agent-brain-cli 10.1.2__tar.gz → 10.2.1__tar.gz

{agent_brain_cli-10.1.2 → agent_brain_cli-10.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: agent-brain-cli
-Version: 10.1.2
+Version: 10.2.1
 Summary: Agent Brain CLI - Command-line interface for managing AI agent memory and knowledge retrieval
 Home-page: https://github.com/SpillwaveSolutions/agent-brain
 License: MIT
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
-Requires-Dist: agent-brain-rag (>=10.1.0,<11.0.0)
-Requires-Dist: agent-brain-uds (>=10.1.0,<11.0.0)
+Requires-Dist: agent-brain-rag (>=10.2.1,<11.0.0)
+Requires-Dist: agent-brain-uds (>=10.2.1,<11.0.0)
 Requires-Dist: click (>=8.1.0,<9.0.0)
 Requires-Dist: httpx (>=0.28.0,<0.29.0)
 Requires-Dist: pydantic (>=2.10.0,<3.0.0)

{agent_brain_cli-10.1.2 → agent_brain_cli-10.2.1}/agent_brain_cli/__init__.py

@@ -1,3 +1,3 @@
 """Doc-Serve CLI - Command-line interface for managing Doc-Serve server."""
 
-__version__ = "10.1.2"
+__version__ = "10.2.1"

{agent_brain_cli-10.1.2 → agent_brain_cli-10.2.1}/agent_brain_cli/client/api_client.py

@@ -159,6 +159,7 @@ class DocServeClient:
         self,
         base_url: str = "http://127.0.0.1:8000",
         timeout: float = 30.0,
+        api_key: str | None = None,
     ):
         """
         Initialize the client.
@@ -166,13 +167,21 @@ class DocServeClient:
         Args:
             base_url: Server base URL.
             timeout: Request timeout in seconds.
+            api_key: Optional X-API-Key value (Issue #179). When supplied,
+                every outbound request carries the header. ``None`` means
+                no auth (legacy single-user loopback dev path).
         """
         self.base_url = base_url.rstrip("/")
         self.timeout = timeout
-        self._client = httpx.Client(timeout=timeout)
+        headers = {"X-API-Key": api_key} if api_key else None
+        self._client = httpx.Client(timeout=timeout, headers=headers)
 
     @classmethod
-    def from_httpx(cls, client: httpx.Client) -> "DocServeClient":
+    def from_httpx(
+        cls,
+        client: httpx.Client,
+        api_key: str | None = None,
+    ) -> "DocServeClient":
         """Build a DocServeClient that uses a pre-constructed httpx.Client.
 
         Used by the transport selector to inject a UDS-backed client
@@ -183,6 +192,9 @@ class DocServeClient:
         Args:
             client: An already-configured ``httpx.Client``. The wrapper
                 takes ownership and will close it on ``__exit__``.
+            api_key: Optional X-API-Key to merge into the client's
+                default headers (Issue #179). Caller may also have set
+                the header on ``client`` directly; both paths work.
 
         Returns:
             A DocServeClient backed by ``client``.
@@ -191,6 +203,8 @@ class DocServeClient:
         instance.base_url = ""  # inner client carries the real base_url
         timeout = client.timeout
         instance.timeout = timeout.read or 30.0
+        if api_key:
+            client.headers["X-API-Key"] = api_key
         instance._client = client
         return instance
 
@@ -370,7 +384,6 @@ class DocServeClient:
         include_types: list[str] | None = None,
         generate_summaries: bool = False,
         force: bool = False,
-        allow_external: bool = False,
         injector_script: str | None = None,
         folder_metadata_file: str | None = None,
         dry_run: bool = False,
@@ -393,7 +406,6 @@ class DocServeClient:
             include_types: File type preset names (e.g., ["python", "docs"]).
             generate_summaries: Generate LLM summaries for code chunks.
             force: Bypass deduplication and force a new job.
-            allow_external: Allow paths outside the project directory.
             injector_script: Path to Python script exporting process_chunk().
             folder_metadata_file: Path to JSON file with static metadata.
             dry_run: Validate injector against sample chunks without indexing.
@@ -433,7 +445,7 @@ class DocServeClient:
             "POST",
             "/index/",
             json=body,
-            params={"force": force, "allow_external": allow_external},
+            params={"force": force},
         )
 
         return IndexResponse(

{agent_brain_cli-10.1.2 → agent_brain_cli-10.2.1}/agent_brain_cli/client/transport.py

@@ -17,7 +17,7 @@ from pathlib import Path
 
 import click
 
-from ..config import resolve_transport
+from ..config import resolve_api_key, resolve_transport
 from .api_client import DocServeClient
 
