beakr-cli 0.3.1__tar.gz → 0.3.3__tar.gz

beakr_cli-0.3.3/CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+## 0.3.3 (2026-10-14)
+
+Security fix. Upgrade with `beakr update` or `uv tool upgrade beakr-cli`.
+
+- The API key saved by `beakr auth login` and `beakr install` lives in
+  `~/.beakr/config.json`. Earlier releases created `~/.beakr` and that file
+  with default permissions (usually readable by every user on the machine).
+  0.3.3 creates the directory `0700` and the file `0600`, writes the file
+  atomically so the key is never briefly readable, and tightens a directory and
+  file an earlier release created the first time it reads them.
+- No other behavior changes; 0.3.3 talks to the same API as 0.3.2.
+
+If other people have accounts on a machine where you used an earlier release,
+consider revoking that API key in the Beakr web app and logging in with a new one.

{beakr_cli-0.3.1 → beakr_cli-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: beakr-cli
-Version: 0.3.1
+Version: 0.3.3
 Summary: CLI and MCP server for Beakr's knowledge base
 Project-URL: Homepage, https://thebeakr.com
 Project-URL: Repository, https://github.com/BeakrHub/beakr-cli

{beakr_cli-0.3.1 → beakr_cli-0.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "beakr-cli"
-version = "0.3.1"
+version = "0.3.3"
 description = "CLI and MCP server for Beakr's knowledge base"
 readme = "README.md"
 license = "MIT"

{beakr_cli-0.3.1 → beakr_cli-0.3.3}/src/beakr_cli/__init__.py

@@ -1,3 +1,3 @@
 """Beakr CLI -- command-line and MCP server for Beakr's knowledge base."""
 
-__version__ = "0.3.1"
+__version__ = "0.3.3"

beakr_cli-0.3.3/src/beakr_cli/config.py

@@ -0,0 +1,83 @@
+"""Persistent configuration stored in ~/.beakr/config.json.
+
+The file holds the API key, so it is readable by its owner only: the directory
+is 0700 and the file 0600. Releases up to 0.3.2 wrote both with the default
+umask (usually 0755/0644, readable by every local user); ``load`` and ``save``
+tighten an existing directory and file the first time this version touches them.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import stat
+import tempfile
+from pathlib import Path
+from typing import Any
+
+CONFIG_DIR = Path.home() / ".beakr"
+CONFIG_FILE = CONFIG_DIR / "config.json"
+
+_DIR_MODE = 0o700
+_FILE_MODE = 0o600
+# POSIX permission bits mean nothing useful on Windows, where the profile
+# directory is already private to the user.
+_ENFORCE_MODES = os.name != "nt"
+
+
+def _tighten(path: Path, mode: int) -> None:
+    """Remove group and other access from ``path`` if it has any."""
+    if not _ENFORCE_MODES:
+        return
+    try:
+        current = stat.S_IMODE(path.stat().st_mode)
+        if current & 0o077:
+            path.chmod(mode)
+    except OSError:
+        # Best effort: a file owned by someone else, or on a filesystem without
+        # POSIX modes, must not stop the command from running.
+        return
+
+
+def ensure_dir() -> None:
+    """Create ~/.beakr owner-only, or tighten it if an older release made it."""
+    CONFIG_DIR.mkdir(mode=_DIR_MODE, parents=True, exist_ok=True)
+    _tighten(CONFIG_DIR, _DIR_MODE)
+
+
+def load() -> dict[str, Any]:
+    if not CONFIG_FILE.exists():
+        return {}
+    _tighten(CONFIG_DIR, _DIR_MODE)
+    _tighten(CONFIG_FILE, _FILE_MODE)
+    return json.loads(CONFIG_FILE.read_text())
+
+
+def save(data: dict[str, Any]) -> None:
+    ensure_dir()
+    # mkstemp creates the file 0600; renaming it over the config means the key
+    # is never on disk with wider permissions, even for an instant.
+    fd, tmp_name = tempfile.mkstemp(dir=CONFIG_DIR, prefix=".config.", suffix=".tmp")
+    try:
+        with os.fdopen(fd, "w") as handle:
+            handle.write(json.dumps(data, indent=2) + "\n")
+        os.replace(tmp_name, CONFIG_FILE)
+    except BaseException:
+        Path(tmp_name).unlink(missing_ok=True)
+        raise
+
+
+def get(key: str, default: Any = None) -> Any:
+    return load().get(key, default)
+
+
+def set_key(key: str, value: Any) -> None:
+    data = load()
+    data[key] = value
+    save(data)
+
+
+def delete_key(key: str) -> None:
+    data = load()
+    data.pop(key, None)
+    save(data)

