() / ".akash" / "agents.json"
+    agents_file.parent.mkdir(parents=True, exist_ok=True)
+    try:
+        agents = json.loads(agents_file.read_text())
+    except Exception:
+        agents = {}
+    
+    profile_id = secrets.token_hex(2)
+    agents[profile_id] = {
+        "client_id": d["client_id"],
+        "client_secret": d["client_secret"],
+        "name": name
+    }
+    agents_file.write_text(json.dumps(agents, indent=2))
+    try: agents_file.chmod(0o600)
+    except OSError: pass
+
+    _p()
+    _ok(f"Agent Credentials Issued & Saved Locally: {_cy(name)}")
+    print(f"  {_DM}Profile ID    :{_RS} {_C}{profile_id}{_RS}")
+    print(f"  {_DM}Client ID     :{_RS} {_ye(d['client_id'])}")
+    print(f"  {_DM}Client Secret :{_RS} {_W}{d['client_secret']}{_RS}")
+    print(f"  {_DM}Expires At    :{_RS} {_dim(d['expires_at'][:19].replace('T', ' '))} UTC ({ttl} days)")
+    _p()
+    _info("To use in Cursor or Claude Desktop, add a Command MCP Server with:")
+    if url:
+        print(f"  {_G}akash mcp serve --id {profile_id} --url {url}{_RS}")
+    else:
+        print(f"  {_G}akash mcp serve --id {profile_id}{_RS}")
+    _p()
+
+@agent_app.command("requests")
+def agent_requests():
+    """List pending device registration requests."""
+    api_key, base = _resolve_client(url, require_key=False)
+    hdrs = {"Origin": "https://akash.cli", "x-device-id": _device_fingerprint()}
+    if api_key: hdrs["x-api-key"] = api_key
+    with _Spin("checking pending device requests…"):
+        res = httpx.get(
+            f"{base}/api/agent/requests",
+            headers=hdrs,
+            timeout=10.0
+        )
+    if res.status_code != 200:
+        _err(f"Failed: {res.text}")
+        raise typer.Exit(1)
+
+    reqs = res.json().get("requests", [])
+    if not reqs:
+        _info("no device registration requests found")
+        return
+
+    _p()
+    print(f"  {_C}◈{_RS}  {_W}Agent Device Registrations{_RS} {_dim(f'({len(reqs)})')}")
+    _p()
+    print(f"  {_DM}{'ID':<12}  {'AGENT':<16}  {'IP':<15}  {'LOCATION':<20}  STATUS{_RS}")
+    print(f"  {_GR}{'─'*72}{_RS}")
+    for r in reqs:
+        st_color = _G if r["status"] == "approved" else (_Y if r["status"] == "pending" else _R)
+        loc = f"{r['city']}, {r['country']}"
+        print(f"  {_ye(r['request_id']):<21} {_W}{r['client_name'][:15]:<16}{_RS} {r['ip_address']:<15} {loc[:19]:<20} {st_color}{r['status'].upper()}{_RS}")
+    _p()
+    _info("Inspect details:  akash agent inspect <ID>")
+    _info("Approve access:   akash agent approve <ID>")
+
+@agent_app.command("inspect")
+def agent_inspect(request_id: str):
+    """View full contextual intelligence card for a request."""
+    api_key, base = _resolve_client(url, require_key=False)
+    hdrs = {"Origin": "https://akash.cli", "x-device-id": _device_fingerprint()}
+    if api_key: hdrs["x-api-key"] = api_key
+    with _Spin(f"inspecting {request_id}…"):
+        res = httpx.get(
+            f"{base}/api/agent/requests",
+            headers=hdrs,
+            timeout=10.0
+        )
+    reqs = res.json().get("requests", [])
+    match = next((r for r in reqs if r["request_id"] == request_id), None)
+    if not match:
+        _err(f"Request ID '{request_id}' not found.")
+        raise typer.Exit(1)
+    _render_inspection_card(match)
+
+@agent_app.command("approve")
+def agent_approve(request_id: str):
+    """Approve a device registration directly from your terminal."""
+    api_key, base = _resolve_client(url, require_key=False)
+    hdrs = {"Origin": "https://akash.cli", "x-device-id": _device_fingerprint()}
+    if api_key: hdrs["x-api-key"] = api_key
+    with _Spin(f"approving {request_id}…"):
+        res = httpx.post(
+            f"{base}/api/agent/requests/{request_id}/approve",
+            headers=hdrs,
+            timeout=10.0
+        )
+    if res.status_code == 200:
+        _ok(f"Device request {_ye(request_id)} APPROVED! Access token released to agent.")
+    else:
+        _err(f"Approval failed: {res.text}")
+
+@agent_app.command("reject")
+def agent_reject(request_id: str):
+    """Reject a device registration request."""
+    api_key, base = _resolve_client(url, require_key=False)
+    hdrs = {"Origin": "https://akash.cli", "x-device-id": _device_fingerprint()}
+    if api_key: hdrs["x-api-key"] = api_key
+    with _Spin(f"rejecting {request_id}…"):
+        res = httpx.post(
+            f"{base}/api/agent/requests/{request_id}/reject",
+            headers=hdrs,
+            timeout=10.0
+        )
+    if res.status_code == 200:
+        _ok(f"Device request {_ye(request_id)} REJECTED.")
+    else:
+        _err(f"Rejection failed: {res.text}")
+
+@app.command("guard")
+def guard_console(url: Optional[str] = typer.Option(None, "--url", help="Override server URL")):
+    import time
+    """Interactive real-time terminal console that listens for agent access requests."""
+    api_key, base = _resolve_client(url, require_key=False)
+    hdrs = {"Origin": "https://akash.cli", "x-device-id": _device_fingerprint()}
+    if api_key: hdrs["x-api-key"] = api_key
+    print(f"\n  {_G}◉{_RS}  {_W}Akash Guard Console Online{_RS}")
+    print(f"  {_DM}Listening for incoming agent device registrations (Ctrl-C to stop)…{_RS}\n")
+
+    handled_requests = set()
+    while True:
+        try:
+            res = httpx.get(
+                f"{base}/api/agent/requests",
+                headers=hdrs,
+                timeout=5.0
+            )
+            if res.status_code == 200:
+                for r in res.json().get("requests", []):
+                    rid = r["request_id"]
+                    if r["status"] == "pending" and rid not in handled_requests:
+                        _render_inspection_card(r)
+                        try:
+                            sys.stdout.write(f"  Approve access for this device? [y/N]: ")
+                            sys.stdout.flush()
+                            choice = sys.stdin.readline().strip().lower()
+                        except (KeyboardInterrupt, EOFError):
+                            choice = "n"
+
+                        if choice == "y":
+                            httpx.post(f"{base}/api/agent/requests/{rid}/approve", headers=hdrs, timeout=5)
+                            _ok(f"Approved {rid} - Access token released to agent!\n")
+                        else:
+                            httpx.post(f"{base}/api/agent/requests/{rid}/reject", headers=hdrs, timeout=5)
+                            _warn(f"Rejected {rid}.\n")
+                        handled_requests.add(rid)
+            time.sleep(2.0)
+        except KeyboardInterrupt:
+            print(f"\n  {_DM}Guard console stopped.{_RS}\n")
+            break
+        except Exception:
+            time.sleep(3.0)
+
+
+# =============================================================================
+# MODEL CONTEXT PROTOCOL (MCP) SERVER FOR AI AGENTS (Cursor, Claude, AutoGen)
+# =============================================================================
+
+mcp_app = typer.Typer(help="Model Context Protocol (MCP) server for AI agents.")
+app.add_typer(mcp_app, name="mcp", help="Model Context Protocol (MCP) bridge for AI agents")
+
+
+def _sanitize_agent_command(command: str) -> tuple[bool, str]:
+    """Inspects command for destructive patterns, exfiltration pipes, and jail escapes using Regex."""
+    import re
+    cmd = command.strip()
+    cmd_lower = cmd.lower()
+
+    # 1. Block destructive system wipe commands (e.g. rm -rf /, rm -r -f ~)
+    if re.search(r'rm\s+-[a-zA-Z\s]*[rf]+[a-zA-Z\s]*\s+(/|/\*|~|~\/\*)(?:\s|$)', cmd_lower):
+        return False, "CRITICAL SECURITY BLOCK: Destructive system command rejected (rm -rf root/home)."
+    
+    FORBIDDEN_BINARIES = [
+        ":(){ :|:& };:", "mkfs", "dd if=", "> /dev/sda", "> /dev/nvme",
+        "shutdown", "reboot", "init 0", "init 6"
+    ]
+    for fb in FORBIDDEN_BINARIES:
+        if fb in cmd_lower:
+            return False, f"CRITICAL SECURITY BLOCK: Dangerous system command rejected: '{fb}'"
+
+    # 2. Block reverse shells and unverified network pipes (curl/wget ... | bash)
+    if re.search(r'(curl|wget)\b.*?\|\s*(bash|sh|zsh)\b', cmd_lower):
+        return False, "SECURITY BLOCK: Unauthorized network execution pipe rejected."
+        
+    NETWORK_EXFIL = ["/dev/tcp/", "/dev/udp/", "nc -e", "ncat -e", "netcat -e"]
+    for np in NETWORK_EXFIL:
+        if np in cmd_lower:
+            return False, f"SECURITY BLOCK: Potential reverse shell rejected: '{np}'"
+
+    # 3. Block access to private credential directories
+    CREDENTIAL_TARGETS = [
+        ".ssh", ".aws", ".akash/machine.key", ".akash/config.enc",
+        "/etc/shadow", "/etc/sudoers"
+    ]
+    for ct in CREDENTIAL_TARGETS:
+        if ct in cmd_lower:
+            return False, f"SECURITY BLOCK: Access to sensitive credential path rejected: '{ct}'"
+
+    return True, ""
+
+def _redact_agent_output(output: str) -> str:
+    """Masks database passwords, private keys, and API tokens before returning to AI."""
+    from .terminal import sanitize_secret_text
