virtuai-cli 0.7.6__tar.gz → 0.8.0__tar.gz

{virtuai_cli-0.7.6 → virtuai_cli-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: virtuai-cli
-Version: 0.7.6
+Version: 0.8.0
 Summary: Run VirtuAI deep agents on your local machine
 Author-email: uCloudStore <lmoreno@ucloudstore.com>
 License: Proprietary
@@ -152,13 +152,39 @@ Exit codes: `0` success · `1` stream error · `2` bad args / agent not found.
 
 ## Security model
 
-- The CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows).
-- All traffic is over TLS WebSockets and HTTPS; the CLI uses the [`certifi`](https://github.com/certifi/python-certifi) CA bundle, so macOS Python installs without `Install Certificates.command` still verify correctly.
-- Local commands run under your user account with your file permissions.
-- The agent **cannot `cd` above the working directory** — `cd ..` past the workdir is rejected by the executor.
-- A denylist blocks obvious foot-guns: `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/…`, etc.
-- Every executed command is recorded with timestamp + exit code to `~/.virtuai/audit.log`.
-- The agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is in the foreground — no background daemon.
+**Read this section before pointing an agent at anything you care about.**
+
+The CLI runs the agent's shell commands **as your user account**, with your full filesystem permissions. There is no sandbox. The agent can do anything you can do at the shell. The guardrails below are best described as *speed bumps*, not walls.
+
+### What is enforced
+
+- **Auth**: CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows). All traffic is TLS (WSS + HTTPS) with the [`certifi`](https://github.com/certifi/python-certifi) CA bundle.
+- **File-tool path jail**: the deepagents file tools — `write_file`, `edit_file`, `read_file` — route through `upload_files`/`download_files`, which reject absolute paths outside the workdir. This part works.
+- **`cd` jail in bash**: the executor wraps every shell command in a bash subshell with a custom `cd` function that refuses to leave the workdir. Catches the trivial `cd ..` case.
+- **Denylist**: a regex match on the command string blocks `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/...`. Easy to bypass with aliasing or encoding; mostly there to stop drive-by accidents.
+- **Audit log**: every executed command + exit code goes to `~/.virtuai/audit.log` with a timestamp.
+- **Foreground-only**: the agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is running — no background daemon.
+
+### What is NOT enforced
+
+- **Shell commands can use absolute paths anywhere**. The `cd` jail only intercepts `cd`. `cat /etc/passwd`, `ls /Users/you/Documents`, `rm /tmp/whatever` — none of these touch `cd`, so none are blocked. **The agent can read, write, and delete anything you can.**
+- The `cd` jail itself is **bash-only**. `sh -c '...'`, `python -c "os.chdir('/')"`, `node -e "..."` all bypass it.
+- **Command substitution, eval, env vars, aliases** all defeat the denylist. `$(echo s)$(echo udo) ...` looks nothing like `sudo` to a regex.
+- **Network egress is not restricted.** The agent can `curl`/`wget` anywhere, exfiltrate to any host.
+
+### If you need real isolation
+
+The only honest options:
+
+1. **Run the CLI inside a container** with the workdir bind-mounted and nothing else:
+   ```bash
+   docker run --rm -it -v "$PWD:/work" -w /work python:3.12 bash -c "pip install virtuai-cli && virtuai pair <code> && virtuai chat"
+   ```
+   The container has access only to what you mount.
+2. **OS-level sandboxing**: wrap `virtuai run` in `sandbox-exec` on macOS or run inside a `landlock`/`bubblewrap` jail on Linux.
+3. **Switch the agent's backend to the E2B remote sandbox** in the portal. The agent then runs against a disposable VM, not your laptop. The CLI runner becomes optional (you'd only need it for "interactive" workflows where local files matter).
+
+**Use the CLI runner the same way you'd use a powerful shell session you don't fully trust.** Point it at a project directory, never at `~`, and don't run unattended on a machine with credentials lying around.
 
 ## Programmatic use
 

{virtuai_cli-0.7.6 → virtuai_cli-0.8.0}/README.md

@@ -129,13 +129,39 @@ Exit codes: `0` success · `1` stream error · `2` bad args / agent not found.
 
