virtuai-cli 0.7.5__tar.gz → 0.7.7__tar.gz

{virtuai_cli-0.7.5 → virtuai_cli-0.7.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: virtuai-cli
-Version: 0.7.5
+Version: 0.7.7
 Summary: Run VirtuAI deep agents on your local machine
 Author-email: uCloudStore <lmoreno@ucloudstore.com>
 License: Proprietary
@@ -152,13 +152,39 @@ Exit codes: `0` success · `1` stream error · `2` bad args / agent not found.
 
 ## Security model
 
-- The CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows).
-- All traffic is over TLS WebSockets and HTTPS; the CLI uses the [`certifi`](https://github.com/certifi/python-certifi) CA bundle, so macOS Python installs without `Install Certificates.command` still verify correctly.
-- Local commands run under your user account with your file permissions.
-- The agent **cannot `cd` above the working directory** — `cd ..` past the workdir is rejected by the executor.
-- A denylist blocks obvious foot-guns: `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/…`, etc.
-- Every executed command is recorded with timestamp + exit code to `~/.virtuai/audit.log`.
-- The agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is in the foreground — no background daemon.
+**Read this section before pointing an agent at anything you care about.**
+
+The CLI runs the agent's shell commands **as your user account**, with your full filesystem permissions. There is no sandbox. The agent can do anything you can do at the shell. The guardrails below are best described as *speed bumps*, not walls.
+
+### What is enforced
+
+- **Auth**: CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows). All traffic is TLS (WSS + HTTPS) with the [`certifi`](https://github.com/certifi/python-certifi) CA bundle.
+- **File-tool path jail**: the deepagents file tools — `write_file`, `edit_file`, `read_file` — route through `upload_files`/`download_files`, which reject absolute paths outside the workdir. This part works.
+- **`cd` jail in bash**: the executor wraps every shell command in a bash subshell with a custom `cd` function that refuses to leave the workdir. Catches the trivial `cd ..` case.
+- **Denylist**: a regex match on the command string blocks `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/...`. Easy to bypass with aliasing or encoding; mostly there to stop drive-by accidents.
+- **Audit log**: every executed command + exit code goes to `~/.virtuai/audit.log` with a timestamp.
+- **Foreground-only**: the agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is running — no background daemon.
+
+### What is NOT enforced
+
+- **Shell commands can use absolute paths anywhere**. The `cd` jail only intercepts `cd`. `cat /etc/passwd`, `ls /Users/you/Documents`, `rm /tmp/whatever` — none of these touch `cd`, so none are blocked. **The agent can read, write, and delete anything you can.**
+- The `cd` jail itself is **bash-only**. `sh -c '...'`, `python -c "os.chdir('/')"`, `node -e "..."` all bypass it.
+- **Command substitution, eval, env vars, aliases** all defeat the denylist. `$(echo s)$(echo udo) ...` looks nothing like `sudo` to a regex.
+- **Network egress is not restricted.** The agent can `curl`/`wget` anywhere, exfiltrate to any host.
+
+### If you need real isolation
+
+The only honest options:
+
+1. **Run the CLI inside a container** with the workdir bind-mounted and nothing else:
+   ```bash
+   docker run --rm -it -v "$PWD:/work" -w /work python:3.12 bash -c "pip install virtuai-cli && virtuai pair <code> && virtuai chat"
+   ```
+   The container has access only to what you mount.
+2. **OS-level sandboxing**: wrap `virtuai run` in `sandbox-exec` on macOS or run inside a `landlock`/`bubblewrap` jail on Linux.
+3. **Switch the agent's backend to the E2B remote sandbox** in the portal. The agent then runs against a disposable VM, not your laptop. The CLI runner becomes optional (you'd only need it for "interactive" workflows where local files matter).
+
+**Use the CLI runner the same way you'd use a powerful shell session you don't fully trust.** Point it at a project directory, never at `~`, and don't run unattended on a machine with credentials lying around.
 
