akashcli 4.7.9__tar.gz → 4.8.1__tar.gz

{akashcli-4.7.9 → akashcli-4.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: akashcli
-Version: 4.7.9
+Version: 4.8.1
 Summary: Akash CLI — secure remote shell relay, file vault, and device management
 License-Expression: MIT
 Keywords: akash,cli,relay,remote-shell,vault

{akashcli-4.7.9 → akashcli-4.8.1}/akashcli/cli.py

@@ -2854,33 +2854,50 @@ def _resolve_agent_id(target_id: str) -> tuple[str, str, str]:
 
 @agent_app.command("scopes")
 def agent_scopes():
-    """View directory of all available roles, scopes, and permission rules with animation."""
+    """View directory of all available roles, presets, scopes, and tools."""
     with _Spin("loading scope directory…"):
         pass
     _p()
-    print(f"  {_C}◈{_RS}  {_W}Akash Agent Scopes & Roles Directory{_RS}")
+    print(f"  {_C}◈{_RS}  {_W}Akash Agent Scopes & Role Presets Directory{_RS}")
+    print(f"  {_GR}────────────────────────────────────────────────────────────{_RS}")
     _p()
-    print(f"  {_DM}ROLE PRESETS (Recommended):{_RS}")
-    print(f"  {_cy('@viewer')}   {_DM}: Read-Only Inspector (Cannot edit code, delete files, or install packages){_RS}")
-    print(f"            {_dim('Scopes: workspace:read, exec:read_only, fs:cwd_only')}")
-    print(f"  {_cy('@coder')}    {_DM}: Safe Developer (Can edit code and test; file deletions blocked){_RS}")
+    print(f"  {_W}ROLE PRESETS:{_RS}")
+    print(f"  {_cy('@viewer')}   {_DM}: Read-Only Inspector (Cannot edit code, delete files, or run mutating commands){_RS}")
+    print(f"            {_dim('Scopes: workspace:read, exec:read_only, fs:cwd_only, limits:max_commands=50')}")
+    print(f"  {_cy('@editor')}   {_DM}: Safe Editor (Can create and edit files; cannot run shell or delete){_RS}")
+    print(f"            {_dim('Scopes: workspace:read, workspace:write, fs:cwd_only, vault:checkpoint')}")
+    print(f"  {_cy('@coder')}    {_DM}: Safe Developer (Can edit code, build, and test; file deletions blocked){_RS}")
     print(f"            {_dim('Scopes: workspace:read, workspace:write, exec:build, fs:cwd_only, fs:no_delete, vault:checkpoint')}")
     print(f"  {_cy('@tester')}   {_DM}: QA Runner (Can build and test; cannot edit source files){_RS}")
     print(f"            {_dim('Scopes: workspace:read, exec:build, fs:cwd_only, limits:timeout=30')}")
+    print(f"  {_cy('@admin')}    {_DM}: Full DevOps & Package Manager (Can edit, install packages, network calls){_RS}")
+    print(f"            {_dim('Scopes: workspace:read, workspace:write, exec:build, exec:package_install, exec:network, vault:checkpoint')}")
     print(f"  {_cy('@full')}     {_DM}: Unrestricted Master Access (*){_RS}")
     _p()
-    print(f"  {_DM}GRANULAR PERMISSION SCOPES:{_RS}")
-    print(f"  {_ye('exec:read_only')}         {_DM}Blocks all mutating commands (touch, mkdir, git commit, sed){_RS}")
