cloudagent-daemon 0.5.0__tar.gz → 0.5.1__tar.gz

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.1}/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to the local daemon. Format follows
 [Keep a Changelog](https://keepachangelog.com/); versions are
 [PEP 440](https://peps.python.org/pep-0440/). Release with `scripts/release.sh`.
 
+## [0.5.1] — 2026-08-20
+
+### Added
+- Qoder engine now supports cross-owner `read_analyze` (only-read remote
+  command). Previously the daemon fail-closed refused `read_analyze` on qoder
+  because qodercli's tool-restriction was never verified end-to-end (#106).
+  This release ships a proven limited-tool surface:
+  - qodercli launched with `--setting-sources '' --permission-mode
+    bypass_permissions --tools Read Glob Grep --no-session-persistence
+    --strict-mcp-config` and a dedicated read_analyze MCP config; no `--resume`
+    of the owner lane.
+  - `mcp-bridge --tool-profile read_analyze` applies a POSITIVE allowlist at
+    MCP `tools/list` time: only 13 membership-gated query tools remain; every
+    write/mutation tool (`platform_send`, `room_post`, `send_message`,
+    upload/download, reminder/task mutation, react, login, chief tools) is
+    removed. Unknown profile → `ValueError` (fail-closed).
+  - Final analysis is delivered by the daemon-controlled fallback to the
+    backend-supplied origin conversation only; the model cannot choose a
+    destination.
+  Verified by real cross-owner E2E (human non-owner → qoder agent, induced
+  write/command/`platform_send` all blocked, read-only result returned to the
+  origin channel). Confidentiality scope is intentionally the target agent's
+  own read ACL (same-org cross-owner read/analysis is the product contract).
+
+### Known debt
+- mcp-bridge per-spawn token-file is still not wired end-to-end; bridge/daemon
+  IPC trust rests on the same-user 0600 unix socket, so a malicious native
+  process under the same OS user could forge an agent_id. Pre-existing and
+  shared by all engines/run-modes; tracked separately (#110), not introduced
+  by this release.
+
 ## [0.5.0] — 2026-08-19
 
 First release since 0.4.1 (2026-07-22). Everything below shipped to internal

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cloudagent-daemon
-Version: 0.5.0
+Version: 0.5.1
 Summary: Local daemon for cloudagent — bridges Claude Code, Codex, and Qoder CLI agents to the cloudagent backend.
 Project-URL: Homepage, https://cloudagent.chat
 Project-URL: Repository, https://codeup.aliyun.com/69bd0a4d29ad98af4065ce71/cloudagent

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cloudagent-daemon"
-version = "0.5.0"
+version = "0.5.1"
 description = "Local daemon for cloudagent — bridges Claude Code, Codex, and Qoder CLI agents to the cloudagent backend."
 authors = [{name = "chaoyin", email = "tudoucyx@gmail.com"}]
 readme = "README.md"

cloudagent_daemon-0.5.1/src/cloudagent_daemon/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.5.1"

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.1}/src/cloudagent_daemon/claude_runner.py

@@ -1382,6 +1382,9 @@ The daemon discards stdout — only the mcp tool call reaches the channel.
             wake_prompt = self._codex_stdin_preamble(
                 agent_id, append_system_prompt,
                 read_analyze=run_mode == "read_analyze",
+                daemon_managed_reply=(
+                    runtime_engine == "qoder" and run_mode == "read_analyze"
+                ),
             ) + wake_prompt
         try:
             assert proc.stdin is not None  # for type checkers
@@ -1519,6 +1522,19 @@ The daemon discards stdout — only the mcp tool call reaches the channel.
         "mcp__cloudagent__platform_task_status",
     )
 