 ## Programmatic use
 

{virtuai_cli-0.7.5 → virtuai_cli-0.7.7}/README.md

@@ -129,13 +129,39 @@ Exit codes: `0` success · `1` stream error · `2` bad args / agent not found.
 
 ## Security model
 
-- The CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows).
-- All traffic is over TLS WebSockets and HTTPS; the CLI uses the [`certifi`](https://github.com/certifi/python-certifi) CA bundle, so macOS Python installs without `Install Certificates.command` still verify correctly.
-- Local commands run under your user account with your file permissions.
-- The agent **cannot `cd` above the working directory** — `cd ..` past the workdir is rejected by the executor.
-- A denylist blocks obvious foot-guns: `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/…`, etc.
-- Every executed command is recorded with timestamp + exit code to `~/.virtuai/audit.log`.
-- The agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is in the foreground — no background daemon.
+**Read this section before pointing an agent at anything you care about.**
+
+The CLI runs the agent's shell commands **as your user account**, with your full filesystem permissions. There is no sandbox. The agent can do anything you can do at the shell. The guardrails below are best described as *speed bumps*, not walls.
+
+### What is enforced
+
+- **Auth**: CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows). All traffic is TLS (WSS + HTTPS) with the [`certifi`](https://github.com/certifi/python-certifi) CA bundle.
+- **File-tool path jail**: the deepagents file tools — `write_file`, `edit_file`, `read_file` — route through `upload_files`/`download_files`, which reject absolute paths outside the workdir. This part works.
+- **`cd` jail in bash**: the executor wraps every shell command in a bash subshell with a custom `cd` function that refuses to leave the workdir. Catches the trivial `cd ..` case.
+- **Denylist**: a regex match on the command string blocks `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/...`. Easy to bypass with aliasing or encoding; mostly there to stop drive-by accidents.
+- **Audit log**: every executed command + exit code goes to `~/.virtuai/audit.log` with a timestamp.
+- **Foreground-only**: the agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is running — no background daemon.
+
+### What is NOT enforced
+
+- **Shell commands can use absolute paths anywhere**. The `cd` jail only intercepts `cd`. `cat /etc/passwd`, `ls /Users/you/Documents`, `rm /tmp/whatever` — none of these touch `cd`, so none are blocked. **The agent can read, write, and delete anything you can.**
+- The `cd` jail itself is **bash-only**. `sh -c '...'`, `python -c "os.chdir('/')"`, `node -e "..."` all bypass it.
+- **Command substitution, eval, env vars, aliases** all defeat the denylist. `$(echo s)$(echo udo) ...` looks nothing like `sudo` to a regex.
+- **Network egress is not restricted.** The agent can `curl`/`wget` anywhere, exfiltrate to any host.
+
+### If you need real isolation
+
+The only honest options:
+
+1. **Run the CLI inside a container** with the workdir bind-mounted and nothing else:
+   ```bash
+   docker run --rm -it -v "$PWD:/work" -w /work python:3.12 bash -c "pip install virtuai-cli && virtuai pair <code> && virtuai chat"
+   ```
+   The container has access only to what you mount.
+2. **OS-level sandboxing**: wrap `virtuai run` in `sandbox-exec` on macOS or run inside a `landlock`/`bubblewrap` jail on Linux.
+3. **Switch the agent's backend to the E2B remote sandbox** in the portal. The agent then runs against a disposable VM, not your laptop. The CLI runner becomes optional (you'd only need it for "interactive" workflows where local files matter).
+
+**Use the CLI runner the same way you'd use a powerful shell session you don't fully trust.** Point it at a project directory, never at `~`, and don't run unattended on a machine with credentials lying around.
 