 ## Security model
 
-- The CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows).
-- All traffic is over TLS WebSockets and HTTPS; the CLI uses the [`certifi`](https://github.com/certifi/python-certifi) CA bundle, so macOS Python installs without `Install Certificates.command` still verify correctly.
-- Local commands run under your user account with your file permissions.
-- The agent **cannot `cd` above the working directory** — `cd ..` past the workdir is rejected by the executor.
-- A denylist blocks obvious foot-guns: `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/…`, etc.
-- Every executed command is recorded with timestamp + exit code to `~/.virtuai/audit.log`.
-- The agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is in the foreground — no background daemon.
+**Read this section before pointing an agent at anything you care about.**
+
+The CLI runs the agent's shell commands **as your user account**, with your full filesystem permissions. There is no sandbox. The agent can do anything you can do at the shell. The guardrails below are best described as *speed bumps*, not walls.
+
+### What is enforced
+
+- **Auth**: CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows). All traffic is TLS (WSS + HTTPS) with the [`certifi`](https://github.com/certifi/python-certifi) CA bundle.
+- **File-tool path jail**: the deepagents file tools — `write_file`, `edit_file`, `read_file` — route through `upload_files`/`download_files`, which reject absolute paths outside the workdir. This part works.
+- **`cd` jail in bash**: the executor wraps every shell command in a bash subshell with a custom `cd` function that refuses to leave the workdir. Catches the trivial `cd ..` case.
+- **Denylist**: a regex match on the command string blocks `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/...`. Easy to bypass with aliasing or encoding; mostly there to stop drive-by accidents.
+- **Audit log**: every executed command + exit code goes to `~/.virtuai/audit.log` with a timestamp.
+- **Foreground-only**: the agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is running — no background daemon.
+
+### What is NOT enforced
+
+- **Shell commands can use absolute paths anywhere**. The `cd` jail only intercepts `cd`. `cat /etc/passwd`, `ls /Users/you/Documents`, `rm /tmp/whatever` — none of these touch `cd`, so none are blocked. **The agent can read, write, and delete anything you can.**
+- The `cd` jail itself is **bash-only**. `sh -c '...'`, `python -c "os.chdir('/')"`, `node -e "..."` all bypass it.
+- **Command substitution, eval, env vars, aliases** all defeat the denylist. `$(echo s)$(echo udo) ...` looks nothing like `sudo` to a regex.
+- **Network egress is not restricted.** The agent can `curl`/`wget` anywhere, exfiltrate to any host.
+
+### If you need real isolation
+
+The only honest options:
+
+1. **Run the CLI inside a container** with the workdir bind-mounted and nothing else:
+   ```bash
+   docker run --rm -it -v "$PWD:/work" -w /work python:3.12 bash -c "pip install virtuai-cli && virtuai pair <code> && virtuai chat"
+   ```
+   The container has access only to what you mount.
+2. **OS-level sandboxing**: wrap `virtuai run` in `sandbox-exec` on macOS or run inside a `landlock`/`bubblewrap` jail on Linux.
+3. **Switch the agent's backend to the E2B remote sandbox** in the portal. The agent then runs against a disposable VM, not your laptop. The CLI runner becomes optional (you'd only need it for "interactive" workflows where local files matter).
+
+**Use the CLI runner the same way you'd use a powerful shell session you don't fully trust.** Point it at a project directory, never at `~`, and don't run unattended on a machine with credentials lying around.
 
 ## Programmatic use
 

{virtuai_cli-0.7.6 → virtuai_cli-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "virtuai-cli"
-version = "0.7.6"
+version = "0.8.0"
 description = "Run VirtuAI deep agents on your local machine"
 readme = "README.md"
 requires-python = ">=3.11"

{virtuai_cli-0.7.6 → virtuai_cli-0.8.0}/src/virtuai_cli/__init__.py

@@ -1,2 +1,2 @@
 """VirtuAI local CLI."""
-__version__ = "0.7.6"
+__version__ = "0.8.0"

virtuai_cli-0.8.0/src/virtuai_cli/chat/sse.py

@@ -0,0 +1,138 @@
+"""Async SSE chat client — POSTs a user message and yields parsed events."""
+
+from __future__ import annotations
+
+import json
+import mimetypes
+import ssl
+from pathlib import Path
+from typing import AsyncIterator, Optional, Sequence
+
+import certifi
+import httpx
+from httpx_sse import aconnect_sse
+
+
+def _ssl_context() -> ssl.SSLContext:
+    return ssl.create_default_context(cafile=certifi.where())
+
+
+async def stream_chat(
+    server_url: str,
+    token: str,
+    agent_id: str,
+    message: str,
+    session_id: Optional[str] = None,
+    model_id: Optional[str] = None,
+    timeout: float = 600.0,
+) -> AsyncIterator[dict]:
+    """Open an SSE chat stream and yield each event as a parsed dict.
+
+    The CLI token is passed as `Authorization: Bearer <token>`; the chat
+    principal now accepts CLI tokens (see web_chat/deps.py).
+    """
+    payload: dict = {"message": message}
+    if session_id:
+        payload["session_id"] = session_id
+    if model_id:
+        payload["model_id"] = model_id
+
+    headers = {"Authorization": f"Bearer {token}"}
+    url = f"{server_url.rstrip('/')}/api/web-chat/chat/{agent_id}/stream"
+    verify = certifi.where()
+
+    async with httpx.AsyncClient(verify=verify, timeout=httpx.Timeout(timeout, connect=15.0)) as client:
+        async with aconnect_sse(client, "POST", url, json=payload, headers=headers) as event_source:
+            async for event in _iter_normalized_sse(event_source):
+                yield event
+
+
+# Mirror of frontend/src/utils/webChatMultimodalCatalog.ts
+WEBCHAT_MAX_FILES = 3
+WEBCHAT_MAX_FILE_SIZE_MB = 10
+WEBCHAT_ALLOWED_EXTENSIONS = {
+    ".jpg", ".jpeg", ".png", ".gif", ".webp",
+    ".pdf",
+    ".txt", ".csv", ".md",
+    ".docx", ".xlsx", ".pptx",
+}
+_EXTRA_MIMES = {
+    ".md": "text/markdown",
+    ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+}
+
+
+def guess_mime(path: Path) -> str:
+    """Return a best-effort MIME type for an attachment path.
+
+    Falls back to a small extra map for office types and markdown that
+    Python's mimetypes module doesn't ship reliably across platforms.
+    """
+    suffix = path.suffix.lower()
+    if suffix in _EXTRA_MIMES:
+        return _EXTRA_MIMES[suffix]
+    mime, _ = mimetypes.guess_type(str(path))
+    return mime or "application/octet-stream"
+
+
+async def stream_chat_multimodal(
+    server_url: str,
+    token: str,
+    agent_id: str,
+    message: str,
+    files: Sequence[Path],
+    session_id: Optional[str] = None,
+    model_id: Optional[str] = None,
+    timeout: float = 600.0,
+) -> AsyncIterator[dict]:
+    """Like stream_chat() but POSTs to the multimodal endpoint with attachments.
+
+    The web chat's multimodal stream accepts up to WEBCHAT_MAX_FILES files of
+    the types listed in WEBCHAT_ALLOWED_EXTENSIONS; the server extracts text
+    from PDFs/Office docs and feeds it (or the raw image bytes) to the model.
+    """
+    data: dict = {"message": message}
+    if session_id:
+        data["session_id"] = session_id
+    if model_id:
+        data["model_id"] = model_id
+
+    file_uploads = []
+    for path in files:
+        try:
+            content = path.read_bytes()
+        except OSError as exc:
+            raise FileNotFoundError(f"can't read {path}: {exc}") from exc
+        file_uploads.append(("files", (path.name, content, guess_mime(path))))
+
+    headers = {"Authorization": f"Bearer {token}"}
+    url = f"{server_url.rstrip('/')}/api/web-chat/chat/{agent_id}/multimodal/stream"
+    verify = certifi.where()
+
+    async with httpx.AsyncClient(verify=verify, timeout=httpx.Timeout(timeout, connect=15.0)) as client:
+        async with aconnect_sse(
+            client, "POST", url, data=data, files=file_uploads, headers=headers
+        ) as event_source:
+            async for event in _iter_normalized_sse(event_source):
+                yield event
+
+
+async def _iter_normalized_sse(event_source) -> AsyncIterator[dict]:
+    """Shared SSE-to-typed-event loop for both stream_chat variants."""
+    async for sse in event_source.aiter_sse():
+        if not sse.data:
+            continue
+        if sse.data.strip() == "[DONE]":
+            yield {"type": "done"}
+            continue
+        try:
+            parsed = json.loads(sse.data)
+        except json.JSONDecodeError:
+            continue
+        if isinstance(parsed, dict):
+            yield parsed
+        elif isinstance(parsed, str):
+            # Classic agents stream tokens as bare JSON strings.
+            yield {"type": "token", "content": parsed}

