cloudagent-daemon 0.3.0__tar.gz → 0.4.0__tar.gz

{cloudagent_daemon-0.3.0 → cloudagent_daemon-0.4.0}/.gitignore

@@ -49,6 +49,9 @@ CLAUDE.md
 # Git worktrees (local-only, isolated feature branches)
 .worktrees/
 
+# Local code-graph tooling DB (understand-anything / codegraph, ~60MB, not shared)
+.codegraph/
+
 # Local agent scratch output (UI checker screenshots, design data dumps, etc.)
 .r2c/
 one-company-fe/deploy
@@ -86,6 +89,20 @@ package-lock.json
 
 # playwright 测试相关
 .playwright-mcp/
+tests/taoguang/
+# fr live sanity 临时 Playwright 脚本 (Alex review 时 drop, 本地用)
+one-company-fe/fr-sanity*.js
 
 # M7 设计 demo 的解压产物（源在 Opc.zip，解压即得）
 company/m7/refactors/Opc_extracted/
+
+# understand-anything tool cache
+.understand-anything/
+
+# cyber-room-android
+cyber-room-android/.gradle/
+cyber-room-android/build/
+cyber-room-android/app/build/
+cyber-room-android/local.properties
+cyber-room-android/qa/evidence/
+cyber-room-android/qa/.secrets/

{cloudagent_daemon-0.3.0 → cloudagent_daemon-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudagent-daemon
-Version: 0.3.0
+Version: 0.4.0
 Summary: Local daemon for cloudagent — bridges Claude Code subprocesses to the cloudagent backend over WebSocket.
 Project-URL: Homepage, https://cloudagent.chat
 Project-URL: Repository, https://codeup.aliyun.com/69bd0a4d29ad98af4065ce71/cloudagent

{cloudagent_daemon-0.3.0 → cloudagent_daemon-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cloudagent-daemon"
-version = "0.3.0"
+version = "0.4.0"
 description = "Local daemon for cloudagent — bridges Claude Code subprocesses to the cloudagent backend over WebSocket."
 authors = [{name = "chaoyin", email = "tudoucyx@gmail.com"}]
 readme = "README.md"

cloudagent_daemon-0.4.0/src/cloudagent_daemon/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.4.0"

