compartment 4.2__tar.gz → 4.3__tar.gz

{compartment-4.2/src/compartment.egg-info → compartment-4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: compartment
-Version: 4.2
+Version: 4.3
 Summary: Compartment - high-security, fully offline, encrypted vector memory for AI agents (MCP)
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/MaxFreedomPollard/Compartment

{compartment-4.2 → compartment-4.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "compartment"
-version = "4.2"
+version = "4.3"
 description = "Compartment - high-security, fully offline, encrypted vector memory for AI agents (MCP)"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{compartment-4.2 → compartment-4.3}/src/compartment/__init__.py

@@ -1,6 +1,6 @@
 """Compartment - high-security, fully offline, encrypted vector memory for AI agents."""
 
-__version__ = "4.2"
+__version__ = "4.3"
 
 from . import offline_guard as _og
 

{compartment-4.2 → compartment-4.3}/src/compartment/menubar.py

@@ -664,11 +664,12 @@ def _launcher_argv() -> list[str]:
 def _set_login_agent(enabled: bool) -> str:
     plist = _agent_plist()
     if not enabled:
-        try:
-            subprocess.run(["launchctl", "unload", str(plist)],
-                           capture_output=True, timeout=10)
-        except (OSError, subprocess.SubprocessError):
-            pass
+        # bootout first: with KeepAlive set, a running copy that is still
+        # registered would be restarted by launchd after the plist was
+        # deleted, and the icon would come back from a file that no longer
+        # exists. Unload stays as the fallback for older macOS.
+        _launchctl("bootout", f"{_gui_domain()}/{LAUNCH_AGENT_LABEL}")
+        _launchctl("unload", str(plist))
         plist.unlink(missing_ok=True)
         return "off"
     argv = _launcher_argv()
@@ -684,15 +685,67 @@ def _set_login_agent(enabled: bool) -> str:
         '    <key>ProgramArguments</key>\n'
         f'    <array>\n{args}    </array>\n'
         '    <key>RunAtLoad</key><true/>\n'
-        '    <key>KeepAlive</key><false/>\n'
+        # KeepAlive was <false/>, which made this a one-shot: launchd started
+        # the app at login and then never looked at it again. Anything that
+        # ended the process - a crash, an ObjC exception, macOS reclaiming
+        # memory, an upgrade replacing the binary underneath it - took the
+        # icon out of the menu bar until the next login, with nothing said.
+        # A status bar app is meant to sit there for as long as the machine
+        # is up.
+        #
+        # SuccessfulExit false is the form that means "bring it back if it
+        # died, leave it alone if it left". Quit calls NSApp.terminate_, which
+        # exits 0, so the one way to remove the icon is still the one the user
+        # asked for. A crash exits non-zero and comes straight back.
+        '    <key>KeepAlive</key>\n'
+        '    <dict>\n'
+        '      <key>SuccessfulExit</key><false/>\n'
+        '    </dict>\n'
         '  </dict>\n'
         '</plist>\n', encoding="utf-8")
+    return _bootstrap_agent(plist)
+
+
+def _launchctl(*argv: str) -> tuple[int, str]:
+    """Run launchctl and actually look at what it said."""
     try:
-        subprocess.run(["launchctl", "load", str(plist)],
-                       capture_output=True, timeout=10)
+        r = subprocess.run(["launchctl", *argv], capture_output=True,
+                           text=True, timeout=15)
     except (OSError, subprocess.SubprocessError) as exc:
-        return f"failed: {exc}"
-    return "on"
+        return 1, str(exc)
+    return r.returncode, (r.stderr or r.stdout or "").strip()
+
+
+def _gui_domain() -> str:
+    """launchd's per-user domain. `os.getuid` is POSIX-only and this module
+    is imported on every platform, so it is asked for rather than assumed:
+    an AttributeError here would take down anything that merely touched the
+    login-agent code on Windows."""
+    uid = getattr(os, "getuid", None)
+    return f"gui/{uid() if uid else 0}"
+
+
+def _bootstrap_agent(plist: Path) -> str:
+    """Load the agent, and report a refusal as one.
+
+    The old code ran `launchctl load` and threw the result away, so a plist
+    that was written but never loaded reported "on" and started nothing at
+    the next login - which is exactly the state a machine ends up in when
+    the label is already bootstrapped and load quietly refuses.
+
+    `bootstrap` is the modern verb and the only one that reports properly.
+    An existing registration is booted out first so this is idempotent, and
+    `load` remains as the fallback for macOS versions that predate it.
+    """
+    domain = _gui_domain()
+    _launchctl("bootout", f"{domain}/{LAUNCH_AGENT_LABEL}")   # ok if absent
+    code, msg = _launchctl("bootstrap", domain, str(plist))
+    if code == 0:
+        return "on"
+    code, msg2 = _launchctl("load", "-w", str(plist))         # older macOS
+    if code == 0:
+        return "on"
+    return f"failed: {msg or msg2 or 'launchctl refused the agent'}"
 
