cade-cli 0.16.3__tar.gz → 0.16.5__tar.gz

{cade_cli-0.16.3 → cade_cli-0.16.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cade-cli
-Version: 0.16.3
+Version: 0.16.5
 Summary: Cade - The CLI Agent from Arcade.dev (install: curl -fsSL https://arcadeagent.dev/install | sh)
 Project-URL: Homepage, https://arcade.dev
 Project-URL: Documentation, https://arcadeagent.dev/docs
@@ -129,7 +129,7 @@ The script detects your OS/arch, downloads the matching prebuilt binary
 `~/.local/bin`. Pin a version or install location:
 
 ```bash
-CADE_VERSION=0.16.3 CADE_INSTALL_DIR=/usr/local/bin \
+CADE_VERSION=0.16.5 CADE_INSTALL_DIR=/usr/local/bin \
   sh -c "$(curl -fsSL https://arcadeagent.dev/install)"
 ```
 

{cade_cli-0.16.3 → cade_cli-0.16.5}/README.md

@@ -38,7 +38,7 @@ The script detects your OS/arch, downloads the matching prebuilt binary
 `~/.local/bin`. Pin a version or install location:
 
 ```bash
-CADE_VERSION=0.16.3 CADE_INSTALL_DIR=/usr/local/bin \
+CADE_VERSION=0.16.5 CADE_INSTALL_DIR=/usr/local/bin \
   sh -c "$(curl -fsSL https://arcadeagent.dev/install)"
 ```
 

{cade_cli-0.16.3 → cade_cli-0.16.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cade-cli"
-version = "0.16.3"
+version = "0.16.5"
 description = "Cade - The CLI Agent from Arcade.dev (install: curl -fsSL https://arcadeagent.dev/install | sh)"
 readme = "README.md"
 requires-python = ">=3.11"

{cade_cli-0.16.3 → cade_cli-0.16.5}/src/cadecoder/cli/commands/daemon.py

@@ -103,9 +103,16 @@ def start(
     prewarm: list[str] = typer.Option(
         None, "--prewarm", help="Agent to start at boot (repeatable)."
     ),
-    no_auth: bool = typer.Option(
-        False, "--no-auth", help="Loopback only: treat every caller as the local principal."
-    ),
+    auth: Annotated[
+        bool | None,
+        typer.Option(
+            "--auth/--no-auth",
+            help=(
+                "Require bearer tokens. Default: off on loopback (stdio MCP hosts / "
+                "CLI attach), on for non-loopback binds. --no-auth is refused off-loopback."
+            ),
+        ),
+    ] = None,
     verbose: Annotated[
         bool,
         typer.Option(
@@ -117,7 +124,7 @@ def start(
 ) -> None:
     """Run the gateway supervisor in the foreground (serves all agents)."""
     from cadecoder.daemon.lock import DaemonAlreadyRunningError
-    from cadecoder.daemon.server import UnsafeBindError, run_daemon
+    from cadecoder.daemon.server import UnsafeBindError, resolve_require_auth, run_daemon
 
     if verbose:
         from cadecoder.core.logging import setup_logging
@@ -130,9 +137,10 @@ def start(
             "(recv/send/turn/tool/cron/wake/reject) to stdout[/dim]"
         )
 
+    require_auth = resolve_require_auth(bind=bind, auth=auth)
     try:
         code = asyncio.run(
-            run_daemon(bind=bind, prewarm=list(prewarm or []), require_auth=not no_auth)
+            run_daemon(bind=bind, prewarm=list(prewarm or []), require_auth=require_auth)
         )
     except DaemonAlreadyRunningError as e:
         console.print(f"[red]{e}[/red]")

{cade_cli-0.16.3 → cade_cli-0.16.5}/src/cadecoder/daemon/server.py

@@ -42,6 +42,20 @@ class UnsafeBindError(RuntimeError):
     """Refused: auth is off but the bind is reachable off-box."""
 
