virtuai-cli 0.7.6__tar.gz → 0.7.7__tar.gz

{virtuai_cli-0.7.6 → virtuai_cli-0.7.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: virtuai-cli
-Version: 0.7.6
+Version: 0.7.7
 Summary: Run VirtuAI deep agents on your local machine
 Author-email: uCloudStore <lmoreno@ucloudstore.com>
 License: Proprietary
@@ -152,13 +152,39 @@ Exit codes: `0` success · `1` stream error · `2` bad args / agent not found.
 
 ## Security model
 
-- The CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows).
-- All traffic is over TLS WebSockets and HTTPS; the CLI uses the [`certifi`](https://github.com/certifi/python-certifi) CA bundle, so macOS Python installs without `Install Certificates.command` still verify correctly.
-- Local commands run under your user account with your file permissions.
-- The agent **cannot `cd` above the working directory** — `cd ..` past the workdir is rejected by the executor.
-- A denylist blocks obvious foot-guns: `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/…`, etc.
-- Every executed command is recorded with timestamp + exit code to `~/.virtuai/audit.log`.
-- The agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is in the foreground — no background daemon.
+**Read this section before pointing an agent at anything you care about.**
+
+The CLI runs the agent's shell commands **as your user account**, with your full filesystem permissions. There is no sandbox. The agent can do anything you can do at the shell. The guardrails below are best described as *speed bumps*, not walls.
+
+### What is enforced
+
+- **Auth**: CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows). All traffic is TLS (WSS + HTTPS) with the [`certifi`](https://github.com/certifi/python-certifi) CA bundle.
+- **File-tool path jail**: the deepagents file tools — `write_file`, `edit_file`, `read_file` — route through `upload_files`/`download_files`, which reject absolute paths outside the workdir. This part works.
+- **`cd` jail in bash**: the executor wraps every shell command in a bash subshell with a custom `cd` function that refuses to leave the workdir. Catches the trivial `cd ..` case.
+- **Denylist**: a regex match on the command string blocks `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/...`. Easy to bypass with aliasing or encoding; mostly there to stop drive-by accidents.
+- **Audit log**: every executed command + exit code goes to `~/.virtuai/audit.log` with a timestamp.
+- **Foreground-only**: the agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is running — no background daemon.
+
+### What is NOT enforced
+
+- **Shell commands can use absolute paths anywhere**. The `cd` jail only intercepts `cd`. `cat /etc/passwd`, `ls /Users/you/Documents`, `rm /tmp/whatever` — none of these touch `cd`, so none are blocked. **The agent can read, write, and delete anything you can.**
+- The `cd` jail itself is **bash-only**. `sh -c '...'`, `python -c "os.chdir('/')"`, `node -e "..."` all bypass it.
+- **Command substitution, eval, env vars, aliases** all defeat the denylist. `$(echo s)$(echo udo) ...` looks nothing like `sudo` to a regex.
+- **Network egress is not restricted.** The agent can `curl`/`wget` anywhere, exfiltrate to any host.
+
+### If you need real isolation
+
+The only honest options:
+
+1. **Run the CLI inside a container** with the workdir bind-mounted and nothing else:
+   ```bash
+   docker run --rm -it -v "$PWD:/work" -w /work python:3.12 bash -c "pip install virtuai-cli && virtuai pair <code> && virtuai chat"
+   ```
+   The container has access only to what you mount.
+2. **OS-level sandboxing**: wrap `virtuai run` in `sandbox-exec` on macOS or run inside a `landlock`/`bubblewrap` jail on Linux.
+3. **Switch the agent's backend to the E2B remote sandbox** in the portal. The agent then runs against a disposable VM, not your laptop. The CLI runner becomes optional (you'd only need it for "interactive" workflows where local files matter).
+
+**Use the CLI runner the same way you'd use a powerful shell session you don't fully trust.** Point it at a project directory, never at `~`, and don't run unattended on a machine with credentials lying around.
 
 ## Programmatic use
 

{virtuai_cli-0.7.6 → virtuai_cli-0.7.7}/README.md

@@ -129,13 +129,39 @@ Exit codes: `0` success · `1` stream error · `2` bad args / agent not found.
 
