asher-cli 1.0.1__tar.gz → 1.0.2__tar.gz

asher_cli-1.0.2/.github/workflows/bandit.yml

@@ -0,0 +1,47 @@
+# Bandit is a security linter for Python, by PyCQA (Apache v2.0).
+# https://pypi.org/project/bandit/
+#
+# Results land under the repository's Security → Code scanning tab.
+#
+# Scan configuration — which paths are excluded, which checks are skipped and
+# why — lives in [tool.bandit] in pyproject.toml, so `uv run poe security`
+# reproduces this job's findings locally.
+
+name: Bandit
+
+on:
+  push:
+    branches: ["main", "release/*"]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: ["main"]
+  schedule:
+    - cron: '32 0 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  bandit:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
+      - name: Bandit scan
+        # --exit-zero: findings must not fail the job, or the upload step below
+        # is skipped and code scanning keeps showing the previous run's alerts.
+        run: >-
+          uvx --from 'bandit[toml,sarif]' bandit
+          -c pyproject.toml -r . -f sarif -o bandit.sarif --exit-zero
+
+      - name: Upload SARIF to code scanning
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          sarif_file: bandit.sarif
+          category: bandit

{asher_cli-1.0.1 → asher_cli-1.0.2}/CHANGELOG.md

@@ -7,12 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 Generated by [git-cliff](https://git-cliff.org) from conventional commits.
 
+## [1.0.2] - 2026-08-05
+
+### 🐛 Bug Fixes
+
+- Silence bandit noise and resolve dependency advisories
+
+### 🔧 Miscellaneous
+
+- Enable Bandit B101 for asher/ and bump version to 1.0.2
+
 ## [1.0.1] - 2026-08-04
 
 ### 🚀 Features
 
 - *(history)* Copy-to-clipboard + discoverable footer hints
 
+### 📚 Documentation
+
+- *(changelog)* Cut v1.0.1
+
 ## [1.0.0] - 2026-08-02
 
 ### 🚀 Features

{asher_cli-1.0.1 → asher_cli-1.0.2}/CLAUDE.md

@@ -81,6 +81,7 @@ tests/
 
 .github/workflows/
   ci.yml            ruff + mypy + pytest on every push/PR
+  bandit.yml        bandit security scan → SARIF → code scanning (config: [tool.bandit] in pyproject.toml)
 ```
 
 ## Credentials
@@ -196,6 +197,7 @@ Don't add comments above functions or inline unless the WHY is genuinely non-obv
 - All command execution runs in `@work` async workers to keep the UI responsive
 - Cat modes: `idle`, `happy`, `cleaning` (animated), `sleeping`, `error`, `full`
 - `VERSION` is read from `importlib.metadata.version("asher-cli")` — falls back to `"dev"` when running from source
+- **No `assert` in `asher/`** — Bandit enforces this (B101 is enabled; only `tests/` is exempt, via `exclude_dirs`). For a `requires_robot` command, narrow with `if app._robot is None: return` rather than an assert: `_dispatch_command` already rejects the disconnected case, and unlike `assert` the guard survives `python -O`
 - The primary login path is the inline flow in `login_flow.py` (`LoginFlow` state machine: `IDLE` → `AWAITING_EMAIL` → `AWAITING_PASSWORD`). `LoginScreen` (`auth.py`) still exists as a modal but is not used in the current main flow.
 - `LoginScreen` uses `event.stop()` on `Input.Submitted` and `Button.Pressed` to prevent bubbling to the App's `on_input_submitted` (relevant if re-activating the modal path)
 
@@ -226,6 +228,7 @@ uv run poe watch         # run with Python auto-restart on file change (watchfil
 uv run poe test          # run test suite
 uv run poe check         # ruff + mypy + pytest (same as CI)
 uv run poe fix           # auto-fix ruff issues
+uv run poe security      # bandit scan (same config the Bandit workflow uses)
 ```
 
 Pre-push hook (`.githooks/pre-push`) runs: ruff check → ruff format --check → mypy. Tests are not in the hook — run them manually.