-    print(f"  {_ye('fs:no_delete')}           {_DM}Blocks destructive deletions (rm, unlink, git rm){_RS}")
-    print(f"  {_ye('exec:package_install')}   {_DM}Enables installing packages (pip install, npm install){_RS}")
+    print(f"  {_W}GRANULAR PERMISSION SCOPES:{_RS}")
+    print(f"  {_ye('workspace:read')}        {_DM}Enables inspecting files via akash_read_file and akash_list_dir{_RS}")
+    print(f"  {_ye('workspace:write')}       {_DM}Enables writing files via akash_write_file{_RS}")
+    print(f"  {_ye('exec:read_only')}         {_DM}Blocks mutating terminal commands (touch, mkdir, sed, git commit){_RS}")
+    print(f"  {_ye('fs:no_delete')}           {_DM}Blocks destructive deletions (rm, unlink, git rm, rmdir){_RS}")
+    print(f"  {_ye('exec:package_install')}   {_DM}Enables package managers (pip install, npm install, apt){_RS}")
     print(f"  {_ye('exec:network')}           {_DM}Enables outbound network pipes (curl, wget){_RS}")
-    print(f"  {_ye('fs:cwd_only')}            {_DM}Restricts operations strictly to current project root{_RS}")
-    print(f"  {_ye('vault:checkpoint')}       {_DM}Enables time-machine undo snapshots before AI edits{_RS}")
+    print(f"  {_ye('fs:cwd_only')}            {_DM}Restricts operations strictly to current working directory{_RS}")
+    print(f"  {_ye('vault:checkpoint')}       {_DM}Enables automatic undo rollback snapshots before AI edits{_RS}")
     _p()
-    print(f"  {_DM}HOW TO ASSIGN OR UPDATE:{_RS}")
-    print(f"  Create with role :  {_C}akash agent create --name 'Agent' --role @coder{_RS}")
+    print(f"  {_W}AVAILABLE MCP TOOLS:{_RS}")
+    print(f"  • {_C}akash_exec_command{_RS}      {_DM}: Safe terminal runner with secret redaction and process timeouts{_RS}")
+    print(f"  • {_C}akash_read_file{_RS}         {_DM}: Read files with line-range pagination directly into AI context{_RS}")
+    print(f"  • {_C}akash_write_file{_RS}        {_DM}: Write or update files safely on device{_RS}")
+    print(f"  • {_C}akash_list_dir{_RS}          {_DM}: Browse directory trees with sizes, types, and depth control{_RS}")
+    print(f"  • {_C}akash_checkpoint_create{_RS} {_DM}: Create an encrypted rollback snapshot before major changes{_RS}")
+    print(f"  • {_C}akash_undo{_RS}              {_DM}: Revert workspace to pre-action state{_RS}")
+    print(f"  • {_C}akash_scope_details{_RS}     {_DM}: Introspect active permissions and security rules{_RS}")
+    _p()
+    print(f"  {_W}HOW TO ASSIGN OR UPDATE:{_RS}")
+    print(f"  Create with role :  {_C}akash agent create -n 'Dev' -r @coder{_RS}")
+    print(f"  Switch role      :  {_C}akash agent update --id <ID> --role @admin{_RS}")
     print(f"  Add a scope      :  {_C}akash agent update --id <ID> --scopes +exec:package_install{_RS}")
-    print(f"  Switch role      :  {_C}akash agent update --id <ID> --role @viewer{_RS}")
+    print(f"  Inspect agent    :  {_C}akash agent info <ID>{_RS}")
     _p()
 