 ## Security model
 
-- The CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows).
-- All traffic is over TLS WebSockets and HTTPS; the CLI uses the [`certifi`](https://github.com/certifi/python-certifi) CA bundle, so macOS Python installs without `Install Certificates.command` still verify correctly.
-- Local commands run under your user account with your file permissions.
-- The agent **cannot `cd` above the working directory** — `cd ..` past the workdir is rejected by the executor.
-- A denylist blocks obvious foot-guns: `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/…`, etc.
-- Every executed command is recorded with timestamp + exit code to `~/.virtuai/audit.log`.
-- The agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is in the foreground — no background daemon.
+**Read this section before pointing an agent at anything you care about.**
+
+The CLI runs the agent's shell commands **as your user account**, with your full filesystem permissions. There is no sandbox. The agent can do anything you can do at the shell. The guardrails below are best described as *speed bumps*, not walls.
+
+### What is enforced
+
+- **Auth**: CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows). All traffic is TLS (WSS + HTTPS) with the [`certifi`](https://github.com/certifi/python-certifi) CA bundle.
+- **File-tool path jail**: the deepagents file tools — `write_file`, `edit_file`, `read_file` — route through `upload_files`/`download_files`, which reject absolute paths outside the workdir. This part works.
+- **`cd` jail in bash**: the executor wraps every shell command in a bash subshell with a custom `cd` function that refuses to leave the workdir. Catches the trivial `cd ..` case.
+- **Denylist**: a regex match on the command string blocks `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/...`. Easy to bypass with aliasing or encoding; mostly there to stop drive-by accidents.
+- **Audit log**: every executed command + exit code goes to `~/.virtuai/audit.log` with a timestamp.
+- **Foreground-only**: the agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is running — no background daemon.
+
+### What is NOT enforced
+
+- **Shell commands can use absolute paths anywhere**. The `cd` jail only intercepts `cd`. `cat /etc/passwd`, `ls /Users/you/Documents`, `rm /tmp/whatever` — none of these touch `cd`, so none are blocked. **The agent can read, write, and delete anything you can.**
+- The `cd` jail itself is **bash-only**. `sh -c '...'`, `python -c "os.chdir('/')"`, `node -e "..."` all bypass it.
+- **Command substitution, eval, env vars, aliases** all defeat the denylist. `$(echo s)$(echo udo) ...` looks nothing like `sudo` to a regex.
+- **Network egress is not restricted.** The agent can `curl`/`wget` anywhere, exfiltrate to any host.
+
+### If you need real isolation
+
+The only honest options:
+
+1. **Run the CLI inside a container** with the workdir bind-mounted and nothing else:
+   ```bash
+   docker run --rm -it -v "$PWD:/work" -w /work python:3.12 bash -c "pip install virtuai-cli && virtuai pair <code> && virtuai chat"
+   ```
+   The container has access only to what you mount.
+2. **OS-level sandboxing**: wrap `virtuai run` in `sandbox-exec` on macOS or run inside a `landlock`/`bubblewrap` jail on Linux.
+3. **Switch the agent's backend to the E2B remote sandbox** in the portal. The agent then runs against a disposable VM, not your laptop. The CLI runner becomes optional (you'd only need it for "interactive" workflows where local files matter).
+
+**Use the CLI runner the same way you'd use a powerful shell session you don't fully trust.** Point it at a project directory, never at `~`, and don't run unattended on a machine with credentials lying around.
 
 ## Programmatic use
 

{virtuai_cli-0.7.6 → virtuai_cli-0.7.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "virtuai-cli"
-version = "0.7.6"
+version = "0.7.7"
 description = "Run VirtuAI deep agents on your local machine"
 readme = "README.md"
 requires-python = ">=3.11"

{virtuai_cli-0.7.6 → virtuai_cli-0.7.7}/src/virtuai_cli/__init__.py

@@ -1,2 +1,2 @@
 """VirtuAI local CLI."""
-__version__ = "0.7.6"
+__version__ = "0.7.7"

{virtuai_cli-0.7.6 → virtuai_cli-0.7.7}/src/virtuai_cli/chat/tui.py

@@ -73,7 +73,10 @@ class ChatApp(App):
     """
 
