cloudagent-daemon 0.5.0__tar.gz → 0.5.2__tar.gz

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.2}/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to the local daemon. Format follows
 [Keep a Changelog](https://keepachangelog.com/); versions are
 [PEP 440](https://peps.python.org/pep-0440/). Release with `scripts/release.sh`.
 
+## [0.5.1] — 2026-08-20
+
+### Added
+- Qoder engine now supports cross-owner `read_analyze` (only-read remote
+  command). Previously the daemon fail-closed refused `read_analyze` on qoder
+  because qodercli's tool-restriction was never verified end-to-end (#106).
+  This release ships a proven limited-tool surface:
+  - qodercli launched with `--setting-sources '' --permission-mode
+    bypass_permissions --tools Read Glob Grep --no-session-persistence
+    --strict-mcp-config` and a dedicated read_analyze MCP config; no `--resume`
+    of the owner lane.
+  - `mcp-bridge --tool-profile read_analyze` applies a POSITIVE allowlist at
+    MCP `tools/list` time: only 13 membership-gated query tools remain; every
+    write/mutation tool (`platform_send`, `room_post`, `send_message`,
+    upload/download, reminder/task mutation, react, login, chief tools) is
+    removed. Unknown profile → `ValueError` (fail-closed).
+  - Final analysis is delivered by the daemon-controlled fallback to the
+    backend-supplied origin conversation only; the model cannot choose a
+    destination.
+  Verified by real cross-owner E2E (human non-owner → qoder agent, induced
+  write/command/`platform_send` all blocked, read-only result returned to the
+  origin channel). Confidentiality scope is intentionally the target agent's
+  own read ACL (same-org cross-owner read/analysis is the product contract).
+
+### Known debt
+- mcp-bridge per-spawn token-file is still not wired end-to-end; bridge/daemon
+  IPC trust rests on the same-user 0600 unix socket, so a malicious native
+  process under the same OS user could forge an agent_id. Pre-existing and
+  shared by all engines/run-modes; tracked separately (#110), not introduced
+  by this release.
+
 ## [0.5.0] — 2026-08-19
 
 First release since 0.4.1 (2026-07-22). Everything below shipped to internal

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cloudagent-daemon
-Version: 0.5.0
+Version: 0.5.2
 Summary: Local daemon for cloudagent — bridges Claude Code, Codex, and Qoder CLI agents to the cloudagent backend.
 Project-URL: Homepage, https://cloudagent.chat
 Project-URL: Repository, https://codeup.aliyun.com/69bd0a4d29ad98af4065ce71/cloudagent

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cloudagent-daemon"
-version = "0.5.0"
+version = "0.5.2"
 description = "Local daemon for cloudagent — bridges Claude Code, Codex, and Qoder CLI agents to the cloudagent backend."
 authors = [{name = "chaoyin", email = "tudoucyx@gmail.com"}]
 readme = "README.md"

cloudagent_daemon-0.5.2/src/cloudagent_daemon/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.5.2"

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.2}/src/cloudagent_daemon/claude_runner.py

@@ -391,6 +391,7 @@ class ClaudeRunner:
         partial_publisher: PartialPublisher | None = None,
         event_publisher: EventPublisher | None = None,
         agent_to_session: "dict[str, str | None] | None" = None,
+        agent_to_delivery: "dict[str, str | None] | None" = None,
         claude_permission_mode: str = "bypassPermissions",
         runtime_binaries: dict[str, str] | None = None,
         http: object | None = None,
@@ -440,6 +441,10 @@ class ClaudeRunner:
         # unix socket ``get_current_session`` op instead of reading a file.
         # None means feature disabled (legacy / test path).
         self._agent_to_session: dict[str, str | None] | None = agent_to_session
+        # #112 — opaque backend delivery provenance for the currently running
+        # turn.  The MCP bridge queries this map through daemon IPC and adds it
+        # to outbound calls without exposing a forgeable tool parameter.
+        self._agent_to_delivery: dict[str, str | None] | None = agent_to_delivery
 
