brainlayer 1.5.44__tar.gz → 1.5.45__tar.gz

{brainlayer-1.5.44 → brainlayer-1.5.45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: brainlayer
-Version: 1.5.44
+Version: 1.5.45
 Summary: Persistent memory MCP server for AI agents — 17 tools, semantic search, knowledge graph, on-device SQLite
 Project-URL: Homepage, https://brainlayer.etanheyman.com
 Project-URL: Repository, https://github.com/EtanHey/brainlayer
@@ -23,6 +23,7 @@ Requires-Dist: abydos>=0.5.0
 Requires-Dist: apsw>=3.45.0
 Requires-Dist: deprecation>=2.1.0
 Requires-Dist: google-api-python-client>=2.0.0
+Requires-Dist: google-auth-oauthlib>=1.1.0
 Requires-Dist: google-auth>=2.0.0
 Requires-Dist: idna<4,>=2.5
 Requires-Dist: jsonschema>=4.20.0
@@ -370,6 +371,12 @@ BRAINLAYER_ENRICH_BACKEND=groq brainlayer enrich   # Force Groq
 
 ## CLI Reference
 
+### Backups
+
+Run `brainlayer backup auth` once to authorize BrainLayer's Drive backups in your browser.
+The private token lives at `~/.config/brainlayer/drive-tokens.json`; `BRAINLAYER_DRIVE_TOKEN_PATH` overrides it.
+BrainBar uses `brainlayer backup auth --status --json` to check and `brainlayer backup auth --json` to authorize.
+
 ```bash
 brainlayer setup              # Create ~/.config/brainlayer/brainlayer.env
 brainlayer setup --launchd    # Create config and install launchd agents

{brainlayer-1.5.44 → brainlayer-1.5.45}/README.md

@@ -293,6 +293,12 @@ BRAINLAYER_ENRICH_BACKEND=groq brainlayer enrich   # Force Groq
 
 ## CLI Reference
 
+### Backups
+
+Run `brainlayer backup auth` once to authorize BrainLayer's Drive backups in your browser.
+The private token lives at `~/.config/brainlayer/drive-tokens.json`; `BRAINLAYER_DRIVE_TOKEN_PATH` overrides it.
+BrainBar uses `brainlayer backup auth --status --json` to check and `brainlayer backup auth --json` to authorize.
+
 ```bash
 brainlayer setup              # Create ~/.config/brainlayer/brainlayer.env
 brainlayer setup --launchd    # Create config and install launchd agents

{brainlayer-1.5.44 → brainlayer-1.5.45}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brainlayer"
-version = "1.5.44"
+version = "1.5.45"
 description = "Persistent memory MCP server for AI agents — 17 tools, semantic search, knowledge graph, on-device SQLite"
 license = {text = "Apache-2.0"}
 readme = "README.md"
@@ -34,6 +34,7 @@ dependencies = [
     "idna>=2.5,<4",  # Imported through requests by backup and hook entrypoints
     "google-api-python-client>=2.0.0",  # Daily DB backup upload to Google Drive
     "google-auth>=2.0.0",  # OAuth refresh for Google Drive backups
+    "google-auth-oauthlib>=1.1.0",  # Installed-app Drive consent for BrainLayer-owned backup tokens
     "ranx>=0.3.20",  # IR evaluation metrics + significance testing
     "abydos>=0.5.0",  # Beider-Morse phonetic matching for cross-script entity aliases
     "deprecation>=2.1.0",  # Imported by abydos phonetic modules used by prompt hooks

{brainlayer-1.5.44 → brainlayer-1.5.45}/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.etanhey/brainlayer",
   "title": "BrainLayer",
   "description": "Persistent memory for AI agents \u2014 local-first semantic search, knowledge graph, and 17 MCP tools with ToolAnnotations. One SQLite file, no cloud, no API keys.",
-  "version": "1.5.44",
+  "version": "1.5.45",
   "websiteUrl": "https://brainlayer.etanheyman.com",
   "repository": {
     "url": "https://github.com/EtanHey/brainlayer",
@@ -14,7 +14,7 @@
       "registryType": "pypi",
       "registryBaseUrl": "https://pypi.org",
       "identifier": "brainlayer",
-      "version": "1.5.44",
+      "version": "1.5.45",
       "runtimeHint": "pipx",
       "transport": {
         "type": "stdio"

