cloudagent-daemon 0.2.1__tar.gz → 0.2.2__tar.gz

{cloudagent_daemon-0.2.1 → cloudagent_daemon-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudagent-daemon
-Version: 0.2.1
+Version: 0.2.2
 Summary: Local daemon for cloudagent — bridges Claude Code subprocesses to the cloudagent backend over WebSocket.
 Project-URL: Homepage, https://cloudagent.chat
 Project-URL: Repository, https://codeup.aliyun.com/69bd0a4d29ad98af4065ce71/cloudagent
@@ -43,56 +43,45 @@ backend, and exits when its work is done.
 
 ## Quick start (no clone)
 
-The fastest way to run cloudagent-daemon, slock-style:
-
-Each command below is a SINGLE LINE — copy the whole line as-is.
-Multi-line snippets with `\` continuations are fragile across copy-paste
-(some terminals / web `<pre>` blocks drop the trailing `\` and break the
-command into separate statements).
-
-> **Tag-pinned releases.** The `@daemon-vX.Y.Z` ref below points at a frozen
-> daemon release (annotated git tag). To upgrade later, re-run the same
-> command with the latest tag — see `git ls-remote --tags origin "daemon-v*"`
-> on the cloudagent repo, or [the releases list][releases]. Don't replace
-> the tag with a branch name (e.g. `cy` / `m5`); branches move and can drag
-> in unrelated work-in-progress.
-
-[releases]: https://codeup.aliyun.com/69bd0a4d29ad98af4065ce71/cloudagent/-/tags?search=daemon-v
+Published to PyPI as [`cloudagent-daemon`](https://pypi.org/project/cloudagent-daemon/).
+Requires Python 3.12+ and Claude Code CLI on PATH.
 
 ```bash
-# One-shot run (no install) — single line
-uvx --from "git+ssh://git@codeup.aliyun.com:/69bd0a4d29ad98af4065ce71/cloudagent.git@daemon-v0.2.1#subdirectory=daemon_cli" cloudagent-daemon start --server-url https://api-fr.cloudagent.chat --api-key sk_machine_***
+# One-shot run (no persistent install)
+uvx cloudagent-daemon start --server-url https://api.cloudagent.chat --api-key sk_machine_***
 ```
 
 ```bash
-# Or install persistently — single line, install + start chained with &&
-uv tool install --from "git+ssh://git@codeup.aliyun.com:/69bd0a4d29ad98af4065ce71/cloudagent.git@daemon-v0.2.1#subdirectory=daemon_cli" cloudagent-daemon && cloudagent-daemon start --server-url https://api-fr.cloudagent.chat --api-key sk_machine_***
+# Persistent install — install + start chained with && (single line)
+uv tool install cloudagent-daemon && cloudagent-daemon start --server-url https://api.cloudagent.chat --api-key sk_machine_***
 ```
 
-To upgrade an existing install to the newest tag (forces re-resolve of the
-git ref so a moved tag wouldn't silently stick on the old commit anyway —
-but tags are immutable here, so the bump in the URL is the real signal):
-
 ```bash
-uv tool install --reinstall --force --from "git+ssh://git@codeup.aliyun.com:/69bd0a4d29ad98af4065ce71/cloudagent.git@daemon-v0.2.1#subdirectory=daemon_cli" cloudagent-daemon
+# Or via pipx
+pipx install cloudagent-daemon
 ```
 
-Once published to PyPI, this becomes:
+To upgrade later:
 
 ```bash
-uvx cloudagent-daemon start --server-url https://api-fr.cloudagent.chat --api-key sk_machine_***
+uv tool upgrade cloudagent-daemon
 # or
-pipx install cloudagent-daemon
+pipx upgrade cloudagent-daemon
 ```
 
-## Install
+### Developer install (from source)
+
+Contributors working off the cloudagent repo can install the unreleased dev
+tip directly from the `cy` branch — requires SSH access to the codeup mirror:
+
+```bash
+uv tool install --from "git+ssh://git@codeup.aliyun.com:/69bd0a4d29ad98af4065ce71/cloudagent.git@cy#subdirectory=daemon_cli" cloudagent-daemon
+```
 
-Requires Python 3.12+ and Claude Code CLI installed.
+Or editable install for local hacking:
 
 ```bash
 pip install -e ./daemon_cli
-# or after release:
-# pipx install cloudagent-daemon
 ```
 
 ## Quick start

{cloudagent_daemon-0.2.1 → cloudagent_daemon-0.2.2}/README.md

@@ -11,56 +11,45 @@ backend, and exits when its work is done.
 