     BINDINGS = [
-        Binding("escape", "cancel_stream", "Cancel", show=True),
+        # priority=True so Esc always cancels the stream even when the
+        # TextArea-based ChatInput has focus — TextArea itself doesn't bind
+        # Esc, but priority makes the guarantee explicit.
+        Binding("escape", "cancel_stream", "Cancel", show=True, priority=True),
         Binding("ctrl+c", "quit", "Quit", show=True),
         Binding("ctrl+l", "clear_conversation", "New chat", show=True),
         Binding("ctrl+y", "copy_last", "Copy last", show=True, priority=True),

{virtuai_cli-0.7.6 → virtuai_cli-0.7.7}/src/virtuai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: virtuai-cli
-Version: 0.7.6
+Version: 0.7.7
 Summary: Run VirtuAI deep agents on your local machine
 Author-email: uCloudStore <lmoreno@ucloudstore.com>
 License: Proprietary
@@ -152,13 +152,39 @@ Exit codes: `0` success · `1` stream error · `2` bad args / agent not found.
 
 ## Security model
 
-- The CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows).
-- All traffic is over TLS WebSockets and HTTPS; the CLI uses the [`certifi`](https://github.com/certifi/python-certifi) CA bundle, so macOS Python installs without `Install Certificates.command` still verify correctly.
-- Local commands run under your user account with your file permissions.
-- The agent **cannot `cd` above the working directory** — `cd ..` past the workdir is rejected by the executor.
-- A denylist blocks obvious foot-guns: `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/…`, etc.
-- Every executed command is recorded with timestamp + exit code to `~/.virtuai/audit.log`.
-- The agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is in the foreground — no background daemon.
+**Read this section before pointing an agent at anything you care about.**
+
+The CLI runs the agent's shell commands **as your user account**, with your full filesystem permissions. There is no sandbox. The agent can do anything you can do at the shell. The guardrails below are best described as *speed bumps*, not walls.
+
+### What is enforced
+
+- **Auth**: CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows). All traffic is TLS (WSS + HTTPS) with the [`certifi`](https://github.com/certifi/python-certifi) CA bundle.
+- **File-tool path jail**: the deepagents file tools — `write_file`, `edit_file`, `read_file` — route through `upload_files`/`download_files`, which reject absolute paths outside the workdir. This part works.
+- **`cd` jail in bash**: the executor wraps every shell command in a bash subshell with a custom `cd` function that refuses to leave the workdir. Catches the trivial `cd ..` case.
+- **Denylist**: a regex match on the command string blocks `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/...`. Easy to bypass with aliasing or encoding; mostly there to stop drive-by accidents.
+- **Audit log**: every executed command + exit code goes to `~/.virtuai/audit.log` with a timestamp.
+- **Foreground-only**: the agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is running — no background daemon.
+
+### What is NOT enforced
+
+- **Shell commands can use absolute paths anywhere**. The `cd` jail only intercepts `cd`. `cat /etc/passwd`, `ls /Users/you/Documents`, `rm /tmp/whatever` — none of these touch `cd`, so none are blocked. **The agent can read, write, and delete anything you can.**
+- The `cd` jail itself is **bash-only**. `sh -c '...'`, `python -c "os.chdir('/')"`, `node -e "..."` all bypass it.
+- **Command substitution, eval, env vars, aliases** all defeat the denylist. `$(echo s)$(echo udo) ...` looks nothing like `sudo` to a regex.
+- **Network egress is not restricted.** The agent can `curl`/`wget` anywhere, exfiltrate to any host.
+
+### If you need real isolation
+
+The only honest options:
+
+1. **Run the CLI inside a container** with the workdir bind-mounted and nothing else:
+   ```bash
+   docker run --rm -it -v "$PWD:/work" -w /work python:3.12 bash -c "pip install virtuai-cli && virtuai pair <code> && virtuai chat"
+   ```
+   The container has access only to what you mount.
+2. **OS-level sandboxing**: wrap `virtuai run` in `sandbox-exec` on macOS or run inside a `landlock`/`bubblewrap` jail on Linux.
+3. **Switch the agent's backend to the E2B remote sandbox** in the portal. The agent then runs against a disposable VM, not your laptop. The CLI runner becomes optional (you'd only need it for "interactive" workflows where local files matter).
+
+**Use the CLI runner the same way you'd use a powerful shell session you don't fully trust.** Point it at a project directory, never at `~`, and don't run unattended on a machine with credentials lying around.
 
 ## Programmatic use