+    # #107 — qoder read_analyze is enforced with a positive allowlist, not a
+    # denylist.  qodercli 1.1.26 live probes showed that ``--tools`` removes
+    # every other built-in capability from the init event even under
+    # ``bypass_permissions``; the latter is still required so the injected
+    # cloudagent MCP server can post the analysis result in headless mode.
+    # Keep this deliberately small: WebFetch/WebSearch are excluded to avoid
+    # an untrusted cross-owner prompt exfiltrating files it just read.
+    QODER_READ_ANALYZE_BUILTIN_TOOLS: tuple[str, ...] = (
+        "Read",
+        "Glob",
+        "Grep",
+    )
+
     # 1i Bug F — operational contract for daemon-spawned wakes.
     # Without this, claude in --print mode just dumps its answer to stdout
     # and exits, never invoking send_message — so the user never sees a reply.
@@ -1875,10 +1891,16 @@ TASKS (频道任务板) — 频道里的分工协作走任务认领原语，纪
         "提交给 owner 审核 —— owner 批准后再由 owner 指挥自己的 agent 实际落盘。"
         "不要试图直接改文件;被拦不是故障,是权限设计。"
     )
+    QODER_READ_ANALYZE_REPLY_NOTE = (
+        "【Qoder 只读回报例外】本模式刻意不向模型暴露 platform_send、"
+        "room_post、send_message 或任何写类 MCP 工具。不要尝试调用这些工具；"
+        "请把完整分析作为本轮最终文本直接输出。daemon 会把该最终文本经受控"
+        "fallback 发回 backend 下发的原始 conversation_id，目标不可由你更改。"
+    )
 
     def _codex_stdin_preamble(
         self, agent_id: str, append_system_prompt: str | None,
-        *, read_analyze: bool = False,
+        *, read_analyze: bool = False, daemon_managed_reply: bool = False,
     ) -> str:
         """The system contract as a stdin preamble — codex's substitute for
         ``--append-system-prompt`` (which only the claude argv path has).
@@ -1891,6 +1913,8 @@ TASKS (频道任务板) — 频道里的分工协作走任务认领原语，纪
         parts = [self.SYSTEM_PROMPT_APPEND.format(agent_id=agent_id)]
         if read_analyze:
             parts.append(self.READ_ANALYZE_SYSTEM_NOTE)
+        if daemon_managed_reply:
+            parts.append(self.QODER_READ_ANALYZE_REPLY_NOTE)
         if append_system_prompt and append_system_prompt.strip():
             parts.append(append_system_prompt.strip())
         joined = "\n\n".join(parts)
@@ -1952,6 +1976,38 @@ TASKS (频道任务板) — 频道里的分工协作走任务认领原语，纪
                 exc_info=True,
             )
 
