brainiac-cli 0.20.45__tar.gz → 0.20.46__tar.gz

{brainiac_cli-0.20.45/src/brainiac_cli.egg-info → brainiac_cli-0.20.46}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brainiac-cli
-Version: 0.20.45
+Version: 0.20.46
 Summary: Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index).
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/Autopsias/brainiac
@@ -19,11 +19,12 @@ Requires-Dist: cryptography>=49
 Requires-Dist: PyYAML>=6
 Requires-Dist: regex>=2023.0.0
 Requires-Dist: keyring>=24; sys_platform == "win32"
-Requires-Dist: pypdf>=6.15.0
+Requires-Dist: pypdf>=6.21.2
 Requires-Dist: python-docx>=1.1
 Requires-Dist: python-pptx>=0.6.23
 Requires-Dist: openpyxl>=3.1
-Requires-Dist: Pillow>=12.3.0
+Requires-Dist: Pillow>=13.0.0; python_version >= "3.11"
+Requires-Dist: Pillow>=12.3.0; python_version < "3.11"
 Provides-Extra: vec
 Requires-Dist: sqlite-vec>=0.1.6; extra == "vec"
 Provides-Extra: audit
@@ -43,11 +44,12 @@ Requires-Dist: PyYAML>=6; extra == "corporate"
 Provides-Extra: yaml
 Requires-Dist: PyYAML>=6; extra == "yaml"
 Provides-Extra: ingest
-Requires-Dist: pypdf>=6.15.0; extra == "ingest"
+Requires-Dist: pypdf>=6.21.2; extra == "ingest"
 Requires-Dist: python-docx>=1.1; extra == "ingest"
 Requires-Dist: python-pptx>=0.6.23; extra == "ingest"
 Requires-Dist: openpyxl>=3.1; extra == "ingest"
-Requires-Dist: Pillow>=12.3.0; extra == "ingest"
+Requires-Dist: Pillow>=13.0.0; python_version >= "3.11" and extra == "ingest"
+Requires-Dist: Pillow>=12.3.0; python_version < "3.11" and extra == "ingest"
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == "dev"
 Requires-Dist: build>=1; extra == "dev"

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/pyproject.toml

@@ -8,7 +8,7 @@ build-backend = "setuptools.build_meta"
 # check. The IMPORT package stays `brain` and the console script stays
 # `brain` — only the distribution/project name changes.
 name = "brainiac-cli"
-version = "0.20.45"
+version = "0.20.46"
 description = "Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index)."
 readme = "README.md"
 license = "Apache-2.0"
@@ -42,7 +42,7 @@ dependencies = [
     # because requirements.lock is CI/audit-only -- a plain
     # `pip install brainiac-cli` reads THIS constraint, and >=4.0 let the
     # vulnerable 6.14.2 survive an upgrade to 0.20.5 on a real host.
-    "pypdf>=6.15.0",
+    "pypdf>=6.21.2",
     "python-docx>=1.1",
     "python-pptx>=0.6.23",
     "openpyxl>=3.1",
@@ -50,7 +50,10 @@ dependencies = [
     # binary is present — the pytesseract binding itself stays a fully
     # OPTIONAL, NOT-a-pip-dependency probe: OCR degrades gracefully absent
     # it, matching the ADR's "system binaries are never pip deps" rule).
-    "Pillow>=12.3.0",
+    # >=13.0.0 fixes 37 advisories (one a FlashPix heap overflow); 13 needs
+    # Python 3.11+, and no fixed 12.x exists, so 3.10 keeps the old floor.
+    "Pillow>=13.0.0; python_version >= '3.11'",
+    "Pillow>=12.3.0; python_version < '3.11'",
 ]
 
 [project.optional-dependencies]
@@ -94,7 +97,7 @@ yaml = ["PyYAML>=6"]
 # message hints valid even though a default install already has these. Absent,
 # `brain ingest` degrades per-handler (reports which extensions are
 # unavailable) rather than crashing.
-ingest = ["pypdf>=6.15.0", "python-docx>=1.1", "python-pptx>=0.6.23", "openpyxl>=3.1", "Pillow>=12.3.0"]
+ingest = ["pypdf>=6.21.2", "python-docx>=1.1", "python-pptx>=0.6.23", "openpyxl>=3.1", "Pillow>=13.0.0; python_version >= '3.11'", "Pillow>=12.3.0; python_version < '3.11'"]
 # pytest-xdist/-timeout back the documented parallel suite run (AGENTS.md §8,
 # "Running the test suite"): ~15 min sequential -> ~6 min at `-n 8`. Both are
 # pytest-dev org, actively maintained. Declared here so a fresh checkout can
@@ -296,3 +299,20 @@ python-platform = "linux"
 # `_assets` is the generated mirror of tools/ + scripts/ inside src/brain/.
 include = ["src", "tools", "eval", "scripts", "packaging"]
 exclude = ["**/_plans", "**/_archive", "**/_evidence", "**/_assets"]
+
+[tool.uv]
+# Wait 7 days before resolving a newly published version (a new release can be
+# malicious or broken). shortcut: pypdf 6.21.2, filelock 4.2.4 and certifi
+# 2026.10.23 are security fixes under 7 days old on 2026-10-24, so they are
+# exempt; remove the exemptions after 2026-10-31.
+exclude-newer = "7 days"
+exclude-newer-package = { pypdf = false, filelock = false, certifi = false }
+# fastembed (the optional `embed` extra, not installed by default) caps
+# pillow<13 in every release up to 0.9.0, but pillow 13.0.0 is the first
+# release fixing 37 advisories (one a FlashPix heap overflow). fastembed uses
+# pillow only for IMAGE embeddings; this repo embeds text only.
+# shortcut: drop this once a fastembed release allows pillow>=13.
+override-dependencies = [
+    "pillow>=13.0.0; python_version >= '3.11'",
+    "pillow>=12.3.0; python_version < '3.11'",
+]

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/_version.py

@@ -9,4 +9,4 @@ pip-installed host, importlib.metadata stays primary; brain/__init__.py reads
 this file only as the fallback before 0.0.0+unknown.
 """
 
-__version__ = "0.20.45"
+__version__ = "0.20.46"

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/audit_drift.py

@@ -6,6 +6,7 @@ import os
 from datetime import date
 from pathlib import Path
 from typing import TYPE_CHECKING
+from .atomic_temp import atomic_temp_path
 
 if TYPE_CHECKING:  # annotation-only; a runtime import here would be a cycle
     from .audit_chain import AuditChain
@@ -32,7 +33,7 @@ def _write_dispositions(path: Path, payload: dict) -> None:
     turn every explained finding back into an unexplained one. `os.replace` is
     atomic within a filesystem, so a reader sees the old file or the new one.
     """
-    tmp = path.with_name(path.name + ".tmp")
+    tmp = atomic_temp_path(path)
     tmp.write_text(json.dumps(payload, indent=2), encoding="utf-8")
     os.replace(tmp, path)
 

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/core/_maintenance_state.py

@@ -1,5 +1,6 @@
 """Maintenance state methods for BrainCore."""
 from __future__ import annotations
+from ..atomic_temp import atomic_temp_path
 
 from ._shared import (
     Any,
@@ -130,7 +131,7 @@ class _MaintenanceStateMixin:
 
         path = config.maintain_state_path(self.vault)
         path.parent.mkdir(parents=True, exist_ok=True)
-        tmp = path.with_suffix(path.suffix + ".tmp")
+        tmp = atomic_temp_path(path)
         tmp.write_text(_json.dumps(state, indent=2, sort_keys=True), encoding="utf-8")
         _os.replace(tmp, path)
     def _note_graphify_build_outcome(

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/exceptions_page.py

@@ -60,6 +60,7 @@ from . import maintenance as _maintenance
 from . import maintenance_notify as _notify
 from . import remediation as _rem
 from . import remediation_exceptions as _rex
+from .atomic_temp import atomic_temp_path
 from .exceptions_render import render_page  # re-exported: the page's one
 # renderer, split out on 2026-08-22 when this file hit the 500-line bound.
 
@@ -287,7 +288,7 @@ def maybe_ping(vault: Path, keys: list[str], full_path: Path) -> str | None:
     if not str(out or "").startswith("skipped"):  # a SKIP defers, never spends
         try:
             state_path.parent.mkdir(parents=True, exist_ok=True)
-            tmp = state_path.with_name(state_path.name + ".tmp")
+            tmp = atomic_temp_path(state_path)
             tmp.write_text(json.dumps({"hash": current_hash}), encoding="utf-8")
             os.replace(tmp, state_path)
         except OSError:
@@ -364,6 +365,6 @@ def generate(core: Any, today: datetime.date | None = None) -> dict[str, Any]:
 
 
 def _atomic_write(path: Path, text: str) -> None:
-    tmp = path.with_name(path.name + ".tmp")
+    tmp = atomic_temp_path(path)
     tmp.write_text(text, encoding="utf-8")
     os.replace(tmp, path)

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/exceptions_verify.py

@@ -78,6 +78,7 @@ from pathlib import Path
 from typing import Any
 
 from . import config as _config
+from .atomic_temp import atomic_temp_path
 
 PINNED_FILENAME = "pinned-verify.json"
 MOUNT_HTML_FILENAME = "exceptions.html"
@@ -372,7 +373,7 @@ def stage_pin(vault: Path, workspace: Path | None = None) -> dict[str, Any]:
     data = {"vault_id": vid, "public_key_pem": pem}
     path = staging_root(vault, workspace) / PINNED_FILENAME
     path.parent.mkdir(parents=True, exist_ok=True)
-    tmp = path.with_name(path.name + ".tmp")
+    tmp = atomic_temp_path(path)
     tmp.write_text(json.dumps(data, indent=1, sort_keys=True), encoding="utf-8")
     os.replace(tmp, path)
     return data
@@ -413,6 +414,6 @@ def publish_summary(vault: Path, workspace: Path | None = None) -> None:
         if not src.exists():
             continue
         dest = dest_dir / filename
-        tmp = dest.with_name(dest.name + ".tmp")
+        tmp = atomic_temp_path(dest)
         tmp.write_bytes(src.read_bytes())
         os.replace(tmp, dest)

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/folds/intake.py

@@ -240,12 +240,12 @@ class IntakeFoldsMixin:
             from .. import cos                                   # noqa: PLC0415
 
             ops = cos.run_ops_dir(self.vault)
-            ledgers = sorted(ops.glob("_cos_ingestion_ledger_*.jsonl"),
+            ledgers = sorted(ops.glob(cos.LEDGER_GLOB),
                              key=self._ledger_order)
             if not ledgers:
                 return
             latest = ledgers[-1]
-            run_id = latest.stem[len("_cos_ingestion_ledger_"):]
+            run_id = cos.ledger_run_id(latest)
             rows, seen = [], set()
             for line in latest.read_text(encoding="utf-8").splitlines():
                 if not line.strip():
@@ -268,7 +268,7 @@ class IntakeFoldsMixin:
         """Sort key for `_cos_ingestion_ledger_<date>-run<N>.jsonl`: the date
         as text, then the run number as an INT. A missing or unparseable run
         number sorts first, which keeps a malformed name from winning."""
-        stem = path.stem[len("_cos_ingestion_ledger_"):]
+        stem = path.stem[len("_cos_ingestion_ledger_"):]  # no COS import: this runs unguarded
         date, _, tail = stem.partition("-run")
         return (date, int(tail) if tail.isdigit() else -1)
 
@@ -355,12 +355,12 @@ class IntakeFoldsMixin:
             from .. import cos                                   # noqa: PLC0415
 
             ops = cos.run_ops_dir(self.vault)
-            ledgers = sorted(ops.glob("_cos_ingestion_ledger_*.jsonl"),
+            ledgers = sorted(ops.glob(cos.LEDGER_GLOB),
                              key=self._ledger_order)
             if not ledgers:
                 return
             latest = ledgers[-1]
-            run_id = latest.stem[len("_cos_ingestion_ledger_"):]
+            run_id = cos.ledger_run_id(latest)
             stuck, seen = {}, set()
             for line in latest.read_text(encoding="utf-8").splitlines():
                 if not line.strip():

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/graph_ops.py

@@ -14,6 +14,7 @@ from . import classification, config, egress
 from . import graphify as graphify_model
 from .graph import build_graph
 from .progress import progress_note
+from .atomic_temp import atomic_temp_path
 
 
 @dataclass(frozen=True)
@@ -186,7 +187,7 @@ def _publish_graph_artifact(
     day: dt.date,
 ) -> None:
     """Atomically publish validated graph and manifest files."""
-    temporary_graph = paths.graph.with_suffix(paths.graph.suffix + ".tmp")
+    temporary_graph = atomic_temp_path(paths.graph)
     temporary_graph.write_text(
         json.dumps(artifact, indent=2, sort_keys=True), encoding="utf-8"
     )
@@ -197,7 +198,7 @@ def _publish_graph_artifact(
         "built_at": day.isoformat(),
         "notes": manifest,
     }
-    temporary_manifest = paths.manifest.with_suffix(paths.manifest.suffix + ".tmp")
+    temporary_manifest = atomic_temp_path(paths.manifest)
     temporary_manifest.write_text(
         json.dumps(new_state, indent=2, sort_keys=True), encoding="utf-8"
     )

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/ingest/deliverables.py

@@ -49,6 +49,7 @@ from typing import TYPE_CHECKING, Any
 
 from .. import classification as CLS
 from .. import supersede_declared as SUP
+from ..atomic_temp import atomic_temp_path
 
 if TYPE_CHECKING:  # the stage record; a runtime import here would be a cycle
     from .pipeline_stages import ClaimRecord
@@ -423,7 +424,7 @@ def _store(vault: Any, pending: dict[str, dict[str, Any]]) -> None:
     path = journal_path(vault)
     path.parent.mkdir(parents=True, exist_ok=True)
     config.secure_file_permissions(path.parent, 0o700)
-    tmp = path.with_name(path.name + ".tmp")
+    tmp = atomic_temp_path(path)
     tmp.write_text(json.dumps(pending, indent=2, sort_keys=True), encoding="utf-8")
     config.secure_file_permissions(tmp, 0o600)
     tmp.replace(path)

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/ingest/handlers/concealment_pdf.py

@@ -62,7 +62,10 @@ def page_fonts(page: Any) -> dict[str, Any]:
     """
     fonts: dict[str, Any] = {}
     try:
-        from pypdf._font import Font
+        try:
+            from pypdf.generic._font import Font  # pypdf >= 6.21
+        except ImportError:  # coverage-audit: older pypdf keeps Font here
+            from pypdf._font import Font
 
         resources = page.get_inherited("/Resources", None)
         table = resources.get("/Font") if resources else None

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/ingest/pipeline_files.py

@@ -10,6 +10,7 @@ import shutil
 import tempfile
 from pathlib import Path
 from typing import Any
+from ..atomic_temp import atomic_temp_path
 
 
 def manifest_path(vault: Path) -> Path:
@@ -32,7 +33,7 @@ def load_manifest(vault: Path) -> dict[str, str]:
 def save_manifest(vault: Path, manifest: dict[str, str]) -> None:
     path = manifest_path(vault)
     path.parent.mkdir(parents=True, exist_ok=True)
-    tmp = path.with_suffix(".tmp")
+    tmp = atomic_temp_path(path)
     tmp.write_text(json.dumps(manifest, indent=2, sort_keys=True), encoding="utf-8")
     os.replace(tmp, path)
 
@@ -57,7 +58,7 @@ def load_failures(vault: Path) -> dict[str, int]:
 def save_failures(vault: Path, failures: dict[str, int]) -> None:
     path = failures_path(vault)
     path.parent.mkdir(parents=True, exist_ok=True)
-    tmp = path.with_suffix(".tmp")
+    tmp = atomic_temp_path(path)
     tmp.write_text(json.dumps(failures, indent=2, sort_keys=True), encoding="utf-8")
     os.replace(tmp, path)
 
@@ -88,7 +89,11 @@ def read_nofollow(path: Path, *, max_bytes: int | None = None) -> bytes:
 
     if path.is_symlink():
         raise ReadRefused(f"{path.name} is a symlink — refused")
-    flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_BINARY", 0)
+    # O_NONBLOCK: a FIFO planted at the name would otherwise block the open
+    # until a writer arrives, before the S_ISREG check below can refuse it
+    # (same guard as ``cos._io``). It changes nothing for a regular file.
+    flags = (os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_BINARY", 0)
+             | getattr(os, "O_NONBLOCK", 0))
     try:
         fd = os.open(path, flags)
     except OSError as exc:

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/interview.py

@@ -27,6 +27,7 @@ import os
 import re
 from pathlib import Path
 from typing import Any
+from .atomic_temp import atomic_temp_path
 
 SCHEMA = "brain-interview/1"
 STATE_RELPATH = ".brain/interview/state.json"
@@ -103,7 +104,7 @@ def read_state(vault: Any) -> dict[str, Any]:
 def write_state(vault: Any, state: dict[str, Any]) -> Path:
     p = state_path(vault)
     p.parent.mkdir(parents=True, exist_ok=True)
-    tmp = p.with_suffix(".json.tmp")
+    tmp = atomic_temp_path(p)
     tmp.write_text(json.dumps(state, ensure_ascii=False, sort_keys=True,
                               indent=1) + "\n", encoding="utf-8")
     os.chmod(tmp, 0o600)

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/invariant_coverage.py

@@ -9,6 +9,7 @@ from pathlib import Path
 from typing import Any
 
 from .invariant_shared import SAMPLE_CAP
+from .atomic_temp import atomic_temp_path
 
 # ---------------------------------------------------------------------------
 # G12 — the exclusion set, defined ONCE here and imported by every consumer
@@ -437,7 +438,7 @@ def write_link_lane(conn: Any, vault: Path, *, limit: int | None = None) -> dict
     except (OSError, ValueError):
         previous = None
     payload.update(lane_consumption(previous, all_ids, payload["generated"]))
-    tmp = out.with_suffix(".json.tmp")
+    tmp = atomic_temp_path(out)
     tmp.write_text(json.dumps(payload, indent=1), encoding="utf-8")
     tmp.replace(out)
     return {"path": str(out), "written": len(payload["candidates"]),

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/maintenance_notify.py

@@ -13,6 +13,7 @@ import os
 import platform
 import subprocess
 import hashlib
+from .atomic_temp import atomic_temp_path
 
 
 # ---------------------------------------------------------------------------
@@ -138,7 +139,7 @@ def record_current_findings(
     }
     try:
         path.parent.mkdir(parents=True, exist_ok=True)
-        tmp = path.with_name(path.name + ".tmp")
+        tmp = atomic_temp_path(path)
         tmp.write_text(json.dumps(payload, indent=1), encoding="utf-8")
         os.replace(tmp, path)
     except OSError:

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/overlay_generated.py

@@ -64,6 +64,7 @@ from typing import Any, NamedTuple
 
 from . import frontmatter
 from . import overlay as ov
+from .atomic_temp import atomic_temp_path
 
 #: Sibling of ``keywords/`` — deliberately NOT inside it. See the module
 #: docstring: ``keywords/`` drives ingest classification and this does not.
@@ -223,7 +224,7 @@ def _publish(path: Path, text: str) -> None:
     ``*.md`` glob in :func:`brain.overlay._ring_files` cannot pick a half-written
     temp file up as a ring file of its own.
     """
-    tmp = path.with_name(f".{path.name}.tmp")
+    tmp = atomic_temp_path(path)
     try:
         tmp.write_text(text, encoding="utf-8")
         os.replace(tmp, path)

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/provision.py

@@ -47,7 +47,7 @@ from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any, Callable, Optional
 
-from . import workspaces
+from . import atomic_temp, workspaces
 # Wire 5 moved to `provision_mcp` (its own module: the Desktop config is a
 # third-party file with a third party still writing to it). Re-exported here
 # because this module is the one every caller already imports.
@@ -94,7 +94,7 @@ def write_request(vault: str | os.PathLike[str], *, role: str) -> dict[str, Any]
     for zone in ("brain", "raw", "inbox"):
         (vault_p / zone).mkdir(exist_ok=True)
     payload = {"version": 1, "requested_at": _now_iso(), "role": role}
-    tmp = marker.with_suffix(".tmp")
+    tmp = atomic_temp.atomic_temp_path(marker)
     tmp.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8")
     os.replace(tmp, marker)
     return {"action": "provision-request", "status": "staged",

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/remediation_exceptions_store.py

@@ -21,6 +21,7 @@ from typing import Any, Mapping
 
 from . import remediation_state as _rs
 from .remediation_answers import unlabelled_ids
+from .atomic_temp import atomic_temp_path
 
 #: BUMPED (llm-review, s06 HIGH finding). Behaviour changed under this same
 #: string once already: an earlier build of THIS feature normalized a pair's
@@ -127,7 +128,7 @@ def _write_proposal(vault: str | os.PathLike[str], meta: Mapping[str, Any]) -> N
     d = exceptions_dir(vault) / PENDING_DIRNAME
     d.mkdir(parents=True, exist_ok=True)
     path = d / f"{meta['id']}.json"
-    tmp = path.with_name(path.name + ".tmp")
+    tmp = atomic_temp_path(path)
     tmp.write_text(json.dumps(dict(meta), indent=1, sort_keys=True), encoding="utf-8")
     os.replace(tmp, path)
 

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/remediation_state.py

@@ -52,6 +52,7 @@ from pathlib import Path
 from typing import Any, Mapping, MutableMapping
 
 from . import maintenance_escalation as _escalation
+from .atomic_temp import atomic_temp_path
 
 #: The host-private root, under ``config.index_dir(vault)``.
 DIRNAME = "remediation"
@@ -128,7 +129,7 @@ def write_state(vault: str | os.PathLike[str], state: Mapping[str, Any]) -> bool
         d = remediation_dir(vault)
         d.mkdir(parents=True, exist_ok=True)
         path = d / STATE_FILENAME
-        tmp = path.with_name(path.name + ".tmp")
+        tmp = atomic_temp_path(path)
         tmp.write_text(json.dumps(payload, indent=1, sort_keys=True), encoding="utf-8")
         os.replace(tmp, path)
         return True

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/session_hook_settings.py

@@ -19,10 +19,11 @@ from pathlib import Path
 from typing import Any
 
 from .session_hook_spec import HOOK_EVENT, HOOKS, HookSpec
+from .atomic_temp import atomic_temp_path
 
 
 def _write_json_atomic(path: Path, payload: Any) -> None:
-    tmp = path.with_name(path.name + ".tmp")
+    tmp = atomic_temp_path(path)
     tmp.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8")
     os.replace(tmp, path)
 

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/update_channels.py

@@ -4,11 +4,11 @@ from __future__ import annotations
 import os
 import shutil
 import subprocess
-import sys
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Callable, Optional
 from .cowork_snapshot_guard import snapshot_lands_on_the_mount
+from .vmstaging import tools_on_path
 from .doctor import (
     CHANNEL_EDITABLE,
     CHANNEL_PIP_USER,
@@ -233,11 +233,11 @@ def stage_engine_and_skills(
 
     vendor_status: dict[str, str] = {}
     try:
-        sys.path.insert(0, str(engine_src / "tools"))
-        import vendor_semantic_deps as vendor_deps  # type: ignore
+        with tools_on_path(engine_src):
+            import vendor_semantic_deps as vendor_deps  # type: ignore
 
-        vendor_deps.write_shim(brain_dir)
-        vendor_status = vendor_deps.stage_vendor(brain_dir)
+            vendor_deps.write_shim(brain_dir)
+            vendor_status = vendor_deps.stage_vendor(brain_dir)
     except Exception as exc:
         vendor_status = {"error": f"{type(exc).__name__}: {exc}"}
 
@@ -421,8 +421,8 @@ def restage_workspaces(
     resolve_model_source: Callable[[], tuple[Path, str]],
 ) -> list[dict]:
     """Restage every registered Cowork workspace."""
-    sys.path.insert(0, str(engine_src / "tools"))
-    import workspace_registry as workspace_registry_module  # type: ignore
+    with tools_on_path(engine_src):
+        import workspace_registry as workspace_registry_module  # type: ignore
 
     results: list[dict] = []
     model_source: tuple[Path, str] | None = None

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/vmstaging.py

@@ -29,15 +29,32 @@ marker the host can read WITHOUT executing it, or it cannot be checked at all.
 """
 from __future__ import annotations
 
+import contextlib
 import hashlib
 import re
 import shutil
+import sys
 from pathlib import Path
-from typing import Any
+from typing import Any, Iterator
 
 ARCHES = ("x86_64", "aarch64")
 
 
+@contextlib.contextmanager
+def tools_on_path(engine_src: Path) -> Iterator[None]:
+    """Put ``<engine_src>/tools`` on ``sys.path`` for the block, and ALWAYS take
+    it off again, so importing a tools module never leaves the path changed."""
+    entry = str(engine_src / "tools")
+    sys.path.insert(0, entry)
+    try:
+        yield
+    finally:
+        try:
+            sys.path.remove(entry)
+        except ValueError:
+            pass
+
+
 def stage_vm_binaries(brain_dir: Path, dist: Path) -> dict:
     """Copy each frozen ELF, its ``.version`` marker, and rewrite SHA256SUMS.
 