cloudagent_daemon-0.4.0/src/cloudagent_daemon/agent_upload.py

@@ -0,0 +1,201 @@
+"""Local-agent file upload read site (task #9 刀3) — runs in **daemon-main**.
+
+The local agent's ``upload_file(path)`` MCP tool (mcp_bridge) only forwards the
+path over IPC — it NEVER reads the file. The actual read happens HERE, in the
+daemon-main process, because only this process has the user's Mac filesystem
+(the backend can't read Mac paths). After the read-site gate passes we hand the
+bytes to the backend's ``/v1/daemon/agent-file-upload`` (刀1) via multipart with
+the resolved realpath + declared size + a cross-check sha.
+
+Read-site gate (Alex 刀3): exactly ONE explicit file — no directory / glob /
+recursion; ``os.path.realpath`` (resolves symlinks); the shared home denylist
+(byte-for-byte copy of the backend module); ``stat`` size BEFORE reading bytes;
+bounded read (cap+1) in case the file grew between stat and open; the
+client-computed sha is only a CROSS-CHECK (the backend recomputes the truth).
+
+A read-site failure returns ``{"ok": False, ...}`` and NEVER calls the backend
+and NEVER fabricates a success.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import mimetypes
+import os
+import stat
+from typing import Any
+
+import httpx
+
+from .agent_upload_denylist import is_denied
+
+logger = logging.getLogger(__name__)
+
+_PATH_AGENT_UPLOAD = "/v1/daemon/agent-file-upload"
+
+
+def _cap() -> int:
+    """Per-file byte cap (read-site pre-check). The backend re-enforces its own
+    ``settings.agent_upload_max_bytes`` authoritatively; this just rejects early
+    and clearly. Overridable via env for parity with the backend default."""
+    raw = os.environ.get("CLOUDAGENT_AGENT_UPLOAD_MAX_BYTES", "").strip()
+    try:
+        v = int(raw)
+        if v > 0:
+            return v
+    except ValueError:
+        pass
+    return 50 * 1024 * 1024
+
+
+def _err(code: str, message: str) -> dict[str, Any]:
+    return {"ok": False, "error": {"code": code, "message": message}}
+
+
+def _backend_error_message(resp: httpx.Response) -> str:
+    """Pull the agent-readable message out of the backend's ``{"error":{...}}``."""
+    try:
+        body = resp.json()
+    except ValueError:
+        return f"upload rejected (backend {resp.status_code})"
+    err = body.get("error") if isinstance(body, dict) else None
+    if isinstance(err, dict):
+        if err.get("message"):
+            return str(err["message"])
+        if err.get("code"):
+            return str(err["code"])
+    return f"upload rejected (backend {resp.status_code})"
+
+
+async def handle_upload_file(
+    http: Any,
+    *,
+    agent_id: str,
+    session_id: str | None,
+    args: dict[str, Any],
+) -> dict[str, Any]:
+    """Read the LOCAL file (all FS checks here) → multipart to the backend.
+
+    Returns ``{"ok": True, "data": {...}}`` / ``{"ok": False, "error": {...}}``
+    matching the ``send_tool_call`` shape the ipc_handler expects.
+    """
+    path = args.get("path")
+    if not isinstance(path, str) or not path.strip():
+        return _err(
+            "INVALID_ARGS",
+            "upload_file: 'path' must be a non-empty path to ONE file",
+        )
+    raw = path.strip()
+
+    # ONE explicit file. Expand ~, realpath (resolves symlinks so a link into a
+    # denied dir is caught by its real target).
+    rp = os.path.realpath(os.path.expanduser(raw))
+    try:
+        st = os.stat(rp)
+    except OSError as exc:
+        return _err(
+            "NOT_FOUND",
+            f"upload_file: cannot access {raw!r} ({exc.strerror or exc}). "
+            "Pass the path to an existing file.",
+        )
+    if stat.S_ISDIR(st.st_mode):
+        return _err(
+            "INVALID_ARGS",
+            "upload_file: that path is a directory. Pass ONE explicit file "
+            "— directories, globs and recursion are not supported.",
+        )
+    if not stat.S_ISREG(st.st_mode):
+        return _err(
+            "INVALID_ARGS",
+            "upload_file: that path is not a regular file (e.g. a device, "
+            "socket or fifo).",
+        )
+
+    # Home-relative + segment denylist (authoritative — symlinks already
+    # resolved). Hit → hard failure, no "rename & retry" hint.
+    denied, reason = is_denied(rp, home=os.path.expanduser("~"))
+    if denied:
+        return _err(
+            "DENIED",
+            f"upload_file: {raw!r} is blocked for security ({reason}). Files "
+            "under credential/secret locations (e.g. ~/.ssh, ~/.aws) cannot be "
+            "uploaded.",
+        )
+
+    # Size guard BEFORE reading the bytes (stat-based).
+    cap = _cap()
+    size = st.st_size
+    if size == 0:
+        return _err("EMPTY", "upload_file: that file is empty.")
+    if size > cap:
+        return _err(
+            "TOO_LARGE",
+            f"upload_file: that file is too large ({size} bytes; the limit is "
+            f"{cap} bytes).",
+        )
+
+    # Read bytes — size already capped; bounded read in case the file grew
+    # between stat and open.
+    try:
+        with open(rp, "rb") as fh:
+            content = fh.read(cap + 1)
+    except OSError as exc:
+        return _err(
+            "READ_FAILED",
+            f"upload_file: cannot read {raw!r} ({exc.strerror or exc}).",
+        )
+    if len(content) == 0:
+        return _err("EMPTY", "upload_file: that file is empty.")
+    if len(content) > cap:
+        return _err(
+            "TOO_LARGE",
+            f"upload_file: that file is too large (over {cap} bytes).",
+        )
+
+    sha = hashlib.sha256(content).hexdigest()
+    fname = os.path.basename(rp)
+    mime = mimetypes.guess_type(fname)[0] or "application/octet-stream"
+
+    # cr0624 #51 — 平台会话（频道/DM）上传：透传 conversation_id，后端改走
+    # 平台分支（成员校验 + 自动贴附件消息）。无值 = 老 task 路径，行为不变。
+    conv_ref = args.get("conversation_id")
+    form: dict[str, str] = {
+        "agent_id": agent_id,
+        "session_id": session_id or "",
+        "client_realpath": rp,
+        "declared_size": str(size),
+        "content_sha256": sha,
+    }
+    if isinstance(conv_ref, str) and conv_ref.strip().startswith("conv_"):
+        form["conversation_id"] = conv_ref.strip()
+
+    try:
+        resp = await http.post_multipart(
+            _PATH_AGENT_UPLOAD,
+            files={"file": (fname, content, mime)},
+            data=form,
+        )
+    except httpx.HTTPStatusError as exc:
+        return _err("UPLOAD_REJECTED", f"upload_file: {_backend_error_message(exc.response)}")
+    except Exception as exc:  # noqa: BLE001
+        logger.warning("agent_upload: backend call failed: %s", exc, exc_info=True)
+        return _err(
+            "UPLOAD_FAILED",
+            f"upload_file: upload failed ({type(exc).__name__}). Please retry.",
+        )
+
+    name = resp.get("name") or fname
+    download_path = resp.get("download_path")
+    placed = "频道" if "conversation_id" in form else "协作室"
+    return {
+        "ok": True,
+        "data": {
+            "file_id": resp.get("file_id"),
+            "filename": name,
+            "download_path": download_path,
+            "message": (
+                f"已上传「{name}」，并已在{placed}贴出附件消息：{download_path}"
+            ),
+        },
+    }