+    @staticmethod
+    def _qoder_read_analyze_mcp_config(
+        ws: AgentWorkspaceLike, agent_id: str
+    ) -> Path:
+        """Write the per-wake, query-only cloudagent MCP config for qoder.
+
+        The regular workspace config exposes state-changing tools (send,
+        upload, task mutations, reminders).  ``--tools`` only restricts qoder
+        built-ins, so read_analyze needs a separately profiled bridge whose
+        ``tools/list`` contains query-only operations.  The daemon fallback,
+        not the model, posts the final analysis back to the source channel.
+        """
+        from .paths import build_mcp_bridge_args, daemon_executable
+
+        config_path = ws.path / ".meta" / "qoder-read-analyze-mcp-config.json"
+        token_file = str(ws.path / ".meta" / "claude-token.txt")
+        config = {
+            "mcpServers": {
+                "cloudagent": {
+                    "command": daemon_executable(),
+                    "args": build_mcp_bridge_args(
+                        agent_id,
+                        token_file,
+                        tool_profile="read_analyze",
+                    ),
+                }
+            }
+        }
+        config_path.parent.mkdir(parents=True, exist_ok=True)
+        config_path.write_text(json.dumps(config, indent=2), encoding="utf-8")
+        return config_path
+
     def _build_cmd(
         self,
         ws: AgentWorkspaceLike,
@@ -2061,20 +2117,14 @@ TASKS (频道任务板) — 频道里的分工协作走任务认领原语，纪
             # stream-json/--append-system-prompt/--mcp-config/--resume 全对齐，
             # 输出走既有 stream_json 消费器（联调时如发现事件形状偏差再适配）。
             # 认证：QODER_PERSONAL_ACCESS_TOKEN 环境变量或 qodercli login。
-            if read_analyze:
-                # fail-closed：qoder 的只读硬化（--tools/--disallowed-tools 的
-                # 内建工具名、--permission-mode 无头语义）尚未在真机验证 ——
-                # 未验证的安全属性不许上线（#55 口径），宁可拒绝 spawn。
-                raise RuntimeError(
-                    "qoder runtime does not support run_mode=read_analyze yet "
-                    "(read-only hardening flags unverified); refusing to spawn"
-                )
             binary = self.runtime_binaries.get("qoder") or "qodercli"
             # #95 — 会话按 conversation_id 分轨（DM/各频道各自续聊），不再共用
             # 全局 last_session；无 conversation_id 的非平台唤醒沿用全局轨。
+            # #107 — read_analyze 与 claude/codex 一样绝不 resume owner 轨，
+            # 防外部指挥上下文渗进后续 full 会话。
             lane_session = (
                 self._qoder_lane_session(ws, conversation_id)
-                if with_resume else None
+                if with_resume and not read_analyze else None
             )
             cmd = [binary]
             # r6 同款：模型 + 推理强度由 chairman 在编辑页选（qoder 档位
@@ -2085,13 +2135,18 @@ TASKS (频道任务板) — 频道里的分工协作走任务认领原语，纪
                 cmd += ["--reasoning-effort", reasoning_effort]
             if lane_session:
                 cmd += ["--resume", lane_session]
+            mcp_config_path = (
+                self._qoder_read_analyze_mcp_config(ws, agent_id)
+                if read_analyze
+                else ws.mcp_config_path()
+            )
             # #95 — 运营契约 + 本轮 append（含频道级提示）**不走 argv
             # --append-system-prompt**：qodercli --resume 不可靠采用新的 append，
             # 改与 codex 同款折进 stdin 活跃前导（见 _spawn_attempt），每轮必到
             # 模型眼前，不依赖 CLI 对 resume 的语义。
             cmd += [
                 "--mcp-config",
-                str(ws.mcp_config_path()),
+                str(mcp_config_path),
                 "--print",
                 "--output-format",
                 "stream-json",
@@ -2100,6 +2155,24 @@ TASKS (频道任务板) — 频道里的分工协作走任务认领原语，纪
                 "--permission-mode",
                 "bypass_permissions",
             ]
+            if read_analyze:
+                # #107 — qodercli 1.1.26 双机真测：--tools 是 built-in
+                # capability allowlist；在 bypass_permissions 下 init.tools
+                # 仍精确为 Glob/Grep/Read，Bash/Write/Edit/NotebookEdit/Web*
+                # 不可调用，诱导写文件的探针保持不存在。同时 bypass 让
+                # cloudagent MCP 能在 --print 无头模式回报结果。
+                #
+                # 空 setting-sources 不加载 user/project/local hooks；strict
+                # MCP 只保留 daemon 生成的 cloudagent 配置；禁用 session
+                # persistence，配合上面的 no-resume 保证 owner 会话隔离。
+                cmd += [
+                    "--setting-sources",
+                    "",
+                    "--no-session-persistence",
+                    "--strict-mcp-config",
+                    "--tools",
+                    *self.QODER_READ_ANALYZE_BUILTIN_TOOLS,
+                ]
             return cmd
 
         cmd = [self.runtime_binaries.get("claude_code") or self.claude_binary]

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.1}/src/cloudagent_daemon/cli.py

@@ -973,13 +973,23 @@ def mcp_bridge(
         ),
     ),
     profile: str | None = typer.Option(None, "--profile", help=_PROFILE_HELP),
+    tool_profile: str = typer.Option(
+        "full",
+        "--tool-profile",
+        help="MCP capability profile (full or read_analyze).",
+    ),
 ) -> None:
     """[internal] stdio MCP server invoked by claude subprocess."""
     from .mcp_bridge import run_bridge
 
     profile_name = _resolve_cli_profile(profile)
     asyncio.run(
-        run_bridge(agent_id=agent_id, token_file=token_file, profile=profile_name)
+        run_bridge(
+            agent_id=agent_id,
+            token_file=token_file,
+            profile=profile_name,
+            tool_profile=tool_profile,
+        )
     )
 
 

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.1}/src/cloudagent_daemon/mcp_bridge.py

@@ -79,6 +79,32 @@ PLATFORM_TOOLS: frozenset[str] = frozenset(
     }
 )
 
