cloudagent-daemon 0.2.2__tar.gz → 0.2.4__tar.gz

{cloudagent_daemon-0.2.2 → cloudagent_daemon-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudagent-daemon
-Version: 0.2.2
+Version: 0.2.4
 Summary: Local daemon for cloudagent — bridges Claude Code subprocesses to the cloudagent backend over WebSocket.
 Project-URL: Homepage, https://cloudagent.chat
 Project-URL: Repository, https://codeup.aliyun.com/69bd0a4d29ad98af4065ce71/cloudagent

{cloudagent_daemon-0.2.2 → cloudagent_daemon-0.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cloudagent-daemon"
-version = "0.2.2"
+version = "0.2.4"
 description = "Local daemon for cloudagent — bridges Claude Code subprocesses to the cloudagent backend over WebSocket."
 authors = [{name = "chaoyin", email = "tudoucyx@gmail.com"}]
 readme = "README.md"

cloudagent_daemon-0.2.4/src/cloudagent_daemon/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.2.4"

{cloudagent_daemon-0.2.2 → cloudagent_daemon-0.2.4}/src/cloudagent_daemon/cli.py

@@ -74,11 +74,6 @@ def _resolve_cli_profile(profile: str | None) -> str:
         raise typer.Exit(2)
 
 
-#: Env var that overrides ``DaemonConfig.claude_permission_mode``. The
-#: only permission knob available to one-shot mode (no config.json).
-PERMISSION_MODE_ENV = "CLOUDAGENT_DAEMON_PERMISSION_MODE"
-
-
 def _apply_permission_mode_override(cfg):  # type: ignore[no-untyped-def]
     """Return ``cfg`` with ``claude_permission_mode`` replaced by the
     ``CLOUDAGENT_DAEMON_PERMISSION_MODE`` env var when it is set.
@@ -88,6 +83,7 @@ def _apply_permission_mode_override(cfg):  # type: ignore[no-untyped-def]
     When the env var is unset / empty, ``cfg`` is returned unchanged.
     """
     from .config import DaemonConfig
+    from .paths import PERMISSION_MODE_ENV
 
     mode = os.environ.get(PERMISSION_MODE_ENV)
     if not mode:
@@ -645,6 +641,19 @@ def install_service_cmd(
         ),
     ),
     profile: str | None = typer.Option(None, "--profile", help=_PROFILE_HELP),
+    permission_mode: str = typer.Option(
+        "default",
+        "--permission-mode",
+        help=(
+            "Claude CLI permission mode for daemon-spawned staff agents. "
+            "'default' — only the cloudagent MCP toolset runs unattended "
+            "(staff cannot touch the filesystem). 'acceptEdits' — file "
+            "edits auto-accepted within the agent's working directory "
+            "(Bash still gates). 'bypassPermissions' — every tool runs "
+            "unattended (needed for staff that run git/build via Bash). "
+            "Baked into the service unit as CLOUDAGENT_DAEMON_PERMISSION_MODE."
+        ),
+    ),
 ) -> None:
     """Install daemon as a launchd (macOS) or systemd (Linux) user service.
 
@@ -655,7 +664,7 @@ def install_service_cmd(
       macOS (named profile fr): tail -F ~/.cloudagent/daemon/profiles/fr/logs/launchd.{out,err}.log
       Linux:                    journalctl --user -u cloudagent-daemon[-<profile>] -f
     """
-    from .config import DaemonState
+    from .config import VALID_PERMISSION_MODES, DaemonState
     from .paths import (
         DEFAULT_PROFILE,
         profile_state_path,
@@ -666,6 +675,14 @@ def install_service_cmd(
 
     profile_name = _resolve_cli_profile(profile)
 
+    if permission_mode not in VALID_PERMISSION_MODES:
+        typer.echo(
+            f"Error: --permission-mode must be one of "
+            f"{sorted(VALID_PERMISSION_MODES)}, got {permission_mode!r}",
+            err=True,
+        )
+        raise typer.Exit(2)
+
     # Task #115 (2026-05-12) — same resolve sequence the ``start``
     # command uses (tilde-expand → resolve → mkdir). We also persist
     # to state.json so a later ``cloudagent-daemon start`` (no flag)
@@ -717,6 +734,7 @@ def install_service_cmd(
             insecure=insecure,
             workspace_root=resolved_workspace_root,
             profile=profile_name,
+            permission_mode=permission_mode,
         )
     except RuntimeError as exc:
         typer.echo(f"Error: {exc}", err=True)
@@ -724,6 +742,8 @@ def install_service_cmd(
     typer.echo(f"✓ Installed {plat} service unit: {path}")
     if profile_name != DEFAULT_PROFILE:
         typer.echo(f"  profile: {profile_name}")
+    if permission_mode != "default":
+        typer.echo(f"  permission mode: {permission_mode}")
     typer.echo("Daemon will auto-restart on crash and start at login.")
 