{beakr_cli-0.3.1 → beakr_cli-0.3.3}/src/beakr_cli/updates.py

@@ -15,6 +15,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import shutil
 import subprocess
 import sys
@@ -89,7 +90,7 @@ def _read_cache() -> tuple[str | None, datetime | None]:
 
 def _write_cache(latest: str, checked_at: datetime) -> None:
     try:
-        config.CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+        config.ensure_dir()
         _cache_file().write_text(
             json.dumps({"latest": latest, "checked_at": checked_at.isoformat()}) + "\n"
         )
@@ -164,30 +165,40 @@ def _uv_tool_dir() -> Path:
     return base / "uv" / "tools"
 
 
-def _receipt_is_local_source(receipt: Path) -> bool:
-    """True when the uv tool was installed from a directory, path, or git checkout.
+#: The ``{ name = "beakr-cli", ... }`` inline table in a uv tool receipt's
+#: ``requirements``. Parsed from the requirement entry alone: the receipt also
+#: carries ``entrypoints`` with ``install-path = ...``, and matching keys against
+#: the whole file made every uv tool install look like a local checkout.
+_RECEIPT_REQUIREMENT = re.compile(r'\{\s*name\s*=\s*"' + re.escape(PACKAGE_NAME) + r'"([^}]*)\}')
+_SOURCE_KEYS = re.compile(r"(?<![\w-])(directory|path|git|url|editable)\s*=")
+_PINNED_SPECIFIER = re.compile(r'(?<![\w-])specifier\s*=\s*"\s*==')
+
+
+def _receipt_requirement(receipt: Path) -> str | None:
+    """The body of this package's requirement entry in a uv receipt, if readable."""
+    try:
+        match = _RECEIPT_REQUIREMENT.search(receipt.read_text())
+    except OSError:
+        return None
+    return match.group(1) if match else None
+
+
+def _receipt_is_local_source(requirement: str) -> bool:
+    """True when the uv tool was installed from a directory, path, URL, or git.
 
     Upgrading such an install from PyPI would silently swap a developer's local
     build for the release, so it is reported rather than done.
     """
-    try:
-        text = receipt.read_text()
-    except OSError:
-        return False
-    return any(marker in text for marker in ("directory =", "path =", "git ="))
+    return _SOURCE_KEYS.search(requirement) is not None
 
 
-def _receipt_pins_version(receipt: Path) -> bool:
+def _receipt_pins_version(requirement: str) -> bool:
     """True when the uv tool was installed as ``beakr-cli==X``.
 
     ``uv tool upgrade`` honours the pin and does nothing, so offering it would
     report an upgrade that never happens.
     """
-    try:
-        text = receipt.read_text()
-    except OSError:
-        return False
-    return f'name = "{PACKAGE_NAME}", specifier = "==' in text
+    return _PINNED_SPECIFIER.search(requirement) is not None
 
 
 def detect_install(prefix: Path | None = None) -> InstallInfo:
@@ -200,8 +211,8 @@ def detect_install(prefix: Path | None = None) -> InstallInfo:
     except OSError:
         in_uv_tools = False
     if in_uv_tools or ("uv" in parts and "tools" in parts):
-        receipt = env / "uv-receipt.toml"
-        if _receipt_is_local_source(receipt):
+        requirement = _receipt_requirement(env / "uv-receipt.toml") or ""
+        if _receipt_is_local_source(requirement):
             return InstallInfo(
                 InstallMethod.uv_tool_source,
                 None,
@@ -209,7 +220,7 @@ def detect_install(prefix: Path | None = None) -> InstallInfo:
                 "`uv tool install --force <checkout>`, or switch to the published "
                 f"release with `uv tool install --force {PACKAGE_NAME}`.",
             )
-        if _receipt_pins_version(receipt):
+        if _receipt_pins_version(requirement):
             return InstallInfo(
                 InstallMethod.uv_tool_pinned,
                 None,

{beakr_cli-0.3.1 → beakr_cli-0.3.3}/tests/test_auth_cli.py

@@ -10,7 +10,7 @@ def test_whoami_reports_environment_scope_over_stored_config(monkeypatch) -> Non
         "beakr_cli.commands.auth.api_get",
         lambda _path: {
             "user": {"display_name": "Sarah Chen"},
-            "personal_org": {"name": "Yale University"},
+            "personal_org": {"name": "Example University"},
         },
     )
     monkeypatch.setattr("beakr_cli.commands.auth.config.get", lambda _key: "stale-config")