+# #107 — cross-owner ``read_analyze`` must expose no state-changing MCP
+# capability to the model.  The daemon posts the final analysis through its
+# controlled platform fallback, so ``platform_send`` is intentionally absent;
+# only membership-gated/query-only tools remain visible inside qodercli.
+# Confidentiality scope is intentionally the TARGET AGENT'S existing read ACL,
+# not the initiating human's ACL: same-org cross-owner read/analysis is the
+# product contract.  Results can leave that read scope only through the daemon
+# fallback, whose destination is the backend-supplied source conversation.
+READ_ANALYZE_MCP_TOOLS: frozenset[str] = frozenset(
+    {
+        "list_messages",
+        "list_reminders",
+        "platform_read",
+        "platform_channels_list",
+        "platform_search",
+        "platform_react_list",
+        "platform_inbox",
+        "platform_list_integrations",
+        "platform_task_list",
+        "search_task_context",
+        "read_task_room_context",
+        "resolve_task_ref",
+        "list_related_delegations",
+    }
+)
+
 
 def _read_identity(agent_id: str) -> dict:
     """Defensive read of ``~/.cloudagent/agents/<id>/.meta/identity.json``.
@@ -206,8 +232,9 @@ def build_server(
     socket_path: Path = DEFAULT_SOCKET_PATH,
     identity: dict | None = None,
     session_id: str | None = None,
+    tool_profile: str = "full",
 ) -> FastMCP:
-    """Construct a FastMCP server with tools filtered by ``is_chief``.
+    """Construct a FastMCP server filtered by identity and tool profile.
 
     Split out from ``run_bridge`` so unit tests can introspect the tool
     list without spinning up stdio.
@@ -226,7 +253,15 @@ def build_server(
     Pass ``None`` only when no session is known (the backend will then
     reject with INVALID_ARGS — that's the expected behaviour and
     surfaces the bug rather than masking it).
+
+    ``tool_profile='read_analyze'`` is the fail-closed cross-owner surface:
+    after normal registration, every tool outside
+    :data:`READ_ANALYZE_MCP_TOOLS` is removed.  Filtering at MCP registration
+    time is stronger than asking the model not to call a write tool: the tool
+    never appears in ``tools/list`` and cannot be invoked by name.
     """
+    if tool_profile not in ("full", "read_analyze"):
+        raise ValueError(f"unknown MCP tool profile: {tool_profile}")
     if identity is None:
         identity = _read_identity(agent_id)
 
@@ -791,6 +826,11 @@ def build_server(
                 session_id,
             )
 
+    if tool_profile == "read_analyze":
+        for tool in tuple(server._tool_manager.list_tools()):
+            if tool.name not in READ_ANALYZE_MCP_TOOLS:
+                server.remove_tool(tool.name)
+
     return server
 
 
@@ -825,6 +865,7 @@ async def run_bridge(
     token_file: Path | None = None,
     socket_path: Path | None = None,
     profile: str | None = None,
+    tool_profile: str = "full",
 ) -> None:
     """Run the bridge until claude closes stdin.
 
@@ -910,10 +951,13 @@ async def run_bridge(
         socket_path=socket_path,
         identity=identity,
         session_id=current_session_id,
+        tool_profile=tool_profile,
     )
     logger.info(
-        "mcp_bridge: ready agent=%s is_chief=%s — entering stdio loop",
+        "mcp_bridge: ready agent=%s is_chief=%s tool_profile=%s — "
+        "entering stdio loop",
         agent_id,
         identity.get("is_chief") is True,
+        tool_profile,
     )
     await server.run_stdio_async()

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.1}/src/cloudagent_daemon/paths.py

@@ -200,6 +200,7 @@ def build_mcp_bridge_args(
     agent_id: str,
     token_file: str,
     profile: str | None = None,
+    tool_profile: str = "full",
 ) -> list[str]:
     """Build argv for the ``cloudagent-daemon mcp-bridge`` MCP server.
 
