iac-code 0.6.0__tar.gz → 0.8.0__tar.gz

{iac_code-0.6.0 → iac_code-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: iac_code
-Version: 0.6.0
+Version: 0.8.0
 Summary: Your AI-powered Infrastructure as Code assistant
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10

{iac_code-0.6.0 → iac_code-0.8.0}/pyproject.toml

@@ -35,6 +35,7 @@ dependencies = [
     "keyring>=25.0",
     "tree-sitter>=0.25,<0.26",
     "tree-sitter-bash>=0.25,<0.26",
+    "mcp>=1.28.0",
 ]
 
 [project.optional-dependencies]
@@ -74,6 +75,7 @@ dev = [
     "setuptools>=68.0",
     "wheel",
     "tomli>=2.0; python_version<\"3.11\"",
+    "pexpect>=4.9.0",
 ]
 
 [build-system]

iac_code-0.8.0/src/iac_code/__init__.py

@@ -0,0 +1,2 @@
+__version__ = "0.8.0"
+__release_date__ = "2026-07-02"

{iac_code-0.6.0 → iac_code-0.8.0}/src/iac_code/a2a/app.py

@@ -6,6 +6,7 @@ import binascii
 import hashlib
 import hmac
 import json
+import logging
 import os
 from contextlib import asynccontextmanager, suppress
 from email.utils import formatdate
@@ -25,8 +26,13 @@ from starlette.responses import JSONResponse, Response
 from starlette.routing import BaseRoute, Route
 
 from iac_code.a2a.agent_card import agent_card_to_client_dict
+from iac_code.a2a.jsonrpc_passthrough import (
+    install_jsonrpc_error_data_passthrough,
+    install_v03_jsonrpc_error_data_passthrough,
+)
 from iac_code.i18n import _
 
+logger = logging.getLogger(__name__)
 _V03_JSONRPC_METHODS = frozenset(
     {
         "message/send",
@@ -273,7 +279,9 @@ def create_app(
         Route(AGENT_CARD_WELL_KNOWN_PATH, get_agent_card, methods=["GET"]),
         Route("/iac-code/pipeline/state", get_pipeline_state, methods=["GET"]),
     ]
+    install_jsonrpc_error_data_passthrough()
     jsonrpc_endpoint = create_jsonrpc_routes(components.handler, rpc_url="/", enable_v0_3_compat=True)[0].endpoint
+    install_v03_jsonrpc_error_data_passthrough(jsonrpc_endpoint)
 
     async def handle_jsonrpc(request: Request) -> Response:
         await normalize_v03_jsonrpc_version(request)
@@ -517,7 +525,7 @@ def run_server(
     try:
         import uvicorn
     except ImportError as exc:
-        raise RuntimeError("A2A server dependencies are missing. Install iac-code with the 'a2a' extra.") from exc
+        raise RuntimeError("A2A server dependencies are missing. Install with: pip install 'iac-code[a2a]'") from exc
 
     uvicorn.run(
         app,

{iac_code-0.6.0 → iac_code-0.8.0}/src/iac_code/a2a/client.py

@@ -131,8 +131,23 @@ class A2AClient:
         *,
         cwd: str,
         context_id: str | None = None,
+        model: str | None = None,
+        iac_code_api_key: str | None = None,
+        thinking_enabled: bool | None = None,
+        thinking_effort: str | None = None,
+        thinking_budget: int | None = None,
     ) -> A2AClientResponse:
-        payload = self._message_payload(method="SendMessage", prompt=prompt, cwd=cwd, context_id=context_id)
+        payload = self._message_payload(
+            method="SendMessage",
+            prompt=prompt,
+            cwd=cwd,
+            context_id=context_id,
+            model=model,
+            iac_code_api_key=iac_code_api_key,
+            thinking_enabled=thinking_enabled,
+            thinking_effort=thinking_effort,
+            thinking_budget=thinking_budget,
+        )
         transport = self._make_transport_client(url)
         response = await transport.send(payload)
         return A2AClientResponse(payload=response)
@@ -144,8 +159,23 @@ class A2AClient:
         *,
         cwd: str,
         context_id: str | None = None,
+        model: str | None = None,
+        iac_code_api_key: str | None = None,
+        thinking_enabled: bool | None = None,
+        thinking_effort: str | None = None,
+        thinking_budget: int | None = None,
     ) -> AsyncIterator[dict[str, Any]]:
-        payload = self._message_payload(method="SendStreamingMessage", prompt=prompt, cwd=cwd, context_id=context_id)
+        payload = self._message_payload(
+            method="SendStreamingMessage",
+            prompt=prompt,
+            cwd=cwd,
+            context_id=context_id,
+            model=model,
+            iac_code_api_key=iac_code_api_key,
+            thinking_enabled=thinking_enabled,
+            thinking_effort=thinking_effort,
+            thinking_budget=thinking_budget,
+        )
         transport = self._make_transport_client(url)
         async for event in transport.stream(payload):
             yield event
@@ -332,12 +362,44 @@ class A2AClient:
             api_key_header=auth.api_key_header,
         )
 