 @agent_app.command("info")
@@ -3220,18 +3237,39 @@ _LAST_UNDO_DIR = Path.home() / ".akash" / "undo_vault"
 def _save_undo_checkpoint():
     try:
         import tarfile
+        cwd = Path.cwd().resolve()
+        home = Path.home().resolve()
+        # Never archive the full home directory or system root!
+        if cwd == home or cwd == Path("/") or str(cwd).startswith(("/proc", "/sys", "/dev")):
+            return
         _LAST_UNDO_DIR.mkdir(parents=True, exist_ok=True)
         undo_tar = _LAST_UNDO_DIR / "workspace_last.tar.gz"
+        excluded = {".git", "venv", "__pycache__", ".akash", "storage", ".termux", "node_modules", ".cache", "build", "dist"}
         with tarfile.open(undo_tar, "w:gz") as tar:
+            count = 0
             for item in os.listdir("."):
-                if item in (".git", "venv", "__pycache__", ".akash"):
+                if item in excluded or item.startswith(".") or os.path.islink(item):
+                    continue
+                p = Path(item)
+                if not p.exists() or p.is_symlink():
+                    continue
+                try:
+                    if p.is_file() and p.stat().st_size > 5 * 1024 * 1024:
+                        continue
+                except Exception:
                     continue
-                if os.path.exists(item):
-                    tar.add(item)
+                tar.add(item, recursive=True, filter=lambda ti: None if (ti.name in excluded or ti.issym()) else ti)
+                count += 1
+                if count > 100:
+                    break
     except Exception:
         pass
 