 ## Quick start (no clone)
 
-The fastest way to run cloudagent-daemon, slock-style:
-
-Each command below is a SINGLE LINE — copy the whole line as-is.
-Multi-line snippets with `\` continuations are fragile across copy-paste
-(some terminals / web `<pre>` blocks drop the trailing `\` and break the
-command into separate statements).
-
-> **Tag-pinned releases.** The `@daemon-vX.Y.Z` ref below points at a frozen
-> daemon release (annotated git tag). To upgrade later, re-run the same
-> command with the latest tag — see `git ls-remote --tags origin "daemon-v*"`
-> on the cloudagent repo, or [the releases list][releases]. Don't replace
-> the tag with a branch name (e.g. `cy` / `m5`); branches move and can drag
-> in unrelated work-in-progress.
-
-[releases]: https://codeup.aliyun.com/69bd0a4d29ad98af4065ce71/cloudagent/-/tags?search=daemon-v
+Published to PyPI as [`cloudagent-daemon`](https://pypi.org/project/cloudagent-daemon/).
+Requires Python 3.12+ and Claude Code CLI on PATH.
 
 ```bash
-# One-shot run (no install) — single line
-uvx --from "git+ssh://git@codeup.aliyun.com:/69bd0a4d29ad98af4065ce71/cloudagent.git@daemon-v0.2.1#subdirectory=daemon_cli" cloudagent-daemon start --server-url https://api-fr.cloudagent.chat --api-key sk_machine_***
+# One-shot run (no persistent install)
+uvx cloudagent-daemon start --server-url https://api.cloudagent.chat --api-key sk_machine_***
 ```
 
 ```bash
-# Or install persistently — single line, install + start chained with &&
-uv tool install --from "git+ssh://git@codeup.aliyun.com:/69bd0a4d29ad98af4065ce71/cloudagent.git@daemon-v0.2.1#subdirectory=daemon_cli" cloudagent-daemon && cloudagent-daemon start --server-url https://api-fr.cloudagent.chat --api-key sk_machine_***
+# Persistent install — install + start chained with && (single line)
+uv tool install cloudagent-daemon && cloudagent-daemon start --server-url https://api.cloudagent.chat --api-key sk_machine_***
 ```
 
-To upgrade an existing install to the newest tag (forces re-resolve of the
-git ref so a moved tag wouldn't silently stick on the old commit anyway —
-but tags are immutable here, so the bump in the URL is the real signal):
-
 ```bash
-uv tool install --reinstall --force --from "git+ssh://git@codeup.aliyun.com:/69bd0a4d29ad98af4065ce71/cloudagent.git@daemon-v0.2.1#subdirectory=daemon_cli" cloudagent-daemon
+# Or via pipx
+pipx install cloudagent-daemon
 ```
 
-Once published to PyPI, this becomes:
+To upgrade later:
 
 ```bash
-uvx cloudagent-daemon start --server-url https://api-fr.cloudagent.chat --api-key sk_machine_***
+uv tool upgrade cloudagent-daemon
 # or
-pipx install cloudagent-daemon
+pipx upgrade cloudagent-daemon
 ```
 
-## Install
+### Developer install (from source)
+
+Contributors working off the cloudagent repo can install the unreleased dev
+tip directly from the `cy` branch — requires SSH access to the codeup mirror:
+
+```bash
+uv tool install --from "git+ssh://git@codeup.aliyun.com:/69bd0a4d29ad98af4065ce71/cloudagent.git@cy#subdirectory=daemon_cli" cloudagent-daemon
+```
 
-Requires Python 3.12+ and Claude Code CLI installed.
+Or editable install for local hacking:
 
 ```bash
 pip install -e ./daemon_cli
-# or after release:
-# pipx install cloudagent-daemon
 ```
 
 ## Quick start

{cloudagent_daemon-0.2.1 → cloudagent_daemon-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cloudagent-daemon"
-version = "0.2.1"
+version = "0.2.2"
 description = "Local daemon for cloudagent — bridges Claude Code subprocesses to the cloudagent backend over WebSocket."
 authors = [{name = "chaoyin", email = "tudoucyx@gmail.com"}]
 readme = "README.md"

cloudagent_daemon-0.2.2/src/cloudagent_daemon/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.2.2"

{cloudagent_daemon-0.2.1 → cloudagent_daemon-0.2.2}/src/cloudagent_daemon/claude_runner.py