-    def _message_payload(self, *, method: str, prompt: str, cwd: str, context_id: str | None) -> dict[str, Any]:
+    def _message_payload(
+        self,
+        *,
+        method: str,
+        prompt: str,
+        cwd: str,
+        context_id: str | None,
+        model: str | None,
+        iac_code_api_key: str | None,
+        thinking_enabled: bool | None,
+        thinking_effort: str | None,
+        thinking_budget: int | None,
+    ) -> dict[str, Any]:
+        iac_code_metadata: dict[str, Any] = {"cwd": cwd}
+        if model:
+            stripped_model = model.strip()
+            if stripped_model:
+                iac_code_metadata["iac_code_model"] = stripped_model
+        if iac_code_api_key:
+            stripped_api_key = iac_code_api_key.strip()
+            if stripped_api_key:
+                iac_code_metadata["iac_code_api_key"] = stripped_api_key
+        thinking: dict[str, Any] = {}
+        if thinking_enabled is not None:
+            thinking["enabled"] = thinking_enabled
+        if thinking_effort:
+            stripped_effort = thinking_effort.strip()
+            if stripped_effort:
+                thinking["effort"] = stripped_effort
+        if isinstance(thinking_budget, int) and not isinstance(thinking_budget, bool) and thinking_budget > 0:
+            thinking["budget"] = thinking_budget
+        if thinking:
+            iac_code_metadata["thinking"] = thinking
         message: dict[str, Any] = {
             "messageId": str(uuid.uuid4()),
             "role": "ROLE_USER",
             "parts": [{"text": prompt}],
-            "metadata": {"iac_code": {"cwd": cwd}},
+            "metadata": {"iac_code": iac_code_metadata},
         }
         if context_id:
             message["contextId"] = context_id

{iac_code-0.6.0 → iac_code-0.8.0}/src/iac_code/a2a/events.py

@@ -23,10 +23,21 @@ from iac_code.a2a.artifacts import (
     sanitize_public_tool_output_data,
 )
 from iac_code.a2a.exposure import A2AExposureType, normalize_a2a_exposure_types
+from iac_code.a2a.metadata_redaction import A2AMetadataEchoRedactor
+from iac_code.i18n import _
+from iac_code.services.permissions.audit import (
+    build_input_summary,
+    build_redacted_tool_input,
+    emit_auto_permission_audit,
+    emit_permission_boundary_audit,
+    is_aliyun_api_non_read_only_permission_event,
+)
 from iac_code.types.stream_events import (
     ErrorEvent,
+    MCPProgressEvent,
     MessageEndEvent,
     PermissionRequestEvent,
+    SubPipelineStreamEvent,
     TextDeltaEvent,
     ThinkingDeltaEvent,
     ToolInputDeltaEvent,
@@ -40,6 +51,22 @@ _ERROR_TEXT_MAX_CHARS = 1000
 _METADATA_MAX_DEPTH = 32
 logger = logging.getLogger(__name__)
 A2APermissionResolver: TypeAlias = Callable[[PermissionRequestEvent], "bool | Awaitable[bool]"]
+IAC_CODE_SESSION_ID_METADATA_KEY = "iacCodeSessionId"
+_METADATA_REDACTOR = A2AMetadataEchoRedactor()
+
+
+def iac_code_session_metadata(session_id: str) -> dict[str, Any]:
+    return {"iac_code": {IAC_CODE_SESSION_ID_METADATA_KEY: session_id}}
+
+
+def with_iac_code_session_metadata(metadata: dict[str, Any] | None, session_id: str | None) -> dict[str, Any] | None:
+    if not session_id:
+        return metadata
+    merged = dict(metadata or {})
+    iac_code = dict(merged.get("iac_code") or {})
+    iac_code[IAC_CODE_SESSION_ID_METADATA_KEY] = session_id
+    merged["iac_code"] = iac_code
+    return merged
 
 
 def _truncate(value: Any, *, _depth: int = 0) -> Any:
@@ -54,10 +81,69 @@ def _truncate(value: Any, *, _depth: int = 0) -> Any:
     return value
 
