iac-code 0.7.0__tar.gz → 0.8.0__tar.gz

{iac_code-0.7.0 → iac_code-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: iac_code
-Version: 0.7.0
+Version: 0.8.0
 Summary: Your AI-powered Infrastructure as Code assistant
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10

{iac_code-0.7.0 → iac_code-0.8.0}/pyproject.toml

@@ -35,6 +35,7 @@ dependencies = [
     "keyring>=25.0",
     "tree-sitter>=0.25,<0.26",
     "tree-sitter-bash>=0.25,<0.26",
+    "mcp>=1.28.0",
 ]
 
 [project.optional-dependencies]

iac_code-0.8.0/src/iac_code/__init__.py

@@ -0,0 +1,2 @@
+__version__ = "0.8.0"
+__release_date__ = "2026-07-02"

{iac_code-0.7.0 → iac_code-0.8.0}/src/iac_code/a2a/client.py

@@ -132,6 +132,10 @@ class A2AClient:
         cwd: str,
         context_id: str | None = None,
         model: str | None = None,
+        iac_code_api_key: str | None = None,
+        thinking_enabled: bool | None = None,
+        thinking_effort: str | None = None,
+        thinking_budget: int | None = None,
     ) -> A2AClientResponse:
         payload = self._message_payload(
             method="SendMessage",
@@ -139,6 +143,10 @@ class A2AClient:
             cwd=cwd,
             context_id=context_id,
             model=model,
+            iac_code_api_key=iac_code_api_key,
+            thinking_enabled=thinking_enabled,
+            thinking_effort=thinking_effort,
+            thinking_budget=thinking_budget,
         )
         transport = self._make_transport_client(url)
         response = await transport.send(payload)
@@ -152,6 +160,10 @@ class A2AClient:
         cwd: str,
         context_id: str | None = None,
         model: str | None = None,
+        iac_code_api_key: str | None = None,
+        thinking_enabled: bool | None = None,
+        thinking_effort: str | None = None,
+        thinking_budget: int | None = None,
     ) -> AsyncIterator[dict[str, Any]]:
         payload = self._message_payload(
             method="SendStreamingMessage",
@@ -159,6 +171,10 @@ class A2AClient:
             cwd=cwd,
             context_id=context_id,
             model=model,
+            iac_code_api_key=iac_code_api_key,
+            thinking_enabled=thinking_enabled,
+            thinking_effort=thinking_effort,
+            thinking_budget=thinking_budget,
         )
         transport = self._make_transport_client(url)
         async for event in transport.stream(payload):
@@ -354,12 +370,31 @@ class A2AClient:
         cwd: str,
         context_id: str | None,
         model: str | None,
+        iac_code_api_key: str | None,
+        thinking_enabled: bool | None,
+        thinking_effort: str | None,
+        thinking_budget: int | None,
     ) -> dict[str, Any]:
-        iac_code_metadata = {"cwd": cwd}
+        iac_code_metadata: dict[str, Any] = {"cwd": cwd}
         if model:
             stripped_model = model.strip()
             if stripped_model:
                 iac_code_metadata["iac_code_model"] = stripped_model
+        if iac_code_api_key:
+            stripped_api_key = iac_code_api_key.strip()
+            if stripped_api_key:
+                iac_code_metadata["iac_code_api_key"] = stripped_api_key
+        thinking: dict[str, Any] = {}
+        if thinking_enabled is not None:
+            thinking["enabled"] = thinking_enabled
+        if thinking_effort:
+            stripped_effort = thinking_effort.strip()
+            if stripped_effort:
+                thinking["effort"] = stripped_effort
+        if isinstance(thinking_budget, int) and not isinstance(thinking_budget, bool) and thinking_budget > 0:
+            thinking["budget"] = thinking_budget
+        if thinking:
+            iac_code_metadata["thinking"] = thinking
         message: dict[str, Any] = {
             "messageId": str(uuid.uuid4()),
             "role": "ROLE_USER",

