firekeep-client 1.7.2__tar.gz → 1.8.0__tar.gz

{firekeep_client-1.7.2/firekeep_client.egg-info → firekeep_client-1.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: firekeep-client
-Version: 1.7.2
+Version: 1.8.0
 Summary: Client for Firekeep, the self-hosted operating layer for connected AI agents.
 License-Expression: LicenseRef-Firekeep-BUSL-1.1
 Project-URL: Homepage, https://firekeep.ai

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/firekeep_client/__init__.py

@@ -9,4 +9,4 @@ versions without a verdict (`_check_versions`) and judges staleness against the
 release manifest instead (`_check_client_version`).
 """
 
-__version__ = "1.7.2"
+__version__ = "1.8.0"

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/firekeep_client/adapters/codex.py

@@ -46,6 +46,9 @@ def _toml_block(venv_bin: Path) -> str:
         # TOML literal (single-quoted) string: no escape processing -> Windows backslashes safe.
         lines.append(f"command = '{cmd}'")
         lines.append(f"args = [{arglist}]")
+        # Codex clears the env of stdio MCP servers; forward what Firekeep
+        # Studio sets per run (spec 2026-10-11 §7.2).
+        lines.append('env_vars = ["FIREKEEP_SESSION_REPORT_FILE"]')
         lines.append("")
     return "\n".join(lines).rstrip()
 

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/firekeep_client/childenv.py

@@ -65,7 +65,7 @@ _KIT = frozenset({
     "FIREKEEP_SHIM_DEBUG", "FIREKEEP_NO_JOB_OBJECT",
     "FIREKEEP_REPORT_CONSENT", "FIREKEEP_REPORT_DIR",
     "FIREKEEP_FAILURE_REPORT", "FIREKEEP_NO_FAILURE_REPORT",
-    "FIREKEEP_SESSION_ID", "NEXUS_AGENT_ID",
+    "FIREKEEP_SESSION_ID", "FIREKEEP_SESSION_REPORT_FILE", "NEXUS_AGENT_ID",
     # hook-side knobs the client modules a child imports may consult
     "FIREKEEP_AGENT_GOAL", "FIREKEEP_BRIEFING", "FIREKEEP_NO_AUTO_UPDATE",
     "FIREKEEP_NO_AUTO_SYNC", "FIREKEEP_NO_AUTO_INDEX", "FIREKEEP_NO_AUTO_NIGHTSHIFT",

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/firekeep_client/cli.py

@@ -87,6 +87,44 @@ def cmd_version(args) -> int:
     return 0
 
 
+# --- whoami: identity facts for Studio 0.5 -----------------------------------
+
+def cmd_whoami(args) -> int:
+    """Identity facts a local client (Firekeep Studio) needs — never the API key.
+
+    Studio must not read ~/.firekeep/config itself because the file holds the
+    key, so this is the one place it learns the agent id (spec 2026-10-11 §7.1).
+    """
+    cfg = None
+    try:
+        cfg = resolver.load_config(_config_path())
+    except resolver.ConfigMigrationConflict as exc:
+        print(f"firekeep: {exc}", file=sys.stderr)
+        return 3
+    except resolver.ConfigError:
+        cfg = None
+    agent: str | None = None
+    if cfg is not None:
+        try:
+            agent = resolver.agent_id(cfg)
+        except resolver.ConfigError:
+            agent = None
+    if agent == wizard.PLACEHOLDER_AGENT_ID:
+        agent = None  # the installer skeleton value is "unconfigured"
+    facts = {
+        "agent_id": agent,
+        "kit_version": __version__,
+        "personal_mode": bool(resolver.is_bypassed()),
+        "server_configured": bool(cfg is not None and wizard._already_connected(cfg)),
+    }
+    if getattr(args, "json", False):
+        print(json.dumps(facts))
+    else:
+        for key, value in facts.items():
+            print(f"{key}: {value}")
+    return 0 if agent else 1
+
+
 # --- install: venv, pip, ~/.firekeep bootstrap, adapter render -----------------
 
 # `configured = false` is the sentinel that makes "never set up" a REPRESENTABLE
@@ -277,7 +315,18 @@ def _venv_has_pip(venv: Path) -> bool:
     return True
 
 
-def _create_venv(venv: Path) -> None:
+def _is_live_venv(home: Path, venv: Path) -> bool:
+    """True when the `current` link resolves to `venv` — the install every hook runs."""
+    current = home / CURRENT_LINK_NAME
+    if not os.path.lexists(current):
+        return False
+    try:
+        return os.path.normcase(os.path.realpath(current)) == os.path.normcase(os.path.realpath(venv))
+    except OSError:
+        return False
+
+
+def _create_venv(venv: Path, home: Path) -> None:
     if _venv_bin(venv).exists():
         if _venv_has_pip(venv):
             return
@@ -285,6 +334,16 @@ def _create_venv(venv: Path) -> None:
         # bootstrap that died between `uv venv` and `uv pip install` leaves exactly this.
         # Short-circuiting here used to crash the checkout install later in _pip_install;
         # rebuild in place instead (--clear reprovisions, pip included via ensurepip).
+        #
+        # Never the LIVE venv, though: a healthy bootstrap venv is pip-less too, and a
+        # checkout whose version matches the installed one lands here. On 2026-10-12 the
+        # --clear died on executables held by running sessions, leaving Scripts/ without
+        # a stdlib, and every hook on the machine failed until the venv was rebuilt.
+        if _is_live_venv(home, venv):
+            raise RuntimeError(
+                f"{venv} is the live install (`current` points at it) and has no pip; "
+                "rebuilding it would break every running session. Bump the checkout's "
+                "version, or run `firekeep update` to repair the installed release.")
         _run([sys.executable, "-m", "venv", "--clear", str(venv)])
         return
     _run([sys.executable, "-m", "venv", str(venv)])
@@ -555,7 +614,7 @@ def cmd_install(args) -> int:
             # Checkout install: provision a fresh versioned venv at its FINAL path
             # (never moved — venvs aren't relocatable) and flip `current` to it below.
             venv = home / VENVS_DIR_NAME / _kit_version(kit)
-            _create_venv(venv)
+            _create_venv(venv, home)
         else:
             venv = Path(sys.executable).resolve().parent.parent
         python = _venv_python(venv)
@@ -3147,6 +3206,10 @@ def _build_parser() -> argparse.ArgumentParser:
     ver = sub.add_parser("version", help="print client version + skew status")
     ver.set_defaults(func=cmd_version)
 
+    who = sub.add_parser("whoami", help="print this machine's Firekeep identity (never the key)")
+    who.add_argument("--json", action="store_true", help="one line of JSON for programs")
+    who.set_defaults(func=cmd_whoami)
+
     inst = sub.add_parser("install", help="install/refresh the client kit")
     # An unset runtime prepares every shipped adapter. Explicit --runtime (or the
     # bootstrap's FIREKEEP_RUNTIME) remains available for a targeted re-render.

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/firekeep_client/gateway.py

@@ -66,6 +66,15 @@ TOOLSET_PRESETS: dict[str, frozenset[str]] = {
         "ctx_abandon_session", "ctx_list_sessions", "ctx_resume_session",
         "ctx_get_shadow",
     }),
+    # Firekeep Studio's Keep panel and per-turn receipts (Studio 0.5, spec
+    # 2026-10-11 §7.1). Reads plus knowledge feedback only: Studio never
+    # starts, updates or completes a Keep session — the agent owns those.
+    "studio": frozenset({
+        "memory_recall", "memory_feedback",
+        "skill_list", "skill_recall",
+        "relay_who_is_online", "relay_read",
+        "ctx_list_sessions", "replay_timeline", "corpus_sources",
+    }),
 }
 
 # A preset that narrows the tool surface also narrows the handshake text: the

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/firekeep_client/promptrecall.py

@@ -286,6 +286,15 @@ def remember(agent: str, ids: list[str]) -> None:
         hooklog.log_failure(_HOOK, f"proactive recall dedupe write failed: {e}")
 
 
+def _keep_session(cfg) -> str | None:
+    """The agent's current Keep session, so the pushed recall is attributed to
+    it in replay (Studio 0.5 receipts, spec §7.2). Best-effort: None on any error."""
+    try:
+        return state.current_session_id(resolver.agent_id(cfg))
+    except Exception:  # noqa: BLE001
+        return None
+
+
 def recall(cfg, prompt: str) -> list:
     """POST the prompt to cortex `/memory/recall` and return its `sources`.
 
@@ -309,12 +318,15 @@ def recall(cfg, prompt: str) -> list:
     memory filed under `infrastructure` and friends — 146 of them on the live store,
     which is the defect `docs/guides/cortex-design-decisions.md` records.
 