 
 def login_status() -> str:

{compartment-4.2 → compartment-4.3}/src/compartment/systray.py

@@ -223,6 +223,52 @@ def remove_desktop_entry() -> bool:
         return False
 
 
+# --- starting at login on Linux ---------------------------------------------
+# An entry in the applications menu makes Compartment findable. It does not
+# make it run, and the two were being treated as one thing: `login_status`
+# answered "on" whenever the menu entry existed, so a desktop that had never
+# started Compartment at login reported that it did. The autostart directory
+# is a different directory with a different meaning, and this is it.
+
+def autostart_entry_path() -> Path:
+    base = os.environ.get("XDG_CONFIG_HOME") or str(Path.home() / ".config")
+    return Path(base) / "autostart" / DESKTOP_FILE
+
+
+def install_autostart_entry(vault: str | None = None) -> str:
+    """Start Compartment at login, the way every XDG desktop reads it."""
+    path = autostart_entry_path()
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        icon = app_icon_path()
+        path.write_text(
+            "[Desktop Entry]\n"
+            "Type=Application\n"
+            "Name=Compartment\n"
+            "Comment=Encrypted memory for AI agents\n"
+            f"Exec={_panel_command(vault)}\n"
+            + (f"Icon={icon}\n" if icon.is_file() else "")
+            + "Terminal=false\n"
+            # GNOME and KDE both read these, and without them a session can
+            # decide an autostart entry is stale and skip it.
+            "X-GNOME-Autostart-enabled=true\n"
+            "Hidden=false\n"
+            "NoDisplay=false\n",
+            encoding="utf-8")
+        path.chmod(0o644)
+    except OSError as exc:
+        return f"error: {exc}"
+    return str(path)
+
+
+def remove_autostart_entry() -> bool:
+    try:
+        autostart_entry_path().unlink(missing_ok=True)
+        return True
+    except OSError:
+        return False
+
+
 def _is_linux() -> bool:
     """This module draws the panel on Windows and on everything that is not
     macOS. Only the latter uses desktop entries, and macOS must never get
@@ -233,9 +279,10 @@ def _is_linux() -> bool:
 