 
+def resolve_require_auth(*, bind: str, auth: bool | None) -> bool:
+    """Decide whether the gateway should require bearer tokens.
+
+    When ``auth`` is ``None`` (CLI default), loopback binds run unauthenticated
+    so stdio MCP hosts and CLI attach work without a token; non-loopback binds
+    require auth. Explicit ``--auth`` / ``--no-auth`` always win (subject to
+    :func:`_guard_auth_bind`).
+    """
+    host, _ = _parse_bind(bind)
+    if auth is not None:
+        return auth
+    return host not in _LOOPBACK_HOSTS
+
+
 def _guard_auth_bind(host: str, require_auth: bool) -> None:
     """Refuse to run unauthenticated on a non-loopback bind.
 
@@ -52,7 +66,7 @@ def _guard_auth_bind(host: str, require_auth: bool) -> None:
     if not require_auth and host not in _LOOPBACK_HOSTS:
         raise UnsafeBindError(
             f"refusing to run with auth disabled on non-loopback bind {host!r}; "
-            "mint a token and drop --no-auth, or bind 127.0.0.1"
+            "mint a token and pass --auth, or bind 127.0.0.1"
         )
 
 

{cade_cli-0.16.3 → cade_cli-0.16.5}/src/cadecoder/providers/anthropic.py

@@ -31,6 +31,11 @@ from cadecoder.providers.base import (
     StreamEvent,
     stream_with_retry,
 )
+from cadecoder.providers.http_client import (
+    is_decompress_error,
+    make_async_http_client,
+    make_sync_http_client,
+)
 
 # HTTP statuses from Anthropic that indicate a transient server-side issue
 # and are safe to retry. 529 is Anthropic's "Overloaded" code; 408/429/5xx
@@ -87,13 +92,18 @@ class AnthropicProvider(Provider):
         if not self.api_key:
             raise ProviderError("Anthropic API key not configured", ProviderType.ANTHROPIC)
 
-        self.client = AsyncAnthropic(api_key=self.api_key)
+        # Own the httpx client so we can pin Accept-Encoding (avoids brotli /
+        # zlib "incorrect header check" failures in frozen PyInstaller builds).
+        self._http_client = make_async_http_client()
+        self.client = AsyncAnthropic(api_key=self.api_key, http_client=self._http_client)
+        self._sync_http_client = None
         self._sync_client: Anthropic | None = None
 
     def _get_sync_client(self) -> Anthropic:
         """Get or create synchronous client for model fetching."""
         if self._sync_client is None:
-            self._sync_client = Anthropic(api_key=self.api_key)
+            self._sync_http_client = make_sync_http_client()
+            self._sync_client = Anthropic(api_key=self.api_key, http_client=self._sync_http_client)
         return self._sync_client
 
     @property
@@ -220,6 +230,9 @@ class AnthropicProvider(Provider):
             return ErrorClass.TRANSIENT
         if isinstance(exc, APIStatusError) and exc.status_code in _RETRIABLE_STATUSES:
             return ErrorClass.TRANSIENT
+        # Broken Content-Encoding on SSE streams (seen in frozen builds).
+        if is_decompress_error(exc):
+            return ErrorClass.TRANSIENT
         return ErrorClass.PERMANENT
 
     def format_error_for_user(self, exc: BaseException) -> str:
@@ -233,6 +246,11 @@ class AnthropicProvider(Provider):
                 return f"Anthropic service error ({exc.status_code}) — please retry."
         if isinstance(exc, APITimeoutError | APIConnectionError):
             return "Network error talking to Anthropic — please retry."
+        if is_decompress_error(exc):
+            return (
+                "Network/encoding error talking to Anthropic (response decompress failed) — "
+                "please retry."
+            )
         return str(exc)
 
     def stream(self, request: ProviderRequest) -> AsyncIterator[StreamEvent]:

cade_cli-0.16.5/src/cadecoder/providers/http_client.py

@@ -0,0 +1,52 @@
+"""Shared httpx client helpers for LLM providers.
+
+Frozen/PyInstaller builds have hit ``zlib.error: Error -3 while decompressing
+data: incorrect header check`` on Anthropic SSE streams when httpx negotiates
+brotli (``br``) or otherwise mishandles ``Content-Encoding``. Pinning
+``Accept-Encoding`` to gzip/deflate avoids that path while keeping compression.
+"""
+
+from __future__ import annotations
+
+import httpx
+
+# Do not advertise ``br`` / ``zstd`` — those decoders are fragile in frozen
+# binaries and have produced "incorrect header check" failures on streams.
+_SAFE_ACCEPT_ENCODING = "gzip, deflate"
+
+
+def make_async_http_client(*, timeout: float = 600.0) -> httpx.AsyncClient:
+    """Return an AsyncClient safe for Anthropic/OpenAI streaming in frozen apps."""
+    return httpx.AsyncClient(
+        headers={"Accept-Encoding": _SAFE_ACCEPT_ENCODING},
+        timeout=httpx.Timeout(timeout, connect=10.0),
+        follow_redirects=True,
+    )
+
+
+def make_sync_http_client(*, timeout: float = 60.0) -> httpx.Client:
+    """Return a sync Client with the same encoding constraints."""
+    return httpx.Client(
+        headers={"Accept-Encoding": _SAFE_ACCEPT_ENCODING},
+        timeout=httpx.Timeout(timeout, connect=10.0),
+        follow_redirects=True,
+    )
+
+
+def is_decompress_error(exc: BaseException) -> bool:
+    """True when ``exc`` looks like a broken Content-Encoding decode."""
+    import zlib
+
+    if isinstance(exc, zlib.error):
+        return True
+    if isinstance(exc, httpx.DecodingError):
+        return True
+    msg = str(exc).lower()
+    return "incorrect header check" in msg or "while decompressing" in msg
+
+
+__all__ = [
+    "is_decompress_error",
+    "make_async_http_client",
+    "make_sync_http_client",
+]

{cade_cli-0.16.3 → cade_cli-0.16.5}/src/cadecoder/providers/openai.py

@@ -30,6 +30,11 @@ from cadecoder.providers.base import (
     StreamEvent,
     stream_with_retry,
 )
+from cadecoder.providers.http_client import (
+    is_decompress_error,
+    make_async_http_client,
+    make_sync_http_client,
+)
 
 # Retriable HTTP statuses — 408 timeout, 429 rate limit, 500/502/503/504 5xx,
 # 529 seen occasionally behind OpenAI-compatible proxies (Anthropic's code).
@@ -57,7 +62,13 @@ class OpenAIProvider(Provider):
         if not self.api_key:
             raise ProviderError("OpenAI API key not configured", ProviderType.OPENAI)
 
-        self.client = AsyncOpenAI(api_key=self.api_key, base_url=self.base_url)
+        self._http_client = make_async_http_client()
+        self.client = AsyncOpenAI(
+            api_key=self.api_key,
+            base_url=self.base_url,
+            http_client=self._http_client,
+        )
+        self._sync_http_client = None
         self._sync_client: OpenAI | None = None
 
     # Curated fallback list of OpenAI cloud chat models, used when the live API
@@ -83,7 +94,12 @@ class OpenAIProvider(Provider):
     def _get_sync_client(self) -> OpenAI:
         """Get or create a synchronous client for model listing."""
         if self._sync_client is None:
-            self._sync_client = OpenAI(api_key=self.api_key, base_url=self.base_url)
+            self._sync_http_client = make_sync_http_client()
+            self._sync_client = OpenAI(
+                api_key=self.api_key,
+                base_url=self.base_url,
+                http_client=self._sync_http_client,
+            )
         return self._sync_client
 
     @property
@@ -173,6 +189,8 @@ class OpenAIProvider(Provider):
             return ErrorClass.TRANSIENT
         if isinstance(exc, APIStatusError) and exc.status_code in _RETRIABLE_STATUSES:
             return ErrorClass.TRANSIENT
+        if is_decompress_error(exc):
+            return ErrorClass.TRANSIENT
         return ErrorClass.PERMANENT
 
     def format_error_for_user(self, exc: BaseException) -> str:
@@ -184,6 +202,11 @@ class OpenAIProvider(Provider):
                 return f"OpenAI service error ({exc.status_code}) — please retry."
         if isinstance(exc, APITimeoutError | APIConnectionError):
             return "Network error talking to OpenAI — please retry."
+        if is_decompress_error(exc):
+            return (
+                "Network/encoding error talking to OpenAI (response decompress failed) — "
+                "please retry."
+            )
         return str(exc)
 
     def stream(self, request: ProviderRequest) -> AsyncIterator[StreamEvent]: