asher-cli 1.4.1__tar.gz → 1.5.0__tar.gz

{asher_cli-1.4.1 → asher_cli-1.5.0}/.github/workflows/bandit.yml

@@ -37,7 +37,7 @@ jobs:
         # --exit-zero: findings must not fail the job, or the upload step below
         # is skipped and code scanning keeps showing the previous run's alerts.
         run: >-
-          uvx --from 'bandit[toml,sarif]' bandit
+          uvx --from 'bandit[toml,sarif]==1.9.4' bandit
           -c pyproject.toml -r . -f sarif -o bandit.sarif --exit-zero
 
       - name: Upload SARIF to code scanning

{asher_cli-1.4.1 → asher_cli-1.5.0}/.github/workflows/release.yml

@@ -6,8 +6,7 @@ on:
       - "release/*"
 
 permissions:
-  contents: write  # needed to create GitHub Releases
-  id-token: write  # needed for PyPI OIDC trusted publishing
+  contents: read
 
 jobs:
   build:
@@ -32,6 +31,8 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     environment: pypi
+    permissions:
+      id-token: write  # needed for PyPI OIDC trusted publishing
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
@@ -43,6 +44,8 @@ jobs:
     name: Create GitHub Release
     needs: [build, publish]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # needed to create GitHub Releases
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8

{asher_cli-1.4.1 → asher_cli-1.5.0}/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 Generated by [git-cliff](https://git-cliff.org) from conventional commits.
 
+## [1.5.0] - 2026-10-03
+
+### 🛡️ Security
+
+- *(mcp)* Cap `mcp<2` when `/mcp on` installs the extra
+- *(mcp)* Don't overwrite a `claude_desktop_config.json` that can't be parsed
+- *(ci)* Scope release token permissions to the jobs that need them
+- *(ci)* Pin bandit to 1.9.4
+
 ## [1.4.1] - 2026-10-01
 
 ### 🐛 Bug Fixes

{asher_cli-1.4.1 → asher_cli-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: asher-cli
-Version: 1.4.1
+Version: 1.5.0
 Summary: Terminal dashboard for Litter Robot (LR3/LR4/LR5) via the Whisker cloud API
 Project-URL: Homepage, https://github.com/karanshukla/asher-cli
 Project-URL: Repository, https://github.com/karanshukla/asher-cli

{asher_cli-1.4.1 → asher_cli-1.5.0}/asher/mcp/config.py

@@ -11,6 +11,10 @@ from pathlib import Path
 _SERVER_NAME = "Asher CLI MCP Bridge"
 
 
+class McpConfigError(Exception):
+    """A Claude Desktop config file exists but can't be read as a JSON object."""
+
+
 def mcp_extra_installed() -> bool:
     """Whether pylitterbot's mcp extra (the third-party `mcp` SDK) is importable."""
     return importlib.util.find_spec("mcp") is not None
@@ -60,10 +64,12 @@ def _load(path: Path) -> dict:
     if not path.exists():
         return {}
     try:
-        data: dict = json.loads(path.read_text(encoding="utf-8"))
-        return data
-    except (json.JSONDecodeError, OSError):
-        return {}
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, OSError) as e:
+        raise McpConfigError(f"Can't read {path}: {e}") from e
+    if not isinstance(data, dict):
+        raise McpConfigError(f"Can't read {path}: not a JSON object")
+    return data
 
 
 def _save(path: Path, data: dict) -> None:
@@ -74,12 +80,13 @@ def _save(path: Path, data: dict) -> None:
 def set_mcp_enabled(enabled: bool) -> list[Path]:
     """Add or remove the MCP server entry in every known config location.
 
-    Returns the list of config paths actually written.
+    Returns the list of config paths actually written. Raises McpConfigError,
+    before writing anything, if any existing config can't be read.
     """
     touched: list[Path] = []
+    configs = [(path, _load(path)) for path in config_paths()]
 
-    for path in config_paths():
-        data = _load(path)
+    for path, data in configs:
         servers = data.setdefault("mcpServers", {})
 
         if enabled:
@@ -101,7 +108,9 @@ def mcp_status() -> list[tuple[Path, bool]]:
     """Return (path, enabled) for every known Claude Desktop config location."""
     result = []
     for path in config_paths():
-        data = _load(path)
-        enabled = _SERVER_NAME in data.get("mcpServers", {})
+        try:
+            enabled = _SERVER_NAME in _load(path).get("mcpServers", {})
+        except McpConfigError:
+            enabled = False
         result.append((path, enabled))
     return result