{iac_code-0.7.0 → iac_code-0.8.0}/src/iac_code/a2a/events.py

@@ -23,10 +23,21 @@ from iac_code.a2a.artifacts import (
     sanitize_public_tool_output_data,
 )
 from iac_code.a2a.exposure import A2AExposureType, normalize_a2a_exposure_types
+from iac_code.a2a.metadata_redaction import A2AMetadataEchoRedactor
+from iac_code.i18n import _
+from iac_code.services.permissions.audit import (
+    build_input_summary,
+    build_redacted_tool_input,
+    emit_auto_permission_audit,
+    emit_permission_boundary_audit,
+    is_aliyun_api_non_read_only_permission_event,
+)
 from iac_code.types.stream_events import (
     ErrorEvent,
+    MCPProgressEvent,
     MessageEndEvent,
     PermissionRequestEvent,
+    SubPipelineStreamEvent,
     TextDeltaEvent,
     ThinkingDeltaEvent,
     ToolInputDeltaEvent,
@@ -40,6 +51,22 @@ _ERROR_TEXT_MAX_CHARS = 1000
 _METADATA_MAX_DEPTH = 32
 logger = logging.getLogger(__name__)
 A2APermissionResolver: TypeAlias = Callable[[PermissionRequestEvent], "bool | Awaitable[bool]"]
+IAC_CODE_SESSION_ID_METADATA_KEY = "iacCodeSessionId"
+_METADATA_REDACTOR = A2AMetadataEchoRedactor()
+
+
+def iac_code_session_metadata(session_id: str) -> dict[str, Any]:
+    return {"iac_code": {IAC_CODE_SESSION_ID_METADATA_KEY: session_id}}
+
+
+def with_iac_code_session_metadata(metadata: dict[str, Any] | None, session_id: str | None) -> dict[str, Any] | None:
+    if not session_id:
+        return metadata
+    merged = dict(metadata or {})
+    iac_code = dict(merged.get("iac_code") or {})
+    iac_code[IAC_CODE_SESSION_ID_METADATA_KEY] = session_id
+    merged["iac_code"] = iac_code
+    return merged
 
 
 def _truncate(value: Any, *, _depth: int = 0) -> Any:
@@ -54,10 +81,69 @@ def _truncate(value: Any, *, _depth: int = 0) -> Any:
     return value
 
 
+def _sanitize_trace_input(value: Any) -> Any:
+    return _METADATA_REDACTOR.redact(_truncate(value))
+
+
+def _public_tool_input_metadata(tool_name: str, tool_input: dict[str, Any]) -> dict[str, Any]:
+    return {"inputSummary": build_input_summary(tool_name, tool_input)}
+
+
+def _public_permission_input_metadata(tool_name: str, tool_input: dict[str, Any]) -> dict[str, Any]:
+    if tool_name == "aliyun_api":
+        return {"inputSummary": build_input_summary(tool_name, tool_input)}
+    return {"toolInput": build_redacted_tool_input(tool_input)}
+
+
+def _permission_request_event(event: Any) -> PermissionRequestEvent | None:
+    while isinstance(event, SubPipelineStreamEvent):
+        event = event.inner
+    return event if isinstance(event, PermissionRequestEvent) else None
+
+
 def make_text_part(text: str) -> Part:
     return Part(text=text)
 