+    return sanitize_secret_text(output)
+
+@mcp_app.command("serve")
+def mcp_serve(
+    url: Optional[str] = typer.Option(None, "--url", help="Override server URL"),
+    client_id: str = typer.Option(None, "--client-id", help="Agent Client ID"),
+    client_secret: str = typer.Option(None, "--client-secret", help="Agent Client Secret"),
+    profile_id: str = typer.Option(None, "--id", help="Local Agent Profile ID")
+):
+    """Runs standard Model Context Protocol (MCP) JSON-RPC 2.0 server over stdio for AI agents."""
+    import sys, json, platform
+    _, base = _resolve_client(url, require_key=False)
+
+    if profile_id:
+        from pathlib import Path
+        try:
+            agents = json.loads((Path.home() / ".akash" / "agents.json").read_text())
+            if profile_id in agents:
+                client_id = agents[profile_id]["client_id"]
+                client_secret = agents[profile_id]["client_secret"]
+        except Exception:
+            pass
+
+    cid = client_id or os.getenv("AKASH_CLIENT_ID")
+    csec = client_secret or os.getenv("AKASH_CLIENT_SECRET")
+
+    if not cid or not csec:
+        sys.stderr.write("\r\n[MCP ERROR] Missing Client ID or Secret. Please pass --id, or --client-id and --client-secret.\r\n")
+        sys.exit(1)
+
+    # 1. Automatic Handshake & Knock
+    dev_fp = _device_fingerprint()
+    hostname = platform.node() or "unknown-host"
+    os_info = f"{platform.system()} {platform.release()} {platform.machine()}"
+
+    token = None
+    # Check if this machine is already approved or needs to knock
+    try:
+        res = httpx.post(f"{base}/api/agent/token", json={
+            "client_id": cid,
+            "client_secret": csec,
+            "device_fingerprint": dev_fp,
+            "hostname": hostname,
+            "platform": os_info,
+            "target_device": "*"
+        }, timeout=5.0)
+
+        if res.status_code == 202:
+            # Device needs human approval in terminal
+            req_id = res.json().get("request_id")
+            sys.stderr.write(f"\r\n[MCP GATE] Device '{hostname}' ({dev_fp[:16]}...) waiting for approval in 'akash guard' terminal...\r\n")
+            sys.stderr.flush()
+
+            # Poll until human types 'y' in akash guard
+            while not token:
+                time.sleep(1.5)
+                poll_res = httpx.get(f"{base}/api/agent/token/poll/{req_id}", timeout=5.0)
+                if poll_res.status_code == 200:
+                    d = poll_res.json()
+                    if d.get("status") == "approved":
+                        token = d.get("access_token")
+                        sys.stderr.write("\r\n[MCP GATE] Device approved! AI Agent connection active.\r\n")
+                        sys.stderr.flush()
+                        break
+                    elif d.get("status") == "rejected":
+                        sys.stderr.write("\r\n[MCP GATE] Device rejected by human in Akash Guard.\r\n")
+                        sys.stderr.flush()
+                        sys.exit(1)
+        elif res.status_code == 200:
+            token = res.json().get("access_token")
+    except Exception as e:
+        sys.stderr.write(f"\r\n[MCP NOTICE] Operating in local sandbox mode ({e})\r\n")
+
+    # 2. Standard MCP Tools Declaration
+    TOOLS = [
+        {
+            "name": "akash_exec_command",
+            "description": "Execute a shell command inside the project workspace. Output is bounded and sanitized.",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "command": {"type": "string", "description": "Command to run (e.g. 'pytest', 'ls -la', 'python3 main.py')"},
+                    "cwd": {"type": "string", "description": "Directory relative to workspace root", "default": "."}
+                },
+                "required": ["command"]
+            }
+        },
+        {
+            "name": "akash_checkpoint_create",
+            "description": "Create an encrypted rollback checkpoint in Akash Vault before editing files.",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "label": {"type": "string", "description": "Checkpoint name (e.g. 'pre_refactor')"}
+                },
+                "required": ["label"]
+            }
+        },
+        {
+            "name": "akash_checkpoint_restore",
+            "description": "Roll back project workspace to a previous checkpoint code if mistakes were made.",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "code": {"type": "string", "description": "Vault code to roll back to"}