{brainlayer-1.5.44 → brainlayer-1.5.45}/src/brainlayer/__init__.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-__version__ = "1.5.44"
+__version__ = "1.5.45"
 # Git sha the distributed package was built from; stamped by the release build, None in a source tree.
 # scripts/sprint_gate.py reads it in "keg" mode to prove the served package is the code under test.
 # No runtime `str | None` annotation: launchd/install.sh imports this under /usr/bin/python3 (3.9).

brainlayer-1.5.45/src/brainlayer/_build.py

@@ -0,0 +1 @@
+BUILD_SHA = "d3d00b64768a53e7c534ee82dc9f9938aab65f81"

{brainlayer-1.5.44 → brainlayer-1.5.45}/src/brainlayer/backup_daily.py

@@ -36,13 +36,14 @@ from typing import Any
 
 import requests
 
+from . import drive_credentials
 from .paths import get_db_path
 from .socket_hygiene import refuse_production_brainbar_socket
 
 _sleep = time.sleep
 
-DEFAULT_TOKEN_PATH = Path.home() / ".config" / "google-drive-mcp" / "tokens.json"
-DEFAULT_CLIENT_PATH = Path.home() / ".config" / "google-drive-mcp" / "gcp-oauth.keys.json"
+DEFAULT_TOKEN_PATH = drive_credentials.DEFAULT_TOKEN_PATH
+DEFAULT_CLIENT_PATH = drive_credentials.DEFAULT_CLIENT_PATH
 CANONICAL_MACHINE_ID = "MacBook-Pro"
 CANONICAL_FOLDER_PARTS = ["Brain Drive", "06_ARCHIVE", "backups", "brainlayer-db"]
 # Compatibility alias for callers that explicitly target the legacy M4 folder.
@@ -69,7 +70,7 @@ DRIVE_UPLOAD_DEADLINE_FLOOR_ENV = "BRAINLAYER_DRIVE_UPLOAD_DEADLINE_FLOOR_SECOND
 DRIVE_UPLOAD_MIN_BYTES_PER_SECOND_ENV = "BRAINLAYER_DRIVE_UPLOAD_MIN_BYTES_PER_SECOND"
 DRIVE_UPLOAD_STALL_MAX_ATTEMPTS_ENV = "BRAINLAYER_DRIVE_UPLOAD_STALL_MAX_ATTEMPTS"
 DRIVE_FOLDER_MIME = "application/vnd.google-apps.folder"
-DRIVE_SCOPES = ["https://www.googleapis.com/auth/drive"]
+DRIVE_SCOPES = drive_credentials.DRIVE_SCOPES
 DEFAULT_LOCAL_COMPRESSED_KEEP = 3
 DEFAULT_LOCAL_UNCOMPRESSED_KEEP = 1
 DEFAULT_DRIVE_KEEP = 7
@@ -986,65 +987,12 @@ def _send_brainbar_json_request(
     return json.loads(data.decode("utf-8"))
 
 
-def _atomic_write_text(path: Path, content: str) -> None:
-    temp_path = path.with_name(f".{path.name}.{os.getpid()}.tmp")
-    try:
-        temp_path.write_text(content)
-        os.replace(temp_path, path)
-    finally:
-        temp_path.unlink(missing_ok=True)
-
-
-def get_drive_credentials(token_path: Path = DEFAULT_TOKEN_PATH, client_path: Path = DEFAULT_CLIENT_PATH):
-    """Load and refresh Google Drive OAuth credentials from the existing MCP auth files."""
-    from google.auth.transport.requests import Request
-    from google.oauth2.credentials import Credentials
-
-    token_path = Path(token_path).expanduser()
-    client_path = Path(client_path).expanduser()
-    if not token_path.exists():
-        raise FileNotFoundError(f"Google Drive token file not found: {token_path}")
-    if not client_path.exists():
-        raise FileNotFoundError(f"Google OAuth client file not found: {client_path}")
-
-    lock_path = token_path.with_suffix(token_path.suffix + ".lock")
-    with lock_path.open("w") as lock_file:
-        fcntl.flock(lock_file, fcntl.LOCK_EX)
-        token_data = json.loads(token_path.read_text())
-        client_data = json.loads(client_path.read_text())["installed"]
-
-        expiry = token_data.get("expiry")
-        if not expiry and token_data.get("expiry_date"):
-            expiry = dt.datetime.fromtimestamp(int(token_data["expiry_date"]) / 1000, tz=dt.UTC).isoformat()
-
-        parsed_expiry = dt.datetime.fromisoformat(expiry.replace("Z", "+00:00")) if expiry else None
-        if parsed_expiry and parsed_expiry.tzinfo:
-            parsed_expiry = parsed_expiry.astimezone(dt.UTC).replace(tzinfo=None)
-        elif parsed_expiry:
-            parsed_expiry = parsed_expiry.replace(tzinfo=None)
-
-        creds = Credentials(
-            token=token_data.get("access_token"),
-            refresh_token=token_data.get("refresh_token"),
-            token_uri=client_data["token_uri"],
-            client_id=client_data["client_id"],
-            client_secret=client_data["client_secret"],
-            scopes=token_data.get("scope", " ".join(DRIVE_SCOPES)).split(),
-            expiry=parsed_expiry,
-        )
-
-        # google-auth Credentials.expired compares against a naive UTC helper, so keep expiry comparisons naive UTC.
-        refresh_before = dt.datetime.now(dt.UTC).replace(tzinfo=None) + dt.timedelta(hours=2)
-        if creds.expired or not creds.valid or (creds.expiry and creds.expiry < refresh_before):
-            creds.refresh(Request())
-            token_data["access_token"] = creds.token
-            token_data["expiry"] = creds.expiry.isoformat() if creds.expiry else None
-            _atomic_write_text(token_path, json.dumps(token_data, indent=2, sort_keys=True) + "\n")
+def get_drive_credentials(token_path: Path | None = None, client_path: Path | None = None):
+    """Use BrainLayer-owned credentials for both database and JSONL backups."""
+    return drive_credentials.load_credentials(token_path=token_path, client_path=client_path)
 
-    return creds
 
-
-def build_drive_service(token_path: Path = DEFAULT_TOKEN_PATH, client_path: Path = DEFAULT_CLIENT_PATH):
+def build_drive_service(token_path: Path | None = None, client_path: Path | None = None):
     from googleapiclient.discovery import build
 
     return build("drive", "v3", credentials=get_drive_credentials(token_path, client_path))
@@ -1954,7 +1902,15 @@ def main() -> int:
     timeout_seconds = _configured_backup_timeout_seconds()
     if _env_flag_enabled(BACKUP_SUPERVISED_CHILD_ENV):
         return _run_backup_process(timeout_seconds)
-    return _supervise_backup_process(timeout_seconds)
+    from .job_alerts import report
+
+    try:
+        code = _supervise_backup_process(timeout_seconds)
+    except Exception:
+        report("backup-daily", "Database backup failed; check the backup log")
+        raise
+    report("backup-daily", None if code == 0 else "Database backup failed; check the backup log")
+    return code
 
 
 if __name__ == "__main__":

{brainlayer-1.5.44 → brainlayer-1.5.45}/src/brainlayer/cli/__init__.py

@@ -50,6 +50,25 @@ sandbox_app = typer.Typer(help="Manage isolated sandbox BrainLayer databases")
 app.add_typer(sandbox_app, name="sandbox")
 jobs_app = typer.Typer(help="Inspect and restart installed BrainLayer LaunchAgents")
 app.add_typer(jobs_app, name="jobs")
+backup_app = typer.Typer(help="Manage BrainLayer backup authorization")
+app.add_typer(backup_app, name="backup")
+
+
+@backup_app.command("auth")
+def backup_auth_command(
+    status: bool = typer.Option(False, "--status", help="Check authorization without changing the token."),
+    json_output: bool = typer.Option(False, "--json", help="Print one JSON result for BrainBar."),
+) -> None:
+    """Authorize the BrainLayer-owned Google Drive token in the system browser."""
+    from .. import drive_credentials
+
+    result = drive_credentials.credential_status() if status else drive_credentials.authorize()
+    if json_output:
+        typer.echo(json.dumps(result, sort_keys=True))
+    else:
+        typer.echo(result["reason"])
+    if not status and result["status"] != "ok":
+        raise typer.Exit(1)
 
 
 @jobs_app.command("restart")
@@ -2804,6 +2823,7 @@ def wal_checkpoint(
     quiet: bool = typer.Option(False, "--quiet", help="Silent unless error"),
 ) -> None:
     """Run a SQLite WAL checkpoint through the BrainLayer CLI."""
+    from ..job_alerts import report as report_job_alert
     from ..wal_checkpoint import run_wal_checkpoint
 
     normalized_mode = mode.upper()
@@ -2815,12 +2835,14 @@ def wal_checkpoint(
             run_wal_checkpoint(normalized_mode, retry_busy=True) if retry_busy else run_wal_checkpoint(normalized_mode)
         )
     except FileNotFoundError as e:
+        report_job_alert("wal-checkpoint", "BrainLayer WAL checkpoint failed; check the job log")
         if json_output:
             console.print_json(data={"error": str(e)})
         elif not quiet:
             rprint(f"[bold red]Error:[/] {e}")
         raise typer.Exit(1)
     except Exception as e:
+        report_job_alert("wal-checkpoint", "BrainLayer WAL checkpoint failed; check the job log")
         if json_output:
             console.print_json(data={"error": str(e)})
         elif not quiet:
@@ -2838,7 +2860,9 @@ def wal_checkpoint(
         )
 
     if result["busy"]:
+        report_job_alert("wal-checkpoint", "BrainLayer WAL checkpoint was busy; check the job log")
         raise typer.Exit(1)
+    report_job_alert("wal-checkpoint", None)
 
 
 @app.command("repair-fts")
@@ -2846,6 +2870,7 @@ def repair_fts(
     db_path: Path | None = typer.Argument(None, help="Offline database copy; omitted means read-only FTS count check."),
 ) -> None:
     """Check live FTS counts read-only, or rebuild an explicit offline copy."""
+    from ..job_alerts import report as report_job_alert
     from ..runtime_store import OfflineMigrator, check_fts_counts
 
     try:
@@ -2858,8 +2883,13 @@ def repair_fts(
             finally:
                 store.close()
     except PermissionError as exc:
+        report_job_alert("repair-fts", "BrainLayer FTS repair failed; check the job log")
         rprint(f"[bold red]Repair refused:[/] {exc}")
         raise typer.Exit(1) from exc
+    except Exception:
+        report_job_alert("repair-fts", "BrainLayer FTS repair failed; check the job log")
+        raise
+    report_job_alert("repair-fts", None)
     console.print_json(data=result)
 
 