{virtuai_cli-0.7.6 → virtuai_cli-0.8.0}/src/virtuai_cli/chat/tui.py

@@ -16,7 +16,13 @@ from textual.widgets import Footer, Header, Static, TextArea
 
 from virtuai_cli import runner as ws_runner
 from virtuai_cli.chat.history import list_conversations, load_conversation
-from virtuai_cli.chat.sse import stream_chat
+from virtuai_cli.chat.sse import (
+    WEBCHAT_ALLOWED_EXTENSIONS,
+    WEBCHAT_MAX_FILES,
+    WEBCHAT_MAX_FILE_SIZE_MB,
+    stream_chat,
+    stream_chat_multimodal,
+)
 from virtuai_cli.chat.widgets import AssistantTurn, ChatInput, TextSegment, UserBubble
 
 
@@ -28,6 +34,9 @@ SLASH_COMMANDS: list[tuple[str, str]] = [
     ("/new", "alias for /clear"),
     ("/copy", "copy the last assistant response to the clipboard"),
     ("/select", "toggle terminal-native text selection (also F2)"),
+    ("/attach", "attach a file to your next message: /attach <path>"),
+    ("/attachments", "list pending attachments"),
+    ("/detach", "remove an attachment by name or index: /detach <n|name>"),
     ("/history", "list this agent's recent conversations"),
     ("/load", "load a past conversation: /load <session_id>"),
     ("/models", "list models available for this agent"),
@@ -73,7 +82,10 @@ class ChatApp(App):
     """
 
     BINDINGS = [
-        Binding("escape", "cancel_stream", "Cancel", show=True),
+        # priority=True so Esc always cancels the stream even when the
+        # TextArea-based ChatInput has focus — TextArea itself doesn't bind
+        # Esc, but priority makes the guarantee explicit.
+        Binding("escape", "cancel_stream", "Cancel", show=True, priority=True),
         Binding("ctrl+c", "quit", "Quit", show=True),
         Binding("ctrl+l", "clear_conversation", "New chat", show=True),
         Binding("ctrl+y", "copy_last", "Copy last", show=True, priority=True),
@@ -116,6 +128,9 @@ class ChatApp(App):
         self._streaming: bool = False
         self._status_message: str = ""
         self._spinner_idx: int = 0
+        # Pending attachments to include with the next message — flipped to the
+        # multimodal endpoint when non-empty, cleared after a successful send.
+        self._pending_attachments: list[Path] = []
 
     # ── Layout ────────────────────────────────────────────────────────────
     def compose(self) -> ComposeResult:
@@ -313,6 +328,9 @@ class ChatApp(App):
             return
 
         await self._append(UserBubble(text))
+        if self._pending_attachments:
+            preview = " · ".join(f"📎 {p.name}" for p in self._pending_attachments)
+            await self._append(Static(f"  [dim]{preview}[/dim]"))
         turn = AssistantTurn()
         await self._append(turn)
         self._current_turn = turn
@@ -347,6 +365,12 @@ class ChatApp(App):
             self.action_copy_last()
         elif head == "/select":
             self.action_toggle_select_mode()
+        elif head == "/attach":
+            await self._attach_file(arg)
+        elif head == "/attachments":
+            await self._show_attachments()
+        elif head == "/detach":
+            await self._detach_file(arg)
         elif head == "/help":
             await self._append(Static(
                 "[b]Commands[/b]\n"
@@ -354,6 +378,9 @@ class ChatApp(App):
                 "  /clear, /new       start a fresh conversation\n"
                 "  /copy              copy the last assistant response to clipboard\n"
                 "  /select            toggle terminal-native text selection\n"
+                "  /attach <path>     attach a file to your next message\n"
+                "  /attachments       list pending attachments\n"
+                "  /detach <n|name>   remove an attachment (or /detach to clear all)\n"
                 "  /history           list this agent's recent conversations\n"
                 "  /load <id>         load a past conversation by session_id\n"
                 "  /models            list models available for this agent\n"
@@ -393,6 +420,90 @@ class ChatApp(App):
         lines.append("\n[dim]Use [/dim][b]/model <id>[/b][dim] to switch.[/dim]")
         await self._append(Static("\n".join(lines)))
 