 
+def _sanitize_trace_input(value: Any) -> Any:
+    return _METADATA_REDACTOR.redact(_truncate(value))
+
+
+def _public_tool_input_metadata(tool_name: str, tool_input: dict[str, Any]) -> dict[str, Any]:
+    return {"inputSummary": build_input_summary(tool_name, tool_input)}
+
+
+def _public_permission_input_metadata(tool_name: str, tool_input: dict[str, Any]) -> dict[str, Any]:
+    if tool_name == "aliyun_api":
+        return {"inputSummary": build_input_summary(tool_name, tool_input)}
+    return {"toolInput": build_redacted_tool_input(tool_input)}
+
+
+def _permission_request_event(event: Any) -> PermissionRequestEvent | None:
+    while isinstance(event, SubPipelineStreamEvent):
+        event = event.inner
+    return event if isinstance(event, PermissionRequestEvent) else None
+
+
 def make_text_part(text: str) -> Part:
     return Part(text=text)
 
 
+async def publish_mcp_warnings(
+    event_queue: Any,
+    *,
+    task_id: str,
+    context_id: str,
+    runtime: Any,
+    state: int = TaskState.TASK_STATE_WORKING,
+    iac_code_session_id: str | None = None,
+) -> None:
+    warnings = list(getattr(runtime, "mcp_config_warnings", None) or [])
+    pushed_count = getattr(runtime, "_a2a_mcp_warnings_pushed_count", 0)
+    if pushed_count >= len(warnings):
+        return
+    for warning in warnings[pushed_count:]:
+        message = str(getattr(warning, "message", None) or warning)
+        await _enqueue_status(
+            event_queue,
+            task_id=task_id,
+            context_id=context_id,
+            state=state,
+            message=_agent_text_message(
+                task_id=task_id,
+                context_id=context_id,
+                text=_("MCP warning: {message}").format(message=message),
+            ),
+            metadata={
+                "iac_code": {
+                    "mcpWarning": {
+                        "serverName": str(getattr(warning, "server_name", "")),
+                        "code": str(getattr(warning, "code", "")),
+                        "message": message,
+                    }
+                }
+            },
+            iac_code_session_id=iac_code_session_id,
+        )
+    setattr(runtime, "_a2a_mcp_warnings_pushed_count", len(warnings))
+
+
 def _extract_artifact_metadata(result: Any, artifact_store: Any | None) -> dict[str, Any] | None:
     if artifact_store is None or not isinstance(result, dict):
         return None
@@ -144,12 +230,14 @@ async def _enqueue_status(
     state: int,
     message: Message | None = None,
     metadata: dict[str, Any] | None = None,
+    iac_code_session_id: str | None = None,
 ) -> None:
     update = TaskStatusUpdateEvent(
         task_id=task_id,
         context_id=context_id,
         status=TaskStatus(state=TaskState.Name(state), message=message),
     )
+    metadata = with_iac_code_session_metadata(metadata, iac_code_session_id)
     if metadata is not None:
         ParseDict(metadata, update.metadata)
     await event_queue.enqueue_event(update)
@@ -165,6 +253,7 @@ async def publish_stream_event(
     permission_resolver: A2APermissionResolver | None = None,
     auto_approve_permissions: bool = False,
     exposure_types: Any = None,
+    iac_code_session_id: str | None = None,
 ) -> str | None:
     enabled_exposure_types = normalize_a2a_exposure_types(exposure_types)
 
@@ -177,6 +266,7 @@ async def publish_stream_event(
             context_id=context_id,
             state=TaskState.TASK_STATE_WORKING,
             message=_agent_text_message(task_id=task_id, context_id=context_id, text=event.text),
+            iac_code_session_id=iac_code_session_id,
         )
         return event.text
 
