cade-cli 0.16.4__tar.gz → 0.16.6__tar.gz

{cade_cli-0.16.4 → cade_cli-0.16.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cade-cli
-Version: 0.16.4
+Version: 0.16.6
 Summary: Cade - The CLI Agent from Arcade.dev (install: curl -fsSL https://arcadeagent.dev/install | sh)
 Project-URL: Homepage, https://arcade.dev
 Project-URL: Documentation, https://arcadeagent.dev/docs
@@ -129,7 +129,7 @@ The script detects your OS/arch, downloads the matching prebuilt binary
 `~/.local/bin`. Pin a version or install location:
 
 ```bash
-CADE_VERSION=0.16.4 CADE_INSTALL_DIR=/usr/local/bin \
+CADE_VERSION=0.16.6 CADE_INSTALL_DIR=/usr/local/bin \
   sh -c "$(curl -fsSL https://arcadeagent.dev/install)"
 ```
 
@@ -211,13 +211,15 @@ Tools come from three sources and are addressed uniformly by their registered na
 
 - **`Local_*`** — built-in: filesystem (`ReadFile`, `WriteFile`, `Edit`, `ListFiles`), shell (`Bash`), `Search`, `Git`, `Task*`, `AskUserQuestion`, `RetrieveToolResult`, `ToolSchema`, `PinContext`, `PushNotification`, `WebFetch`, and `WebSearch`.
 - **`Memory_*`** — agent-library backed, per-agent indexed knowledge store.
-- **Arcade Cloud + user MCP servers** — anything you register.
+- **Arcade Agent Hub + user MCP servers** — Hub for Gmail/Slack/GitHub/… (`cade mcp authorize hub`); plus anything else you register.
 
 ```bash
 cade tools list                         # all tools, all sources
 cade tools list --source local          # filter by source
 cade tools search "send slack"          # keyword search
 cade tools info Local_ReadFile          # full schema + description
+cade mcp authorize hub                  # Arcade catalogue (OAuth)
+cade mcp install-hosts                  # register Cade in Cursor / Claude / …
 ```
 
 The full local tool surface (including the bidirectional MCP capabilities and `cade daemon` integration) is documented in [`docs/mcp.md`](./docs/mcp.md).
@@ -276,7 +278,7 @@ cade daemon token new cursor -e delegate -e resources
 
 Adapter + tool config lives in `~/.cade/config/agents/<name>.toml`. Edit and `kill -HUP $(cat ~/.cade/run/daemon.pid)` to reload without restart.
 
-**Security defaults are fail-closed:** `allowed_senders = []` blocks everyone on messengers; MCP hosts authenticate with bearer tokens; tools are default-deny against `[tools].allow`.
+**Security defaults are fail-closed:** `allowed_senders = []` blocks everyone on messengers; tools are default-deny against `[tools].allow`. Loopback MCP (stdio shim / local CLI) needs no token; pass `cade daemon start --auth` or bind off-loopback to require bearer tokens.
 
 ---
 
@@ -327,7 +329,7 @@ All state lives under `~/.cade/`. Override the location with `CADE_HOME=/path/to
 | File | Purpose |
 |---|---|
 | `config/cade.toml` | Global settings + `[agent_defaults]` (model, provider, UI, …) |
-| `config/agents/<name>.toml` | Per-agent config (model, prompt, `[[mcp]]`, `[serve]`, hooks) |
+| `config/agents/<name>.toml` | Per-agent config (model, prompt, `[[mcp]]`, `[tools]`, `[adapters.*]`, hooks) |
 | `data/agents/<id>/` | Per-agent state: `threads/ memory/ tasks/ inbox/` |
 | `run/daemon.pid` | Single gateway-supervisor pidfile |
 | `run/agents/<name>/` | Per-agent runtime: mcp-services, grants |
@@ -344,6 +346,8 @@ Full layout, env vars, and TOML schema in [`docs/configuration.md`](./docs/confi
 | `ARCADE_API_KEY`, `ARCADE_BASE_URL` | Arcade Cloud (alternative to OAuth) |
 | `CADE_LOCAL_ONLY=1` | Skip remote tools entirely |
 | `CADE_HOME` | Override config directory |
+| `CADE_ATTACH=0` | Don't attach CLI turns to `cade daemon` |
+| `CADE_AUTOSTART=0` | Don't spawn the daemon when attach needs one |
 | `CADE_PROJECT_ROOT` | Sandbox `Local_*` filesystem tools to this root |
 
 ---

{cade_cli-0.16.4 → cade_cli-0.16.6}/README.md

@@ -38,7 +38,7 @@ The script detects your OS/arch, downloads the matching prebuilt binary
 `~/.local/bin`. Pin a version or install location:
 
 ```bash
-CADE_VERSION=0.16.4 CADE_INSTALL_DIR=/usr/local/bin \
+CADE_VERSION=0.16.6 CADE_INSTALL_DIR=/usr/local/bin \
   sh -c "$(curl -fsSL https://arcadeagent.dev/install)"
 ```
 