 
+async def publish_mcp_warnings(
+    event_queue: Any,
+    *,
+    task_id: str,
+    context_id: str,
+    runtime: Any,
+    state: int = TaskState.TASK_STATE_WORKING,
+    iac_code_session_id: str | None = None,
+) -> None:
+    warnings = list(getattr(runtime, "mcp_config_warnings", None) or [])
+    pushed_count = getattr(runtime, "_a2a_mcp_warnings_pushed_count", 0)
+    if pushed_count >= len(warnings):
+        return
+    for warning in warnings[pushed_count:]:
+        message = str(getattr(warning, "message", None) or warning)
+        await _enqueue_status(
+            event_queue,
+            task_id=task_id,
+            context_id=context_id,
+            state=state,
+            message=_agent_text_message(
+                task_id=task_id,
+                context_id=context_id,
+                text=_("MCP warning: {message}").format(message=message),
+            ),
+            metadata={
+                "iac_code": {
+                    "mcpWarning": {
+                        "serverName": str(getattr(warning, "server_name", "")),
+                        "code": str(getattr(warning, "code", "")),
+                        "message": message,
+                    }
+                }
+            },
+            iac_code_session_id=iac_code_session_id,
+        )
+    setattr(runtime, "_a2a_mcp_warnings_pushed_count", len(warnings))
+
+
 def _extract_artifact_metadata(result: Any, artifact_store: Any | None) -> dict[str, Any] | None:
     if artifact_store is None or not isinstance(result, dict):
         return None
@@ -144,12 +230,14 @@ async def _enqueue_status(
     state: int,
     message: Message | None = None,
     metadata: dict[str, Any] | None = None,
+    iac_code_session_id: str | None = None,
 ) -> None:
     update = TaskStatusUpdateEvent(
         task_id=task_id,
         context_id=context_id,
         status=TaskStatus(state=TaskState.Name(state), message=message),
     )
+    metadata = with_iac_code_session_metadata(metadata, iac_code_session_id)
     if metadata is not None:
         ParseDict(metadata, update.metadata)
     await event_queue.enqueue_event(update)
@@ -165,6 +253,7 @@ async def publish_stream_event(
     permission_resolver: A2APermissionResolver | None = None,
     auto_approve_permissions: bool = False,
     exposure_types: Any = None,
+    iac_code_session_id: str | None = None,
 ) -> str | None:
     enabled_exposure_types = normalize_a2a_exposure_types(exposure_types)
 
@@ -177,6 +266,7 @@ async def publish_stream_event(
             context_id=context_id,
             state=TaskState.TASK_STATE_WORKING,
             message=_agent_text_message(task_id=task_id, context_id=context_id, text=event.text),
+            iac_code_session_id=iac_code_session_id,
         )
         return event.text
 