 

{cloudagent_daemon-0.2.2 → cloudagent_daemon-0.2.4}/src/cloudagent_daemon/config.py

@@ -25,6 +25,14 @@ from .paths import (
 
 _LRU_CAP = 1024
 
+# Accepted values for ``DaemonConfig.claude_permission_mode`` /
+# ``--permission-mode`` / ``CLOUDAGENT_DAEMON_PERMISSION_MODE``. Single
+# source of truth — the field_validator and cli's install-service both
+# check against this.
+VALID_PERMISSION_MODES = frozenset(
+    {"default", "acceptEdits", "bypassPermissions"}
+)
+
 
 def _atomic_write_json(path: Path, data: dict) -> None:
     """Write *data* as JSON to *path* atomically with fsync and mode 0o600."""
@@ -81,11 +89,10 @@ class DaemonConfig(BaseModel):
     @field_validator("claude_permission_mode")
     @classmethod
     def _validate_permission_mode(cls, v: str) -> str:
-        allowed = {"default", "acceptEdits", "bypassPermissions"}
-        if v not in allowed:
+        if v not in VALID_PERMISSION_MODES:
             raise ValueError(
-                f"claude_permission_mode must be one of {sorted(allowed)}, "
-                f"got {v!r}"
+                "claude_permission_mode must be one of "
+                f"{sorted(VALID_PERMISSION_MODES)}, got {v!r}"
             )
         return v
 

{cloudagent_daemon-0.2.2 → cloudagent_daemon-0.2.4}/src/cloudagent_daemon/paths.py

@@ -46,6 +46,12 @@ _PROFILE_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]{0,30}$")
 # ``agent unregister`` etc.
 ENV_VAR = "CLOUDAGENT_DAEMON_PROFILE"
 
+# Env var that overrides DaemonConfig.claude_permission_mode. Surfaced
+# into the daemon process by ``install-service`` (baked into the
+# launchd plist / systemd unit) and read by ``cli.start``. The only
+# permission knob available to one-shot mode (no config.json).
+PERMISSION_MODE_ENV = "CLOUDAGENT_DAEMON_PERMISSION_MODE"
+
 
 def validate_profile_name(name: str) -> str:
     """Return *name* if it is safe to use; raise ``ValueError`` otherwise.

{cloudagent_daemon-0.2.2 → cloudagent_daemon-0.2.4}/src/cloudagent_daemon/service.py

@@ -22,6 +22,7 @@ from pathlib import Path
 from .paths import (
     DEFAULT_PROFILE,
     ENV_VAR,
+    PERMISSION_MODE_ENV,
     profile_launchd_label,
     profile_log_dir,
     profile_systemd_unit_name,
@@ -76,6 +77,7 @@ def _launchd_plist_content(
     insecure: bool,
     workspace_root: str | None = None,
     profile: str | None = None,
+    permission_mode: str = "default",
 ) -> str:
     """Render the plist XML.
 
@@ -119,6 +121,18 @@ def _launchd_plist_content(
             f"        <string>{profile_name}</string>\n"
         )
 
+    # 2026-05-19 — when a non-default permission mode is requested,
+    # bake CLOUDAGENT_DAEMON_PERMISSION_MODE into the plist so the
+    # daemon process inherits it. "default" omits the key entirely so
+    # the rendered plist stays byte-for-byte identical to the legacy
+    # output (zero-migration guarantee).
+    permission_env = ""
+    if permission_mode and permission_mode != "default":
+        permission_env = (
+            f"        <key>{PERMISSION_MODE_ENV}</key>\n"
+            f"        <string>{permission_mode}</string>\n"
+        )
+
     return f"""<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTD/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -152,7 +166,7 @@ def _launchd_plist_content(
              instead of sitting in an 8 KB buffer until the process exits. -->
         <key>PYTHONUNBUFFERED</key>
         <string>1</string>
-{profile_env}    </dict>
+{profile_env}{permission_env}    </dict>
 </dict>
 </plist>
 """
@@ -164,6 +178,7 @@ def install_macos(
     insecure: bool,
     workspace_root: str | None = None,
     profile: str | None = None,
+    permission_mode: str = "default",
 ) -> Path:
     """Install + load + start the launchd user agent for *profile*."""
     profile_name = resolve_profile(profile)
@@ -174,14 +189,30 @@ def install_macos(
     log_dir.mkdir(parents=True, exist_ok=True)
 