+                },
+                "required": ["code"]
+            }
+        }
+    ]
+
+    # 3. JSON-RPC 2.0 stdio message loop (Standard MCP protocol)
+    while True:
+        try:
+            line = sys.stdin.readline()
+            if not line:
+                break
+            msg = json.loads(line.strip())
+            msg_id = msg.get("id")
+            method = msg.get("method")
+            params = msg.get("params", {})
+
+            # JSON-RPC 2.0 Specification: Do NOT respond to Notifications (id is None)
+            if "id" not in msg or msg_id is None:
+                continue
+
+            if method == "initialize":
+                reply = {
+                    "jsonrpc": "2.0",
+                    "id": msg_id,
+                    "result": {
+                        "protocolVersion": "2024-11-05",
+                        "serverInfo": {"name": "akash-mcp", "version": "4.6.7"},
+                        "capabilities": {"tools": {}}
+                    }
+                }
+            elif method == "tools/list":
+                reply = {
+                    "jsonrpc": "2.0",
+                    "id": msg_id,
+                    "result": {"tools": TOOLS}
+                }
+            elif method == "tools/call":
+                tool_name = params.get("name")
+                args = params.get("arguments", {})
+
+                if tool_name == "akash_exec_command":
+                    cmd = args.get("command", "")
+                    
+                    # 1. Pass through Security Firewall
+                    is_safe, sec_reason = _sanitize_agent_command(cmd)
+                    if not is_safe:
+                        sys.stderr.write(f"\r\n🚨 [FIREWALL BLOCKED] {sec_reason}\r\n")
+                        sys.stderr.flush()
+                        reply = {
+                            "jsonrpc": "2.0",
+                            "id": msg_id,
+                            "result": {
+                                "content": [{"type": "text", "text": f"⛔ {sec_reason}"}],
+                                "isError": True
+                            }
+                        }
+                    else:
+                        # 2. Run safely inside workspace with timeout & secret redaction
+                        import subprocess
+                        r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=60)
+                        raw_out = r.stdout + r.stderr
+                        sanitized_out = _redact_agent_output(raw_out)
+                        
+                        # Bounded output ceiling (32 KB max to prevent LLM token flooding)
+                        if len(sanitized_out) > 32768:
+                            sanitized_out = sanitized_out[:32768] + "\n... [Output truncated at 32 KB to protect context window]"
+                        
+                        reply = {
+                            "jsonrpc": "2.0",
+                            "id": msg_id,
+                            "result": {
+                                "content": [{"type": "text", "text": sanitized_out or "(no output)"}],
+                                "isError": r.returncode != 0
+                            }
+                        }
+                elif tool_name == "akash_checkpoint_create":
+                    label = args.get("label", "agent_checkpoint")
+                    from .terminal import build_snapshot
+                    archive_bytes, manifest, name = build_snapshot(label=label)
+                    reply = {
+                        "jsonrpc": "2.0",
+                        "id": msg_id,
+                        "result": {
+                            "content": [{"type": "text", "text": f"Checkpoint '{label}' created successfully ({len(manifest.get('files', []))} files tracked)."}]
+                        }
+                    }
+                else:
+                    reply = {
+                        "jsonrpc": "2.0",
+                        "id": msg_id,
+                        "error": {"code": -32601, "message": f"Tool '{tool_name}' not found."}
+                    }
+            else:
+                reply = {"jsonrpc": "2.0", "id": msg_id, "result": {}}
+
+            sys.stdout.write(json.dumps(reply) + "\n")
+            sys.stdout.flush()
+
+        except Exception as e:
+            err_reply = {"jsonrpc": "2.0", "id": None, "error": {"code": -32603, "message": str(e)}}
+            sys.stdout.write(json.dumps(err_reply) + "\n")
+            sys.stdout.flush()

