cade-cli 0.18.0__tar.gz → 0.19.0__tar.gz

{cade_cli-0.18.0 → cade_cli-0.19.0}/.gitignore

@@ -47,3 +47,4 @@ activate.sh
 
 # uv
 uv.lock
+.venv-docs/

{cade_cli-0.18.0 → cade_cli-0.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cade-cli
-Version: 0.18.0
+Version: 0.19.0
 Summary: Cade - The CLI Agent from Arcade.dev (install: curl -fsSL https://arcadeagent.dev/install | sh)
 Project-URL: Homepage, https://arcade.dev
 Project-URL: Documentation, https://arcadeagent.dev/docs

{cade_cli-0.18.0 → cade_cli-0.19.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cade-cli"
-version = "0.18.0"
+version = "0.19.0"
 description = "Cade - The CLI Agent from Arcade.dev (install: curl -fsSL https://arcadeagent.dev/install | sh)"
 readme = "README.md"
 requires-python = ">=3.11"

{cade_cli-0.18.0 → cade_cli-0.19.0}/src/cadecoder/daemon/allowlist.py

@@ -9,8 +9,8 @@ Policy:
   * `deny` wins over `allow` (explicit block beats any permit).
   * If `allow` is non-empty, only tools matching one of its patterns may run.
   * If BOTH `allow` and `deny` are empty, everything is allowed (unrestricted).
-  * The shipped default (`DEFAULT_TOOL_ALLOW` / `DEFAULT_TOOL_DENY`) is an
-    empty `allow` plus `deny = ["Local_Bash"]` — every tool except Bash.
+  * The shipped default (`DEFAULT_TOOL_ALLOW` / `DEFAULT_TOOL_DENY`) is empty
+    on both sides — every tool is allowed.
   * When `sandbox_root` is set, every Local_* tool call whose arguments carry
     a filesystem path is rejected if that path resolves outside the root —
     unless path restrictions are globally disabled via
@@ -37,23 +37,29 @@ HOOK_NAME = "cadecoder.daemon.allowlist"
 # The shipped default tool policy, and the only definition of it. Everything
 # that seeds a policy for a new agent reads these — never the literals.
 #
-# An empty allow list means "no allow-restriction", so the pair below reads as
-# "every tool except Local_Bash". Bash is the sole exclusion because a script
-# can always `cd` out of any sandbox root, so it cannot be contained the way
-# the typed file tools are (see _PATH_ARGS).
+# Empty on both sides: no allow-restriction and nothing denied by name. Bash
+# used to be denied here on the grounds that a script can `cd` out of any
+# sandbox root, but containment is now the OS sandbox's job — Local_Bash runs
+# under sandbox-exec/bwrap with only the live GrantSet mounted, and refuses to
+# run at all when no backend is available. Denying it by name only cost
+# capability; it was never what kept it contained.
+#
+# Both lists are still written (empty, not absent), so a seeded agent stays
+# distinguishable from one whose policy was never configured — see
+# ToolsSettings.is_configured.
 #
 # Tuples, not lists: a module-level mutable default is one `.append()` away
 # from leaking into every config that shares it.
 DEFAULT_TOOL_ALLOW: Final[tuple[str, ...]] = ()
-DEFAULT_TOOL_DENY: Final[tuple[str, ...]] = ("Local_Bash",)
+DEFAULT_TOOL_DENY: Final[tuple[str, ...]] = ()
 
 # Path-bearing argument name per tool. Keys are the runtime tool names the
 # composite manager exposes (Local_* prefix). Values are the JSON input key
 # whose value is a filesystem path. Tools not in this map are not path-checked.
 #
-# Bash takes a `cwd` but we don't sandbox it here — the script itself can
-# always `cd` out of any configured cwd, so the correct policy is to keep
-# Bash denied. This map intentionally omits it.
+# Bash takes a `cwd` but is not path-checked here — a script can `cd` anywhere,
+# so a pre-flight argument check proves nothing. Its containment is the OS
+# sandbox in cade_mcp_local.tools.shell. This map intentionally omits it.
 _PATH_ARGS: dict[str, str] = {
     "Local_ReadFile": "file_path",
     "Local_WriteFile": "file_path",
@@ -178,11 +184,11 @@ def default_tool_settings() -> ToolsSettings:
     policy another agent was seeded with.
 
