cortexdb-cli 0.4.1__py3-none-any.whl → 0.4.2__py3-none-any.whl

cortexdb_cli/__init__.py

@@ -1,3 +1,3 @@
-"""CortexDB CLI — command-line interface for the v1 memory API."""
-
-__version__ = "0.4.1"
+"""CortexDB CLI — command-line interface for the v1 memory API."""
+
+__version__ = "0.4.2"

cortexdb_cli/client.py

@@ -1,92 +1,92 @@
-"""HTTP client for the CortexDB v1 API.
-
-Thin wrapper around httpx that reads credentials + endpoint from the CLI
-context and stamps every request with both `Authorization: Bearer …` and
-`X-Cortex-Actor: …`. The actor header is mandatory on v1 — missing it
-returns 401 ACTOR_MISMATCH no matter how valid the token is.
-
-We deliberately don't depend on the cortexdbai SDK: keeping the CLI a
-straight HTTP client makes the install fast and lets us pin httpx
-independently from the SDK's release cadence.
-"""
-
-from __future__ import annotations
-
-from contextlib import contextmanager
-from typing import Any, Generator
-
-import httpx
-
-from cortexdb_cli import __version__
-
-DEFAULT_ENDPOINT = "https://api-v1.cortexdb.ai"
-
-
-class CortexClient:
-    """Synchronous HTTP client for the CortexDB v1 API."""
-
-    def __init__(
-        self,
-        endpoint: str,
-        api_key: str,
-        actor: str = "",
-        timeout: float = 30.0,
-    ) -> None:
-        self.endpoint = endpoint.rstrip("/")
-        self.api_key = api_key
-        self.actor = actor
-        headers: dict[str, str] = {
-            "Content-Type": "application/json",
-            "User-Agent": f"cortexdb-cli/{__version__}",
-        }
-        if api_key:
-            headers["Authorization"] = f"Bearer {api_key}"
-        if actor:
-            headers["X-Cortex-Actor"] = actor
-        self._http = httpx.Client(
-            base_url=self.endpoint,
-            headers=headers,
-            timeout=timeout,
-        )
-
-    def close(self) -> None:
-        self._http.close()
-
-    def get(self, path: str, params: dict[str, Any] | None = None) -> httpx.Response:
-        return self._http.get(path, params=params)
-
-    def post(
-        self,
-        path: str,
-        json: dict[str, Any] | None = None,
-        params: dict[str, Any] | None = None,
-    ) -> httpx.Response:
-        return self._http.post(path, json=json, params=params)
-
-    def delete(self, path: str, params: dict[str, Any] | None = None) -> httpx.Response:
-        return self._http.delete(path, params=params)
-
-
-def signup(endpoint: str = DEFAULT_ENDPOINT, timeout: float = 30.0) -> dict[str, Any]:
-    """Call POST /v1/auth/signup and return {token, user_id, scope, expires_at, tier}.
-
-    The endpoint is public — no auth required. Free tier; 7-day TTL.
-    """
-    with httpx.Client(timeout=timeout) as http:
-        resp = http.post(f"{endpoint.rstrip('/')}/v1/auth/signup", json={})
-        resp.raise_for_status()
-        return resp.json()
-
-
-@contextmanager
-def get_client(ctx: dict[str, Any]) -> Generator[CortexClient, None, None]:
-    """Create a CortexClient from CLI context."""
-    client = CortexClient(
-        endpoint=ctx.get("endpoint", DEFAULT_ENDPOINT),
-        api_key=ctx.get("api_key", ""),
-        actor=ctx.get("actor", ""),
-    )
-    try:
-        yield client
-    finally:
-        client.close()
+"""HTTP client for the CortexDB v1 API.
+
+Thin wrapper around httpx that reads credentials + endpoint from the CLI
+context and stamps every request with both `Authorization: Bearer …` and
+`X-Cortex-Actor: …`. The actor header is mandatory on v1 — missing it
+returns 401 ACTOR_MISMATCH no matter how valid the token is.
+
+We deliberately don't depend on the cortexdbai SDK: keeping the CLI a
+straight HTTP client makes the install fast and lets us pin httpx
+independently from the SDK's release cadence.
+"""
+
+from __future__ import annotations
+
+from contextlib import contextmanager
+from typing import Any, Generator
+
+import httpx
+
+from cortexdb_cli import __version__
+
+DEFAULT_ENDPOINT = "https://api-v1.cortexdb.ai"
+
+
+class CortexClient:
+    """Synchronous HTTP client for the CortexDB v1 API."""
+
+    def __init__(
+        self,
+        endpoint: str,
+        api_key: str,
+        actor: str = "",
+        timeout: float = 30.0,
+    ) -> None:
+        self.endpoint = endpoint.rstrip("/")
+        self.api_key = api_key
+        self.actor = actor
+        headers: dict[str, str] = {
+            "Content-Type": "application/json",
+            "User-Agent": f"cortexdb-cli/{__version__}",
+        }
+        if api_key:
+            headers["Authorization"] = f"Bearer {api_key}"
+        if actor:
+            headers["X-Cortex-Actor"] = actor
+        self._http = httpx.Client(
+            base_url=self.endpoint,
+            headers=headers,
+            timeout=timeout,
+        )
+
+    def close(self) -> None:
+        self._http.close()
+
+    def get(self, path: str, params: dict[str, Any] | None = None) -> httpx.Response:
+        return self._http.get(path, params=params)
+
+    def post(
+        self,
+        path: str,
+        json: dict[str, Any] | None = None,
+        params: dict[str, Any] | None = None,
+    ) -> httpx.Response:
+        return self._http.post(path, json=json, params=params)
+
+    def delete(self, path: str, params: dict[str, Any] | None = None) -> httpx.Response:
+        return self._http.delete(path, params=params)
+
+
+def signup(endpoint: str = DEFAULT_ENDPOINT, timeout: float = 30.0) -> dict[str, Any]:
+    """Call POST /v1/auth/signup and return {token, user_id, scope, expires_at, tier}.
+
+    The endpoint is public — no auth required. Free tier; 7-day TTL.
+    """
+    with httpx.Client(timeout=timeout) as http:
+        resp = http.post(f"{endpoint.rstrip('/')}/v1/auth/signup", json={})
+        resp.raise_for_status()
+        return resp.json()
+
+
+@contextmanager
+def get_client(ctx: dict[str, Any]) -> Generator[CortexClient, None, None]:
+    """Create a CortexClient from CLI context."""
+    client = CortexClient(
+        endpoint=ctx.get("endpoint", DEFAULT_ENDPOINT),
+        api_key=ctx.get("api_key", ""),
+        actor=ctx.get("actor", ""),
+    )
+    try:
+        yield client
+    finally:
+        client.close()