 def _restore_undo_checkpoint() -> tuple[bool, str]:
+    cwd = Path.cwd().resolve()
+    home = Path.home().resolve()
+    if cwd == home or cwd == Path("/"):
+        return False, "Undo snapshot is disabled when running in root or home directory for safety."
     undo_tar = _LAST_UNDO_DIR / "workspace_last.tar.gz"
     if not undo_tar.exists():
         return False, "No undo checkpoint available for this session."
@@ -3342,6 +3380,185 @@ def _parse_temp_duration(val: str) -> int:
     elif unit in ('d', 'day', 'days'): return num * 1440
     return num
 
+def _handle_tool_read_file(args: dict, scopes: str) -> tuple[str, bool]:
+    path_str = args.get("path", "").strip()
+    if not path_str:
+        return "Error: 'path' argument is required.", True
+
+    target_path = Path(path_str).expanduser()
+    if not target_path.is_absolute():
+        target_path = (Path.cwd() / target_path).resolve()
+    else:
+        target_path = target_path.resolve()
+
+    scopes_list = [s.strip().lower() for s in scopes.split(",") if s.strip()]
+    if "*" not in scopes_list and "@full" not in scopes_list:
+        if "fs:cwd_only" in scopes_list:
+            cwd = Path.cwd().resolve()
+            try:
+                target_path.relative_to(cwd)
+            except ValueError:
+                return f"⛔ Permission denied by scope 'fs:cwd_only': Path '{path_str}' is outside working directory ({cwd}).", True
+
+    if not target_path.exists():
+        return f"Error: File '{path_str}' not found.", True
+    if target_path.is_dir():
+        return f"Error: '{path_str}' is a directory, not a file. Use akash_list_dir to view directory contents.", True
+
+    start_line = int(args.get("start_line", 1) or 1)
+    end_line = args.get("end_line")
+    end_line = int(end_line) if end_line is not None else None
+    max_bytes = int(args.get("max_bytes", 65536) or 65536)
+
+    try:
+        with open(target_path, "rb") as f:
+            chunk = f.read(1024)
+            if b"\x00" in chunk:
+                return f"Binary file detected ({target_path.stat().st_size} bytes). Raw binary cannot be rendered in text context.", True
+
+        with open(target_path, "r", encoding="utf-8", errors="replace") as f:
+            lines = f.readlines()
+
+        total_lines = len(lines)
+        s_idx = max(0, start_line - 1)
+        e_idx = end_line if end_line is not None else total_lines
+        selected_lines = lines[s_idx:e_idx]
+
+        content = "".join(selected_lines)
+        if len(content.encode("utf-8")) > max_bytes:
+            content = content[:max_bytes] + f"\n... [Output truncated at {max_bytes} bytes]"
+
+        rel_name = target_path.name
+        header = f"=== File: {rel_name} (Lines {s_idx + 1}-{min(e_idx, total_lines)} of {total_lines}) ===\n"
+        return header + content, False
+    except Exception as e:
+        return f"Error reading file '{path_str}': {e}", True
+
+def _handle_tool_write_file(args: dict, scopes: str) -> tuple[str, bool]:
+    path_str = args.get("path", "").strip()
+    content = args.get("content", "")
+    overwrite = args.get("overwrite", True)
+
+    if not path_str:
+        return "Error: 'path' argument is required.", True
+
+    target_path = Path(path_str).expanduser()
+    if not target_path.is_absolute():
+        target_path = (Path.cwd() / target_path).resolve()
+    else:
+        target_path = target_path.resolve()
+
+    scopes_list = [s.strip().lower() for s in scopes.split(",") if s.strip()]
+    if "*" not in scopes_list and "@full" not in scopes_list:
+        if "exec:read_only" in scopes_list or "@viewer" in scopes_list:
+            return "⛔ Permission denied: Agent is in read-only mode ('exec:read_only'). File writing is blocked.", True
+        if "fs:cwd_only" in scopes_list:
+            cwd = Path.cwd().resolve()
+            try:
+                target_path.relative_to(cwd)
+            except ValueError:
+                return f"⛔ Permission denied by scope 'fs:cwd_only': Path '{path_str}' is outside working directory ({cwd}).", True
+
+    if target_path.exists() and not overwrite:
+        return f"Error: File '{path_str}' already exists and overwrite is set to False.", True
+
+    try:
+        target_path.parent.mkdir(parents=True, exist_ok=True)
+        target_path.write_text(content, encoding="utf-8")
+        byte_count = len(content.encode("utf-8"))
+        line_count = len(content.splitlines())
+        return f"✓ File '{path_str}' successfully written ({byte_count} bytes, {line_count} lines).", False
+    except Exception as e:
+        return f"Error writing file '{path_str}': {e}", True
+
+def _handle_tool_list_dir(args: dict, scopes: str) -> tuple[str, bool]:
+    path_str = args.get("path", ".").strip() or "."
+    depth = min(max(int(args.get("depth", 1) or 1), 1), 3)
+
+    target_path = Path(path_str).expanduser()
+    if not target_path.is_absolute():
+        target_path = (Path.cwd() / target_path).resolve()
+    else:
+        target_path = target_path.resolve()
+
+    scopes_list = [s.strip().lower() for s in scopes.split(",") if s.strip()]
