cade-cli 0.16.4__tar.gz → 0.16.5__tar.gz

{cade_cli-0.16.4 → cade_cli-0.16.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cade-cli
-Version: 0.16.4
+Version: 0.16.5
 Summary: Cade - The CLI Agent from Arcade.dev (install: curl -fsSL https://arcadeagent.dev/install | sh)
 Project-URL: Homepage, https://arcade.dev
 Project-URL: Documentation, https://arcadeagent.dev/docs
@@ -129,7 +129,7 @@ The script detects your OS/arch, downloads the matching prebuilt binary
 `~/.local/bin`. Pin a version or install location:
 
 ```bash
-CADE_VERSION=0.16.4 CADE_INSTALL_DIR=/usr/local/bin \
+CADE_VERSION=0.16.5 CADE_INSTALL_DIR=/usr/local/bin \
   sh -c "$(curl -fsSL https://arcadeagent.dev/install)"
 ```
 

{cade_cli-0.16.4 → cade_cli-0.16.5}/README.md

@@ -38,7 +38,7 @@ The script detects your OS/arch, downloads the matching prebuilt binary
 `~/.local/bin`. Pin a version or install location:
 
 ```bash
-CADE_VERSION=0.16.4 CADE_INSTALL_DIR=/usr/local/bin \
+CADE_VERSION=0.16.5 CADE_INSTALL_DIR=/usr/local/bin \
   sh -c "$(curl -fsSL https://arcadeagent.dev/install)"
 ```
 

{cade_cli-0.16.4 → cade_cli-0.16.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cade-cli"
-version = "0.16.4"
+version = "0.16.5"
 description = "Cade - The CLI Agent from Arcade.dev (install: curl -fsSL https://arcadeagent.dev/install | sh)"
 readme = "README.md"
 requires-python = ">=3.11"

{cade_cli-0.16.4 → cade_cli-0.16.5}/src/cadecoder/cli/commands/daemon.py

@@ -103,9 +103,16 @@ def start(
     prewarm: list[str] = typer.Option(
         None, "--prewarm", help="Agent to start at boot (repeatable)."
     ),
-    no_auth: bool = typer.Option(
-        False, "--no-auth", help="Loopback only: treat every caller as the local principal."
-    ),
+    auth: Annotated[
+        bool | None,
+        typer.Option(
+            "--auth/--no-auth",
+            help=(
+                "Require bearer tokens. Default: off on loopback (stdio MCP hosts / "
+                "CLI attach), on for non-loopback binds. --no-auth is refused off-loopback."
+            ),
+        ),
+    ] = None,
     verbose: Annotated[
         bool,
         typer.Option(
@@ -117,7 +124,7 @@ def start(
 ) -> None:
     """Run the gateway supervisor in the foreground (serves all agents)."""
     from cadecoder.daemon.lock import DaemonAlreadyRunningError
-    from cadecoder.daemon.server import UnsafeBindError, run_daemon
+    from cadecoder.daemon.server import UnsafeBindError, resolve_require_auth, run_daemon
 
     if verbose:
         from cadecoder.core.logging import setup_logging
@@ -130,9 +137,10 @@ def start(
             "(recv/send/turn/tool/cron/wake/reject) to stdout[/dim]"
         )
 
+    require_auth = resolve_require_auth(bind=bind, auth=auth)
     try:
         code = asyncio.run(
-            run_daemon(bind=bind, prewarm=list(prewarm or []), require_auth=not no_auth)
+            run_daemon(bind=bind, prewarm=list(prewarm or []), require_auth=require_auth)
         )
     except DaemonAlreadyRunningError as e:
         console.print(f"[red]{e}[/red]")

{cade_cli-0.16.4 → cade_cli-0.16.5}/src/cadecoder/daemon/server.py

@@ -42,6 +42,20 @@ class UnsafeBindError(RuntimeError):
     """Refused: auth is off but the bind is reachable off-box."""
 
 
+def resolve_require_auth(*, bind: str, auth: bool | None) -> bool:
+    """Decide whether the gateway should require bearer tokens.
+
+    When ``auth`` is ``None`` (CLI default), loopback binds run unauthenticated
+    so stdio MCP hosts and CLI attach work without a token; non-loopback binds
+    require auth. Explicit ``--auth`` / ``--no-auth`` always win (subject to
+    :func:`_guard_auth_bind`).
+    """
+    host, _ = _parse_bind(bind)
+    if auth is not None:
+        return auth
+    return host not in _LOOPBACK_HOSTS
+
+
 def _guard_auth_bind(host: str, require_auth: bool) -> None:
     """Refuse to run unauthenticated on a non-loopback bind.
 
@@ -52,7 +66,7 @@ def _guard_auth_bind(host: str, require_auth: bool) -> None:
     if not require_auth and host not in _LOOPBACK_HOSTS:
         raise UnsafeBindError(
             f"refusing to run with auth disabled on non-loopback bind {host!r}; "
-            "mint a token and drop --no-auth, or bind 127.0.0.1"
+            "mint a token and pass --auth, or bind 127.0.0.1"
         )