 def login_status() -> str:
     if _is_linux():
-        # No tray to sit in, so nothing worth starting at login: the panel is
-        # opened when it is wanted, from the applications menu.
-        return "on" if desktop_entry_path().is_file() else "off"
+        # The autostart entry, not the applications-menu entry. Reading the
+        # menu entry meant this said "on" for a machine that had never
+        # started Compartment at login in its life.
+        return "on" if autostart_entry_path().is_file() else "off"
     try:
         winreg = _winreg()
         with winreg.OpenKey(winreg.HKEY_CURRENT_USER, RUN_KEY) as k:
@@ -251,9 +298,15 @@ def set_login(enabled: bool) -> str:
     """Register or drop the Run entry. Returns what actually happened."""
     if _is_linux():
         if not enabled:
+            remove_autostart_entry()
             return "off" if remove_desktop_entry() else "error"
+        # Both, and they are not the same thing: the menu entry is how the
+        # app is found, the autostart entry is how it comes up at login.
         out = install_desktop_entry()
-        return "on" if not out.startswith("error") else out
+        if out.startswith("error"):
+            return out
+        auto = install_autostart_entry()
+        return "on" if not auto.startswith("error") else auto
     if sys.platform != "win32":
         return "error: start at login is handled by the menu bar app here"
     try:
@@ -262,6 +315,13 @@ def set_login(enabled: bool) -> str:
             if enabled:
                 winreg.SetValueEx(k, RUN_VALUE, 0, winreg.REG_SZ,
                                   _autostart_command())
+                # Read it back. A write that the registry accepted and then
+                # dropped - a policy, a locked hive, a roaming profile - used
+                # to report "on" and start nothing at the next sign-in.
+                try:
+                    winreg.QueryValueEx(k, RUN_VALUE)
+                except FileNotFoundError:
+                    return "error: the Run entry did not survive the write"
                 return "on"
             try:
                 winreg.DeleteValue(k, RUN_VALUE)
@@ -718,4 +778,6 @@ def quit_running() -> bool:
 
 __all__ = ["run", "self_check", "login_status", "set_login", "quit_running",
            "panel_rows",
+           "autostart_entry_path", "install_autostart_entry",
+           "remove_autostart_entry",
            "icon_path"]

{compartment-4.2 → compartment-4.3/src/compartment.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: compartment
-Version: 4.2
+Version: 4.3
 Summary: Compartment - high-security, fully offline, encrypted vector memory for AI agents (MCP)
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/MaxFreedomPollard/Compartment

{compartment-4.2 → compartment-4.3}/src/compartment.egg-info/SOURCES.txt

@@ -84,6 +84,7 @@ tests/test_starter_data_quality.py
 tests/test_starter_packs.py
 tests/test_starter_visibility.py
 tests/test_status_bar_install.py
+tests/test_stays_running.py
 tests/test_systray.py
 tests/test_tamper.py
 tests/test_twofa.py

{compartment-4.2 → compartment-4.3}/tests/test_attempt_pacing.py

@@ -78,12 +78,21 @@ def test_no_lockout_the_right_passphrase_still_opens_after_many_failures(
 
 def test_a_correct_attempt_clears_the_pacing(vault_path, fast):
     Vault.create(vault_path, PASS, creator="t").lock()
+    # What an unlock costs with nothing pacing it. Argon2 and opening the
+    # file are not free, and on a loaded CI runner they can take longer than
+    # the whole test interval, so "no wait was added" has to be measured
+    # against that cost rather than against a flat number. Comparing to 0.4s
+    # made this a test of how busy the machine was.
+    start = time.monotonic()
+    Vault.unlock(vault_path, passphrase=PASS).lock()
+    baseline = time.monotonic() - start
+
     with pytest.raises((TamperError, CryptoError)):
         Vault.unlock(vault_path, passphrase="wrong")
     Vault.unlock(vault_path, passphrase=PASS).lock()   # pays the wait once
     start = time.monotonic()
     Vault.unlock(vault_path, passphrase=PASS).lock()   # and not again
-    assert time.monotonic() - start < fast
+    assert time.monotonic() - start < baseline + fast
 
 
 def test_the_user_is_told_why_it_is_waiting(vault_path, fast, capsys):