@@ -198,10 +198,16 @@ class ClaudeRunner:
         single_wake_timeout: float | None = None,
         partial_publisher: PartialPublisher | None = None,
         agent_to_session: "dict[str, str | None] | None" = None,
+        claude_permission_mode: str = "default",
     ) -> None:
         self.outbound = outbound
         self.workspace = workspace
         self.claude_binary = claude_binary
+        # Claude CLI ``--permission-mode``. "default" → flag omitted
+        # (legacy behaviour: only the cloudagent MCP toolset is
+        # whitelisted via --allowedTools, Bash/Write/Edit gate). See
+        # DaemonConfig.claude_permission_mode for the per-mode contract.
+        self.claude_permission_mode = claude_permission_mode
         # Allow tests to override the 90-min timeout without monkey-patching
         # a class attribute. Defaults to spec value.
         self._single_wake_timeout: float = (
@@ -541,7 +547,16 @@ The daemon discards stdout — only the mcp tool call reaches the user.
         write are intentionally LEFT to the caller so they always
         reflect the *last* attempt.
         """
-        cmd = self._build_cmd(ws, agent_id, with_resume=with_resume)
+        raw_append = payload.get("append_system_prompt")
+        append_system_prompt = (
+            raw_append if isinstance(raw_append, str) and raw_append.strip() else None
+        )
+        cmd = self._build_cmd(
+            ws,
+            agent_id,
+            with_resume=with_resume,
+            append_system_prompt=append_system_prompt,
+        )
 
         # Task #118 (2026-05-12) — spawn cwd is now the agent-specific
         # cwd (per-agent override → host default → platform fallback).
@@ -773,12 +788,20 @@ Available cloudagent tools:
         agent_id: str,
         *,
         with_resume: bool = True,
+        append_system_prompt: str | None = None,
     ) -> list[str]:
         """Build the ``claude`` argv list for one wake.
 
         1k followup — ``with_resume=False`` forces the runner to omit
         ``--resume`` even if a stored ``last_session_id`` exists. The
         retry path uses this after a stale-session crash.
+
+        ``append_system_prompt`` is per-agent free-text (chairman-editable
+        via the agent dialog, stored in ``agents.metadata_['cloudagent:
+        append_system_prompt']`` and propagated through the deliver
+        payload). When non-empty it is appended verbatim to the operational
+        contract footer with a blank-line separator so it shows up at the
+        very tail of ``--append-system-prompt``.
         """
         cmd: list[str] = [self.claude_binary]
         last_session = ws.last_session_id() if with_resume else None
@@ -786,6 +809,8 @@ Available cloudagent tools:
             cmd += ["--resume", last_session]
         # 1i Bug F — inject operational contract via --append-system-prompt.
         system_prompt = self.SYSTEM_PROMPT_APPEND.format(agent_id=agent_id)
+        if append_system_prompt and append_system_prompt.strip():
+            system_prompt = f"{system_prompt}\n\n{append_system_prompt.strip()}"
         cmd += [
             "--mcp-config",
             str(ws.mcp_config_path()),
@@ -810,6 +835,16 @@ Available cloudagent tools:
             "--append-system-prompt",
             system_prompt,
         ]
+        # 2026-05-19 — opt-in permission relaxation for staff that must
+        # touch the filesystem / run build commands. "default" keeps the
+        # legacy headless behaviour (flag omitted; only the cloudagent
+        # MCP toolset runs unattended). "acceptEdits" / "bypassPermissions"
+        # come from DaemonConfig.claude_permission_mode. The spawn cwd is
+        # already pinned to the agent's workspace_root (see
+        # AgentWorkspaceLike.cwd / Task #118), so acceptEdits' auto-accept
+        # of file edits is naturally scoped to that working directory.
+        if self.claude_permission_mode != "default":
+            cmd += ["--permission-mode", self.claude_permission_mode]
         return cmd
 
     async def _consume_stdout(

{cloudagent_daemon-0.2.1 → cloudagent_daemon-0.2.2}/src/cloudagent_daemon/cli.py

@@ -74,6 +74,32 @@ def _resolve_cli_profile(profile: str | None) -> str:
         raise typer.Exit(2)
 
 
+#: Env var that overrides ``DaemonConfig.claude_permission_mode``. The
+#: only permission knob available to one-shot mode (no config.json).
+PERMISSION_MODE_ENV = "CLOUDAGENT_DAEMON_PERMISSION_MODE"
+
+
+def _apply_permission_mode_override(cfg):  # type: ignore[no-untyped-def]
+    """Return ``cfg`` with ``claude_permission_mode`` replaced by the
+    ``CLOUDAGENT_DAEMON_PERMISSION_MODE`` env var when it is set.
+
+    The replacement goes through ``DaemonConfig`` construction so the
+    field_validator rejects unknown values (raised as ``ValueError``).
+    When the env var is unset / empty, ``cfg`` is returned unchanged.
+    """
+    from .config import DaemonConfig
+
+    mode = os.environ.get(PERMISSION_MODE_ENV)
+    if not mode:
+        return cfg
+    return DaemonConfig(
+        server_url=cfg.server_url,
+        machine_api_key=cfg.machine_api_key,
+        host_id=cfg.host_id,
+        claude_permission_mode=mode,
+    )
+
+
 @app.command()
 def login(
     server: str = typer.Option(..., "--server", help="Backend server URL."),
@@ -265,6 +291,19 @@ def start(
             )
             raise typer.Exit(1)
 