+    async def _attach_file(self, arg: str) -> None:
+        if not arg:
+            await self._append(Static(
+                "Usage: [b]/attach <path>[/b]\n"
+                f"[dim]Allowed: {', '.join(sorted(WEBCHAT_ALLOWED_EXTENSIONS))}\n"
+                f"Limit: {WEBCHAT_MAX_FILES} files per message, "
+                f"{WEBCHAT_MAX_FILE_SIZE_MB} MB each.[/dim]"
+            ))
+            return
+        # Trim surrounding quotes and expand ~/$HOME
+        raw = arg.strip().strip('"').strip("'")
+        path = Path(raw).expanduser()
+        try:
+            path = path.resolve(strict=True)
+        except (FileNotFoundError, OSError) as exc:
+            await self._append(Static(f"[red]File not found:[/red] {raw} ({exc})"))
+            return
+        if not path.is_file():
+            await self._append(Static(f"[red]Not a file:[/red] {path}"))
+            return
+        if path.suffix.lower() not in WEBCHAT_ALLOWED_EXTENSIONS:
+            await self._append(Static(
+                f"[red]Unsupported file type:[/red] {path.suffix or '(no extension)'}\n"
+                f"[dim]Allowed: {', '.join(sorted(WEBCHAT_ALLOWED_EXTENSIONS))}[/dim]"
+            ))
+            return
+        size_mb = path.stat().st_size / (1024 * 1024)
+        if size_mb > WEBCHAT_MAX_FILE_SIZE_MB:
+            await self._append(Static(
+                f"[red]File too large:[/red] {size_mb:.1f} MB "
+                f"(limit {WEBCHAT_MAX_FILE_SIZE_MB} MB)"
+            ))
+            return
+        if len(self._pending_attachments) >= WEBCHAT_MAX_FILES:
+            await self._append(Static(
+                f"[yellow]Already at the {WEBCHAT_MAX_FILES}-file limit.[/yellow] "
+                f"Use [b]/detach <n>[/b] to drop one."
+            ))
+            return
+        if any(p == path for p in self._pending_attachments):
+            await self._append(Static(f"[yellow]Already attached:[/yellow] {path.name}"))
+            return
+        self._pending_attachments.append(path)
+        await self._append(Static(
+            f"[green]📎 Attached:[/green] [b]{path.name}[/b]  "
+            f"[dim]({size_mb:.1f} MB · {path})[/dim]\n"
+            f"[dim]{len(self._pending_attachments)}/{WEBCHAT_MAX_FILES} files pending. "
+            f"Send your message normally; the agent will see them.[/dim]"
+        ))
+
+    async def _show_attachments(self) -> None:
+        if not self._pending_attachments:
+            await self._append(Static("[dim]No attachments pending.[/dim]"))
+            return
+        lines = [f"[b]Pending attachments[/b]  [dim](sent with your next message)[/dim]"]
+        for i, path in enumerate(self._pending_attachments, start=1):
+            size_mb = path.stat().st_size / (1024 * 1024)
+            lines.append(f"  {i}. [b]{path.name}[/b]  [dim]({size_mb:.1f} MB · {path})[/dim]")
+        lines.append("\n[dim]Drop one with [/dim][b]/detach <n>[/b]")
+        await self._append(Static("\n".join(lines)))
+
+    async def _detach_file(self, arg: str) -> None:
+        if not self._pending_attachments:
+            await self._append(Static("[dim]No attachments to detach.[/dim]"))
+            return
+        if not arg:
+            self._pending_attachments.clear()
+            await self._append(Static("[yellow]Cleared all pending attachments.[/yellow]"))
+            return
+        # By index (1-based)
+        if arg.isdigit():
+            idx = int(arg) - 1
+            if 0 <= idx < len(self._pending_attachments):
+                removed = self._pending_attachments.pop(idx)
+                await self._append(Static(f"[yellow]Detached:[/yellow] {removed.name}"))
+                return
+        # By filename
+        for p in list(self._pending_attachments):
+            if p.name == arg or str(p) == arg:
+                self._pending_attachments.remove(p)
+                await self._append(Static(f"[yellow]Detached:[/yellow] {p.name}"))
+                return
+        await self._append(Static(f"[red]No match for:[/red] {arg}"))
+
     async def _show_history(self) -> None:
         try:
             convs = await list_conversations(self.server_url, self.token, self.agent_id, limit=20)
@@ -607,15 +718,27 @@ class ChatApp(App):
     async def _stream_response(self, message: str, turn: AssistantTurn) -> None:
         self._streaming = True
         self._refresh_status_bar()
-        try:
-            async for event in stream_chat(
-                self.server_url,
-                self.token,
-                self.agent_id,
-                message,
+        # Snapshot + clear pending attachments BEFORE the request so a new
+        # /attach during streaming doesn't bleed into this turn or the next.
+        attachments = list(self._pending_attachments)
+        self._pending_attachments.clear()
+
+        if attachments:
+            stream_iter = stream_chat_multimodal(
+                self.server_url, self.token, self.agent_id, message,
+                files=attachments,
+                session_id=self.session_id,
+                model_id=self.current_model_id,
+            )
+        else:
+            stream_iter = stream_chat(
+                self.server_url, self.token, self.agent_id, message,
                 session_id=self.session_id,
                 model_id=self.current_model_id,
-            ):
+            )
+
+        try:
+            async for event in stream_iter:
                 await self._handle_event(event, turn)
                 self._follow_bottom()
         except asyncio.CancelledError:

{virtuai_cli-0.7.6 → virtuai_cli-0.8.0}/src/virtuai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: virtuai-cli
-Version: 0.7.6
+Version: 0.8.0
 Summary: Run VirtuAI deep agents on your local machine
 Author-email: uCloudStore <lmoreno@ucloudstore.com>
 License: Proprietary
@@ -152,13 +152,39 @@ Exit codes: `0` success · `1` stream error · `2` bad args / agent not found.
 
 ## Security model
 
-- The CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows).
-- All traffic is over TLS WebSockets and HTTPS; the CLI uses the [`certifi`](https://github.com/certifi/python-certifi) CA bundle, so macOS Python installs without `Install Certificates.command` still verify correctly.
-- Local commands run under your user account with your file permissions.
-- The agent **cannot `cd` above the working directory** — `cd ..` past the workdir is rejected by the executor.
-- A denylist blocks obvious foot-guns: `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/…`, etc.
-- Every executed command is recorded with timestamp + exit code to `~/.virtuai/audit.log`.
-- The agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is in the foreground — no background daemon.
+**Read this section before pointing an agent at anything you care about.**
+
+The CLI runs the agent's shell commands **as your user account**, with your full filesystem permissions. There is no sandbox. The agent can do anything you can do at the shell. The guardrails below are best described as *speed bumps*, not walls.
+
+### What is enforced
+
+- **Auth**: CLI token is stored in your OS keychain (Keychain on macOS, libsecret on Linux, Credential Manager on Windows). All traffic is TLS (WSS + HTTPS) with the [`certifi`](https://github.com/certifi/python-certifi) CA bundle.
+- **File-tool path jail**: the deepagents file tools — `write_file`, `edit_file`, `read_file` — route through `upload_files`/`download_files`, which reject absolute paths outside the workdir. This part works.
+- **`cd` jail in bash**: the executor wraps every shell command in a bash subshell with a custom `cd` function that refuses to leave the workdir. Catches the trivial `cd ..` case.
+- **Denylist**: a regex match on the command string blocks `sudo`, `rm -rf /`, fork bombs, `mkfs`, `dd of=/dev/...`. Easy to bypass with aliasing or encoding; mostly there to stop drive-by accidents.
+- **Audit log**: every executed command + exit code goes to `~/.virtuai/audit.log` with a timestamp.
+- **Foreground-only**: the agent only has access while `virtuai chat`, `virtuai ask`, or `virtuai run` is running — no background daemon.
+
+### What is NOT enforced
+
+- **Shell commands can use absolute paths anywhere**. The `cd` jail only intercepts `cd`. `cat /etc/passwd`, `ls /Users/you/Documents`, `rm /tmp/whatever` — none of these touch `cd`, so none are blocked. **The agent can read, write, and delete anything you can.**
+- The `cd` jail itself is **bash-only**. `sh -c '...'`, `python -c "os.chdir('/')"`, `node -e "..."` all bypass it.
+- **Command substitution, eval, env vars, aliases** all defeat the denylist. `$(echo s)$(echo udo) ...` looks nothing like `sudo` to a regex.
+- **Network egress is not restricted.** The agent can `curl`/`wget` anywhere, exfiltrate to any host.
+
+### If you need real isolation
+
+The only honest options:
+
+1. **Run the CLI inside a container** with the workdir bind-mounted and nothing else:
+   ```bash
+   docker run --rm -it -v "$PWD:/work" -w /work python:3.12 bash -c "pip install virtuai-cli && virtuai pair <code> && virtuai chat"
+   ```
+   The container has access only to what you mount.
+2. **OS-level sandboxing**: wrap `virtuai run` in `sandbox-exec` on macOS or run inside a `landlock`/`bubblewrap` jail on Linux.
+3. **Switch the agent's backend to the E2B remote sandbox** in the portal. The agent then runs against a disposable VM, not your laptop. The CLI runner becomes optional (you'd only need it for "interactive" workflows where local files matter).
+
+**Use the CLI runner the same way you'd use a powerful shell session you don't fully trust.** Point it at a project directory, never at `~`, and don't run unattended on a machine with credentials lying around.
 