     Returns:
-        Settings permitting every tool except ``Local_Bash``.
+        Settings permitting every tool.
 
     Example:
         >>> settings = default_tool_settings()
-        >>> is_tool_allowed("Slack_SendMessage", settings.allow or [], settings.deny or [])
+        >>> is_tool_allowed("Local_Bash", settings.allow or [], settings.deny or [])
         True
     """
     return ToolsSettings(allow=list(DEFAULT_TOOL_ALLOW), deny=list(DEFAULT_TOOL_DENY))
@@ -237,11 +243,12 @@ def install_allowlist_hook(
         log.debug(f"Replaced {removed} existing {HOOK_NAME!r} hook(s)")
 
     if not tools.allow and not tools.deny:
-        log.warning(
-            "serve tool allow and deny are BOTH empty — bot has access to every "
-            "configured tool, including Local_Bash. Add patterns to [tools].deny "
-            "(or [tools].allow) in the agent's config file, then run: "
-            "cade daemon restart"
+        log.info(
+            "serve tool policy is unrestricted (the shipped default) — every "
+            "configured tool is reachable, including Local_Bash, which runs "
+            "OS-sandboxed against the agent's granted paths. To narrow it, add "
+            "patterns to [tools].allow or [tools].deny in the agent's config "
+            "file, then run: cade daemon restart"
         )
 
     hook = CallbackHook(

{cade_cli-0.18.0 → cade_cli-0.19.0}/src/cadecoder/daemon/gateway/constants.py

@@ -29,16 +29,6 @@ TASKS_URI = "tasks://"
 TASK_TEMPLATE = "tasks://{task_id}"
 FILESYSTEM_URI = "filesystem://"
 
-# Pre-0.16.21 branded URIs. Still registered + accepted so hosts that have not
-# re-run ``cade mcp install-hosts`` keep working after upgrade.
-LEGACY_THREADS_URI = "cade://threads"
-LEGACY_THREAD_TEMPLATE = "cade://thread/{thread_id}"
-LEGACY_MEMORY_URI = "cade://memory"
-LEGACY_MEMORY_SOURCES_URI = "cade://memory/sources"
-LEGACY_TASKS_URI = "cade://tasks"
-LEGACY_TASK_TEMPLATE = "cade://tasks/{task_id}"
-LEGACY_FILESYSTEM_URI = "cade://filesystem"
-
 
 def thread_uri(thread_id: str) -> str:
     """The concrete ``thread://{id}`` URI for one thread."""
@@ -48,13 +38,6 @@ def thread_uri(thread_id: str) -> str:
 __all__ = [
     "CANONICAL_ASK",
     "FILESYSTEM_URI",
-    "LEGACY_FILESYSTEM_URI",
-    "LEGACY_MEMORY_SOURCES_URI",
-    "LEGACY_MEMORY_URI",
-    "LEGACY_TASKS_URI",
-    "LEGACY_TASK_TEMPLATE",
-    "LEGACY_THREADS_URI",
-    "LEGACY_THREAD_TEMPLATE",
     "MCP_SURFACE",
     "MEMORY_SOURCES_URI",
     "MEMORY_URI",

{cade_cli-0.18.0 → cade_cli-0.19.0}/src/cadecoder/daemon/gateway/exposure.py

@@ -44,12 +44,6 @@ _RESOURCE_GROUP: list[tuple[str, str]] = [
     ("memory://", GROUP_RESOURCES),
     ("filesystem://", GROUP_RESOURCES),
     ("file://", GROUP_RESOURCES),
-    # Pre-0.16.21 branded URIs (still accepted for upgrade compatibility).
-    ("cade://threads", GROUP_RESOURCES),
-    ("cade://thread/", GROUP_RESOURCES),
-    ("cade://tasks", GROUP_RESOURCES),
-    ("cade://memory", GROUP_RESOURCES),
-    ("cade://filesystem", GROUP_RESOURCES),
 ]
 