brainlayer-1.5.45/src/brainlayer/drive_credentials.py

@@ -0,0 +1,313 @@
+"""BrainLayer-owned Google Drive credentials shared by both backup jobs.
+
+The MCP's token is a migration source only. Backup refreshes and interactive auth
+write solely to BrainLayer's private token path.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import datetime as dt
+import fcntl
+import json
+import logging
+import os
+import socket
+import stat
+import tempfile
+from pathlib import Path
+from typing import Any
+
+from . import job_alerts
+
+DRIVE_SCOPES = ["https://www.googleapis.com/auth/drive"]
+TOKEN_ENV = "BRAINLAYER_DRIVE_TOKEN_PATH"
+CLIENT_ENV = "BRAINLAYER_DRIVE_CLIENT_PATH"
+DEFAULT_TOKEN_PATH = Path.home() / ".config/brainlayer/drive-tokens.json"
+DEFAULT_CLIENT_PATH = Path.home() / ".config/google-drive-mcp/gcp-oauth.keys.json"
+LEGACY_TOKEN_PATH = Path.home() / ".config/google-drive-mcp/tokens.json"
+LOGGER = logging.getLogger(__name__)
+
+
+def _report_consent(reporter: Any, reason: str | None) -> None:
+    try:
+        reporter("drive-consent", reason)
+    except OSError:
+        LOGGER.warning("Drive consent alert could not be recorded")
+
+
+class DriveCredentialError(RuntimeError):
+    """A payload-free credential failure safe for logs and notifications."""
+
+
+def resolve_paths(*, environ: dict[str, str] | None = None, home: Path | None = None) -> tuple[Path, Path, Path]:
+    environ = os.environ if environ is None else environ
+    home = Path.home() if home is None else Path(home)
+    token = Path(environ.get(TOKEN_ENV) or home / ".config/brainlayer/drive-tokens.json").expanduser()
+    client = Path(environ.get(CLIENT_ENV) or home / ".config/google-drive-mcp/gcp-oauth.keys.json").expanduser()
+    legacy = home / ".config/google-drive-mcp/tokens.json"
+    return token, client, legacy
+
+
+def _paths(
+    token_path: Path | None, client_path: Path | None, legacy_token_path: Path | None
+) -> tuple[Path, Path, Path]:
+    defaults = resolve_paths()
+    return tuple(
+        Path(path).expanduser() if path is not None else default
+        for path, default in zip((token_path, client_path, legacy_token_path), defaults, strict=True)
+    )
+
+
+def _read_object(path: Path, *, private: bool) -> dict[str, Any]:
+    try:
+        fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW)
+    except FileNotFoundError:
+        raise DriveCredentialError("BrainLayer Drive token missing; run brainlayer backup auth") from None
+    except OSError:
+        raise DriveCredentialError("Drive credential file cannot be read") from None
+    try:
+        metadata = os.fstat(fd)
+        if not stat.S_ISREG(metadata.st_mode) or metadata.st_uid != os.getuid():
+            raise DriveCredentialError("Drive credential file must be a regular file owned by this user")
+        if private and stat.S_IMODE(metadata.st_mode) != 0o600:
+            raise DriveCredentialError("BrainLayer Drive token must have mode 0600")
+        with os.fdopen(fd, "r", encoding="utf-8") as stream:
+            fd = -1
+            payload = json.load(stream)
+        if not isinstance(payload, dict):
+            raise ValueError("not an object")
+        return payload
+    except (UnicodeError, ValueError, OSError):
+        raise DriveCredentialError("Drive credential file is invalid") from None
+    finally:
+        if fd >= 0:
+            os.close(fd)
+
+
+def _atomic_write(path: Path, payload: dict[str, Any]) -> None:
+    path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", suffix=".tmp", dir=path.parent)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as stream:
+            os.fchmod(stream.fileno(), 0o600)
+            json.dump(payload, stream, indent=2, sort_keys=True)
+            stream.write("\n")
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.replace(name, path)
+    finally:
+        # Only an uncommitted temporary file is removable; a token is never deleted.
+        if os.path.exists(name):
+            os.unlink(name)
+
+
+@contextlib.contextmanager
+def _token_lock(path: Path):
+    path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    lock_path = path.with_suffix(path.suffix + ".lock")
+    fd = os.open(lock_path, os.O_CREAT | os.O_RDWR | os.O_NOFOLLOW, 0o600)
+    try:
+        fcntl.flock(fd, fcntl.LOCK_EX)
+        yield
+    finally:
+        fcntl.flock(fd, fcntl.LOCK_UN)
+        os.close(fd)
+
+
+def _migrate_if_missing(token: Path, legacy: Path) -> None:
+    if token.exists() or not legacy.exists():
+        return
+    payload = _read_object(legacy, private=False)
+    if not payload.get("access_token") or not payload.get("refresh_token"):
+        raise DriveCredentialError("Legacy Drive token is invalid; run brainlayer backup auth")
+    _atomic_write(token, payload)
+    LOGGER.warning("Copied legacy Google Drive token into BrainLayer-owned storage; legacy token retained")
+
+
+def _expiry(data: dict[str, Any]) -> dt.datetime | None:
+    raw = data.get("expiry")