 ## Programmatic use
 

{virtuai_cli-0.7.5 → virtuai_cli-0.7.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "virtuai-cli"
-version = "0.7.5"
+version = "0.7.7"
 description = "Run VirtuAI deep agents on your local machine"
 readme = "README.md"
 requires-python = ">=3.11"

{virtuai_cli-0.7.5 → virtuai_cli-0.7.7}/src/virtuai_cli/__init__.py

@@ -1,2 +1,2 @@
 """VirtuAI local CLI."""
-__version__ = "0.7.5"
+__version__ = "0.7.7"

{virtuai_cli-0.7.5 → virtuai_cli-0.7.7}/src/virtuai_cli/chat/tui.py

@@ -73,7 +73,10 @@ class ChatApp(App):
     """
 
     BINDINGS = [
-        Binding("escape", "cancel_stream", "Cancel", show=True),
+        # priority=True so Esc always cancels the stream even when the
+        # TextArea-based ChatInput has focus — TextArea itself doesn't bind
+        # Esc, but priority makes the guarantee explicit.
+        Binding("escape", "cancel_stream", "Cancel", show=True, priority=True),
         Binding("ctrl+c", "quit", "Quit", show=True),
         Binding("ctrl+l", "clear_conversation", "New chat", show=True),
         Binding("ctrl+y", "copy_last", "Copy last", show=True, priority=True),
@@ -176,10 +179,13 @@ class ChatApp(App):
         self._runner_task = asyncio.create_task(self._run_ws())
 
     def _tick_status(self) -> None:
+        # Only repaint when something is actually animating — otherwise we'd
+        # force a Textual reflow 10x/sec across the whole scrollback, which
+        # makes long conversations laggy.
         moving = self._streaming or self._connection_state in ("connecting", "reconnecting")
         if moving:
             self._spinner_idx = (self._spinner_idx + 1) % len(self._SPINNER)
-        self._refresh_status_bar()
+            self._refresh_status_bar()
 
     def _refresh_status_bar(self) -> None:
         try:

{virtuai_cli-0.7.5 → virtuai_cli-0.7.7}/src/virtuai_cli/chat/widgets.py

@@ -200,19 +200,52 @@ class UserBubble(Static):
 
 
 class TextSegment(Static):
-    """A streaming markdown segment of assistant text."""
+    """A streaming markdown segment of assistant text.
+
+    Renders are throttled to ~20 Hz: the markdown AST is rebuilt from the
+    full buffer on every paint (Rich/mistletoe parse from scratch), so
+    rendering once per token on a long response is O(n²) and dominates CPU.
+    With throttling, bursts of tokens coalesce into a single render and any
+    final pending render is flushed via mark_final()/flush().
+    """
 
     DEFAULT_CSS = """
     TextSegment { margin: 0 0 0 2; }
     """
 
+    _RENDER_INTERVAL = 0.05  # seconds (= 20 fps)
+
     def __init__(self) -> None:
         super().__init__("")
         self._buf = ""
+        self._last_render_t: float = 0.0
+        self._render_pending: bool = False
 
     def append(self, chunk: str) -> None:
         self._buf += chunk
-        self.update(Markdown(normalize_artifacts(self._buf)))
+        if self._render_pending:
+            # A flush is already scheduled and will pick up the new content.
+            return
+        now = time.monotonic()
+        elapsed = now - self._last_render_t
+        if elapsed >= self._RENDER_INTERVAL:
+            self._flush()
+        else:
+            self._render_pending = True
+            self.set_timer(self._RENDER_INTERVAL - elapsed, self._flush)
+
+    def flush(self) -> None:
+        """Force a render now — used to finalize the segment at end-of-stream."""
+        self._flush()
+
+    def _flush(self) -> None:
+        self._render_pending = False
+        self._last_render_t = time.monotonic()
+        try:
+            self.update(Markdown(normalize_artifacts(self._buf)))
+        except Exception:
+            # Widget might be unmounted by the time a scheduled flush fires.
+            pass
 
     @property
     def content(self) -> str:
@@ -585,4 +618,11 @@ class AssistantTurn(Vertical):
 
     async def mark_final(self) -> None:
         await self._stop_thinking()
+        # Force any throttled TextSegment to do its final render so the user
+        # doesn't see the last sub-50ms of tokens missing after stream-end.
+        for seg in self.query(TextSegment):
+            try:
+                seg.flush()
+            except Exception:
+                pass
         self._final = True

{virtuai_cli-0.7.5 → virtuai_cli-0.7.7}/src/virtuai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: virtuai-cli
-Version: 0.7.5
+Version: 0.7.7
 Summary: Run VirtuAI deep agents on your local machine
 Author-email: uCloudStore <lmoreno@ucloudstore.com>
 License: Proprietary
@@ -152,13 +152,39 @@ Exit codes: `0` success · `1` stream error · `2` bad args / agent not found.
 