@@ -189,6 +279,7 @@ async def publish_stream_event(
             context_id=context_id,
             state=TaskState.TASK_STATE_WORKING,
             metadata={"iac_code": {"thinking": {"type": "raw_thinking", "text": _truncate(event.text)}}},
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
@@ -201,6 +292,7 @@ async def publish_stream_event(
             context_id=context_id,
             state=TaskState.TASK_STATE_WORKING,
             metadata={"iac_code": {"tool": {"status": "started", "toolUseId": event.tool_use_id, "name": event.name}}},
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
@@ -217,10 +309,11 @@ async def publish_stream_event(
                     "tool": {
                         "status": "input_delta",
                         "toolUseId": event.tool_use_id,
-                        "partialJson": _truncate(event.partial_json),
+                        "partialJsonLength": len(event.partial_json),
                     }
                 }
             },
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
@@ -238,10 +331,11 @@ async def publish_stream_event(
                         "status": "input_complete",
                         "toolUseId": event.tool_use_id,
                         "name": event.name,
-                        "input": _truncate(event.input),
+                        **_public_tool_input_metadata(event.name, event.input),
                     }
                 }
             },
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
@@ -270,16 +364,52 @@ async def publish_stream_event(
             context_id=context_id,
             state=TaskState.TASK_STATE_WORKING,
             metadata={"iac_code": {"tool": tool_metadata}},
+            iac_code_session_id=iac_code_session_id,
+        )
+        return None
+
+    if isinstance(event, MCPProgressEvent):
+        if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
+            return None
+        progress_metadata = {
+            "status": "progress",
+            "toolUseId": event.tool_use_id or "",
+            "name": "mcp__{}__{}".format(event.server_name, event.tool_name),
+            "mcp": {
+                "serverName": event.server_name,
+                "toolName": event.tool_name,
+                "progress": event.progress,
+                "total": event.total,
+                "message": _truncate(event.message) if event.message else None,
+            },
+        }
+        await _enqueue_status(
+            event_queue,
+            task_id=task_id,
+            context_id=context_id,
+            state=TaskState.TASK_STATE_WORKING,
+            metadata={"iac_code": {"tool": progress_metadata}},
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
-    if isinstance(event, PermissionRequestEvent):
+    permission_event = _permission_request_event(event)
+    if permission_event is not None:
         approved = auto_approve_permissions
         if permission_resolver is not None:
-            decision = permission_resolver(event)
+            decision = permission_resolver(permission_event)
             approved = bool(await decision) if inspect.isawaitable(decision) else bool(decision)
-        if event.response_future is not None and not event.response_future.done():
-            event.response_future.set_result(approved)
+        elif is_aliyun_api_non_read_only_permission_event(permission_event):
+            approved = False
+        if permission_event.response_future is not None and not permission_event.response_future.done():
+            audit_ok = True
+            if permission_resolver is not None:
+                audit_ok = _emit_resolver_permission_audit(permission_event, approved)
+            else:
+                audit_ok = _emit_auto_permission_audit(permission_event, approved)
+            if approved and not audit_ok:
+                approved = False
+            permission_event.response_future.set_result(approved)
         if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
             return None
         await _enqueue_status(
@@ -291,12 +421,13 @@ async def publish_stream_event(
                 "iac_code": {
                     "permission": {
                         "autoApproved": approved,
-                        "toolName": event.tool_name,
-                        "toolUseId": event.tool_use_id,
-                        "toolInput": _truncate(event.tool_input),
+                        "toolName": permission_event.tool_name,
+                        "toolUseId": permission_event.tool_use_id,
+                        **_public_permission_input_metadata(permission_event.tool_name, permission_event.tool_input),
                     }
                 }
             },
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
@@ -315,6 +446,7 @@ async def publish_stream_event(
                     }
                 }
             },
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
@@ -336,8 +468,56 @@ async def publish_stream_event(
             state=state,
             message=_agent_text_message(task_id=task_id, context_id=context_id, text=text),
             metadata={"iac_code": {"error": error_metadata}},
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
     logger.debug("Skipping unmapped A2A stream event: %s", type(event).__name__)
     return None
+
+
+def _emit_auto_permission_audit(
+    request: PermissionRequestEvent,
+    approved: bool,
+    *,
+    persistence_failure: bool = False,
+) -> bool:
+    if persistence_failure:
+        return emit_permission_boundary_audit(
+            request,
+            decision="deny",
+            scope="auto_deny",
+            source="a2a_auto_persistence_failure",
+            reason_type="persistence_failure",
+            reason_detail="permission metadata persistence failed",
+        )
+    source = "a2a_auto_approve" if approved else "a2a_auto_deny"
+    return emit_auto_permission_audit(
+        request,
+        decision="allow" if approved else "deny",
+        scope="auto_approve" if approved else "auto_deny",
+        source=source,
+    )
+
+
+def _emit_resolver_permission_audit(
+    request: PermissionRequestEvent,
+    approved: bool,
+    *,
+    persistence_failure: bool = False,
+) -> bool:
+    source = "a2a_resolver"
+    reason_type = "a2a_resolver"
+    reason_detail = "allow" if approved else "deny"
+    if persistence_failure:
+        source = "a2a_resolver_persistence_failure"
+        reason_type = "persistence_failure"
+        reason_detail = "permission metadata persistence failed"
+    return emit_permission_boundary_audit(
+        request,
+        decision="allow" if approved else "deny",
+        scope="a2a_resolver",
+        source=source,
+        reason_type=reason_type,
+        reason_detail=reason_detail,
+    )