cortexdb_cli/commands/admin.py

@@ -1,83 +1,83 @@
-"""cortexdb admin — health, usage, layer stats."""
-
-from __future__ import annotations
-
-import click
-
-from cortexdb_cli.client import get_client
-from cortexdb_cli.errors import handle_errors
-from cortexdb_cli.output import (
-    is_json_mode,
-    print_health,
-    print_ontology,
-    print_usage,
-    spinner,
-)
-
-
-@click.group("admin")
-def admin_group() -> None:
-    """Diagnostics — reachability, identity, rate-limit, layer status."""
-
-
-@admin_group.command("health")
-@click.pass_context
-@handle_errors
-def admin_health(ctx: click.Context) -> None:
-    """Auth + reachability check (GET /v1/auth/whoami)."""
-    cfg = ctx.obj
-    with get_client(cfg) as client:
-        resp = client.get("/v1/auth/whoami")
-        resp.raise_for_status()
-        body = resp.json()
-        # Normalise into the shape print_health expects.
-        body.setdefault("status", "ok")
-        print_health(body, cfg)
-
-
-@admin_group.command("usage")
-@click.pass_context
-@handle_errors
-def admin_usage(ctx: click.Context) -> None:
-    """Tier, capabilities, rate-limit headroom, token expiry."""
-    cfg = ctx.obj
-    with get_client(cfg) as client:
-        if not is_json_mode(cfg):
-            with spinner("Loading usage..."):
-                resp = client.get("/v1/auth/whoami")
-        else:
-            resp = client.get("/v1/auth/whoami")
-        resp.raise_for_status()
-        body = resp.json()
-        # Fold rate-limit + expiry response headers into the body so the
-        # output formatter can render them in one block.
-        for k in (
-            "X-RateLimit-Limit",
-            "X-RateLimit-Reset",
-            "X-RateLimit-Remaining",
-            "X-Cortex-Token-Expires-In",
-            "X-Cortex-Token-Expires-At",
-        ):
-            if k in resp.headers:
-                body[k] = resp.headers[k]
-        print_usage(body, cfg)
-
-
-@admin_group.command("layers")
-@click.pass_context
-@handle_errors
-def admin_layers(ctx: click.Context) -> None:
-    """Per-layer counts and synthesis lag (GET /v1/admin/layers/stats).
-
-    Stability: experimental — the endpoint is gated by the
-    `admin.layers.stats` capability and may not be present on the free tier.
-    """
-    cfg = ctx.obj
-    with get_client(cfg) as client:
-        if not is_json_mode(cfg):
-            with spinner("Loading layer stats..."):
-                resp = client.get("/v1/admin/layers/stats")
-        else:
-            resp = client.get("/v1/admin/layers/stats")
-        resp.raise_for_status()
-        print_ontology(resp.json(), cfg)
+"""cortexdb admin — health, usage, layer stats."""
+
+from __future__ import annotations
+
+import click
+
+from cortexdb_cli.client import get_client
+from cortexdb_cli.errors import handle_errors
+from cortexdb_cli.output import (
+    is_json_mode,
+    print_health,
+    print_ontology,
+    print_usage,
+    spinner,
+)
+
+
+@click.group("admin")
+def admin_group() -> None:
+    """Diagnostics — reachability, identity, rate-limit, layer status."""
+
+
+@admin_group.command("health")
+@click.pass_context
+@handle_errors
+def admin_health(ctx: click.Context) -> None:
+    """Auth + reachability check (GET /v1/auth/whoami)."""
+    cfg = ctx.obj
+    with get_client(cfg) as client:
+        resp = client.get("/v1/auth/whoami")
+        resp.raise_for_status()
+        body = resp.json()
+        # Normalise into the shape print_health expects.
+        body.setdefault("status", "ok")
+        print_health(body, cfg)
+
+
+@admin_group.command("usage")
+@click.pass_context
+@handle_errors
+def admin_usage(ctx: click.Context) -> None:
+    """Tier, capabilities, rate-limit headroom, token expiry."""
+    cfg = ctx.obj
+    with get_client(cfg) as client:
+        if not is_json_mode(cfg):
+            with spinner("Loading usage..."):
+                resp = client.get("/v1/auth/whoami")
+        else:
+            resp = client.get("/v1/auth/whoami")
+        resp.raise_for_status()
+        body = resp.json()
+        # Fold rate-limit + expiry response headers into the body so the
+        # output formatter can render them in one block.
+        for k in (
+            "X-RateLimit-Limit",
+            "X-RateLimit-Reset",
+            "X-RateLimit-Remaining",
+            "X-Cortex-Token-Expires-In",
+            "X-Cortex-Token-Expires-At",
+        ):
+            if k in resp.headers:
+                body[k] = resp.headers[k]
+        print_usage(body, cfg)
+
+
+@admin_group.command("layers")
+@click.pass_context
+@handle_errors
+def admin_layers(ctx: click.Context) -> None:
+    """Per-layer counts and synthesis lag (GET /v1/admin/layers/stats).
+
+    Stability: experimental — the endpoint is gated by the
+    `admin.layers.stats` capability and may not be present on the free tier.
+    """
+    cfg = ctx.obj
+    with get_client(cfg) as client:
+        if not is_json_mode(cfg):
+            with spinner("Loading layer stats..."):
+                resp = client.get("/v1/admin/layers/stats")
+        else:
+            resp = client.get("/v1/admin/layers/stats")
+        resp.raise_for_status()
+        print_ontology(resp.json(), cfg)