     # ------------------------------------------------------------------
     # Public API
@@ -618,6 +623,14 @@ The daemon discards stdout — only the mcp tool call reaches the channel.
         # reading the file. Both paths coexist for backward compat.
         if self._agent_to_session is not None:
             self._agent_to_session[agent_id] = _effective_session_id
+        current_delivery_id = payload.get("delivery_id")
+        _effective_delivery_id = (
+            current_delivery_id
+            if isinstance(current_delivery_id, str) and current_delivery_id
+            else None
+        )
+        if self._agent_to_delivery is not None:
+            self._agent_to_delivery[agent_id] = _effective_delivery_id
 
         # M7 W3 — localagent company-context injection. BEFORE spawning
         # claude, if this deliver belongs to a task whose context has not
@@ -709,6 +722,8 @@ The daemon discards stdout — only the mcp tool call reaches the channel.
             # (c) IPC architecture upgrade — clear from memory map.
             if self._agent_to_session is not None:
                 self._agent_to_session.pop(agent_id, None)
+            if self._agent_to_delivery is not None:
+                self._agent_to_delivery.pop(agent_id, None)
 
         captured_session = attempt.captured_session_id
         rc = attempt.exit_code
@@ -830,6 +845,11 @@ The daemon discards stdout — only the mcp tool call reaches the channel.
                                 "content": attempt.final_result_text,
                                 "conversation_id": platform_conv_id,
                                 "acknowledge_new_messages": True,
+                                **(
+                                    {"delivery_id": _effective_delivery_id}
+                                    if _effective_delivery_id
+                                    else {}
+                                ),
                             },
                             timeout=15.0,
                         )
@@ -876,6 +896,8 @@ The daemon discards stdout — only the mcp tool call reaches the channel.
                         payload, attempt.final_result_text
                     )
                 )
+                if _effective_delivery_id:
+                    fallback_args["delivery_id"] = _effective_delivery_id
                 await self.outbound.send_tool_call(
                     agent_id=agent_id,
                     session_id=fallback_session,
@@ -1006,7 +1028,14 @@ The daemon discards stdout — only the mcp tool call reaches the channel.
                     agent_id=agent_id,
                     session_id=fallback_session,
                     tool_name="send_message",
-                    args=self._fallback_reply_args(payload, abort_body),
+                    args={
+                        **self._fallback_reply_args(payload, abort_body),
+                        **(
+                            {"delivery_id": _effective_delivery_id}
+                            if _effective_delivery_id
+                            else {}
+                        ),
+                    },
                     timeout=15.0,
                 )
                 try:
@@ -1026,15 +1055,20 @@ The daemon discards stdout — only the mcp tool call reaches the channel.
                     reason,
                 )
 
-        await self.outbound.send_agent_status(
-            agent_id,
-            final_status,
-            exit_code=rc,
-            conversation_id=(
+        final_status_kwargs: dict[str, Any] = {
+            "exit_code": rc,
+            "conversation_id": (
                 str(payload["conversation_id"])
                 if payload.get("conversation_id")
                 else None
             ),
+        }
+        if _effective_delivery_id:
+            final_status_kwargs["delivery_id"] = _effective_delivery_id
+        await self.outbound.send_agent_status(
+            agent_id,
+            final_status,
+            **final_status_kwargs,
         )
 
         wake_secs = time.monotonic() - wake_start
@@ -1382,6 +1416,9 @@ The daemon discards stdout — only the mcp tool call reaches the channel.
             wake_prompt = self._codex_stdin_preamble(
                 agent_id, append_system_prompt,
                 read_analyze=run_mode == "read_analyze",
+                daemon_managed_reply=(
+                    runtime_engine == "qoder" and run_mode == "read_analyze"
+                ),
             ) + wake_prompt
         try:
             assert proc.stdin is not None  # for type checkers
@@ -1400,14 +1437,20 @@ The daemon discards stdout — only the mcp tool call reaches the channel.
             await self.outbound.send_ack(
                 seq=None, message_id=message_id, status="started"
             )
-        await self.outbound.send_agent_status(
-            agent_id,
-            "running",
-            conversation_id=(
+        running_status_kwargs: dict[str, Any] = {
+            "conversation_id": (
                 str(payload["conversation_id"])
                 if payload.get("conversation_id")
                 else None
-            ),
+            )
+        }
+        delivery_id = payload.get("delivery_id")
+        if isinstance(delivery_id, str) and delivery_id:
+            running_status_kwargs["delivery_id"] = delivery_id
+        await self.outbound.send_agent_status(
+            agent_id,
+            "running",
+            **running_status_kwargs,
         )
 