compartment-4.3/tests/test_stays_running.py

@@ -0,0 +1,169 @@
+"""The icon is supposed to be there until somebody quits it.
+
+A status bar app is not a program you launch, it is a program that is simply
+there, like the clock and the battery. Every fault covered here ended the same
+way for the user: the icon was gone, nothing said why, and the fix was to know
+a command. So these are about persistence rather than appearance.
+
+  - macOS started the app once at login and then stopped caring. Anything
+    that ended the process took the icon away until the next login.
+  - macOS also reported success for an agent it had failed to load, so an
+    install could say "start at login: on" and start nothing.
+  - Linux answered the same question by looking at the applications menu,
+    which says whether Compartment can be found, not whether it runs.
+  - Windows wrote a Run entry without ever reading it back.
+"""
+import plistlib
+import sys
+
+import pytest
+
+from compartment import menubar, systray
+
+
+# ------------------------------------------------------------------- macOS
+
+def _plist(monkeypatch, tmp_path):
+    """Write the login agent into a temp home and hand back the parsed dict."""
+    monkeypatch.setattr(menubar.Path, "home", classmethod(lambda cls: tmp_path))
+    monkeypatch.setattr(menubar, "_launcher_argv", lambda: ["/bin/true"])
+    calls = []
+    monkeypatch.setattr(menubar, "_launchctl",
+                        lambda *a: (calls.append(a), (0, ""))[1])
+    out = menubar._set_login_agent(True)
+    path = tmp_path / "Library" / "LaunchAgents" / f"{menubar.LAUNCH_AGENT_LABEL}.plist"
+    return out, plistlib.loads(path.read_bytes()), calls, path
+
+
+def test_launchd_brings_the_icon_back_after_a_crash(monkeypatch, tmp_path):
+    _out, data, _calls, _p = _plist(monkeypatch, tmp_path)
+    # Not False, and not True either. False is the one-shot that lost the
+    # icon on any unexpected exit; plain True would fight the Quit button.
+    assert data["KeepAlive"] == {"SuccessfulExit": False}
+    assert data["RunAtLoad"] is True
+
+
+def test_quitting_on_purpose_is_still_allowed_to_win(monkeypatch, tmp_path):
+    """SuccessfulExit false means launchd relaunches a non-zero exit only.
+    Quit goes through NSApp.terminate_, which exits zero, so the icon stays
+    gone until the user asks for it back."""
+    _out, data, _calls, _p = _plist(monkeypatch, tmp_path)
+    assert data["KeepAlive"]["SuccessfulExit"] is False
+
+
+def test_the_agent_is_actually_loaded_not_just_written(monkeypatch, tmp_path):
+    _out, _data, calls, path = _plist(monkeypatch, tmp_path)
+    verbs = [c[0] for c in calls]
+    assert "bootstrap" in verbs, calls
+    # Booted out first, so re-running is idempotent rather than a refusal.
+    assert verbs.index("bootout") < verbs.index("bootstrap")
+    assert any(str(path) in c for c in calls)
+
+
+def test_a_refused_agent_is_reported_as_a_failure(monkeypatch, tmp_path):
+    """The old code ran `launchctl load`, discarded the result and returned
+    "on", so an agent that never loaded looked wired."""
+    monkeypatch.setattr(menubar.Path, "home", classmethod(lambda cls: tmp_path))
+    monkeypatch.setattr(menubar, "_launcher_argv", lambda: ["/bin/true"])
+    monkeypatch.setattr(menubar, "_launchctl",
+                        lambda *a: (1, "Load failed: 5: Input/output error"))
+    out = menubar._set_login_agent(True)
+    assert out.startswith("failed"), out
+    assert "Input/output error" in out
+
+
+def test_turning_it_off_deregisters_before_deleting(monkeypatch, tmp_path):
+    """With KeepAlive set, deleting the plist while the job is still
+    registered would have launchd relaunch it from a file that is gone."""
+    monkeypatch.setattr(menubar.Path, "home", classmethod(lambda cls: tmp_path))
+    monkeypatch.setattr(menubar, "_launcher_argv", lambda: ["/bin/true"])