     content = _launchd_plist_content(
-        server_url, api_key, insecure, workspace_root, profile=profile_name
+        server_url,
+        api_key,
+        insecure,
+        workspace_root,
+        profile=profile_name,
+        permission_mode=permission_mode,
     )
     plist_path.write_text(content)
     plist_path.chmod(0o600)
 
     uid = os.getuid()
-    # Bootstrap into launchd (modern API). ``check=False`` because the
-    # service may already be loaded — bootout/kickstart below will recover.
+    # Reinstall-safe (2026-05-19). A plain ``bootstrap`` is a no-op when
+    # the service is already loaded — launchctl keeps the OLD in-memory
+    # plist and never re-reads the file we just wrote. Without a prior
+    # ``bootout`` a re-run of ``install-service`` silently keeps the
+    # stale definition (e.g. a changed CLOUDAGENT_DAEMON_PERMISSION_MODE
+    # never takes effect). So: bootout first (unload any loaded
+    # instance), then bootstrap genuinely loads the fresh plist.
+    # ``bootout`` exits non-zero when nothing is loaded (first install)
+    # — ``check=False`` swallows that, making install == reinstall.
+    subprocess.run(
+        ["launchctl", "bootout", f"gui/{uid}/{label}"],
+        check=False,
+    )
     subprocess.run(
         ["launchctl", "bootstrap", f"gui/{uid}", str(plist_path)],
         check=False,
@@ -223,6 +254,7 @@ def _systemd_unit_content(
     insecure: bool,
     workspace_root: str | None = None,
     profile: str | None = None,
+    permission_mode: str = "default",
 ) -> str:
     profile_name = resolve_profile(profile)
     binary = _binary_path()
@@ -252,6 +284,13 @@ def _systemd_unit_content(
         else ""
     )
 
+    # 2026-05-19 — bake the permission mode into the unit when non-default.
+    permission_env_line = (
+        f"Environment={PERMISSION_MODE_ENV}={permission_mode}\n"
+        if permission_mode and permission_mode != "default"
+        else ""
+    )
+
     return f"""[Unit]
 Description=cloudagent local daemon
 After=network-online.target
@@ -266,7 +305,7 @@ Environment=NO_PROXY=*
 Environment=PATH={daemon_path}
 # Force line-buffered stdout — see launchd plist comment for rationale.
 Environment=PYTHONUNBUFFERED=1
-{profile_env_line}
+{profile_env_line}{permission_env_line}
 [Install]
 WantedBy=default.target
 """
@@ -278,6 +317,7 @@ def install_linux(
     insecure: bool,
     workspace_root: str | None = None,
     profile: str | None = None,
+    permission_mode: str = "default",
 ) -> Path:
     profile_name = resolve_profile(profile)
     unit_name = profile_systemd_unit_name(profile_name)
@@ -285,12 +325,28 @@ def install_linux(
     unit_path.parent.mkdir(parents=True, exist_ok=True)
     unit_path.write_text(
         _systemd_unit_content(
-            server_url, api_key, insecure, workspace_root, profile=profile_name
+            server_url,
+            api_key,
+            insecure,
+            workspace_root,
+            profile=profile_name,
+            permission_mode=permission_mode,
         )
     )
     subprocess.run(["systemctl", "--user", "daemon-reload"], check=False)
     subprocess.run(
-        ["systemctl", "--user", "enable", "--now", unit_name],
+        ["systemctl", "--user", "enable", unit_name],
+        check=False,
+    )
+    # Reinstall-safe (2026-05-19): ``restart`` (not ``enable --now`` /
+    # ``start``) so a re-run of ``install-service`` genuinely applies
+    # the freshly written unit file — ``start`` is a no-op on an
+    # already-running service, leaving the daemon on the stale config.
+    # ``daemon-reload`` above re-read the unit; ``restart`` makes the
+    # running process pick it up. ``restart`` also starts a stopped
+    # service, so this covers first-install too.
+    subprocess.run(
+        ["systemctl", "--user", "restart", unit_name],
         check=False,
     )
     return unit_path
@@ -320,14 +376,25 @@ def install_service(
     insecure: bool = False,
     workspace_root: str | None = None,
     profile: str | None = None,
+    permission_mode: str = "default",
 ) -> Path:
     plat = detect_platform()
     if plat == "macos":
         return install_macos(
-            server_url, api_key, insecure, workspace_root, profile=profile
+            server_url,
+            api_key,
+            insecure,
+            workspace_root,
+            profile=profile,
+            permission_mode=permission_mode,
         )
     return install_linux(
-        server_url, api_key, insecure, workspace_root, profile=profile
+        server_url,
+        api_key,
+        insecure,
+        workspace_root,
+        profile=profile,
+        permission_mode=permission_mode,
     )
 
 

cloudagent_daemon-0.2.2/src/cloudagent_daemon/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.2.2"