         # 1k74 — token-level streaming. Forward the deliver's session_id
@@ -1519,6 +1562,19 @@ The daemon discards stdout — only the mcp tool call reaches the channel.
         "mcp__cloudagent__platform_task_status",
     )
 
+    # #107 — qoder read_analyze is enforced with a positive allowlist, not a
+    # denylist.  qodercli 1.1.26 live probes showed that ``--tools`` removes
+    # every other built-in capability from the init event even under
+    # ``bypass_permissions``; the latter is still required so the injected
+    # cloudagent MCP server can post the analysis result in headless mode.
+    # Keep this deliberately small: WebFetch/WebSearch are excluded to avoid
+    # an untrusted cross-owner prompt exfiltrating files it just read.
+    QODER_READ_ANALYZE_BUILTIN_TOOLS: tuple[str, ...] = (
+        "Read",
+        "Glob",
+        "Grep",
+    )
+
     # 1i Bug F — operational contract for daemon-spawned wakes.
     # Without this, claude in --print mode just dumps its answer to stdout
     # and exits, never invoking send_message — so the user never sees a reply.
@@ -1875,10 +1931,16 @@ TASKS (频道任务板) — 频道里的分工协作走任务认领原语，纪
         "提交给 owner 审核 —— owner 批准后再由 owner 指挥自己的 agent 实际落盘。"
         "不要试图直接改文件;被拦不是故障,是权限设计。"
     )
+    QODER_READ_ANALYZE_REPLY_NOTE = (
+        "【Qoder 只读回报例外】本模式刻意不向模型暴露 platform_send、"
+        "room_post、send_message 或任何写类 MCP 工具。不要尝试调用这些工具；"
+        "请把完整分析作为本轮最终文本直接输出。daemon 会把该最终文本经受控"
+        "fallback 发回 backend 下发的原始 conversation_id，目标不可由你更改。"
+    )
 
     def _codex_stdin_preamble(
         self, agent_id: str, append_system_prompt: str | None,
-        *, read_analyze: bool = False,
+        *, read_analyze: bool = False, daemon_managed_reply: bool = False,
     ) -> str:
         """The system contract as a stdin preamble — codex's substitute for
         ``--append-system-prompt`` (which only the claude argv path has).
@@ -1891,6 +1953,8 @@ TASKS (频道任务板) — 频道里的分工协作走任务认领原语，纪
         parts = [self.SYSTEM_PROMPT_APPEND.format(agent_id=agent_id)]
         if read_analyze:
             parts.append(self.READ_ANALYZE_SYSTEM_NOTE)
+        if daemon_managed_reply:
+            parts.append(self.QODER_READ_ANALYZE_REPLY_NOTE)
         if append_system_prompt and append_system_prompt.strip():
             parts.append(append_system_prompt.strip())
         joined = "\n\n".join(parts)
@@ -1952,6 +2016,38 @@ TASKS (频道任务板) — 频道里的分工协作走任务认领原语，纪
                 exc_info=True,
             )
 