 ## Security model
 
-- The CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows).
-- All traffic is over TLS WebSockets and HTTPS; the CLI uses the [`certifi`](https://github.com/certifi/python-certifi) CA bundle, so macOS Python installs without `Install Certificates.command` still verify correctly.
-- Local commands run under your user account with your file permissions.
-- The agent **cannot `cd` above the working directory** — `cd ..` past the workdir is rejected by the executor.
-- A denylist blocks obvious foot-guns: `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/…`, etc.
-- Every executed command is recorded with timestamp + exit code to `~/.virtuai/audit.log`.
-- The agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is in the foreground — no background daemon.
+**Read this section before pointing an agent at anything you care about.**
+
+The CLI runs the agent's shell commands **as your user account**, with your full filesystem permissions. There is no sandbox. The agent can do anything you can do at the shell. The guardrails below are best described as *speed bumps*, not walls.
+
+### What is enforced
+
+- **Auth**: CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows). All traffic is TLS (WSS + HTTPS) with the [`certifi`](https://github.com/certifi/python-certifi) CA bundle.
+- **File-tool path jail**: the deepagents file tools — `write_file`, `edit_file`, `read_file` — route through `upload_files`/`download_files`, which reject absolute paths outside the workdir. This part works.
+- **`cd` jail in bash**: the executor wraps every shell command in a bash subshell with a custom `cd` function that refuses to leave the workdir. Catches the trivial `cd ..` case.
+- **Denylist**: a regex match on the command string blocks `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/...`. Easy to bypass with aliasing or encoding; mostly there to stop drive-by accidents.
+- **Audit log**: every executed command + exit code goes to `~/.virtuai/audit.log` with a timestamp.
+- **Foreground-only**: the agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is running — no background daemon.
+
+### What is NOT enforced
+
+- **Shell commands can use absolute paths anywhere**. The `cd` jail only intercepts `cd`. `cat /etc/passwd`, `ls /Users/you/Documents`, `rm /tmp/whatever` — none of these touch `cd`, so none are blocked. **The agent can read, write, and delete anything you can.**
+- The `cd` jail itself is **bash-only**. `sh -c '...'`, `python -c "os.chdir('/')"`, `node -e "..."` all bypass it.
+- **Command substitution, eval, env vars, aliases** all defeat the denylist. `$(echo s)$(echo udo) ...` looks nothing like `sudo` to a regex.
+- **Network egress is not restricted.** The agent can `curl`/`wget` anywhere, exfiltrate to any host.
+
+### If you need real isolation
+
+The only honest options:
+
+1. **Run the CLI inside a container** with the workdir bind-mounted and nothing else:
+   ```bash
+   docker run --rm -it -v "$PWD:/work" -w /work python:3.12 bash -c "pip install virtuai-cli && virtuai pair <code> && virtuai chat"
+   ```
+   The container has access only to what you mount.
+2. **OS-level sandboxing**: wrap `virtuai run` in `sandbox-exec` on macOS or run inside a `landlock`/`bubblewrap` jail on Linux.
+3. **Switch the agent's backend to the E2B remote sandbox** in the portal. The agent then runs against a disposable VM, not your laptop. The CLI runner becomes optional (you'd only need it for "interactive" workflows where local files matter).
+
+**Use the CLI runner the same way you'd use a powerful shell session you don't fully trust.** Point it at a project directory, never at `~`, and don't run unattended on a machine with credentials lying around.
 
 ## Programmatic use