+    if not raw and data.get("expiry_date"):
+        raw = dt.datetime.fromtimestamp(int(data["expiry_date"]) / 1000, tz=dt.UTC).isoformat()
+    if not raw:
+        return None
+    parsed = dt.datetime.fromisoformat(str(raw).replace("Z", "+00:00"))
+    return parsed.astimezone(dt.UTC).replace(tzinfo=None) if parsed.tzinfo else parsed
+
+
+def load_credentials(
+    *,
+    token_path: Path | None = None,
+    client_path: Path | None = None,
+    legacy_token_path: Path | None = None,
+    credentials_class: Any = None,
+    request_factory: Any = None,
+    migrate: bool = True,
+    persist_refresh: bool = True,
+    now: dt.datetime | None = None,
+    alert_reporter: Any = job_alerts.report,
+):
+    """Read/refresh under one lock; never erase the prior token on any failure."""
+    if credentials_class is None:
+        from google.oauth2.credentials import Credentials
+
+        credentials_class = Credentials
+    if request_factory is None:
+        from google.auth.transport.requests import Request
+
+        request_factory = Request
+    token, client, legacy = _paths(token_path, client_path, legacy_token_path)
+    with _token_lock(token):
+        if migrate:
+            _migrate_if_missing(token, legacy)
+        token_data = _read_object(token, private=True)
+        consented = token_data.get("consented_at")
+        if consented:
+            try:
+                consent_time = dt.datetime.fromisoformat(str(consented).replace("Z", "+00:00")).astimezone(dt.UTC)
+            except ValueError:
+                raise DriveCredentialError("BrainLayer Drive consent metadata is invalid") from None
+            remaining = consent_time + dt.timedelta(days=7) - (now or dt.datetime.now(dt.UTC)).astimezone(dt.UTC)
+            if remaining <= dt.timedelta(0):
+                _report_consent(alert_reporter, "Drive access expired: Reconnect in BrainBar")
+                raise DriveCredentialError("Drive access expired: Reconnect in BrainBar")
+            if remaining < dt.timedelta(days=1):
+                _report_consent(
+                    alert_reporter,
+                    "Google Drive access for BrainLayer backups expires tomorrow: click Reconnect in BrainBar",
+                )
+        if not token_data.get("refresh_token"):
+            raise DriveCredentialError("BrainLayer Drive token lacks refresh authorization; run brainlayer backup auth")
+        try:
+            client_data = _read_object(client, private=False)["installed"]
+            creds = credentials_class(
+                token=token_data.get("access_token"),
+                refresh_token=token_data.get("refresh_token"),
+                token_uri=client_data["token_uri"],
+                client_id=client_data["client_id"],
+                client_secret=client_data["client_secret"],
+                scopes=str(token_data.get("scope") or " ".join(DRIVE_SCOPES)).split(),
+                expiry=_expiry(token_data),
+            )
+        except (KeyError, TypeError, ValueError, DriveCredentialError):
+            raise DriveCredentialError("Google OAuth client or BrainLayer token is invalid") from None
+        refresh_before = dt.datetime.now(dt.UTC).replace(tzinfo=None) + dt.timedelta(hours=2)
+        if creds.expired or not creds.valid or (creds.expiry and creds.expiry < refresh_before):
+            try:
+                creds.refresh(request_factory())
+            except Exception as exc:
+                from google.auth.exceptions import TransportError
+
+                if isinstance(exc, TransportError):
+                    raise TransportError("Drive token refresh network failure") from None
+                if "invalid_grant" in str(exc).lower():
+                    _report_consent(alert_reporter, "Drive access expired: Reconnect in BrainBar")
+                    raise DriveCredentialError("Drive access expired: Reconnect in BrainBar") from None
+                raise DriveCredentialError("Drive token refresh failed; run brainlayer backup auth") from None
+            if persist_refresh:
+                token_data["access_token"] = creds.token
+                token_data["expiry"] = creds.expiry.isoformat() if creds.expiry else None
+                _atomic_write(token, token_data)
+        return creds
+
+
+def credential_status(*, now: dt.datetime | None = None, **kwargs: Any) -> dict[str, Any]:
+    """Check the owned token only; do not migrate or write a refreshed token."""
+    from google.auth.exceptions import TransportError
+
+    token, _, _ = _paths(kwargs.get("token_path"), kwargs.get("client_path"), None)
+    if not token.exists():
+        return {
+            "state": "missing",
+            "reason": "BrainLayer Drive authorization is missing",
+            "expires_at": None,
+            "days_left": None,
+        }
+    try:
+        data = _read_object(token, private=True)
+        consented = data.get("consented_at")
+        try:
+            expires = (