+    if "*" not in scopes_list and "@full" not in scopes_list:
+        if "fs:cwd_only" in scopes_list:
+            cwd = Path.cwd().resolve()
+            try:
+                target_path.relative_to(cwd)
+            except ValueError:
+                return f"⛔ Permission denied by scope 'fs:cwd_only': Path '{path_str}' is outside working directory ({cwd}).", True
+
+    if not target_path.exists():
+        return f"Error: Path '{path_str}' not found.", True
+    if not target_path.is_dir():
+        return f"Error: '{path_str}' is not a directory. Use akash_read_file for files.", True
+
+    try:
+        output_lines = [f"Directory listing of: {target_path}"]
+        
+        def _walk(curr_p: Path, cur_depth: int, prefix: str = ""):
+            if cur_depth > depth:
+                return
+            try:
+                entries = sorted(list(curr_p.iterdir()), key=lambda p: (not p.is_dir(), p.name.lower()))
+            except PermissionError:
+                output_lines.append(f"{prefix}└── [Permission Denied]")
+                return
+            
+            excluded = {".git", "__pycache__", "venv", ".akash", "node_modules", "storage", ".cache"}
+            filtered = [e for e in entries if e.name not in excluded and not (e.is_symlink() and e.name == "storage")]
+            
+            for idx, entry in enumerate(filtered[:100]):
+                is_last = (idx == len(filtered) - 1)
+                ptr = "└── " if is_last else "├── "
+                sub_pfx = "    " if is_last else "│   "
+                if entry.is_dir():
+                    output_lines.append(f"{prefix}{ptr}📁 {entry.name}/")
+                    if cur_depth < depth and not entry.is_symlink():
+                        _walk(entry, cur_depth + 1, prefix + sub_pfx)
+                elif entry.is_symlink():
+                    output_lines.append(f"{prefix}{ptr}🔗 {entry.name} -> {os.readlink(entry)}")
+                else:
+                    try:
+                        sz = entry.stat().st_size
+                        sz_str = f"{sz / 1024:.1f}KB" if sz >= 1024 else f"{sz}B"
+                    except Exception:
+                        sz_str = "?"
+                    output_lines.append(f"{prefix}{ptr}📄 {entry.name} ({sz_str})")
+            if len(filtered) > 100:
+                output_lines.append(f"{prefix}... [{len(filtered) - 100} more items omitted]")
+
+        _walk(target_path, 1, "")
+        return "\n".join(output_lines), False
+    except Exception as e:
+        return f"Error listing directory '{path_str}': {e}", True
+
+def _handle_tool_scope_details(scopes: str, profile_name: str, profile_id: str) -> tuple[str, bool]:
+    scopes_list = [s.strip() for s in scopes.split(",") if s.strip()]
+    lines = [
+        f"=== Akash Agent Security Scope Profile ===",
+        f"Profile: {profile_name} (ID: {profile_id})",
+        f"Active Scopes ({len(scopes_list)}): {', '.join(scopes_list)}",
+        "",
+        "Enforced Policies:"
+    ]
+    if "*" in scopes_list or "@full" in scopes_list:
+        lines.append("  • Full Access: No restrictions applied.")
+    else:
+        if "fs:cwd_only" in scopes_list:
+            lines.append("  • Workspace Jailing (fs:cwd_only): Access restricted strictly to current project root; path traversal ('..') is blocked.")
+        if "fs:no_delete" in scopes_list:
+            lines.append("  • Delete Prevention (fs:no_delete): Destructive deletions (rm, rmdir, unlink) are blocked.")
+        if "exec:read_only" in scopes_list or "@viewer" in scopes_list:
+            lines.append("  • Read-Only Mode (exec:read_only): File mutations, file writes, and state changes are blocked.")
+        if "exec:package_install" not in scopes_list:
+            lines.append("  • Package Lock: pip/npm/apt installations are blocked (requires 'exec:package_install').")
+        if "vault:checkpoint" in scopes_list:
+            lines.append("  • Safety Checkpoints (vault:checkpoint): AI modifications create rollback snapshots.")
+    return "\n".join(lines), False
+
 @agent_app.command("serve")
 def mcp_serve(
     url: Optional[str] = typer.Option(None, "--url", help="Override server URL"),
@@ -3390,8 +3607,12 @@ def mcp_serve(
     print("  " + _GR + "──────────────────────────────────────────────────" + _RS)
     print("  " + _DM + "Active Tools:" + _RS)
     print("    • akash_exec_command      " + _dim("(Safe terminal runner)"))
+    print("    • akash_read_file         " + _dim("(Inspect & import files into AI)"))
+    print("    • akash_write_file        " + _dim("(Create or edit workspace files)"))
+    print("    • akash_list_dir          " + _dim("(Explore directory trees)"))
     print("    • akash_checkpoint_create " + _dim("(Rollback snapshot)"))
     print("    • akash_undo              " + _dim("(Revert last AI edit)"))
+    print("    • akash_scope_details     " + _dim("(Inspect active session permissions)"))
     print("  " + _GR + "──────────────────────────────────────────────────" + _RS)
     print("  " + _DM + "[LIVE ACTIVITY]" + _RS)
 