cortexdb_cli/commands/audit.py

@@ -0,0 +1,78 @@
+"""cortexdb audit — GET /v1/audit/chain + POST /v1/audit/chain/verify."""
+
+from __future__ import annotations
+
+import click
+
+from cortexdb_cli.client import get_client
+from cortexdb_cli.errors import handle_errors
+from cortexdb_cli.output import console, escape, is_json_mode, print_json, spinner
+
+
+@click.group("audit")
+def audit_group() -> None:
+    """Audit log integrity — hash-chain status and verification."""
+
+
+@audit_group.command("chain")
+@click.option("--actor", help="Restrict chain stats to one actor's rows.")
+@click.pass_context
+@handle_errors
+def audit_chain(ctx: click.Context, actor: str | None) -> None:
+    """Show the audit hash-chain head + length (GET /v1/audit/chain).
+
+    Integrity metadata only — hashes and counts, never row content.
+    """
+    cfg = ctx.obj
+    params: dict[str, str] = {}
+    if actor:
+        params["actor"] = actor
+    with get_client(cfg) as client:
+        resp = client.get("/v1/audit/chain", params=params or None)
+        resp.raise_for_status()
+        data = resp.json()
+
+    if is_json_mode(cfg):
+        print_json(data)
+        return
+    console.print(f"Chain length: [bold]{data.get('length', 0)}[/bold] row(s)")
+    console.print(f"Head hash:    [dim]{escape(str(data.get('head_hash') or '(empty)'))}[/dim]")
+    legacy = data.get("legacy_rows", 0)
+    if legacy:
+        console.print(f"[dim]{legacy} legacy row(s) predate the chain.[/dim]")
+
+
+@audit_group.command("verify")
+@click.pass_context
+@handle_errors
+def audit_verify(ctx: click.Context) -> None:
+    """Walk the whole audit chain, recomputing every row hash
+    (POST /v1/audit/chain/verify)."""
+    cfg = ctx.obj
+    with get_client(cfg) as client:
+        if not is_json_mode(cfg):
+            with spinner("Verifying chain..."):
+                resp = client.post("/v1/audit/chain/verify", json={})
+        else:
+            resp = client.post("/v1/audit/chain/verify", json={})
+        resp.raise_for_status()
+        data = resp.json()
+
+    if is_json_mode(cfg):
+        print_json(data)
+        return
+    if data.get("valid"):
+        console.print(
+            f"[success]Chain valid[/success] — {data.get('length', 0)} row(s), "
+            f"head [dim]{escape(str(data.get('head_hash') or '(empty)'))}[/dim]"
+        )
+    else:
+        console.print(
+            f"[error]Chain BROKEN[/error] at row index "
+            f"[bold]{data.get('first_broken_index')}[/bold] "
+            f"of {data.get('length', 0)}."
+        )
+        raise SystemExit(1)
+    legacy = data.get("legacy_rows", 0)
+    if legacy:
+        console.print(f"[dim]{legacy} legacy row(s) predate the chain.[/dim]")