{asher_cli-1.4.1 → asher_cli-1.5.0}/asher/tui/commands/slash.py

@@ -439,14 +439,15 @@ async def _ensure_mcp_extra(app: AsherApp) -> bool:
     if mcp_extra_installed():
         return True
 
-    pin = f"pylitterbot[mcp]=={pkg_version('pylitterbot')}"
-    app._log_info(f"Installing {pin}…")
+    # Same requirements as the `mcp` extra in pyproject.toml, cap included.
+    requirements = [f"pylitterbot[mcp]=={pkg_version('pylitterbot')}", "mcp<2"]
+    app._log_info(f"Installing {' '.join(requirements)}…")
     proc = await asyncio.create_subprocess_exec(
         sys.executable,
         "-m",
         "pip",
         "install",
-        pin,
+        *requirements,
         stdout=asyncio.subprocess.PIPE,
         stderr=asyncio.subprocess.STDOUT,
     )
@@ -458,7 +459,8 @@ async def _ensure_mcp_extra(app: AsherApp) -> bool:
     app._log_err("Failed to install pylitterbot[mcp]:")
     for line in output.splitlines()[-10:]:
         app._log_err(f"  {line}")
-    app._log_info(f"Try manually: {sys.executable} -m pip install '{pin}'")
+    quoted = " ".join(f"'{r}'" for r in requirements)
+    app._log_info(f"Try manually: {sys.executable} -m pip install {quoted}")
     return False
 
 
@@ -467,7 +469,7 @@ class McpCommand(SlashCommand):
     description = "on|off|status  Litter-Robot MCP server for Claude Desktop"
 
     async def run(self, app: AsherApp, args: list[str]) -> None:
-        from ...mcp.config import mcp_status, set_mcp_enabled  # noqa: PLC0415
+        from ...mcp.config import McpConfigError, mcp_status, set_mcp_enabled  # noqa: PLC0415
 
         sub = args[0].lower() if args else "status"
         if sub not in ("on", "off", "status"):
@@ -507,9 +509,12 @@ class McpCommand(SlashCommand):
                 return
             if not await _ensure_mcp_extra(app):
                 return
-            touched = set_mcp_enabled(True)
-        else:
-            touched = set_mcp_enabled(False)
+
+        try:
+            touched = set_mcp_enabled(sub == "on")
+        except McpConfigError as e:
+            app._log_err(f"{e}. Nothing was changed.")
+            return
 
         verb = "enabled" if sub == "on" else "disabled"
         if touched:

{asher_cli-1.4.1 → asher_cli-1.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "asher-cli"
-version = "1.4.1"
+version = "1.5.0"
 description = "Terminal dashboard for Litter Robot (LR3/LR4/LR5) via the Whisker cloud API"
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -29,7 +29,8 @@ dependencies = [
 [project.optional-dependencies]
 # pylitterbot asks for mcp[cli]>=1.0.0 with no upper bound, but its server does
 # `from mcp.server.fastmcp import FastMCP`, and mcp 2.0 deleted that module.
-# Cap it here until pylitterbot ships a 2.x-compatible release.
+# Cap it here, and in _ensure_mcp_extra (tui/commands/slash.py), until
+# pylitterbot ships a 2.x-compatible release.
 mcp = ["pylitterbot[mcp]==2025.6.6", "mcp<2"]
 # PyGObject is what puts pystray on its AppIndicator backend. Without it pystray
 # silently falls back to a legacy XEmbed icon, which KDE Plasma and GNOME no
@@ -81,7 +82,7 @@ lint   = "ruff check ."
 fmt    = "ruff format --check ."
 types  = "mypy asher/ --ignore-missing-imports"
 test   = "pytest tests/ -v --tb=short"
-security.cmd = "uvx --from bandit[toml] bandit -c pyproject.toml -r ."
+security.cmd = "uvx --from bandit[toml]==1.9.4 bandit -c pyproject.toml -r ."
 security.help = "run the same Bandit scan as the Bandit workflow"
 fix.sequence = [{cmd = "ruff check --fix ."}, {cmd = "ruff format ."}]
 dev    = "textual run --dev asher/__main__.py"
@@ -131,7 +132,7 @@ ignore_missing_imports = true  # pylitterbot and textual have incomplete stubs
 # ── bump-my-version ───────────────────────────────────────────────────────────
 
 [tool.bumpversion]
-current_version = "1.4.1"
+current_version = "1.5.0"
 commit = true
 tag = true
 tag_name = "v{new_version}"

{asher_cli-1.4.1 → asher_cli-1.5.0}/tests/test_mcp_command.py

@@ -7,6 +7,7 @@ from unittest.mock import MagicMock, patch
 
 import pytest
 
+from asher.mcp.config import McpConfigError
 from asher.tui.commands.slash import McpCommand
 