+                dt.datetime.fromisoformat(str(consented).replace("Z", "+00:00")) + dt.timedelta(days=7)
+                if consented
+                else None
+            )
+            if expires and expires.tzinfo is None:
+                raise ValueError("consent time has no timezone")
+        except ValueError:
+            raise DriveCredentialError("BrainLayer Drive consent metadata is invalid") from None
+        current = (now or dt.datetime.now(dt.UTC)).astimezone(dt.UTC)
+        days_left = max(0.0, (expires - current).total_seconds() / 86400) if expires else None
+        timing = {"expires_at": expires.isoformat() if expires else None, "days_left": days_left}
+        if expires and current >= expires:
+            _report_consent(
+                kwargs.get("alert_reporter", job_alerts.report), "Drive access expired: Reconnect in BrainBar"
+            )
+            return {"state": "invalid", "reason": "Drive access expired: Reconnect in BrainBar", **timing}
+        load_credentials(**kwargs, migrate=False, persist_refresh=False, now=now)
+    except TransportError:
+        return {
+            "state": "expiring" if days_left is not None and days_left < 1 else "valid",
+            "reason": "status checked offline; last known state",
+            **timing,
+        }
+    except DriveCredentialError as exc:
+        return {"state": "invalid", "reason": str(exc), "expires_at": None, "days_left": None}
+    if days_left is not None and days_left < 1:
+        return {
+            "state": "expiring",
+            "reason": "Google Drive access for BrainLayer backups expires tomorrow: click Reconnect in BrainBar",
+            **timing,
+        }
+    return {"state": "valid", "reason": "BrainLayer Drive authorization is ready", **timing}
+
+
+def authorize(
+    *,
+    token_path: Path | None = None,
+    client_path: Path | None = None,
+    flow_class: Any = None,
+    now: dt.datetime | None = None,
+    alert_reporter: Any = job_alerts.report,
+) -> dict[str, str]:
+    """Open Google consent in the system browser and save only BrainLayer's token."""
+    from oauthlib.oauth2.rfc6749.errors import AccessDeniedError
+
+    token, client, _ = _paths(token_path, client_path, None)
+    if flow_class is None:
+        from google_auth_oauthlib.flow import InstalledAppFlow
+
+        flow_class = InstalledAppFlow
+    try:
+        _read_object(client, private=False)
+        flow = flow_class.from_client_secrets_file(str(client), scopes=DRIVE_SCOPES)
+        # Suppress the consent URL on stdout; BrainBar expects one JSON result.
+        creds = flow.run_local_server(
+            host="localhost",
+            bind_addr="127.0.0.1",
+            port=0,
+            timeout_seconds=180,
+            open_browser=True,
+            authorization_prompt_message=None,
+            access_type="offline",
+            prompt="consent",
+        )
+        if not creds.refresh_token:
+            raise DriveCredentialError("Google did not grant refresh authorization")
+        payload = {
+            "access_token": creds.token,
+            "refresh_token": creds.refresh_token,
+            "expiry": creds.expiry.isoformat() if creds.expiry else None,
+            "scope": " ".join(DRIVE_SCOPES),
+            "consented_at": (now or dt.datetime.now(dt.UTC)).astimezone(dt.UTC).isoformat(),
+        }
+        with _token_lock(token):
+            _atomic_write(token, payload)
+        _report_consent(alert_reporter, None)
+        return {"status": "ok", "reason": "BrainLayer Drive authorization saved"}
+    except (KeyboardInterrupt, AccessDeniedError):
+        return {"status": "cancelled", "reason": "Google authorization cancelled"}
+    except Exception as exc:
+        if isinstance(exc, (socket.timeout, TimeoutError)) or type(exc).__name__ == "WSGITimeoutError":
+            return {"status": "timeout", "reason": "Google authorization timed out"}
+        return {"status": "error", "reason": "Google authorization failed; retry brainlayer backup auth"}

{brainlayer-1.5.44 → brainlayer-1.5.45}/src/brainlayer/health_check.py

@@ -121,6 +121,7 @@ class HealthIssue:
 class HealthCheckConfig:
     db_path: Path = field(default_factory=get_db_path)
     state_path: Path = field(default_factory=lambda: DEFAULT_STATE_PATH)
+    job_alert_path: Path | None = None
     badge_state_path: Path | None = None
     job_opt_path: Path | None = field(default_factory=installed_opt_path)
     job_plist_dir: Path = field(default_factory=lambda: Path("~/Library/LaunchAgents").expanduser())
@@ -1283,6 +1284,11 @@ def _run_health_check_locked(
     if state.get("_state_corrupt_now"):
         add_issue("job_state_unknown", "critical", str(state["state_corrupt"]))
 
+    from .job_alerts import active_alerts
+
+    for job, reason in active_alerts(config.job_alert_path).items():
+        add_issue(f"job_alert_{job}", "critical", reason)
+
     def publish_badge_state() -> None:
         if config.badge_state_path is None:
             return