{asher_cli-1.0.1 → asher_cli-1.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: asher-cli
-Version: 1.0.1
+Version: 1.0.2
 Summary: Terminal dashboard for Litter Robot (LR3/LR4/LR5) via the Whisker cloud API
 Project-URL: Homepage, https://github.com/karanshukla/asher-cli
 Project-URL: Repository, https://github.com/karanshukla/asher-cli
@@ -339,6 +339,16 @@ uv run poe types   # mypy
 uv run poe check   # run all of the above + tests (same as CI)
 ```
 
+### 6. Security scan
+
+```bash
+uv run poe security # bandit, same config the Bandit workflow uses
+```
+
+Scan settings live in `[tool.bandit]` in `pyproject.toml`, so local runs and the
+Bandit workflow report identical findings. Results from `main` and pull requests
+are published to the repository's **Security → Code scanning** tab.
+
 CI runs on Python 3.10 / 3.11 / 3.12 across Ubuntu, Windows, and macOS on every push.
 
 ## Changelog

{asher_cli-1.0.1 → asher_cli-1.0.2}/README.md

@@ -288,6 +288,16 @@ uv run poe types   # mypy
 uv run poe check   # run all of the above + tests (same as CI)
 ```
 
+### 6. Security scan
+
+```bash
+uv run poe security # bandit, same config the Bandit workflow uses
+```
+
+Scan settings live in `[tool.bandit]` in `pyproject.toml`, so local runs and the
+Bandit workflow report identical findings. Results from `main` and pull requests
+are published to the repository's **Security → Code scanning** tab.
+
 CI runs on Python 3.10 / 3.11 / 3.12 across Ubuntu, Windows, and macOS on every push.
 
 ## Changelog

{asher_cli-1.0.1 → asher_cli-1.0.2}/asher/commands/__init__.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import asyncio
 import contextlib
 import os
+import shutil
 import subprocess
 import sys
 from datetime import time
@@ -121,7 +122,8 @@ class CleanCommand(Command):
     requires_robot = True
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._robot is not None
+        if app._robot is None:
+            return
         app._set_cat("cleaning", "cleaning…")
 
         done: asyncio.Event = asyncio.Event()
@@ -169,7 +171,8 @@ class StatusCommand(Command):
     requires_robot = True
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._robot is not None
+        if app._robot is None:
+            return
         try:
             await app._robot.refresh()
             await app._refresh_status()
@@ -178,12 +181,10 @@ class StatusCommand(Command):
             return
         r = app._robot
         weight = "—"
-        try:
+        with contextlib.suppress(Exception):
             w = getattr(r, "pet_weight", None)
             if w is not None and float(w) > 0:
                 weight = f"{float(w):.1f} lb"
-        except Exception:
-            pass
         last_seen = getattr(app, "_last_cat_seen", None) or getattr(r, "last_seen", None)
         rows = [
             ("Online", "yes" if getattr(r, "is_online", False) else "no"),
@@ -206,7 +207,8 @@ class InfoCommand(Command):
     requires_robot = True
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._robot is not None
+        if app._robot is None:
+            return
         try:
             await app._robot.refresh()
         except Exception as exc:
@@ -267,7 +269,8 @@ class LockCommand(Command):
         return "lock / unlock"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._adapter is not None
+        if app._adapter is None:
+            return
         ok, msg = await app._adapter.set_panel_lockout(True)
         if ok:
             app.query_one("#lock-lbl", Static).update(Text("⊘ Locked", style="bold #d29922"))
@@ -286,7 +289,8 @@ class UnlockCommand(Command):
         return "lock / unlock"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._adapter is not None
+        if app._adapter is None:
+            return
         ok, msg = await app._adapter.set_panel_lockout(False)
         if ok:
             app.query_one("#lock-lbl", Static).update(Text("□ Unlocked", style="#484f58"))
@@ -305,7 +309,8 @@ class SleepCommand(Command):
         return "sleep / wake"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._adapter is not None
+        if app._adapter is None:
+            return
         ok, msg = await app._adapter.set_sleep(True)
         if ok:
             app._log_ok(msg)
@@ -327,7 +332,8 @@ class WakeCommand(Command):
         return "sleep / wake"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._adapter is not None
+        if app._adapter is None:
+            return
         ok, msg = await app._adapter.set_sleep(False)
         if ok:
             app._log_ok(msg)
@@ -350,7 +356,8 @@ class NightLightCommand(Command):
         return "night-light on|off|auto"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._adapter is not None
+        if app._adapter is None:
+            return
         arg = args[0].lower() if args else ""
         if arg not in ("on", "off", "auto"):
             app._log_warn("Usage: night-light on|off|auto")
@@ -380,7 +387,8 @@ class NightLightBrightnessCommand(Command):
         return "night-light-brightness"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._adapter is not None
+        if app._adapter is None:
+            return
         if not args or not args[0].isdigit():
             app._log_warn("Usage: night-light-brightness <level>")
             return
@@ -416,7 +424,8 @@ class PanelBrightnessCommand(Command):
     requires_robot = True
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._adapter is not None
+        if app._adapter is None:
+            return
         if not args:
             current = getattr(app._robot, "panel_brightness", None)
             app._log_info(f"Usage: panel-brightness <low|medium|high>  (current: {current or '—'})")
@@ -435,7 +444,8 @@ class HistoryCommand(Command):
     requires_robot = True
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._robot is not None
+        if app._robot is None:
+            return
         raw = args[0].lower() if args else ""
         if raw in ("all", "max"):
             limit = 500
@@ -467,7 +477,8 @@ class WaitTimeCommand(Command):
         return "wait-time <minutes>"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._robot is not None
+        if app._robot is None:
+            return
         valid = sorted(getattr(app._robot, "VALID_WAIT_TIMES", []))
         if not args or not args[0].isdigit():
             current = getattr(app._robot, "clean_cycle_wait_time_minutes", "?")
@@ -508,7 +519,8 @@ class PowerCommand(Command):
         return "power on|off"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._robot is not None
+        if app._robot is None:
+            return
         arg = args[0].lower() if args else ""
         if arg not in ("on", "off"):
             app._log_warn("Usage: power on|off")
@@ -536,7 +548,8 @@ class RenameCommand(Command):
         return "rename <name>"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._robot is not None
+        if app._robot is None:
+            return
         if not args:
             app._log_warn(f"Usage: rename <new name>  (current: {app._robot.name})")
             return
@@ -563,7 +576,8 @@ class InsightCommand(Command):
     requires_robot = True
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._robot is not None
+        if app._robot is None:
+            return
         raw = args[0].lower() if args else "30"
         if raw == "month":
             days = 30
@@ -618,6 +632,19 @@ def _dow_to_weekday(day: int) -> int:
     return (day - 1) % 7
 
 
+def _parse_sleep_day(day: Any) -> tuple[int, bool, object, object] | None:
+    """Read one schedule day, or None when the API returns a shape we can't read."""
+    try:
+        return (
+            _dow_to_weekday(int(getattr(day, "day", 0))),
+            bool(getattr(day, "is_enabled", False)),
+            getattr(day, "sleep_time", None),
+            getattr(day, "wake_time", None),
+        )
+    except Exception:
+        return None
+
+
 class SleepScheduleCommand(Command):
     name = "sleep-schedule"
     aliases = ("sleepschedule",)
@@ -629,7 +656,8 @@ class SleepScheduleCommand(Command):
         return "sleep-schedule"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._robot is not None
+        if app._robot is None:
+            return
         try:
             schedule = getattr(app._robot, "sleep_schedule", None)
         except Exception as exc:
@@ -663,23 +691,18 @@ class SleepScheduleCommand(Command):
         log = app.query_one("#log", RichLog)
         active_day_indices = set()
         if window is not None:
-            try:
+            with contextlib.suppress(Exception):
                 start_dt, end_dt = window
                 # Sleep windows can wrap past midnight, so flag both the start
                 # and end day as "active now" for the user-facing marker.
                 active_day_indices.add(start_dt.weekday())
                 active_day_indices.add(end_dt.weekday())
-            except Exception:
-                pass
 