+    # 2026-05-19 — CLOUDAGENT_DAEMON_PERMISSION_MODE env var overrides
+    # config.json's ``claude_permission_mode``. This is the ONLY knob
+    # available to one-shot mode (``start --server-url --api-key``),
+    # which never reads or writes a config.json.
+    try:
+        cfg = _apply_permission_mode_override(cfg)
+    except ValueError as exc:
+        typer.echo(
+            f"Error: invalid CLOUDAGENT_DAEMON_PERMISSION_MODE — {exc}",
+            err=True,
+        )
+        raise typer.Exit(2)
+
     state = (
         DaemonState.load_default(profile_name)
         if DaemonState.default_path(profile_name).exists()

{cloudagent_daemon-0.2.1 → cloudagent_daemon-0.2.2}/src/cloudagent_daemon/config.py

@@ -15,7 +15,7 @@ import tempfile
 from pathlib import Path
 from typing import Self
 
-from pydantic import BaseModel
+from pydantic import BaseModel, field_validator
 
 from .paths import (
     DEFAULT_PROFILE,
@@ -51,6 +51,44 @@ class DaemonConfig(BaseModel):
     machine_api_key: str
     host_id: str
 
+    # Claude CLI permission mode for daemon-spawned staff agents.
+    # The daemon spawns each staff's ``claude`` subprocess with
+    # ``cwd`` already pinned to that agent's workspace_root (see
+    # AgentWorkspaceLike.cwd / Task #118), so the mode's effect is
+    # naturally scoped to the agent's project directory.
+    #
+    #   "default"           — (safe default) only the cloudagent MCP
+    #                          toolset runs unattended; Bash/Write/Edit
+    #                          prompt for permission, which in headless
+    #                          ``--print`` mode means they silently fail.
+    #                          Staff cannot touch the filesystem.
+    #   "acceptEdits"       — file edits (Write/Edit/MultiEdit/Notebook-
+    #                          Edit) are auto-accepted **within the
+    #                          workspace (cwd)** — edits outside the
+    #                          working directory still gate. Bash still
+    #                          prompts (so git commit / build stay
+    #                          blocked). This is "只在当前工作目录
+    #                          bypass 文件操作".
+    #   "bypassPermissions" — every tool runs unattended. Required for
+    #                          staff that must run Bash (git commit,
+    #                          pipeline, build). Bash commands have no
+    #                          directory hard-boundary — a command body
+    #                          can cd out — so only enable this on a
+    #                          machine you are comfortable letting the
+    #                          staff agent operate.
+    claude_permission_mode: str = "default"
+
+    @field_validator("claude_permission_mode")
+    @classmethod
+    def _validate_permission_mode(cls, v: str) -> str:
+        allowed = {"default", "acceptEdits", "bypassPermissions"}
+        if v not in allowed:
+            raise ValueError(
+                f"claude_permission_mode must be one of {sorted(allowed)}, "
+                f"got {v!r}"
+            )
+        return v
+
     # ------------------------------------------------------------------
     # Path helpers
     # ------------------------------------------------------------------

{cloudagent_daemon-0.2.1 → cloudagent_daemon-0.2.2}/src/cloudagent_daemon/main_loop.py

@@ -454,6 +454,7 @@ async def _run_sse_post(
         claude_binary=claude_binary,
         partial_publisher=_publish_partial,
         agent_to_session=_agent_to_session,
+        claude_permission_mode=cfg.claude_permission_mode,
     )
 
     async def _queue_full(agent_id: str, message_id: str) -> None:
@@ -737,7 +738,10 @@ async def _run_legacy_ws(
     outbound = OutboundQueue(transport=None, pending_tool_calls=pending_tool_calls)
 
     runner = ClaudeRunner(
-        outbound=outbound, workspace=workspace, claude_binary=claude_binary
+        outbound=outbound,
+        workspace=workspace,
+        claude_binary=claude_binary,
+        claude_permission_mode=cfg.claude_permission_mode,
     )
 
     async def _queue_full(agent_id: str, message_id: str) -> None:

cloudagent_daemon-0.2.1/src/cloudagent_daemon/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.2.1"