 ## Programmatic use
 

virtuai_cli-0.7.6/src/virtuai_cli/chat/sse.py

@@ -1,63 +0,0 @@
-"""Async SSE chat client — POSTs a user message and yields parsed events."""
-
-from __future__ import annotations
-
-import json
-import ssl
-from typing import AsyncIterator, Optional
-
-import certifi
-import httpx
-from httpx_sse import aconnect_sse
-
-
-def _ssl_context() -> ssl.SSLContext:
-    return ssl.create_default_context(cafile=certifi.where())
-
-
-async def stream_chat(
-    server_url: str,
-    token: str,
-    agent_id: str,
-    message: str,
-    session_id: Optional[str] = None,
-    model_id: Optional[str] = None,
-    timeout: float = 600.0,
-) -> AsyncIterator[dict]:
-    """Open an SSE chat stream and yield each event as a parsed dict.
-
-    The CLI token is passed as `Authorization: Bearer <token>`; the chat
-    principal now accepts CLI tokens (see web_chat/deps.py).
-    """
-    payload: dict = {"message": message}
-    if session_id:
-        payload["session_id"] = session_id
-    if model_id:
-        payload["model_id"] = model_id
-
-    headers = {"Authorization": f"Bearer {token}"}
-    url = f"{server_url.rstrip('/')}/api/web-chat/chat/{agent_id}/stream"
-    verify = certifi.where()
-
-    async with httpx.AsyncClient(verify=verify, timeout=httpx.Timeout(timeout, connect=15.0)) as client:
-        async with aconnect_sse(client, "POST", url, json=payload, headers=headers) as event_source:
-            async for sse in event_source.aiter_sse():
-                if not sse.data:
-                    continue
-                # Classic-agent path emits `data: [DONE]` after the stream;
-                # treat that as a done event for symmetry with the deep path.
-                if sse.data.strip() == "[DONE]":
-                    yield {"type": "done"}
-                    continue
-                try:
-                    parsed = json.loads(sse.data)
-                except json.JSONDecodeError:
-                    continue
-                if isinstance(parsed, dict):
-                    yield parsed
-                elif isinstance(parsed, str):
-                    # Classic agents stream tokens as bare JSON strings
-                    # (`data: "hello "`). Wrap them so downstream handlers
-                    # don't need to know about the legacy protocol.
-                    yield {"type": "token", "content": parsed}
-                # Other shapes (lists, ints, null) are dropped silently.