beakr_cli-0.3.3/tests/test_config_permissions.py

@@ -0,0 +1,95 @@
+"""~/.beakr and its config.json hold the API key, so they are owner-only.
+
+Regression: up to 0.3.2 ``config.save`` created ``~/.beakr`` and wrote
+``config.json`` with the process umask (typically 0755 and 0644), so any local
+user could read the stored API key. 0.3.3 writes them 0700/0600 and tightens
+directories and files an older release already created.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import stat
+
+import pytest
+from typer.testing import CliRunner
+
+from beakr_cli import config
+
+pytestmark = pytest.mark.skipif(os.name == "nt", reason="POSIX permission bits")
+
+KEY = "bk_live_permissions_test_key_value"
+
+
+def _mode(path) -> int:
+    return stat.S_IMODE(path.stat().st_mode)
+
+
+@pytest.fixture
+def config_home(tmp_path, monkeypatch):
+    monkeypatch.setattr(config, "CONFIG_DIR", tmp_path / ".beakr")
+    monkeypatch.setattr(config, "CONFIG_FILE", tmp_path / ".beakr" / "config.json")
+    return tmp_path / ".beakr"
+
+
+def test_saving_the_key_creates_an_owner_only_directory_and_file(config_home):
+    previous_umask = os.umask(0o022)
+    try:
+        config.set_key("api_key", KEY)
+    finally:
+        os.umask(previous_umask)
+
+    assert _mode(config_home) == 0o700
+    assert _mode(config.CONFIG_FILE) == 0o600
+    assert json.loads(config.CONFIG_FILE.read_text())["api_key"] == KEY
+    # The atomic write leaves no temporary file behind.
+    assert [p.name for p in config_home.iterdir()] == ["config.json"]
+
+
+def test_reading_tightens_a_directory_and_file_an_older_release_wrote(config_home):
+    config_home.mkdir(mode=0o755)
+    config_home.chmod(0o755)
+    config.CONFIG_FILE.write_text(json.dumps({"api_key": KEY}) + "\n")
+    config.CONFIG_FILE.chmod(0o644)
+
+    assert config.get("api_key") == KEY
+
+    assert _mode(config_home) == 0o700
+    assert _mode(config.CONFIG_FILE) == 0o600
+
+
+def test_saving_tightens_an_existing_world_readable_file(config_home):
+    config_home.mkdir(mode=0o755)
+    config_home.chmod(0o755)
+    config.CONFIG_FILE.write_text("{}\n")
+    config.CONFIG_FILE.chmod(0o644)
+
+    config.save({"api_key": KEY})
+
+    assert _mode(config_home) == 0o700
+    assert _mode(config.CONFIG_FILE) == 0o600
+
+
+def test_update_check_cache_creates_the_directory_owner_only(config_home):
+    from datetime import datetime, timezone
+
+    from beakr_cli import updates
+
+    updates._write_cache("9.9.9", datetime.now(timezone.utc))
+
+    assert _mode(config_home) == 0o700
+
+
+def test_failed_login_does_not_echo_the_api_key(config_home, monkeypatch):
+    from beakr_cli.commands import auth
+
+    def reject(_path, *args, **kwargs):
+        raise RuntimeError("401 Unauthorized")
+
+    monkeypatch.setattr(auth, "api_get", reject)
+    result = CliRunner().invoke(auth.app, ["login", "--api-key", KEY])
+
+    assert result.exit_code == 1
+    assert KEY not in result.output
+    assert config.get("api_key") is None

{beakr_cli-0.3.1 → beakr_cli-0.3.3}/tests/test_updates.py

@@ -137,14 +137,39 @@ def test_running_ahead_of_pypi_is_not_an_update() -> None:
 # Install detection
 # ---------------------------------------------------------------------------
 
+#: Receipts exactly as uv 0.11 writes them. The entrypoints block matters: its
+#: ``install-path = ...`` made every PyPI install look like a local checkout when
+#: detection searched the whole file for ``path =``, so `beakr update` refused to
+#: upgrade any uv tool install in 0.3.0 and 0.3.1.
+_ENTRYPOINTS = """entrypoints = [
+    { name = "beakr", install-path = "/Users/u/.local/bin/beakr", from = "beakr-cli" },
+]
+"""
+PYPI_RECEIPT = '[tool]\nrequirements = [{ name = "beakr-cli" }]\n' + _ENTRYPOINTS
+PINNED_RECEIPT = (
+    '[tool]\nrequirements = [{ name = "beakr-cli", specifier = "==0.3.0" }]\n' + _ENTRYPOINTS
+)
+RANGE_RECEIPT = (
+    '[tool]\nrequirements = [{ name = "beakr-cli", specifier = ">=0.3" }]\n' + _ENTRYPOINTS
+)
+SOURCE_RECEIPT = (
+    '[tool]\nrequirements = [{ name = "beakr-cli", directory = "/src/beakr-cli" }]\n'
+    'constraints = [{ name = "mcp", specifier = "<2" }]\n' + _ENTRYPOINTS
+)
+
 
