brainlayer 1.5.71__tar.gz → 1.5.72__tar.gz

{brainlayer-1.5.71 → brainlayer-1.5.72}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: brainlayer
-Version: 1.5.71
+Version: 1.5.72
 Summary: Persistent local memory for AI agents — 16 BrainBar MCP tools, semantic search, knowledge graph, SQLite
 Project-URL: Homepage, https://brainlayer.etanheyman.com
 Project-URL: Repository, https://github.com/EtanHey/brainlayer

{brainlayer-1.5.71 → brainlayer-1.5.72}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brainlayer"
-version = "1.5.71"
+version = "1.5.72"
 description = "Persistent local memory for AI agents — 16 BrainBar MCP tools, semantic search, knowledge graph, SQLite"
 license = {text = "Apache-2.0"}
 readme = "README.md"

{brainlayer-1.5.71 → brainlayer-1.5.72}/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.etanhey/brainlayer",
   "title": "BrainLayer",
   "description": "Persistent local memory for AI agents \u2014 semantic search, knowledge graph, and 16 BrainBar MCP tools with ToolAnnotations over SQLite.",
-  "version": "1.5.71",
+  "version": "1.5.72",
   "websiteUrl": "https://brainlayer.etanheyman.com",
   "repository": {
     "url": "https://github.com/EtanHey/brainlayer",
@@ -14,7 +14,7 @@
       "registryType": "pypi",
       "registryBaseUrl": "https://pypi.org",
       "identifier": "brainlayer",
-      "version": "1.5.71",
+      "version": "1.5.72",
       "runtimeHint": "pipx",
       "transport": {
         "type": "stdio"

{brainlayer-1.5.71 → brainlayer-1.5.72}/src/brainlayer/__init__.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-__version__ = "1.5.71"
+__version__ = "1.5.72"
 # Git sha the distributed package was built from; stamped by the release build, None in a source tree.
 # scripts/sprint_gate.py reads it in "keg" mode to prove the served package is the code under test.
 # No runtime `str | None` annotation: launchd/install.sh imports this under /usr/bin/python3 (3.9).

brainlayer-1.5.72/src/brainlayer/_build.py

@@ -0,0 +1 @@
+BUILD_SHA = "bfd456ed149a3b573153318a684f8e4fbc6babb8"

{brainlayer-1.5.71 → brainlayer-1.5.72}/src/brainlayer/spotlight.py

@@ -1,6 +1,7 @@
 """Lightweight Spotlight exclusion layout preflight."""
 
 import os
+import stat
 from pathlib import Path
 from typing import Callable, Optional, Tuple
 
@@ -26,7 +27,6 @@ _UNSUPPORTED_RUNTIME_PATH_OVERRIDES = (
     "BRAINLAYER_DRAIN_LOG_PATH",
     "BRAINLAYER_ENRICH_COST_DIR",
     "BRAINLAYER_JSONL_BACKUP_LOG_PATH",
-    "BRAINLAYER_JSONL_BACKUP_STAGING_DIR",
     "BRAINLAYER_JSONL_BACKUP_STATE_PATH",
     "BRAINLAYER_LOG_DIR",
     "BRAINLAYER_OFFSETS_PATH",
@@ -87,6 +87,52 @@ def _validate_disjoint_roots(roots: Tuple[Path, ...]) -> None:
                 raise RuntimeError(f"Spotlight exclusion roots must not overlap: {other} and {root}")
 
 
+def _validate_jsonl_staging_override(
+    env_file: Optional[Path], data_roots: Tuple[Path, ...], *, ismount: Callable[[Path], bool]
+) -> None:
+    from .config import configured_brainlayer_env_value
+
+    name = "BRAINLAYER_JSONL_BACKUP_STAGING_DIR"
+    configured = configured_brainlayer_env_value(name, env_file) if env_file is not None else None
+    # Validate both launchd's selected file and the current CLI's process-first value.
+    for value in dict.fromkeys((configured, os.environ.get(name, configured))):
+        if value in (None, ""):
+            continue
+        stage = Path(value)
+        if not stage.is_absolute() or ".." in stage.parts:
+            raise RuntimeError(f"{name} must be an absolute path without parent traversal: {stage}")
+        root = next(
+            (root for root in data_roots if root / "jsonl-backups" in stage.parents),
+            None,
+        )
+        if root is None:
+            raise RuntimeError(f"{name} must be a dedicated descendant of a managed jsonl-backups directory: {stage}")
+        for component in (*reversed(stage.parents), stage):
+            try:
+                info = component.lstat()
+            except FileNotFoundError:
+                continue
+            if not stat.S_ISDIR(info.st_mode):
+                raise RuntimeError(f"{name} ancestor must be a directory, never a symbolic link: {component}")
+            if info.st_uid not in (0, os.geteuid()) or info.st_mode & 0o022:
+                raise RuntimeError(f"{name} has an unsafe ancestor owner or mode: {component}")
+            if (component == root or root in component.parents) and ismount(component):
+                raise RuntimeError(f"{name} must not cross a mount boundary: {component}")
+            if component == stage and (info.st_uid != os.geteuid() or info.st_mode & 0o077):
+                raise RuntimeError(f"{name} must be a private directory owned by the current user: {stage}")
+        marker = root / SPOTLIGHT_EXCLUSION_MARKER
+        try:
+            marker_info = marker.lstat()
+        except FileNotFoundError as exc:
+            raise RuntimeError(f"{name} requires a marker-backed managed data root: {root}") from exc
+        if (
+            not stat.S_ISREG(marker_info.st_mode)
+            or marker_info.st_uid not in (0, os.geteuid())
+            or marker_info.st_mode & 0o022
+        ):
+            raise RuntimeError(f"{name} requires a safe regular exclusion marker: {marker}")
+
+
 def _ensure_spotlight_excluded_root(root: Path, children: Tuple[str, ...] = ()) -> Path:
     resolved = root.expanduser()
     resolved.mkdir(parents=True, exist_ok=True)
@@ -145,6 +191,7 @@ def ensure_spotlight_excluded_layout(
         if root.is_dir() and not marker.is_file() and next(root.iterdir(), None) is not None:
             raise RuntimeError(f"existing runtime tree {root} requires the Spotlight exclusion migration runbook")
 
+    _validate_jsonl_staging_override(env_file, tuple(resolved_roots[: len(data_roots)]), ismount=ismount_fn)
     data_root_count = len(data_roots)
     return (
         *(_ensure_spotlight_excluded_root(root, _DATA_CHILDREN) for root in resolved_roots[:data_root_count]),

brainlayer-1.5.71/src/brainlayer/_build.py

@@ -1 +0,0 @@
-BUILD_SHA = "bdd90a907a55d35bba00b0618e2458dd21249c2d"