{akashcli-4.6.7 → akashcli-4.6.9}/akashcli/relay.py

@@ -25,7 +25,7 @@ Wire protocol (all JSON frames over the relay WebSocket):
 
 from __future__ import annotations
 
-AKASH_VERSION = "4.6.7"
+AKASH_VERSION = "4.6.9"
 
 import base64
 import json
@@ -424,7 +424,8 @@ def _handle_pty(ws, frame: dict) -> None:
 # ── connect() — controller side ───────────────────────────────────────────────
 
 def connect_run(api_key: str, base_url: str, command: str,
-                target: Optional[str] = None) -> int:
+                target: Optional[str] = None,
+                on_connected: Optional[Callable[[str], None]] = None) -> int:
     """
     Run a command on a remote device via the relay.
     Returns the remote exit code.
@@ -441,6 +442,8 @@ def connect_run(api_key: str, base_url: str, command: str,
         if ack.get("type") == "error":
             raise RuntimeError(ack.get("message", "relay error"))
         device = ack.get("device", target or "?")
+        if on_connected:
+            on_connected(device)
 
         # Send the run command
         ws.send(json.dumps({"type": "run", "command": command}))
@@ -473,7 +476,8 @@ def connect_run(api_key: str, base_url: str, command: str,
 
 
 def connect_shell(api_key: str, base_url: str,
-                  target: Optional[str] = None) -> int:
+                  target: Optional[str] = None,
+                  on_connected: Optional[Callable[[str], None]] = None) -> int:
     """
     Open a full interactive PTY shell on a remote device via the relay.
     Returns the remote exit code.
@@ -517,6 +521,8 @@ def connect_shell(api_key: str, base_url: str,
                 raise RuntimeError(ack.get("message", "relay error"))
 
             device = ack.get("device", target or "?")
+            if on_connected:
+                on_connected(device)
             # Tell device to open a PTY shell
             ws.send(json.dumps({
                 "type": "pty_run",