@@ -120,13 +120,15 @@ Tools come from three sources and are addressed uniformly by their registered na
 
 - **`Local_*`** — built-in: filesystem (`ReadFile`, `WriteFile`, `Edit`, `ListFiles`), shell (`Bash`), `Search`, `Git`, `Task*`, `AskUserQuestion`, `RetrieveToolResult`, `ToolSchema`, `PinContext`, `PushNotification`, `WebFetch`, and `WebSearch`.
 - **`Memory_*`** — agent-library backed, per-agent indexed knowledge store.
-- **Arcade Cloud + user MCP servers** — anything you register.
+- **Arcade Agent Hub + user MCP servers** — Hub for Gmail/Slack/GitHub/… (`cade mcp authorize hub`); plus anything else you register.
 
 ```bash
 cade tools list                         # all tools, all sources
 cade tools list --source local          # filter by source
 cade tools search "send slack"          # keyword search
 cade tools info Local_ReadFile          # full schema + description
+cade mcp authorize hub                  # Arcade catalogue (OAuth)
+cade mcp install-hosts                  # register Cade in Cursor / Claude / …
 ```
 
 The full local tool surface (including the bidirectional MCP capabilities and `cade daemon` integration) is documented in [`docs/mcp.md`](./docs/mcp.md).
@@ -185,7 +187,7 @@ cade daemon token new cursor -e delegate -e resources
 
 Adapter + tool config lives in `~/.cade/config/agents/<name>.toml`. Edit and `kill -HUP $(cat ~/.cade/run/daemon.pid)` to reload without restart.
 
-**Security defaults are fail-closed:** `allowed_senders = []` blocks everyone on messengers; MCP hosts authenticate with bearer tokens; tools are default-deny against `[tools].allow`.
+**Security defaults are fail-closed:** `allowed_senders = []` blocks everyone on messengers; tools are default-deny against `[tools].allow`. Loopback MCP (stdio shim / local CLI) needs no token; pass `cade daemon start --auth` or bind off-loopback to require bearer tokens.
 
 ---
 
@@ -236,7 +238,7 @@ All state lives under `~/.cade/`. Override the location with `CADE_HOME=/path/to
 | File | Purpose |
 |---|---|
 | `config/cade.toml` | Global settings + `[agent_defaults]` (model, provider, UI, …) |
-| `config/agents/<name>.toml` | Per-agent config (model, prompt, `[[mcp]]`, `[serve]`, hooks) |
+| `config/agents/<name>.toml` | Per-agent config (model, prompt, `[[mcp]]`, `[tools]`, `[adapters.*]`, hooks) |
 | `data/agents/<id>/` | Per-agent state: `threads/ memory/ tasks/ inbox/` |
 | `run/daemon.pid` | Single gateway-supervisor pidfile |
 | `run/agents/<name>/` | Per-agent runtime: mcp-services, grants |
@@ -253,6 +255,8 @@ Full layout, env vars, and TOML schema in [`docs/configuration.md`](./docs/confi
 | `ARCADE_API_KEY`, `ARCADE_BASE_URL` | Arcade Cloud (alternative to OAuth) |
 | `CADE_LOCAL_ONLY=1` | Skip remote tools entirely |
 | `CADE_HOME` | Override config directory |
+| `CADE_ATTACH=0` | Don't attach CLI turns to `cade daemon` |
+| `CADE_AUTOSTART=0` | Don't spawn the daemon when attach needs one |
 | `CADE_PROJECT_ROOT` | Sandbox `Local_*` filesystem tools to this root |
 
 ---

{cade_cli-0.16.4 → cade_cli-0.16.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cade-cli"
-version = "0.16.4"
+version = "0.16.6"
 description = "Cade - The CLI Agent from Arcade.dev (install: curl -fsSL https://arcadeagent.dev/install | sh)"
 readme = "README.md"
 requires-python = ">=3.11"

{cade_cli-0.16.4 → cade_cli-0.16.6}/src/cadecoder/cli/commands/daemon.py

@@ -103,9 +103,16 @@ def start(
     prewarm: list[str] = typer.Option(
         None, "--prewarm", help="Agent to start at boot (repeatable)."
     ),
-    no_auth: bool = typer.Option(
-        False, "--no-auth", help="Loopback only: treat every caller as the local principal."
-    ),
+    auth: Annotated[
+        bool | None,
+        typer.Option(
+            "--auth/--no-auth",
+            help=(
+                "Require bearer tokens. Default: off on loopback (stdio MCP hosts / "
+                "CLI attach), on for non-loopback binds. --no-auth is refused off-loopback."
+            ),
+        ),
+    ] = None,
     verbose: Annotated[
         bool,
         typer.Option(
@@ -117,7 +124,7 @@ def start(
 ) -> None:
     """Run the gateway supervisor in the foreground (serves all agents)."""
     from cadecoder.daemon.lock import DaemonAlreadyRunningError
-    from cadecoder.daemon.server import UnsafeBindError, run_daemon
+    from cadecoder.daemon.server import UnsafeBindError, resolve_require_auth, run_daemon
 
     if verbose:
         from cadecoder.core.logging import setup_logging
@@ -130,9 +137,10 @@ def start(
             "(recv/send/turn/tool/cron/wake/reject) to stdout[/dim]"
         )
 