 

{cade_cli-0.18.0 → cade_cli-0.19.0}/src/cadecoder/daemon/gateway/resources.py

@@ -21,13 +21,6 @@ from arcade_mcp_server.context import get_current_model_context
 from cadecoder.core.logging import log
 from cadecoder.daemon.gateway.constants import (
     FILESYSTEM_URI,
-    LEGACY_FILESYSTEM_URI,
-    LEGACY_MEMORY_SOURCES_URI,
-    LEGACY_MEMORY_URI,
-    LEGACY_TASK_TEMPLATE,
-    LEGACY_TASKS_URI,
-    LEGACY_THREAD_TEMPLATE,
-    LEGACY_THREADS_URI,
     MCP_SURFACE,
     MEMORY_SOURCES_URI,
     MEMORY_URI,
@@ -311,25 +304,6 @@ def register_gateway_resources(app: Any) -> None:
         mime_type="application/json",
         handler=lambda _uri: filesystem_payload(),
     )
-    # Legacy cade:// aliases — same handlers so hosts that have not refreshed
-    # skills/rules after upgrade keep working.
-    for legacy_uri, name, handler in (
-        (LEGACY_THREADS_URI, "threads-legacy", lambda _uri: threads_payload()),
-        (LEGACY_THREAD_TEMPLATE, "thread-legacy", thread_payload),
-        (LEGACY_MEMORY_URI, "memory-legacy", lambda _uri: memory_payload()),
-        (LEGACY_MEMORY_SOURCES_URI, "memory-sources-legacy", lambda _uri: memory_sources_payload()),
-        (LEGACY_TASKS_URI, "tasks-legacy", lambda _uri: tasks_payload()),
-        (LEGACY_TASK_TEMPLATE, "task-legacy", task_payload),
-        (LEGACY_FILESYSTEM_URI, "filesystem-legacy", lambda _uri: filesystem_payload()),
-    ):
-        app.add_resource(
-            legacy_uri,
-            name=name,
-            title=name,
-            description="Legacy cade:// alias; prefer the plain-named URI.",
-            mime_type="application/json",
-            handler=handler,
-        )
     log.debug("registered gateway thread/memory/tasks/filesystem resources")
 
 

{cade_cli-0.18.0 → cade_cli-0.19.0}/src/cadecoder/daemon/gateway/subscriptions.py

@@ -26,7 +26,6 @@ from collections.abc import Awaitable, Callable
 
 from cadecoder.core.logging import log
 from cadecoder.daemon.gateway.constants import (
-    LEGACY_THREADS_URI,
     THREADS_URI,
     thread_uri,
 )
@@ -115,14 +114,7 @@ class ThreadUpdateBus:
         registry, emit, loop = self._registry, self._emit, self._loop
         if registry is None or emit is None or loop is None:
             return
-        # Legacy cade:// URIs stay in the fan-out so hosts subscribed before
-        # the 0.16.21 rename keep receiving updates until they reinstall.
-        uris = (
-            thread_uri(thread_id),
-            THREADS_URI,
-            f"cade://thread/{thread_id}",
-            LEGACY_THREADS_URI,
-        )
+        uris = (thread_uri(thread_id), THREADS_URI)
         targets: list[tuple[str, str]] = []
         for uri in uris:
             for session_id in registry.sessions_for(uri):

{cade_cli-0.18.0 → cade_cli-0.19.0}/src/cadecoder/host_plugin/assets/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cade",
   "description": "Your persistent on-device agent: notes memory, durable tasks, and connected tools via Ask.",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "author": {
     "name": "Arcade.dev",
     "url": "https://docs.cade.dev"