@@ -222,6 +223,8 @@ def build_mcp_bridge_args(
     args = ["mcp-bridge", "--agent-id", agent_id, "--token-file", token_file]
     if resolved != DEFAULT_PROFILE:
         args += ["--profile", resolved]
+    if tool_profile != "full":
+        args += ["--tool-profile", tool_profile]
     return args
 
 

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.1}/tests/integration/test_mcp_bridge_round_trip.py

@@ -204,7 +204,10 @@ _COMMON_TOOLS = {
     "send_message",
     "list_messages",
     "upload_file",
+    "download_attachment",
     "schedule_reminder",
+    "list_reminders",
+    "cancel_reminder",
     "room_post",
 }
 _RETRIEVAL_TOOLS = {
@@ -219,6 +222,8 @@ _RETRIEVAL_TOOLS = {
 _PLATFORM_TOOLS = {
     "platform_send",
     "platform_read",
+    "platform_channels_list",
+    "platform_search",
     "platform_react",
     "platform_react_list",
     "platform_inbox",
@@ -281,6 +286,67 @@ async def test_missing_is_chief_defaults_to_staff() -> None:
     assert names.isdisjoint(_CHIEF_ONLY_TOOLS)
 
 
+async def test_read_analyze_profile_registers_query_only_tools() -> None:
+    """#107 — cross-owner qoder never sees state-changing MCP tools.
+
+    The final reply is posted by the daemon's controlled fallback, so even
+    platform_send is intentionally absent from the model-visible surface.
+    """
+    server = build_server(
+        agent_id="a_read_analyze",
+        socket_path=Path("/tmp/never-used.sock"),
+        identity={"is_chief": True},
+        tool_profile="read_analyze",
+    )
+    names = {t.name for t in await server.list_tools()}
+    assert names == {
+        "list_messages",
+        "list_reminders",
+        "platform_read",
+        "platform_channels_list",
+        "platform_search",
+        "platform_react_list",
+        "platform_inbox",
+        "platform_list_integrations",
+        "platform_task_list",
+        "search_task_context",
+        "read_task_room_context",
+        "resolve_task_ref",
+        "list_related_delegations",
+    }
+    assert names.isdisjoint(
+        {
+            "send_message",
+            "upload_file",
+            "download_attachment",
+            "schedule_reminder",
+            "cancel_reminder",
+            "room_post",
+            "platform_send",
+            "platform_react",
+            "platform_login",
+            "platform_task_create",
+            "platform_task_claim",
+            "platform_task_release",
+            "platform_task_status",
+            "delegate_to_staff",
+            "close_task",
+            "request_user_approval",
+            "set_company_status",
+        }
+    )
+
+
+async def test_unknown_tool_profile_fails_closed() -> None:
+    with pytest.raises(ValueError, match="unknown MCP tool profile"):
+        build_server(
+            agent_id="a_bad_profile",
+            socket_path=Path("/tmp/never-used.sock"),
+            identity={},
+            tool_profile="typo",
+        )
+
+
 async def test_chief_only_tool_handler_actually_callable_when_chief(
     ipc_server: tuple[Path, list[dict]],
 ) -> None:

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.1}/tests/unit/test_claude_runner.py

@@ -3036,13 +3036,35 @@ async def test_qoder_runtime_resumes_stored_session(fake_claude, tmp_path):
     assert argv[argv.index("--resume") + 1] == "qoder_old_7"
 