+    monkeypatch.setattr(menubar, "_launchctl", lambda *a: (0, ""))
+    menubar._set_login_agent(True)
+
+    calls = []
+    monkeypatch.setattr(menubar, "_launchctl",
+                        lambda *a: (calls.append(a), (0, ""))[1])
+    assert menubar._set_login_agent(False) == "off"
+    assert calls and calls[0][0] == "bootout"
+    path = tmp_path / "Library" / "LaunchAgents" / f"{menubar.LAUNCH_AGENT_LABEL}.plist"
+    assert not path.exists()
+
+
+# ------------------------------------------------------------------- Linux
+
+def test_linux_autostart_is_a_different_file_from_the_menu_entry(monkeypatch,
+                                                                 tmp_path):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / "cfg"))
+    monkeypatch.setenv("XDG_DATA_HOME", str(tmp_path / "data"))
+    auto = systray.autostart_entry_path()
+    menu = systray.desktop_entry_path()
+    assert auto != menu
+    assert auto.parent.name == "autostart"
+    assert menu.parent.name == "applications"
+
+
+def test_linux_login_status_reads_autostart_not_the_menu(monkeypatch, tmp_path):
+    """The bug: an applications-menu entry made this report "on" for a
+    machine that had never started Compartment at login."""
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / "cfg"))
+    monkeypatch.setenv("XDG_DATA_HOME", str(tmp_path / "data"))
+    monkeypatch.setattr(systray, "_is_linux", lambda: True)
+
+    systray.install_desktop_entry("/v/memory.vault")     # findable...
+    assert systray.login_status() == "off"               # ...but not running
+
+    systray.install_autostart_entry("/v/memory.vault")
+    assert systray.login_status() == "on"
+
+
+def test_linux_autostart_entry_is_one_desktops_will_honour(monkeypatch,
+                                                           tmp_path):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / "cfg"))
+    systray.install_autostart_entry("/v/memory.vault")
+    text = systray.autostart_entry_path().read_text()
+    assert text.startswith("[Desktop Entry]")
+    assert "Type=Application" in text
+    # Without these a session is entitled to treat the entry as stale.
+    assert "X-GNOME-Autostart-enabled=true" in text
+    assert "Hidden=false" in text
+    assert "/v/memory.vault" in text
+
+
+def test_linux_turning_it_off_removes_the_autostart_entry(monkeypatch,
+                                                          tmp_path):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / "cfg"))
+    monkeypatch.setenv("XDG_DATA_HOME", str(tmp_path / "data"))
+    monkeypatch.setattr(systray, "_is_linux", lambda: True)
+    systray.set_login(True)
+    assert systray.login_status() == "on"
+    systray.set_login(False)
+    assert systray.login_status() == "off"
+    assert not systray.autostart_entry_path().exists()
+
+
+def test_linux_set_login_installs_both(monkeypatch, tmp_path):
+    """Turning on start-at-login must not cost the applications-menu entry
+    that was there before it."""
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / "cfg"))
+    monkeypatch.setenv("XDG_DATA_HOME", str(tmp_path / "data"))
+    monkeypatch.setattr(systray, "_is_linux", lambda: True)
+    assert systray.set_login(True) == "on"
+    assert systray.autostart_entry_path().is_file()
+    assert systray.desktop_entry_path().is_file()
+
+
+# ----------------------------------------------------------------- Windows
+
+@pytest.mark.skipif(sys.platform != "win32", reason="Run key is Windows-only")
+def test_windows_reads_the_run_entry_back(monkeypatch):
+    """A write the registry accepted and then dropped used to report "on"."""
+    import winreg
+    real_query = winreg.QueryValueEx
+
+    def vanished(key, name):
+        if name == systray.RUN_VALUE:
+            raise FileNotFoundError(name)
+        return real_query(key, name)
+
+    monkeypatch.setattr(winreg, "QueryValueEx", vanished)
+    assert systray.set_login(True).startswith("error")