-def test_detects_pypi_uv_tool_install(tmp_path, monkeypatch) -> None:
+def _uv_tool_env(tmp_path, monkeypatch, receipt: str) -> Path:
     tools = tmp_path / "uv" / "tools"
     env = tools / "beakr-cli"
     env.mkdir(parents=True)
-    (env / "uv-receipt.toml").write_text('[tool]\nrequirements = [{ name = "beakr-cli" }]\n')
+    (env / "uv-receipt.toml").write_text(receipt)
     monkeypatch.setenv("UV_TOOL_DIR", str(tools))
-    info = updates.detect_install(env)
+    return env
+
+
+@pytest.mark.parametrize("receipt", [PYPI_RECEIPT, RANGE_RECEIPT])
+def test_detects_pypi_uv_tool_install(receipt, tmp_path, monkeypatch) -> None:
+    info = updates.detect_install(_uv_tool_env(tmp_path, monkeypatch, receipt))
     assert info.method is updates.InstallMethod.uv_tool
     # --reinstall-package implies a refresh of the cached index; without one an
     # upgrade shortly after a release resolved the old version and still exited 0.
@@ -155,14 +180,7 @@ def test_detects_pypi_uv_tool_install(tmp_path, monkeypatch) -> None:
 
 def test_version_pinned_uv_tool_is_reported_not_upgraded(tmp_path, monkeypatch) -> None:
     """`uv tool upgrade` keeps a `==X` pin, so running it would upgrade nothing."""
-    tools = tmp_path / "uv" / "tools"
-    env = tools / "beakr-cli"
-    env.mkdir(parents=True)
-    (env / "uv-receipt.toml").write_text(
-        '[tool]\nrequirements = [{ name = "beakr-cli", specifier = "==0.3.0" }]\n'
-    )
-    monkeypatch.setenv("UV_TOOL_DIR", str(tools))
-    info = updates.detect_install(env)
+    info = updates.detect_install(_uv_tool_env(tmp_path, monkeypatch, PINNED_RECEIPT))
     assert info.method is updates.InstallMethod.uv_tool_pinned
     assert info.upgrade_command is None
     assert "uv tool install --force beakr-cli" in info.instructions
@@ -170,14 +188,7 @@ def test_version_pinned_uv_tool_is_reported_not_upgraded(tmp_path, monkeypatch)
 
 def test_local_checkout_uv_tool_is_never_upgraded_from_pypi(tmp_path, monkeypatch) -> None:
     """A developer's local build must not be silently replaced by the release."""
-    tools = tmp_path / "uv" / "tools"
-    env = tools / "beakr-cli"
-    env.mkdir(parents=True)
-    (env / "uv-receipt.toml").write_text(
-        '[tool]\nrequirements = [{ name = "beakr-cli", directory = "/src/beakr-cli" }]\n'
-    )
-    monkeypatch.setenv("UV_TOOL_DIR", str(tools))
-    info = updates.detect_install(env)
+    info = updates.detect_install(_uv_tool_env(tmp_path, monkeypatch, SOURCE_RECEIPT))
     assert info.method is updates.InstallMethod.uv_tool_source
     assert info.upgrade_command is None
 

{beakr_cli-0.3.1 → beakr_cli-0.3.3}/uv.lock

@@ -63,7 +63,7 @@ wheels = [
 
 [[package]]
 name = "beakr-cli"
-version = "0.3.1"
+version = "0.3.3"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },

beakr_cli-0.3.1/src/beakr_cli/config.py

@@ -1,41 +0,0 @@
-"""Persistent configuration stored in ~/.beakr/config.json."""
-
-from __future__ import annotations
-
-import json
-from pathlib import Path
-from typing import Any
-
-CONFIG_DIR = Path.home() / ".beakr"
-CONFIG_FILE = CONFIG_DIR / "config.json"
-
-
-def _ensure_dir() -> None:
-    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
-
-
-def load() -> dict[str, Any]:
-    if not CONFIG_FILE.exists():
-        return {}
-    return json.loads(CONFIG_FILE.read_text())
-
-
-def save(data: dict[str, Any]) -> None:
-    _ensure_dir()
-    CONFIG_FILE.write_text(json.dumps(data, indent=2) + "\n")
-
-
-def get(key: str, default: Any = None) -> Any:
-    return load().get(key, default)
-
-
-def set_key(key: str, value: Any) -> None:
-    data = load()
-    data[key] = value
-    save(data)
-
-
-def delete_key(key: str) -> None:
-    data = load()
-    data.pop(key, None)
-    save(data)