+    @staticmethod
+    def _qoder_read_analyze_mcp_config(
+        ws: AgentWorkspaceLike, agent_id: str
+    ) -> Path:
+        """Write the per-wake, query-only cloudagent MCP config for qoder.
+
+        The regular workspace config exposes state-changing tools (send,
+        upload, task mutations, reminders).  ``--tools`` only restricts qoder
+        built-ins, so read_analyze needs a separately profiled bridge whose
+        ``tools/list`` contains query-only operations.  The daemon fallback,
+        not the model, posts the final analysis back to the source channel.
+        """
+        from .paths import build_mcp_bridge_args, daemon_executable
+
+        config_path = ws.path / ".meta" / "qoder-read-analyze-mcp-config.json"
+        token_file = str(ws.path / ".meta" / "claude-token.txt")
+        config = {
+            "mcpServers": {
+                "cloudagent": {
+                    "command": daemon_executable(),
+                    "args": build_mcp_bridge_args(
+                        agent_id,
+                        token_file,
+                        tool_profile="read_analyze",
+                    ),
+                }
+            }
+        }
+        config_path.parent.mkdir(parents=True, exist_ok=True)
+        config_path.write_text(json.dumps(config, indent=2), encoding="utf-8")
+        return config_path
+
     def _build_cmd(
         self,
         ws: AgentWorkspaceLike,
@@ -2061,20 +2157,14 @@ TASKS (频道任务板) — 频道里的分工协作走任务认领原语，纪
             # stream-json/--append-system-prompt/--mcp-config/--resume 全对齐，
             # 输出走既有 stream_json 消费器（联调时如发现事件形状偏差再适配）。
             # 认证：QODER_PERSONAL_ACCESS_TOKEN 环境变量或 qodercli login。
-            if read_analyze:
-                # fail-closed：qoder 的只读硬化（--tools/--disallowed-tools 的
-                # 内建工具名、--permission-mode 无头语义）尚未在真机验证 ——
-                # 未验证的安全属性不许上线（#55 口径），宁可拒绝 spawn。
-                raise RuntimeError(
-                    "qoder runtime does not support run_mode=read_analyze yet "
-                    "(read-only hardening flags unverified); refusing to spawn"
-                )
             binary = self.runtime_binaries.get("qoder") or "qodercli"
             # #95 — 会话按 conversation_id 分轨（DM/各频道各自续聊），不再共用
             # 全局 last_session；无 conversation_id 的非平台唤醒沿用全局轨。
+            # #107 — read_analyze 与 claude/codex 一样绝不 resume owner 轨，
+            # 防外部指挥上下文渗进后续 full 会话。
             lane_session = (
                 self._qoder_lane_session(ws, conversation_id)
-                if with_resume else None
+                if with_resume and not read_analyze else None
             )
             cmd = [binary]
             # r6 同款：模型 + 推理强度由 chairman 在编辑页选（qoder 档位
@@ -2085,13 +2175,18 @@ TASKS (频道任务板) — 频道里的分工协作走任务认领原语，纪
                 cmd += ["--reasoning-effort", reasoning_effort]
             if lane_session:
                 cmd += ["--resume", lane_session]
+            mcp_config_path = (
+                self._qoder_read_analyze_mcp_config(ws, agent_id)
+                if read_analyze
+                else ws.mcp_config_path()
+            )
             # #95 — 运营契约 + 本轮 append（含频道级提示）**不走 argv
             # --append-system-prompt**：qodercli --resume 不可靠采用新的 append，
             # 改与 codex 同款折进 stdin 活跃前导（见 _spawn_attempt），每轮必到
             # 模型眼前，不依赖 CLI 对 resume 的语义。
             cmd += [
                 "--mcp-config",
-                str(ws.mcp_config_path()),
+                str(mcp_config_path),
                 "--print",
                 "--output-format",
                 "stream-json",
@@ -2100,6 +2195,24 @@ TASKS (频道任务板) — 频道里的分工协作走任务认领原语，纪
                 "--permission-mode",
                 "bypass_permissions",
             ]
+            if read_analyze:
+                # #107 — qodercli 1.1.26 双机真测：--tools 是 built-in
+                # capability allowlist；在 bypass_permissions 下 init.tools
+                # 仍精确为 Glob/Grep/Read，Bash/Write/Edit/NotebookEdit/Web*
+                # 不可调用，诱导写文件的探针保持不存在。同时 bypass 让
+                # cloudagent MCP 能在 --print 无头模式回报结果。
+                #
+                # 空 setting-sources 不加载 user/project/local hooks；strict
+                # MCP 只保留 daemon 生成的 cloudagent 配置；禁用 session
+                # persistence，配合上面的 no-resume 保证 owner 会话隔离。
+                cmd += [
+                    "--setting-sources",
+                    "",
+                    "--no-session-persistence",
+                    "--strict-mcp-config",
+                    "--tools",
+                    *self.QODER_READ_ANALYZE_BUILTIN_TOOLS,
+                ]
             return cmd
 
         cmd = [self.runtime_binaries.get("claude_code") or self.claude_binary]