cloudagent_daemon-0.4.0/src/cloudagent_daemon/agent_upload_denylist.py

@@ -0,0 +1,84 @@
+"""Shared denylist for the agent file-upload feature (任意路径 + 私密目录 denylist).
+
+金山 authorised agent uploads from any explicit file path; Alex's gate (82340720 /
+b41f2cbb) requires a denylist of common credential/secret locations, checked
+**after realpath** so a symlink pointing into a denied directory is caught by its
+real target. A hit is a HARD failure — never hint "rename and retry".
+
+The AUTHORITATIVE check runs at the read site (daemon-main for local agents, the
+pod for cloud agents) where the real home dir + filesystem exist: it does
+``rp = os.path.realpath(path)`` then ``is_denied(rp, home)``. The backend keeps
+this same module (one source of truth) and runs the home-independent
+segment/basename check on the client-supplied realpath as defence-in-depth before
+storing it in the audit record — a buggy or out-of-date client cannot smuggle a
+``~/.ssh/id_ed25519`` past the server.
+
+This module is pure (no FS/network) so both runtimes + the backend share it and it
+is unit-testable in isolation. The daemon package keeps a byte-for-byte copy
+(separate Python package); keep the two in sync.
+"""
+
+from __future__ import annotations
+
+import os
+
+# Home-relative paths (dirs or files) that must never be uploaded. Checked as an
+# absolute prefix/equal once the caller's home dir is known (the authoritative
+# read-site check). Covers SSH/cloud/k8s/registry creds, GPG, shell rc secrets,
+# the OS keychain, editor secret stores, and the daemon's own config dir.
+DENIED_HOME_RELATIVE: tuple[str, ...] = (
+    ".ssh",
+    ".aws",
+    ".config/gcloud",
+    ".config/gh",
+    ".kube",
+    ".docker",
+    ".gnupg",
+    ".cloudagent",
+    ".npmrc",
+    ".pypirc",
+    ".netrc",
+    ".git-credentials",
+    "Library/Keychains",
+    "Library/Application Support/Code/User/globalStorage",
+)
+
+# Home-independent defence-in-depth: any path *segment* equal to one of these is
+# denied regardless of where home is (catches creds dirs nested anywhere).
+_DENIED_SEGMENTS: frozenset[str] = frozenset(
+    {".ssh", ".aws", ".kube", ".docker", ".gnupg", ".cloudagent", "gcloud", "Keychains", "globalStorage"}
+)
+
+# Home-independent: any file whose basename matches is denied wherever it lives.
+_DENIED_BASENAMES: frozenset[str] = frozenset(
+    {".npmrc", ".pypirc", ".netrc", ".git-credentials"}
+)
+
+
+def is_denied(realpath: str, home: str | None = None) -> tuple[bool, str | None]:
+    """Return ``(True, reason)`` if ``realpath`` is on the denylist, else ``(False, None)``.
+
+    ``realpath`` MUST already be ``os.path.realpath``-resolved by the caller (so a
+    symlink into a denied dir is resolved to its real, denied target before this
+    runs). ``home`` enables the authoritative home-relative prefix check at the
+    read site; omit it on the backend defence-in-depth pass (segment/basename only).
+    """
+    norm = os.path.normpath(realpath)
+    base = os.path.basename(norm)
+
+    if base in _DENIED_BASENAMES:
+        return True, f"denied file: {base}"
+
+    segments = norm.split(os.sep)
+    for seg in segments:
+        if seg in _DENIED_SEGMENTS:
+            return True, f"denied path segment: {seg}"
+
+    if home:
+        home_norm = os.path.normpath(home)
+        for rel in DENIED_HOME_RELATIVE:
+            denied_abs = os.path.normpath(os.path.join(home_norm, rel))
+            if norm == denied_abs or norm.startswith(denied_abs + os.sep):
+                return True, f"denied path: ~/{rel}"
+
+    return False, None