 
-async def test_qoder_runtime_refuses_read_analyze(fake_claude, tmp_path):
-    """cr0624 R32 fail-closed — qoder 的只读硬化未经真机验证，read_analyze
-    必须拒绝 spawn 而不是带着未验证的安全属性上线。"""
+async def test_qoder_runtime_read_analyze_uses_verified_tool_allowlist(
+    fake_claude, tmp_path
+):
+    """#107 — verified qoder read_analyze keeps read tools + cloudagent MCP,
+    drops every write/shell/network built-in, and never resumes an owner lane."""
     mcp_cfg = tmp_path / "mcp.json"
     mcp_cfg.write_text("{}")
-    ws = FakeWorkspace(FakeAgentWorkspace(mcp_path=mcp_cfg, last_session=None))
-    fake = fake_claude(stdout_lines=[], exit_code=0)
+    (tmp_path / ".meta").mkdir()
+    lanes_path = tmp_path / ".meta" / "qoder-sessions.json"
+    lanes_path.write_text(json.dumps({"conv_A": "owner_lane"}))
+    agent_ws = FakeAgentWorkspace(
+        mcp_path=mcp_cfg, last_session="owner_global", path=tmp_path
+    )
+    ws = FakeWorkspace(agent_ws)
+    fake = fake_claude(
+        stdout_lines=[
+            json.dumps({
+                "type": "system",
+                "subtype": "init",
+                "session_id": "readonly_ephemeral",
+            }),
+            json.dumps({
+                "type": "result",
+                "subtype": "success",
+                "result": "analysis",
+            }),
+        ],
+        exit_code=0,
+    )
     runner = ClaudeRunner(
         outbound=FakeOutbound(),
         workspace=ws,
@@ -3050,13 +3072,44 @@ async def test_qoder_runtime_refuses_read_analyze(fake_claude, tmp_path):
         runtime_binaries={"qoder": fake},
         single_wake_timeout=10.0,
     )
-    with pytest.raises(RuntimeError, match="read_analyze"):
-        runner._build_cmd(
-            ws.for_agent("agent-A"),
-            "agent-A",
-            runtime_engine="qoder",
-            run_mode="read_analyze",
-        )
+    result = await runner.run_one(
+        "agent-A",
+        {
+            **_make_payload(),
+            "runtime_engine": "qoder",
+            "run_mode": "read_analyze",
+            "conversation_id": "conv_A",
+        },
+    )
+
+    assert result.captured_session_id == "readonly_ephemeral"
+    argv = _read_argv(tmp_path)
+    assert "--resume" not in argv
+    assert argv[argv.index("--permission-mode") + 1] == "bypass_permissions"
+    assert argv[argv.index("--setting-sources") + 1] == ""
+    assert "--no-session-persistence" in argv
+    assert "--strict-mcp-config" in argv
+    assert argv[argv.index("--tools") + 1:] == ["Read", "Glob", "Grep"]
+    for forbidden in (
+        "Bash", "Write", "Edit", "NotebookEdit", "WebFetch", "WebSearch"
+    ):
+        assert forbidden not in argv[argv.index("--tools") + 1:]
+
+    readonly_mcp_path = Path(argv[argv.index("--mcp-config") + 1])
+    assert readonly_mcp_path != mcp_cfg
+    readonly_mcp = json.loads(readonly_mcp_path.read_text())
+    bridge_args = readonly_mcp["mcpServers"]["cloudagent"]["args"]
+    assert bridge_args[-2:] == ["--tool-profile", "read_analyze"]
+
+    stdin = _read_stdin(tmp_path)
+    assert "只读分析模式" in stdin
+    assert "Qoder 只读回报例外" in stdin
+    assert "daemon 会把该最终文本" in stdin
+    # The read-only qoder session is neither resumed nor persisted into the
+    # owner lane/global session track.
+    assert json.loads(lanes_path.read_text()) == {"conv_A": "owner_lane"}
+    assert agent_ws.last_session_id() == "owner_global"
+    assert agent_ws.set_calls == []
 
 
 async def test_qoder_real_event_sequence_converges_on_result(fake_claude, tmp_path):

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.1}/tests/unit/test_cli_smoke.py

@@ -72,6 +72,7 @@ def test_mcp_bridge_command_exists_even_though_hidden():
     assert result.exit_code == 0
     assert "--agent-id" in result.stdout
     assert "--token-file" in result.stdout
+    assert "--tool-profile" in result.stdout
 
 
 # ---------------------------------------------------------------------------

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.1}/tests/unit/test_paths.py

@@ -131,6 +131,13 @@ def test_build_bridge_args_default_profile_omits_flag() -> None:
     ]
 
 
+def test_build_bridge_args_read_analyze_includes_tool_profile() -> None:
+    args = paths.build_mcp_bridge_args(
+        "agent_x", "/tok/t.txt", tool_profile="read_analyze"
+    )
+    assert args[-2:] == ["--tool-profile", "read_analyze"]
+
+
 def test_build_bridge_args_none_falls_back_to_env(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.1}/uv.lock

@@ -122,7 +122,7 @@ wheels = [
 
 [[package]]
 name = "cloudagent-daemon"
-version = "0.5.0"
+version = "0.5.1"
 source = { editable = "." }
 dependencies = [
     { name = "h2" },

cloudagent_daemon-0.5.0/src/cloudagent_daemon/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.5.0"