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.2}/src/cloudagent_daemon/cli.py

@@ -973,13 +973,23 @@ def mcp_bridge(
         ),
     ),
     profile: str | None = typer.Option(None, "--profile", help=_PROFILE_HELP),
+    tool_profile: str = typer.Option(
+        "full",
+        "--tool-profile",
+        help="MCP capability profile (full or read_analyze).",
+    ),
 ) -> None:
     """[internal] stdio MCP server invoked by claude subprocess."""
     from .mcp_bridge import run_bridge
 
     profile_name = _resolve_cli_profile(profile)
     asyncio.run(
-        run_bridge(agent_id=agent_id, token_file=token_file, profile=profile_name)
+        run_bridge(
+            agent_id=agent_id,
+            token_file=token_file,
+            profile=profile_name,
+            tool_profile=tool_profile,
+        )
     )
 
 

{cloudagent_daemon-0.5.0 → cloudagent_daemon-0.5.2}/src/cloudagent_daemon/main_loop.py

@@ -637,6 +637,7 @@ async def _run_sse_post(
     # IPC op instead of reading a file; file fallback kept for backward
     # compat (old daemons without this map still work via the file).
     _agent_to_session: dict[str, str | None] = {}
+    _agent_to_delivery: dict[str, str | None] = {}
 
     # M7 W3 — localagent context injection + delegation reporting.
     # ``injection_state`` is the file-backed (agent,task) dedup store
@@ -657,6 +658,7 @@ async def _run_sse_post(
         partial_publisher=_publish_partial,
         event_publisher=_publish_event,
         agent_to_session=_agent_to_session,
+        agent_to_delivery=_agent_to_delivery,
         claude_permission_mode=cfg.claude_permission_mode,
         runtime_binaries=runtime_binaries,
         http=http,
@@ -752,11 +754,17 @@ async def _run_sse_post(
             a = req.get("args") or {}
             agent_id_q = a.get("agent_id") or ""
             sid = _agent_to_session.get(agent_id_q)
+            delivery_id = _agent_to_delivery.get(agent_id_q)
             logger.info(
-                "main_loop.ipc_handler: get_current_session agent=%s sid=%s",
-                agent_id_q, sid,
+                "main_loop.ipc_handler: get_current_session agent=%s sid=%s delivery=%s",
+                agent_id_q, sid, delivery_id,
             )
-            return {"result": {"session_id": sid}}
+            return {
+                "result": {
+                    "session_id": sid,
+                    "delivery_id": delivery_id,
+                }
+            }
 
         if op != "tool_call":
             logger.warning(
@@ -981,6 +989,8 @@ async def _run_legacy_ws(
     delegation_outbox = DelegationOutbox(
         profile_delegation_outbox_path(profile)
     )
+    agent_to_session_ws: dict[str, str | None] = {}
+    agent_to_delivery_ws: dict[str, str | None] = {}
 
     runner = ClaudeRunner(
         outbound=outbound,
@@ -991,6 +1001,8 @@ async def _run_legacy_ws(
         http=ws_http,
         injection_state=injection_state,
         delegation_outbox=delegation_outbox,
+        agent_to_session=agent_to_session_ws,
+        agent_to_delivery=agent_to_delivery_ws,
     )
 
     # #25 — pre-flight auth self-check (parity with the SSE path). Detached
@@ -1071,6 +1083,15 @@ async def _run_legacy_ws(
     sock_path.parent.mkdir(parents=True, exist_ok=True)
 
     async def ipc_handler(req: dict) -> dict:
+        if req.get("op") == "get_current_session":
+            a = req.get("args") or {}
+            agent_id_q = a.get("agent_id") or ""
+            return {
+                "result": {
+                    "session_id": agent_to_session_ws.get(agent_id_q),
+                    "delivery_id": agent_to_delivery_ws.get(agent_id_q),
+                }
+            }
         if req.get("op") != "tool_call":
             return {"error": {"code": "UNKNOWN_OP", "message": str(req.get("op"))}}
         a = req.get("args") or {}