@@ -3466,7 +3687,10 @@ def mcp_serve(
                                 ws.send(json.dumps({
                                     "type": "tool_response",
                                     "id": call_id,
-                                    "result": {"content": [{"type": "text", "text": f"⛔ {sec_reason}"}], "isError": True}
+                                    "result": {
+                                        "content": [{"type": "text", "text": f"⛔ Security Policy Block: {sec_reason}\nCommand: {cmd}"}],
+                                        "isError": True
+                                    }
                                 }))
                             else:
                                 if any(k in cmd for k in ["touch", "mkdir", "mv", "cp", "sed", ">", ">>", "python", "npm", "pip"]):
@@ -3526,10 +3750,17 @@ def mcp_serve(
                                 ec_icon = f"{_G}✓{_RS}" if returncode == 0 else f"{_R}✗{_RS}"
                                 print(f"{ts_pfx}  {ec_icon} {ec_color}exec:{_RS} {disp_cmd} {ec_color}[{returncode}]{_RS} {_dim(f'{elapsed_ms:.1f}ms')}")
 
+                                if returncode != 0:
+                                    res_content = bounded_out or f"Command exited with status code {returncode} (no output)"
+                                    if not res_content.startswith("⛔"):
+                                        res_content = f"⛔ Command execution failed (exit code {returncode}):\n{res_content}"
+                                else:
+                                    res_content = bounded_out or "(command completed successfully with no output)"
+
                                 ws.send(json.dumps({
                                     "type": "tool_response",
                                     "id": call_id,
-                                    "result": {"content": [{"type": "text", "text": bounded_out or "(no output)"}], "isError": returncode != 0}
+                                    "result": {"content": [{"type": "text", "text": res_content}], "isError": returncode != 0}
                                 }))
                         elif t_name == "akash_undo":
                             with _Spin("undo: reverting workspace to checkpoint", min_seconds=0.25, prefix=ts_pfx):
@@ -3554,6 +3785,60 @@ def mcp_serve(
                                 "id": call_id,
                                 "result": {"content": [{"type": "text", "text": f"Checkpoint '{label}' created."}]}
                             }))
+
+                        elif t_name == "akash_read_file":
+                            f_path = args.get("path", "")
+                            disp_f = f_path if len(f_path) <= 32 else f_path[:29] + "…"
+                            with _Spin(f"read: {disp_f}", min_seconds=0.15, prefix=ts_pfx):
+                                res_text, is_err = _handle_tool_read_file(args, cached.get("scopes", "*"))
+                                elapsed_ms = (time.monotonic() - t0) * 1000
+                            icon = f"{_G}✓{_RS}" if not is_err else f"{_R}✗{_RS}"
+                            print(f"{ts_pfx}  {icon} {(_G if not is_err else _R)}read:{_RS} {disp_f} {_dim(f'{elapsed_ms:.1f}ms')}")
+                            ws.send(json.dumps({
+                                "type": "tool_response",
+                                "id": call_id,
+                                "result": {"content": [{"type": "text", "text": res_text}], "isError": is_err}
+                            }))
+
+                        elif t_name == "akash_write_file":
+                            f_path = args.get("path", "")
+                            disp_f = f_path if len(f_path) <= 32 else f_path[:29] + "…"
+                            _save_undo_checkpoint()
+                            with _Spin(f"write: {disp_f}", min_seconds=0.15, prefix=ts_pfx):
+                                res_text, is_err = _handle_tool_write_file(args, cached.get("scopes", "*"))
+                                elapsed_ms = (time.monotonic() - t0) * 1000
+                            icon = f"{_G}✓{_RS}" if not is_err else f"{_R}✗{_RS}"
+                            print(f"{ts_pfx}  {icon} {(_G if not is_err else _R)}write:{_RS} {disp_f} {_dim(f'{elapsed_ms:.1f}ms')}")
+                            ws.send(json.dumps({
+                                "type": "tool_response",
+                                "id": call_id,
+                                "result": {"content": [{"type": "text", "text": res_text}], "isError": is_err}
+                            }))
+
+                        elif t_name == "akash_list_dir":
+                            d_path = args.get("path", ".")
+                            disp_d = d_path if len(d_path) <= 32 else d_path[:29] + "…"
+                            with _Spin(f"list: {disp_d}", min_seconds=0.15, prefix=ts_pfx):
+                                res_text, is_err = _handle_tool_list_dir(args, cached.get("scopes", "*"))
+                                elapsed_ms = (time.monotonic() - t0) * 1000
+                            icon = f"{_G}✓{_RS}" if not is_err else f"{_R}✗{_RS}"
+                            print(f"{ts_pfx}  {icon} {(_G if not is_err else _R)}list:{_RS} {disp_d} {_dim(f'{elapsed_ms:.1f}ms')}")
+                            ws.send(json.dumps({
+                                "type": "tool_response",
+                                "id": call_id,
+                                "result": {"content": [{"type": "text", "text": res_text}], "isError": is_err}
+                            }))
+
+                        elif t_name == "akash_scope_details":
+                            with _Spin("inspecting scopes…", min_seconds=0.15, prefix=ts_pfx):
+                                res_text, is_err = _handle_tool_scope_details(cached.get("scopes", "*"), pname, profile_id)
+                                elapsed_ms = (time.monotonic() - t0) * 1000
+                            print(f"{ts_pfx}  {_C}🔒 scopes:{_RS} {_dim(pname)} {_dim(f'{elapsed_ms:.1f}ms')}")
+                            ws.send(json.dumps({
+                                "type": "tool_response",
+                                "id": call_id,
+                                "result": {"content": [{"type": "text", "text": res_text}], "isError": is_err}
+                            }))
         except KeyboardInterrupt:
             print("\n  " + _DM + "Worker stopped cleanly." + _RS + "\n")
             break

{akashcli-4.7.9 → akashcli-4.8.1}/akashcli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: akashcli
-Version: 4.7.9
+Version: 4.8.1
 Summary: Akash CLI — secure remote shell relay, file vault, and device management
 License-Expression: MIT
 Keywords: akash,cli,relay,remote-shell,vault

{akashcli-4.7.9 → akashcli-4.8.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "akashcli"
-version = "4.7.9"
+version = "4.8.1"
 description = "Akash CLI — secure remote shell relay, file vault, and device management"
 readme = "README.md"
 requires-python = ">=3.9"