 
@@ -41,14 +41,20 @@ def open_client(ctx: click.Context, *, timeout: float = 30.0) -> DocServeClient:
         base_url_override=obj.get("base_url_override"),
         socket_path_override=obj.get("socket_path_override"),
     )
+    # Issue #179: resolve the API key alongside the transport so the same
+    # CLI invocation works against an authed and an unauthed server.
+    api_key = resolve_api_key()
     if obj.get("debug_transport"):
-        click.echo(f"[debug-transport] {transport} -> {target}", err=True)
+        auth_marker = "with X-API-Key" if api_key else "no auth"
+        click.echo(
+            f"[debug-transport] {transport} -> {target} ({auth_marker})", err=True
+        )
 
     if transport == "http":
-        return DocServeClient(base_url=target, timeout=timeout)
+        return DocServeClient(base_url=target, timeout=timeout, api_key=api_key)
 
     # UDS: import lazily so HTTP-only invocations don't pay the cost.
     from agent_brain_uds import make_client
 
     inner = make_client(socket_path=Path(target), timeout=timeout)
-    return DocServeClient.from_httpx(inner)
+    return DocServeClient.from_httpx(inner, api_key=api_key)

{agent_brain_cli-10.1.2 → agent_brain_cli-10.2.1}/agent_brain_cli/commands/index.py

@@ -79,11 +79,6 @@ console = Console()
     is_flag=True,
     help="Force re-indexing even if embedding provider has changed",
 )
-@click.option(
-    "--allow-external",
-    is_flag=True,
-    help="Allow indexing paths outside the project directory",
-)
 @click.option("--json", "json_output", is_flag=True, help="Output as JSON")
 @click.pass_context
 def index_command(
@@ -101,7 +96,6 @@ def index_command(
     exclude_patterns: str | None,
     generate_summaries: bool,
     force: bool,
-    allow_external: bool,
     json_output: bool,
 ) -> None:
     """Index documents from a folder.
@@ -149,7 +143,6 @@ def index_command(
                 exclude_patterns=exclude_patterns_list,
                 generate_summaries=generate_summaries,
                 force=force,
-                allow_external=allow_external,
             )
 
             if json_output:

{agent_brain_cli-10.1.2 → agent_brain_cli-10.2.1}/agent_brain_cli/commands/init.py

@@ -1,6 +1,7 @@
 """Init command for initializing an Agent Brain project."""
 
 import json
+import secrets
 from pathlib import Path
 
 import click
@@ -69,6 +70,14 @@ STATE_DIR_NAME = ".agent-brain"
     type=click.Path(file_okay=False, resolve_path=True),
     help="Custom state directory for index data (default: .agent-brain)",
 )
+@click.option(
+    "--no-api-key",
+    is_flag=True,
+    help=(
+        "Skip auto-generating an API key (Issue #179). Use for single-user "
+        "loopback dev when no auth is desired. Server still starts without auth."
+    ),
+)
 def init_command(
     path: str | None,
     host: str,
@@ -76,6 +85,7 @@ def init_command(
     force: bool,
     json_output: bool,
     state_dir: str | None,
+    no_api_key: bool,
 ) -> None:
     """Initialize a new Agent Brain project.
 
@@ -145,8 +155,21 @@ def init_command(
             config["port"] = port
             config["auto_port"] = False
 
-        # Write configuration
+        # Issue #179: auto-generate an API key so the server boots with auth
+        # by default. Stored in config.json (project-local); the `start`
+        # command exports it as AGENT_BRAIN_API_KEY for the server
+        # subprocess, and `resolve_api_key` reads it for the CLI side. Opt
+        # out with --no-api-key for single-user loopback workflows.
+        if not no_api_key:
+            config["api_key"] = secrets.token_urlsafe(32)
+
+        # Write configuration with mode 0o600 since it may carry a secret.
         config_path.write_text(json.dumps(config, indent=2))
+        try:
+            config_path.chmod(0o600)
+        except OSError:
+            # Best-effort; filesystems without POSIX modes (FAT) still work.
+            pass
 
         if json_output:
             click.echo(
@@ -162,12 +185,18 @@ def init_command(
                 )
             )
         else:
+            api_key_note = (
+                f"[bold]API Key:[/] generated ({config_path.name}, mode 0o600)"
+                if not no_api_key
+                else "[bold]API Key:[/] [yellow]disabled[/] (--no-api-key)"
+            )
             console.print(
                 Panel(
                     f"[green]Project initialized successfully![/]\n\n"
                     f"[bold]Project Root:[/] {project_root}\n"
                     f"[bold]State Directory:[/] {resolved_state_dir}\n"
-                    f"[bold]Configuration:[/] {config_path}",
+                    f"[bold]Configuration:[/] {config_path}\n"
+                    f"{api_key_note}",
                     title="Agent Brain Initialized",
                     border_style="green",
                 )

{agent_brain_cli-10.1.2 → agent_brain_cli-10.2.1}/agent_brain_cli/commands/inject.py