         for day in days:
-            try:
-                idx = _dow_to_weekday(int(getattr(day, "day", 0)))
-                day_enabled = bool(getattr(day, "is_enabled", False))
-                sleep_t = getattr(day, "sleep_time", None)
-                wake_t = getattr(day, "wake_time", None)
-            except Exception:
+            parsed = _parse_sleep_day(day)
+            if parsed is None:
                 continue
+            idx, day_enabled, sleep_t, wake_t = parsed
 
             name = _DAY_NAMES[idx]
             t = Text()
@@ -712,7 +735,8 @@ class PrivacyCommand(Command):
         return "privacy on|off"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._adapter is not None
+        if app._adapter is None:
+            return
         arg = args[0].lower() if args else ""
         if arg not in ("on", "off"):
             app._log_warn("Usage: privacy on|off")
@@ -735,7 +759,8 @@ class VolumeCommand(Command):
         return "volume <0-100>"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._adapter is not None
+        if app._adapter is None:
+            return
         if not args or not args[0].lstrip("-").isdigit():
             current = getattr(app._robot, "sound_volume", None)
             extra = f"  (current: {current})" if current is not None else ""
@@ -760,7 +785,8 @@ class CameraAudioCommand(Command):
         return "camera-audio on|off"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._adapter is not None
+        if app._adapter is None:
+            return
         arg = args[0].lower() if args else ""
         if arg not in ("on", "off"):
             app._log_warn("Usage: camera-audio on|off")
@@ -784,7 +810,8 @@ class DrawerResetCommand(Command):
         return "drawer-reset"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        assert app._adapter is not None
+        if app._adapter is None:
+            return
         ok, msg = await app._adapter.reset_waste_drawer()
         if ok:
             app._log_ok(msg)
@@ -1287,15 +1314,19 @@ class VersionCommand(SlashCommand):
 
 def _open_folder(path: Path) -> None:
     if sys.platform == "win32":
-        subprocess.Popen(["explorer", "/select,", str(path)])
+        argv = ["explorer", "/select,", str(path)]
     elif sys.platform == "darwin":
-        subprocess.Popen(["open", "-R", str(path)])
+        argv = ["open", "-R", str(path)]
     else:
-        subprocess.Popen(["xdg-open", str(path.parent)])
+        argv = ["xdg-open", str(path.parent)]
+
+    argv[0] = shutil.which(argv[0]) or argv[0]
+    subprocess.Popen(argv)  # nosec B603 # fixed argv, no shell, path is not user-controlled
 
 
 async def _run_export(app: AsherApp, days: int) -> None:
-    assert app._robot is not None
+    if app._robot is None:
+        return
     dest = resolve_dest(app._robot, None)
     app._log_info(f"Fetching history (last {days} days)…")
     try:

{asher_cli-1.0.1 → asher_cli-1.0.2}/asher/mcp_bridge.py

@@ -33,7 +33,9 @@ def main() -> None:
     env["LITTER_ROBOT_USERNAME"] = email
     env["LITTER_ROBOT_PASSWORD"] = password
 
-    result = subprocess.run([sys.executable, "-m", "pylitterbot.mcp"], env=env, check=False)
+    result = subprocess.run(  # nosec B603 # fixed argv on this interpreter, no shell
+        [sys.executable, "-m", "pylitterbot.mcp"], env=env, check=False
+    )
     sys.exit(result.returncode)
 
 