{cade_cli-0.18.0 → cade_cli-0.19.0}/src/cadecoder/host_plugin/assets/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "cade",
   "displayName": "Cade",
   "description": "Your persistent on-device agent: notes memory, durable tasks, and connected tools via Ask.",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "author": {
     "name": "Arcade.dev",
     "email": "support@arcade.dev"

{cade_cli-0.18.0 → cade_cli-0.19.0}/src/cadecoder/host_plugin/doctor.py

@@ -30,7 +30,9 @@ def _mcp_servers_from_file(path: Path) -> dict[str, Any] | None:
         return None
     if not isinstance(data, dict):
         return None
-    servers = data.get("mcpServers") or data.get("mcp")
+    # "servers" is VS Code's spelling; without it the doctor skips that host
+    # silently, so neither a missing entry nor a stale endpoint is ever caught.
+    servers = data.get("mcpServers") or data.get("mcp") or data.get("servers")
     return servers if isinstance(servers, dict) else None
 
 

{cade_cli-0.18.0 → cade_cli-0.19.0}/src/cadecoder/templates/serve/serve.toml.example

@@ -16,20 +16,19 @@
 # support globs (`Local_*`), regex (`/^Local_Task/`), and pipe lists
 # (`Local_ReadFile|Local_ListFiles`).
 #
-# The shipped default below is "every tool except Local_Bash". Narrow it by
-# adding patterns to `allow` (e.g. ["Local_*", "Memory_*"]) if you want this
-# agent restricted to a subset.
+# The shipped default below allows every tool. Narrow it by adding patterns to
+# `allow` (e.g. ["Local_*", "Memory_*"]) if you want this agent restricted to a
+# subset, or to `deny` to block specific tools.
 #
 # Every Local_* call that takes a filesystem path is also sandboxed to the
 # agent's workspace. Absolute paths, `..` traversal, and symlinks that resolve
-# outside it are rejected before the tool runs. Local_ScratchBash is always
-# safe (isolated scratch dir); workspace Local_Bash stays opt-in here.
+# outside it are rejected before the tool runs. Both shell tools are contained
+# by the OS sandbox instead: Local_ScratchBash sees only an isolated scratch
+# dir (network off), and Local_Bash mounts just the agent's granted paths.
 #
 # Removing this whole table restores the default on the next `cade daemon init`.
-# Leaving it here with both lists empty is a deliberate "no restrictions at
-# all" and is preserved as-is.
 allow = []
-deny  = ["Local_Bash"]
+deny  = []
 
 [adapters.telegram]
 enabled = false

{cade_cli-0.18.0 → cade_cli-0.19.0}/src/cadecoder/voice/__init__.py

@@ -26,11 +26,31 @@ warnings.filterwarnings(
     category=DeprecationWarning,
 )
 
+from typing import TYPE_CHECKING, Any  # noqa: E402
+
 from cadecoder.voice.cleanup import strip_for_speech  # noqa: E402
-from cadecoder.voice.session import VoiceChatSession, run_voice_session  # noqa: E402
+
+if TYPE_CHECKING:
+    from cadecoder.voice.session import VoiceChatSession, run_voice_session
 
 __all__ = [
     "VoiceChatSession",
     "run_voice_session",
     "strip_for_speech",
 ]
+
+# The session module pulls in sounddevice and the MLX stack, which only ship
+# with the optional ``voice`` extra. Importing it here made the whole package
+# unimportable without them — including ``cleanup``, which is pure text and
+# needs nothing. Resolve the heavy names on first access instead, so
+# ``from cadecoder.voice import run_voice_session`` still works unchanged.
+_LAZY = frozenset({"VoiceChatSession", "run_voice_session"})
+
+
+def __getattr__(name: str) -> Any:
+    """Import the audio-dependent exports on demand (PEP 562)."""
+    if name in _LAZY:
+        from cadecoder.voice import session
+
+        return getattr(session, name)
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")