{akashcli-4.6.7 → akashcli-4.6.9}/akashcli/uploader.py

@@ -160,39 +160,54 @@ class VaultUploader:
         interval: float = 2.0
     ) -> UploadResult:
         """
-        Polls /api/status/{file_code} until the server reports 'done' or 'error'.
+        Polls /api/status/{file_code} with animated server-stage feedback.
         Blocks for at most `timeout` seconds.
         """
         deadline = time.time() + timeout
         url = f"{self.client.base_url}/api/status/{result.file_code}"
 
-        while time.time() < deadline:
-            time.sleep(interval)
+        spin = None
+        if sys.stdout.isatty():
             try:
-                resp = httpx.get(url, headers=self.client._get_headers(), timeout=10)
-                if resp.status_code == 404:
-                    break  # Task cleaned up — treat as done
-                d = resp.json()
-                status = d.get("status", "")
-                if status == "done":
-                    # file_code may be updated in the task record
-                    final_code = d.get("file_code") or result.file_code
-                    return UploadResult(
-                        status="done",
-                        file_code=final_code,
-                        embed_url=result.embed_url.replace(result.file_code, final_code),
-                        direct_url=result.direct_url.replace(result.file_code, final_code),
-                        input_type=result.input_type,
-                        dna=result.dna
-                    )
-                if status == "error":
-                    raise UploadFailed(f"Server failed to vault file: {d.get('detail', 'unknown error')}")
-            except UploadFailed:
-                raise
+                from .cli import _Spin
+                spin = _Spin(f"vaulting {result.file_code}…")
+                spin.__enter__()
             except Exception:
-                pass  # Transient network hiccup — keep polling
+                spin = None
+
+        try:
+            while time.time() < deadline:
+                time.sleep(interval)
+                try:
+                    resp = httpx.get(url, headers=self.client._get_headers(), timeout=10)
+                    if resp.status_code == 404:
+                        break
+                    d = resp.json()
+                    status = d.get("status", "")
+                    detail = d.get("detail", "")
+                    if spin and (status or detail):
+                        stage_txt = detail or status
+                        spin.update(f"vaulting {result.file_code} ({stage_txt})…")
+                    if status == "done":
+                        final_code = d.get("file_code") or result.file_code
+                        return UploadResult(
+                            status="done",
+                            file_code=final_code,
+                            embed_url=result.embed_url.replace(result.file_code, final_code),
+                            direct_url=result.direct_url.replace(result.file_code, final_code),
+                            input_type=result.input_type,
+                            dna=result.dna
+                        )
+                    if status == "error":
+                        raise UploadFailed(f"Server failed to vault file: {d.get('detail', 'unknown error')}")
+                except UploadFailed:
+                    raise
+                except Exception:
+                    pass
+        finally:
+            if spin:
+                spin.__exit__(None, None, None)
 
-        # Timeout: return what we have (caller can still use embed_url)
         return result
 
     def upload_directory(self, folder_path: str, max_workers: int = 3) -> List[UploadResult]:

{akashcli-4.6.7 → akashcli-4.6.9}/akashcli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: akashcli
-Version: 4.6.7
+Version: 4.6.9
 Summary: Akash CLI — secure remote shell relay, file vault, and device management
 License-Expression: MIT
 Keywords: akash,cli,relay,remote-shell,vault

{akashcli-4.6.7 → akashcli-4.6.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "akashcli"
-version = "4.6.7"
+version = "4.6.9"
 description = "Akash CLI — secure remote shell relay, file vault, and device management"
 readme = "README.md"
 requires-python = ">=3.9"