+    require_auth = resolve_require_auth(bind=bind, auth=auth)
     try:
         code = asyncio.run(
-            run_daemon(bind=bind, prewarm=list(prewarm or []), require_auth=not no_auth)
+            run_daemon(bind=bind, prewarm=list(prewarm or []), require_auth=require_auth)
         )
     except DaemonAlreadyRunningError as e:
         console.print(f"[red]{e}[/red]")

{cade_cli-0.16.4 → cade_cli-0.16.6}/src/cadecoder/daemon/adapters/imessage.py

@@ -458,7 +458,7 @@ class IMessageAdapter:
         raise IMessageBridgeError(
             f"imsg binary not found (cli_path={configured!r}). "
             "Install it with `brew install steipete/tap/imsg` or set cli_path in "
-            "[serve.adapters.imessage]."
+            "[adapters.imessage]."
         )
 
     async def _spawn_and_subscribe(self) -> None:

{cade_cli-0.16.4 → cade_cli-0.16.6}/src/cadecoder/daemon/config.py

@@ -7,7 +7,7 @@ file doesn't fail hard.
 Adapter settings are driven by the adapter registry in
 `cadecoder.daemon.adapters.registry`. Every registered adapter contributes
 one `[adapters.<name>]` section; dropping a new adapter into
-`cadecoder/serve/adapters/` is the only code change needed.
+`cadecoder/daemon/adapters/` is the only code change needed.
 """
 
 from __future__ import annotations

{cade_cli-0.16.4 → cade_cli-0.16.6}/src/cadecoder/daemon/server.py

@@ -42,6 +42,20 @@ class UnsafeBindError(RuntimeError):
     """Refused: auth is off but the bind is reachable off-box."""
 
 
+def resolve_require_auth(*, bind: str, auth: bool | None) -> bool:
+    """Decide whether the gateway should require bearer tokens.
+
+    When ``auth`` is ``None`` (CLI default), loopback binds run unauthenticated
+    so stdio MCP hosts and CLI attach work without a token; non-loopback binds
+    require auth. Explicit ``--auth`` / ``--no-auth`` always win (subject to
+    :func:`_guard_auth_bind`).
+    """
+    host, _ = _parse_bind(bind)
+    if auth is not None:
+        return auth
+    return host not in _LOOPBACK_HOSTS
+
+
 def _guard_auth_bind(host: str, require_auth: bool) -> None:
     """Refuse to run unauthenticated on a non-loopback bind.
 
@@ -52,7 +66,7 @@ def _guard_auth_bind(host: str, require_auth: bool) -> None:
     if not require_auth and host not in _LOOPBACK_HOSTS:
         raise UnsafeBindError(
             f"refusing to run with auth disabled on non-loopback bind {host!r}; "
-            "mint a token and drop --no-auth, or bind 127.0.0.1"
+            "mint a token and pass --auth, or bind 127.0.0.1"
         )
 
 

{cade_cli-0.16.4 → cade_cli-0.16.6}/src/cadecoder/daemon/shim.py

@@ -152,12 +152,19 @@ class StdioHttpProxy:
 
 
 def run_shim(agent: str | None = None) -> int:
-    """Entry point for ``cade __mcp-adapter``. Returns a process exit code."""
-    manifest = read_gateway_manifest()
-    if manifest is None:
-        sys.stderr.write(
-            "cade: no running daemon to connect to.\nStart one with:  cade daemon start\n"
-        )
+    """Entry point for ``cade __mcp-adapter``. Returns a process exit code.
+
+    Autostarts ``cade daemon`` when none is running (same as CLI attach), unless
+    ``CADE_AUTOSTART=0``. Lazy-imports ``ensure_daemon`` to avoid a cycle with
+    :mod:`cadecoder.daemon.ensure`.
+    """
+    # Imported here: ensure.py imports read_gateway_manifest from this module.
+    from cadecoder.daemon.ensure import DaemonStartError, ensure_daemon
+
+    try:
+        manifest = ensure_daemon()
+    except DaemonStartError as e:
+        sys.stderr.write(f"cade: {e}\nStart one with:  cade daemon start\n")
         return 1
 
     endpoint = manifest.get("endpoint")