@@ -98,11 +98,6 @@ console = Console()
     is_flag=True,
     help="Force re-indexing even if embedding provider has changed",
 )
-@click.option(
-    "--allow-external",
-    is_flag=True,
-    help="Allow indexing paths outside the project directory",
-)
 @click.option("--json", "json_output", is_flag=True, help="Output as JSON")
 @click.pass_context
 def inject_command(
@@ -123,7 +118,6 @@ def inject_command(
     exclude_patterns: str | None,
     generate_summaries: bool,
     force: bool,
-    allow_external: bool,
     json_output: bool,
 ) -> None:
     """Index documents from a folder with content injection.
@@ -199,7 +193,6 @@ def inject_command(
                 exclude_patterns=exclude_patterns_list,
                 generate_summaries=generate_summaries,
                 force=force,
-                allow_external=allow_external,
                 injector_script=resolved_script,
                 folder_metadata_file=resolved_metadata,
                 dry_run=dry_run,
@@ -272,4 +265,15 @@ def inject_command(
                     "\n[dim]A conflict occurred. "
                     "Check 'agent-brain jobs' for queue status.[/]"
                 )
+            elif e.status_code == 403:
+                # Injector allowlist rejected the script (issue #181).
+                console.print(
+                    "\n[dim]Injector scripts must be allowlisted in "
+                    "[bold].agent-brain/config.yaml[/] before they can run on "
+                    "the server. Add an entry under [bold]injector_scripts:[/] "
+                    "with the script's path and the sha256 of its contents "
+                    "(run [bold]sha256sum <script>[/] to get the hash). "
+                    "See docs/USER_GUIDE.md 'Content Injection' for the full "
+                    "schema.[/]"
+                )
         raise SystemExit(1) from e

{agent_brain_cli-10.1.2 → agent_brain_cli-10.2.1}/agent_brain_cli/commands/start.py

@@ -368,6 +368,12 @@ def start_command(
         env = os.environ.copy()
         env["AGENT_BRAIN_PROJECT_ROOT"] = str(project_root)
         env["AGENT_BRAIN_STATE_DIR"] = str(state_dir)
+        # Issue #179: propagate the project-local API key from config.json
+        # into the server subprocess. Existing env value wins so operators
+        # can override the file-stored key without re-running init.
+        config_api_key = config.get("api_key")
+        if config_api_key and not env.get("AGENT_BRAIN_API_KEY"):
+            env["AGENT_BRAIN_API_KEY"] = str(config_api_key)
         if strict:
             env["AGENT_BRAIN_STRICT_MODE"] = "true"
         if enable_uds:

{agent_brain_cli-10.1.2 → agent_brain_cli-10.2.1}/agent_brain_cli/config.py

@@ -414,6 +414,58 @@ def get_server_url(config: AgentBrainConfig | None = None) -> str:
     return config.server.url
 
 
+def resolve_api_key(state_dir: Path | None = None) -> str | None:
+    """Resolve the X-API-Key value the CLI should send (Issue #179).
+
+    Precedence (first non-empty wins):
+      1. ``AGENT_BRAIN_API_KEY`` environment variable
+      2. ``runtime.json::api_key`` for the resolved state directory
+         (set by the running server)
+      3. ``config.json::api_key`` for the resolved state directory
+         (set by ``agent-brain init``, used when the server hasn't
+         started yet)
+
+    Returns ``None`` when no source provides a value, which is the
+    correct behavior for a server running in default no-auth loopback
+    mode — the client sends no header and the server's no-op dependency
+    accepts the request.
+
+    Args:
+        state_dir: Optional state directory to read from. Defaults to
+            ``get_state_dir()`` so callers in CLI commands don't need
+            to thread the path through.
+
+    Returns:
+        The resolved API key or ``None``.
+    """
+    import json
+
+    env_key = os.getenv("AGENT_BRAIN_API_KEY")
+    if env_key:
+        return env_key
+
+    if state_dir is None:
+        try:
+            state_dir = get_state_dir()
+        except Exception:
+            return None
+
+    for filename in ("runtime.json", "config.json"):
+        candidate = state_dir / filename
+        if not candidate.exists():
+            continue
+        try:
+            with open(candidate) as f:
+                payload = json.load(f)
+        except (json.JSONDecodeError, OSError):
+            continue
+        api_key = payload.get("api_key")
+        if api_key:
+            return str(api_key)
+
+    return None
+
+
 def resolve_transport(
     *,
     transport_hint: str | None = None,

{agent_brain_cli-10.1.2 → agent_brain_cli-10.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "agent-brain-cli"
-version = "10.1.2"
+version = "10.2.1"
 description = "Agent Brain CLI - Command-line interface for managing AI agent memory and knowledge retrieval"
 authors = ["Spillwave Solutions"]
 readme = "README.md"
@@ -27,8 +27,8 @@ httpx = "^0.28.0"
 rich = "^13.9.0"
 pyyaml = "^6.0.0"
 pydantic = "^2.10.0"
-agent-brain-rag = "^10.1.0"
-agent-brain-uds = "^10.1.0"
+agent-brain-rag = "^10.2.1"
+agent-brain-uds = "^10.2.1"
 
 [tool.poetry.group.dev.dependencies]
 pytest = "^8.3.0"