 
@@ -81,10 +82,11 @@ class TestMcpCommand:
         with (
             patch("asher.core.credentials.load", return_value=("a@b.com", "pw")),
             patch("asher.mcp.config.mcp_extra_installed", return_value=False),
-            patch("asyncio.create_subprocess_exec", return_value=proc),
+            patch("asyncio.create_subprocess_exec", return_value=proc) as mock_exec,
             patch("asher.mcp.config.set_mcp_enabled", return_value=[Path("x")]) as mock_set,
         ):
             await McpCommand().run(app, ["on"])
+        assert "mcp<2" in mock_exec.call_args.args
         mock_set.assert_called_once_with(True)
 
     async def test_on_skips_enabling_when_install_fails(self, app):
@@ -107,6 +109,12 @@ class TestMcpCommand:
         mock_set.assert_called_once_with(False)
         app._log_ok.assert_called_once()
 
+    async def test_off_reports_an_unreadable_config_instead_of_writing(self, app):
+        with patch("asher.mcp.config.set_mcp_enabled", side_effect=McpConfigError("Can't read x")):
+            await McpCommand().run(app, ["off"])
+        app._log_err.assert_called_once()
+        app._log_ok.assert_not_called()
+
     async def test_off_when_already_disabled_logs_info_not_ok(self, app):
         with patch("asher.mcp.config.set_mcp_enabled", return_value=[]):
             await McpCommand().run(app, ["off"])

{asher_cli-1.4.1 → asher_cli-1.5.0}/tests/test_mcp_config.py

@@ -5,7 +5,15 @@ from __future__ import annotations
 import json
 from unittest.mock import patch
 
-from asher.mcp.config import _SERVER_NAME, config_paths, mcp_status, set_mcp_enabled
+import pytest
+
+from asher.mcp.config import (
+    _SERVER_NAME,
+    McpConfigError,
+    config_paths,
+    mcp_status,
+    set_mcp_enabled,
+)
 
 
 class TestSetMcpEnabled:
@@ -45,13 +53,28 @@ class TestSetMcpEnabled:
         assert touched == []
         assert not path.exists()
 
-    def test_handles_corrupt_config_file(self, tmp_path):
+    @pytest.mark.parametrize("content", ["{not valid json", "[]"])
+    def test_refuses_to_overwrite_an_unreadable_config(self, tmp_path, content):
         path = tmp_path / "claude_desktop_config.json"
-        path.write_text("{not valid json", encoding="utf-8")
-        with patch("asher.mcp.config.config_paths", return_value=[path]):
+        path.write_text(content, encoding="utf-8")
+        with (
+            patch("asher.mcp.config.config_paths", return_value=[path]),
+            pytest.raises(McpConfigError),
+        ):
             set_mcp_enabled(True)
-        data = json.loads(path.read_text(encoding="utf-8"))
-        assert _SERVER_NAME in data["mcpServers"]
+        assert path.read_text(encoding="utf-8") == content
+
+    def test_writes_no_location_when_any_is_unreadable(self, tmp_path):
+        good = tmp_path / "good" / "claude_desktop_config.json"
+        bad = tmp_path / "bad" / "claude_desktop_config.json"
+        bad.parent.mkdir()
+        bad.write_text("{not valid json", encoding="utf-8")
+        with (
+            patch("asher.mcp.config.config_paths", return_value=[good, bad]),
+            pytest.raises(McpConfigError),
+        ):
+            set_mcp_enabled(True)
+        assert not good.exists()
 
     def test_enables_across_multiple_locations(self, tmp_path):
         standard = tmp_path / "standard" / "claude_desktop_config.json"
@@ -80,6 +103,13 @@ class TestMcpStatus:
             result = mcp_status()
         assert result == [(path, True)]
 
+    def test_reports_disabled_for_an_unreadable_config(self, tmp_path):
+        path = tmp_path / "claude_desktop_config.json"
+        path.write_text("{not valid json", encoding="utf-8")
+        with patch("asher.mcp.config.config_paths", return_value=[path]):
+            result = mcp_status()
+        assert result == [(path, False)]
+
 
 class TestConfigPaths:
     def test_windows_includes_msix_package_when_present(self, tmp_path, monkeypatch):

{asher_cli-1.4.1 → asher_cli-1.5.0}/uv.lock

@@ -219,7 +219,7 @@ wheels = [
 
 [[package]]
 name = "asher-cli"
-version = "1.4.1"
+version = "1.5.0"
 source = { editable = "." }
 dependencies = [
     { name = "keyring" },