beakr-cli 0.3.2__tar.gz → 0.3.3__tar.gz

beakr_cli-0.3.3/CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+## 0.3.3 (2026-10-14)
+
+Security fix. Upgrade with `beakr update` or `uv tool upgrade beakr-cli`.
+
+- The API key saved by `beakr auth login` and `beakr install` lives in
+  `~/.beakr/config.json`. Earlier releases created `~/.beakr` and that file
+  with default permissions (usually readable by every user on the machine).
+  0.3.3 creates the directory `0700` and the file `0600`, writes the file
+  atomically so the key is never briefly readable, and tightens a directory and
+  file an earlier release created the first time it reads them.
+- No other behavior changes; 0.3.3 talks to the same API as 0.3.2.
+
+If other people have accounts on a machine where you used an earlier release,
+consider revoking that API key in the Beakr web app and logging in with a new one.

{beakr_cli-0.3.2 → beakr_cli-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: beakr-cli
-Version: 0.3.2
+Version: 0.3.3
 Summary: CLI and MCP server for Beakr's knowledge base
 Project-URL: Homepage, https://thebeakr.com
 Project-URL: Repository, https://github.com/BeakrHub/beakr-cli

{beakr_cli-0.3.2 → beakr_cli-0.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "beakr-cli"
-version = "0.3.2"
+version = "0.3.3"
 description = "CLI and MCP server for Beakr's knowledge base"
 readme = "README.md"
 license = "MIT"

{beakr_cli-0.3.2 → beakr_cli-0.3.3}/src/beakr_cli/__init__.py

@@ -1,3 +1,3 @@
 """Beakr CLI -- command-line and MCP server for Beakr's knowledge base."""
 
-__version__ = "0.3.2"
+__version__ = "0.3.3"

beakr_cli-0.3.3/src/beakr_cli/config.py

@@ -0,0 +1,83 @@
+"""Persistent configuration stored in ~/.beakr/config.json.
+
+The file holds the API key, so it is readable by its owner only: the directory
+is 0700 and the file 0600. Releases up to 0.3.2 wrote both with the default
+umask (usually 0755/0644, readable by every local user); ``load`` and ``save``
+tighten an existing directory and file the first time this version touches them.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import stat
+import tempfile
+from pathlib import Path
+from typing import Any
+
+CONFIG_DIR = Path.home() / ".beakr"
+CONFIG_FILE = CONFIG_DIR / "config.json"
+
+_DIR_MODE = 0o700
+_FILE_MODE = 0o600
+# POSIX permission bits mean nothing useful on Windows, where the profile
+# directory is already private to the user.
+_ENFORCE_MODES = os.name != "nt"
+
+
+def _tighten(path: Path, mode: int) -> None:
+    """Remove group and other access from ``path`` if it has any."""
+    if not _ENFORCE_MODES:
+        return
+    try:
+        current = stat.S_IMODE(path.stat().st_mode)
+        if current & 0o077:
+            path.chmod(mode)
+    except OSError:
+        # Best effort: a file owned by someone else, or on a filesystem without
+        # POSIX modes, must not stop the command from running.
+        return
+
+
+def ensure_dir() -> None:
+    """Create ~/.beakr owner-only, or tighten it if an older release made it."""
+    CONFIG_DIR.mkdir(mode=_DIR_MODE, parents=True, exist_ok=True)
+    _tighten(CONFIG_DIR, _DIR_MODE)
+
+
+def load() -> dict[str, Any]:
+    if not CONFIG_FILE.exists():
+        return {}
+    _tighten(CONFIG_DIR, _DIR_MODE)
+    _tighten(CONFIG_FILE, _FILE_MODE)
+    return json.loads(CONFIG_FILE.read_text())
+
+
+def save(data: dict[str, Any]) -> None:
+    ensure_dir()
+    # mkstemp creates the file 0600; renaming it over the config means the key
+    # is never on disk with wider permissions, even for an instant.
+    fd, tmp_name = tempfile.mkstemp(dir=CONFIG_DIR, prefix=".config.", suffix=".tmp")
+    try:
+        with os.fdopen(fd, "w") as handle:
+            handle.write(json.dumps(data, indent=2) + "\n")
+        os.replace(tmp_name, CONFIG_FILE)
+    except BaseException:
+        Path(tmp_name).unlink(missing_ok=True)
+        raise
+
+
+def get(key: str, default: Any = None) -> Any:
+    return load().get(key, default)
+
+
+def set_key(key: str, value: Any) -> None:
+    data = load()
+    data[key] = value
+    save(data)
+
+
+def delete_key(key: str) -> None:
+    data = load()
+    data.pop(key, None)
+    save(data)

{beakr_cli-0.3.2 → beakr_cli-0.3.3}/src/beakr_cli/updates.py

@@ -90,7 +90,7 @@ def _read_cache() -> tuple[str | None, datetime | None]:
 
 def _write_cache(latest: str, checked_at: datetime) -> None:
     try:
-        config.CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+        config.ensure_dir()
         _cache_file().write_text(
             json.dumps({"latest": latest, "checked_at": checked_at.isoformat()}) + "\n"
         )

{beakr_cli-0.3.2 → beakr_cli-0.3.3}/tests/test_auth_cli.py

@@ -10,7 +10,7 @@ def test_whoami_reports_environment_scope_over_stored_config(monkeypatch) -> Non
         "beakr_cli.commands.auth.api_get",
         lambda _path: {
             "user": {"display_name": "Sarah Chen"},
-            "personal_org": {"name": "Yale University"},
+            "personal_org": {"name": "Example University"},
         },
     )
     monkeypatch.setattr("beakr_cli.commands.auth.config.get", lambda _key: "stale-config")

beakr_cli-0.3.3/tests/test_config_permissions.py

@@ -0,0 +1,95 @@
+"""~/.beakr and its config.json hold the API key, so they are owner-only.
+
+Regression: up to 0.3.2 ``config.save`` created ``~/.beakr`` and wrote
+``config.json`` with the process umask (typically 0755 and 0644), so any local
+user could read the stored API key. 0.3.3 writes them 0700/0600 and tightens
+directories and files an older release already created.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import stat
+
+import pytest
+from typer.testing import CliRunner
+
+from beakr_cli import config
+
+pytestmark = pytest.mark.skipif(os.name == "nt", reason="POSIX permission bits")
+
+KEY = "bk_live_permissions_test_key_value"
+
+
+def _mode(path) -> int:
+    return stat.S_IMODE(path.stat().st_mode)
+
+
+@pytest.fixture
+def config_home(tmp_path, monkeypatch):
+    monkeypatch.setattr(config, "CONFIG_DIR", tmp_path / ".beakr")
+    monkeypatch.setattr(config, "CONFIG_FILE", tmp_path / ".beakr" / "config.json")
+    return tmp_path / ".beakr"
+
+
+def test_saving_the_key_creates_an_owner_only_directory_and_file(config_home):
+    previous_umask = os.umask(0o022)
+    try:
+        config.set_key("api_key", KEY)
+    finally:
+        os.umask(previous_umask)
+
+    assert _mode(config_home) == 0o700
+    assert _mode(config.CONFIG_FILE) == 0o600
+    assert json.loads(config.CONFIG_FILE.read_text())["api_key"] == KEY
+    # The atomic write leaves no temporary file behind.
+    assert [p.name for p in config_home.iterdir()] == ["config.json"]
+
+
+def test_reading_tightens_a_directory_and_file_an_older_release_wrote(config_home):
+    config_home.mkdir(mode=0o755)
+    config_home.chmod(0o755)
+    config.CONFIG_FILE.write_text(json.dumps({"api_key": KEY}) + "\n")
+    config.CONFIG_FILE.chmod(0o644)
+
+    assert config.get("api_key") == KEY
+
+    assert _mode(config_home) == 0o700
+    assert _mode(config.CONFIG_FILE) == 0o600
+
+
+def test_saving_tightens_an_existing_world_readable_file(config_home):
+    config_home.mkdir(mode=0o755)
+    config_home.chmod(0o755)
+    config.CONFIG_FILE.write_text("{}\n")
+    config.CONFIG_FILE.chmod(0o644)
+
+    config.save({"api_key": KEY})
+
+    assert _mode(config_home) == 0o700
+    assert _mode(config.CONFIG_FILE) == 0o600
+
+
+def test_update_check_cache_creates_the_directory_owner_only(config_home):
+    from datetime import datetime, timezone
+
+    from beakr_cli import updates
+
+    updates._write_cache("9.9.9", datetime.now(timezone.utc))
+
+    assert _mode(config_home) == 0o700
+
+
+def test_failed_login_does_not_echo_the_api_key(config_home, monkeypatch):
+    from beakr_cli.commands import auth
+
+    def reject(_path, *args, **kwargs):
+        raise RuntimeError("401 Unauthorized")
+
+    monkeypatch.setattr(auth, "api_get", reject)
+    result = CliRunner().invoke(auth.app, ["login", "--api-key", KEY])
+
+    assert result.exit_code == 1
+    assert KEY not in result.output
+    assert config.get("api_key") is None

{beakr_cli-0.3.2 → beakr_cli-0.3.3}/uv.lock

@@ -63,7 +63,7 @@ wheels = [
 
 [[package]]
 name = "beakr-cli"
-version = "0.3.2"
+version = "0.3.3"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },

beakr_cli-0.3.2/src/beakr_cli/config.py

@@ -1,41 +0,0 @@
-"""Persistent configuration stored in ~/.beakr/config.json."""
-
-from __future__ import annotations
-
-import json
-from pathlib import Path
-from typing import Any
-
-CONFIG_DIR = Path.home() / ".beakr"
-CONFIG_FILE = CONFIG_DIR / "config.json"
-
-
-def _ensure_dir() -> None:
-    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
-
-
-def load() -> dict[str, Any]:
-    if not CONFIG_FILE.exists():
-        return {}
-    return json.loads(CONFIG_FILE.read_text())
-
-
-def save(data: dict[str, Any]) -> None:
-    _ensure_dir()
-    CONFIG_FILE.write_text(json.dumps(data, indent=2) + "\n")
-
-
-def get(key: str, default: Any = None) -> Any:
-    return load().get(key, default)
-
-
-def set_key(key: str, value: Any) -> None:
-    data = load()
-    data[key] = value
-    save(data)
-
-
-def delete_key(key: str) -> None:
-    data = load()
-    data.pop(key, None)
-    save(data)