@@ -189,6 +279,7 @@ async def publish_stream_event(
             context_id=context_id,
             state=TaskState.TASK_STATE_WORKING,
             metadata={"iac_code": {"thinking": {"type": "raw_thinking", "text": _truncate(event.text)}}},
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
@@ -201,6 +292,7 @@ async def publish_stream_event(
             context_id=context_id,
             state=TaskState.TASK_STATE_WORKING,
             metadata={"iac_code": {"tool": {"status": "started", "toolUseId": event.tool_use_id, "name": event.name}}},
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
@@ -217,10 +309,11 @@ async def publish_stream_event(
                     "tool": {
                         "status": "input_delta",
                         "toolUseId": event.tool_use_id,
-                        "partialJson": _truncate(event.partial_json),
+                        "partialJsonLength": len(event.partial_json),
                     }
                 }
             },
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
@@ -238,10 +331,11 @@ async def publish_stream_event(
                         "status": "input_complete",
                         "toolUseId": event.tool_use_id,
                         "name": event.name,
-                        "input": _truncate(event.input),
+                        **_public_tool_input_metadata(event.name, event.input),
                     }
                 }
             },
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
@@ -270,16 +364,52 @@ async def publish_stream_event(
             context_id=context_id,
             state=TaskState.TASK_STATE_WORKING,
             metadata={"iac_code": {"tool": tool_metadata}},
+            iac_code_session_id=iac_code_session_id,
+        )
+        return None
+
+    if isinstance(event, MCPProgressEvent):
+        if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
+            return None
+        progress_metadata = {
+            "status": "progress",
+            "toolUseId": event.tool_use_id or "",
+            "name": "mcp__{}__{}".format(event.server_name, event.tool_name),
+            "mcp": {
+                "serverName": event.server_name,
+                "toolName": event.tool_name,
+                "progress": event.progress,
+                "total": event.total,
+                "message": _truncate(event.message) if event.message else None,
+            },
+        }
+        await _enqueue_status(
+            event_queue,
+            task_id=task_id,
+            context_id=context_id,
+            state=TaskState.TASK_STATE_WORKING,
+            metadata={"iac_code": {"tool": progress_metadata}},
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
-    if isinstance(event, PermissionRequestEvent):
+    permission_event = _permission_request_event(event)
+    if permission_event is not None:
         approved = auto_approve_permissions
         if permission_resolver is not None:
-            decision = permission_resolver(event)
+            decision = permission_resolver(permission_event)
             approved = bool(await decision) if inspect.isawaitable(decision) else bool(decision)
-        if event.response_future is not None and not event.response_future.done():
-            event.response_future.set_result(approved)
+        elif is_aliyun_api_non_read_only_permission_event(permission_event):
+            approved = False
+        if permission_event.response_future is not None and not permission_event.response_future.done():
+            audit_ok = True
+            if permission_resolver is not None:
+                audit_ok = _emit_resolver_permission_audit(permission_event, approved)
+            else:
+                audit_ok = _emit_auto_permission_audit(permission_event, approved)
+            if approved and not audit_ok:
+                approved = False
+            permission_event.response_future.set_result(approved)
         if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
             return None
         await _enqueue_status(
@@ -291,12 +421,13 @@ async def publish_stream_event(
                 "iac_code": {
                     "permission": {
                         "autoApproved": approved,
-                        "toolName": event.tool_name,
-                        "toolUseId": event.tool_use_id,
-                        "toolInput": _truncate(event.tool_input),
+                        "toolName": permission_event.tool_name,
+                        "toolUseId": permission_event.tool_use_id,
+                        **_public_permission_input_metadata(permission_event.tool_name, permission_event.tool_input),
                     }
                 }
             },
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
@@ -315,6 +446,7 @@ async def publish_stream_event(
                     }
                 }
             },
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
@@ -336,8 +468,56 @@ async def publish_stream_event(
             state=state,
             message=_agent_text_message(task_id=task_id, context_id=context_id, text=text),
             metadata={"iac_code": {"error": error_metadata}},
+            iac_code_session_id=iac_code_session_id,
         )
         return None
 
     logger.debug("Skipping unmapped A2A stream event: %s", type(event).__name__)
     return None
+
+
+def _emit_auto_permission_audit(
+    request: PermissionRequestEvent,
+    approved: bool,
+    *,
+    persistence_failure: bool = False,
+) -> bool:
+    if persistence_failure:
+        return emit_permission_boundary_audit(
+            request,
+            decision="deny",
+            scope="auto_deny",
+            source="a2a_auto_persistence_failure",
+            reason_type="persistence_failure",
+            reason_detail="permission metadata persistence failed",
+        )
+    source = "a2a_auto_approve" if approved else "a2a_auto_deny"
+    return emit_auto_permission_audit(
+        request,
+        decision="allow" if approved else "deny",
+        scope="auto_approve" if approved else "auto_deny",
+        source=source,
+    )
+
+
+def _emit_resolver_permission_audit(
+    request: PermissionRequestEvent,
+    approved: bool,
+    *,
+    persistence_failure: bool = False,
+) -> bool:
+    source = "a2a_resolver"
+    reason_type = "a2a_resolver"
+    reason_detail = "allow" if approved else "deny"
+    if persistence_failure:
+        source = "a2a_resolver_persistence_failure"
+        reason_type = "persistence_failure"
+        reason_detail = "permission metadata persistence failed"
+    return emit_permission_boundary_audit(
+        request,
+        decision="allow" if approved else "deny",
+        scope="a2a_resolver",
+        source=source,
+        reason_type=reason_type,
+        reason_detail=reason_detail,
+    )