@@ -94,12 +111,11 @@ def stage_vm_support_files(brain_dir: Path, engine_src: Path, packaged_script) -
     """
     vendor_status: dict[str, str] = {}
     try:
-        import sys as _sys
-        _sys.path.insert(0, str(engine_src / "tools"))
-        import vendor_semantic_deps as _vsd  # type: ignore
+        with tools_on_path(engine_src):
+            import vendor_semantic_deps as _vsd  # type: ignore
 
-        _vsd.write_shim(brain_dir)                       # vendored-deps-aware shim
-        vendor_status = _vsd.stage_vendor(brain_dir)     # tokenizers + sqlite-vec per arch
+            _vsd.write_shim(brain_dir)                   # vendored-deps-aware shim
+            vendor_status = _vsd.stage_vendor(brain_dir)  # tokenizers + sqlite-vec per arch
     except Exception as exc:  # advisory — a networkless host degrades to lexical
         vendor_status = {"error": f"{type(exc).__name__}: {exc}"}
 

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brain/workspaces.py

@@ -49,6 +49,7 @@ from pathlib import Path
 from typing import Iterator, Optional
 
 from .pathkey import real_key
+from .atomic_temp import atomic_temp_path
 
 REGISTRY_VERSION = 1
 
@@ -126,7 +127,7 @@ def _load(path: Path) -> dict:
 
 def _write_atomic(path: Path, data: dict) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
-    tmp = path.with_suffix(path.suffix + ".tmp")
+    tmp = atomic_temp_path(path)
     tmp.write_text(json.dumps(data, indent=2, sort_keys=False) + "\n", encoding="utf-8")
     os.replace(tmp, path)
 

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46/src/brainiac_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brainiac-cli
-Version: 0.20.45
+Version: 0.20.46
 Summary: Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index).
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/Autopsias/brainiac
@@ -19,11 +19,12 @@ Requires-Dist: cryptography>=49
 Requires-Dist: PyYAML>=6
 Requires-Dist: regex>=2023.0.0
 Requires-Dist: keyring>=24; sys_platform == "win32"
-Requires-Dist: pypdf>=6.15.0
+Requires-Dist: pypdf>=6.21.2
 Requires-Dist: python-docx>=1.1
 Requires-Dist: python-pptx>=0.6.23
 Requires-Dist: openpyxl>=3.1
-Requires-Dist: Pillow>=12.3.0
+Requires-Dist: Pillow>=13.0.0; python_version >= "3.11"
+Requires-Dist: Pillow>=12.3.0; python_version < "3.11"
 Provides-Extra: vec
 Requires-Dist: sqlite-vec>=0.1.6; extra == "vec"
 Provides-Extra: audit
@@ -43,11 +44,12 @@ Requires-Dist: PyYAML>=6; extra == "corporate"
 Provides-Extra: yaml
 Requires-Dist: PyYAML>=6; extra == "yaml"
 Provides-Extra: ingest
-Requires-Dist: pypdf>=6.15.0; extra == "ingest"
+Requires-Dist: pypdf>=6.21.2; extra == "ingest"
 Requires-Dist: python-docx>=1.1; extra == "ingest"
 Requires-Dist: python-pptx>=0.6.23; extra == "ingest"
 Requires-Dist: openpyxl>=3.1; extra == "ingest"
-Requires-Dist: Pillow>=12.3.0; extra == "ingest"
+Requires-Dist: Pillow>=13.0.0; python_version >= "3.11" and extra == "ingest"
+Requires-Dist: Pillow>=12.3.0; python_version < "3.11" and extra == "ingest"
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == "dev"
 Requires-Dist: build>=1; extra == "dev"

{brainiac_cli-0.20.45 → brainiac_cli-0.20.46}/src/brainiac_cli.egg-info/requires.txt

@@ -6,12 +6,17 @@ huggingface-hub>=0.20
 cryptography>=49
 PyYAML>=6
 regex>=2023.0.0
-pypdf>=6.15.0
+pypdf>=6.21.2
 python-docx>=1.1
 python-pptx>=0.6.23
 openpyxl>=3.1
+
+[:python_version < "3.11"]
 Pillow>=12.3.0
 
+[:python_version >= "3.11"]
+Pillow>=13.0.0
+
 [:sys_platform == "win32"]
 keyring>=24
 
@@ -45,12 +50,17 @@ numpy>=1.24
 regex>=2023.0.0
 
 [ingest]
-pypdf>=6.15.0
+pypdf>=6.21.2
 python-docx>=1.1
 python-pptx>=0.6.23
 openpyxl>=3.1
+
+[ingest:python_version < "3.11"]
 Pillow>=12.3.0
 
+[ingest:python_version >= "3.11"]
+Pillow>=13.0.0
+
 [mcp]
 mcp<2,>=1.30.0