{asher_cli-1.0.1 → asher_cli-1.0.2}/asher/monitoring/__init__.py

@@ -42,11 +42,9 @@ class MonitoringMixin:
 
         if self._robot is None:
             return
-        try:
+        with contextlib.suppress(Exception):
             self._robot.on(EVENT_UPDATE, self._on_robot_update)
             await self._robot.subscribe()
-        except Exception:
-            pass
 
     def _on_robot_update(self) -> None:
         """Sync callback fired by pylitterbot when robot state changes via WebSocket."""
@@ -62,7 +60,7 @@ class MonitoringMixin:
         """Cache the timestamp of the most recent cat-detection event from activity history."""
         if self._robot is None:
             return
-        try:
+        with contextlib.suppress(Exception):
             acts = await self._robot.get_activity_history(limit=50)
             for act in acts:
                 if getattr(act, "action", None) == LitterBoxStatus.CAT_DETECTED:
@@ -70,8 +68,6 @@ class MonitoringMixin:
                     if ts_dt is not None:
                         self._last_cat_seen = ts_dt
                         return
-        except Exception:
-            pass
 
     async def _refresh_status(self) -> None:
         r = self._robot
@@ -85,12 +81,10 @@ class MonitoringMixin:
         last_seen = self._last_cat_seen or getattr(r, "last_seen", None)
 
         weight_val = "—"
-        try:
+        with contextlib.suppress(Exception):
             w = getattr(r, "pet_weight", None)
             if w is not None and float(w) > 0:
                 weight_val = f"{float(w):.1f} lb"
-        except Exception:
-            pass
 
         active_pet_idx = getattr(self, "_active_pet_idx", 0)
         pet = (
@@ -327,9 +321,7 @@ class MonitoringMixin:
     async def _poll_status_interval(self) -> None:
         if self._robot is None:
             return
-        try:
+        with contextlib.suppress(Exception):
             await self._robot.refresh()
             await self._update_last_cat_seen()
             await self._refresh_status()
-        except Exception:
-            pass

{asher_cli-1.0.1 → asher_cli-1.0.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "asher-cli"
-version = "1.0.1"
+version = "1.0.2"
 description = "Terminal dashboard for Litter Robot (LR3/LR4/LR5) via the Whisker cloud API"
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -58,6 +58,8 @@ lint   = "ruff check ."
 fmt    = "ruff format --check ."
 types  = "mypy asher/ --ignore-missing-imports"
 test   = "pytest tests/ -v --tb=short"
+security.cmd = "uvx --from bandit[toml] bandit -c pyproject.toml -r ."
+security.help = "run the same Bandit scan as the Bandit workflow"
 fix.sequence = [{cmd = "ruff check --fix ."}, {cmd = "ruff format ."}]
 dev    = "textual run --dev asher/__main__.py"
 watch  = "python watchrun.py"
@@ -100,7 +102,7 @@ exclude = ["asher/slash-commands"]
 # ── bump-my-version ───────────────────────────────────────────────────────────
 
 [tool.bumpversion]
-current_version = "1.0.1"
+current_version = "1.0.2"
 commit = true
 tag = true
 tag_name = "v{new_version}"
@@ -111,6 +113,21 @@ filename = "pyproject.toml"
 search = 'version = "{current_version}"'
 replace = 'version = "{new_version}"'
 
+# ── Bandit ────────────────────────────────────────────────────────────────────
+
+# Read with `bandit -c pyproject.toml` (needs the `toml` extra). The GitHub
+# Bandit workflow passes the same flag so CI and local runs agree.
+# B101 (assert_used) stays enabled for asher/. `tests` is excluded from the scan
+# entirely, so pytest's asserts never reach it — a hit therefore means a real
+# assert in shipped code, where -O would strip it.
+[tool.bandit]
+exclude_dirs = ["tests", ".venv", ".git", "build", "dist"]
+skips = [
+    # blacklist — flags the `import subprocess` line itself. Each call site is
+    # reviewed individually by B602-B607.
+    "B404",
+]
+
 # ── Pytest ────────────────────────────────────────────────────────────────────
 
 [tool.pytest.ini_options]