+    It carries the agent's current Keep session (`X-Session-Id`) so the recall shows
+    in that session's replay timeline.
+
     Returns [] for a DEGRADED response (vector search down, results graph-only).
     Same call as Bridge makes: the floor below is calibrated on cosine, and a
     graph-only set is a different scale, so pushing it would be pushing noise the
     threshold cannot judge.
     """
-    ep = resolver.resolve("cortex", cfg=cfg)
+    ep = resolver.resolve("cortex", cfg=cfg, session_id=_keep_session(cfg))
     body = {
         "task": prompt[:MAX_TASK_CHARS],
         "top_k": TOP_K,

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/firekeep_client/shim.py

@@ -159,8 +159,9 @@ class _StashSessionAuth(httpx.Auth):
                     # Tap-wired: what THIS process observed, or nothing.
                     sid = self._tap._session_id
                 else:
-                    stash = state.read_session_stash(self._agent)
-                    sid = (stash or {}).get("session_id")
+                    # Fresh stash first; under Studio, the report file survives
+                    # the stash clear a resumed runtime's session_start performs.
+                    sid = state.current_session_id(self._agent)
                 if sid:
                     request.headers["X-Session-Id"] = sid
         except Exception:
@@ -515,11 +516,15 @@ class _BridgeSessionTap:
                 return item
             name = params.get("name")
             rid = getattr(root, "id", None)
-            if rid is not None and (
-                name in self._CAPTURE_TOOLS
-                or name in self._END_TOOLS
-            ):
+            if rid is not None and name in self._CAPTURE_TOOLS:
                 self._pending[rid] = name
+            elif rid is not None and name in self._END_TOOLS:
+                # Remember WHICH session the call targets: an explicit id from
+                # the agent wins, else this process's captured id.
+                raw_args = params.get("arguments")
+                explicit = raw_args.get("session_id") if isinstance(raw_args, dict) else None
+                target = explicit if isinstance(explicit, str) and explicit else self._session_id
+                self._pending[rid] = (name, target)
             if name in self._INJECT_TOOLS:
                 args = params.get("arguments")
                 if isinstance(args, dict):
@@ -546,8 +551,16 @@ class _BridgeSessionTap:
             rid = getattr(root, "id", None)
             if rid is None or rid not in self._pending:
                 return item
-            name = self._pending.pop(rid)
+            entry = self._pending.pop(rid)
+            target = None
+            if isinstance(entry, tuple):
+                name, target = entry
+            else:
+                name = entry
             if name in self._END_TOOLS:
+                # Tombstone the session the call targeted before clearing.
+                if target:
+                    state.end_session_report(target)
                 self._session_id = None
                 state.clear_session_stash(self._agent)
                 return item
@@ -557,6 +570,9 @@ class _BridgeSessionTap:
                 # Keep writing the agent-keyed disk stash: hook cores in other
                 # processes still read it, and it is the restart fallback.
                 state.write_session_stash(self._agent, session_id=sid)
+                # Studio 0.5: tell the launching Studio session which Keep
+                # session this agent is in (no-op unless the env var is set).
+                state.append_session_report(sid)
         except Exception:
             pass
         return item

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/firekeep_client/state.py

@@ -6,6 +6,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import subprocess
 import sys
 import time
@@ -448,6 +449,90 @@ def clear_session_stash(agent_id: str) -> None:
         pass
 
 
+# Firekeep Studio 0.5 (spec 2026-10-11 §7.2): Studio launches each agent with
+# this variable naming a per-Studio-session file. The bridge tap appends every
+# Keep session id it captures, so Studio can build per-turn receipts from the
+# sessions the AGENT started — Studio never starts one itself.
+SESSION_REPORT_ENV = "FIREKEEP_SESSION_REPORT_FILE"
+# Ids travel in an HTTP header (X-Session-Id): no whitespace, no newline, ever.
+_SESSION_ID_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]{0,127}")
+
+
+def _report_path() -> str | None:
+    raw = os.environ.get(SESSION_REPORT_ENV, "").strip()
+    return raw or None
+
+
+def append_session_report(session_id: str) -> None:
+    """Append a captured Keep session id to $FIREKEEP_SESSION_REPORT_FILE.
+    No-op when the variable is unset or the id is not header-safe. Never raises."""
+    try:
+        path = _report_path()
+        if not path or not isinstance(session_id, str) or not _SESSION_ID_RE.fullmatch(session_id):
+            return
+        with open(path, "a", encoding="utf-8", newline="\n") as fh:
+            fh.write(session_id + "\n")
+    except Exception:
+        pass
+
+
+def end_session_report(session_id: str) -> None:
+    """Mark a session as ended in $FIREKEEP_SESSION_REPORT_FILE by appending
+    '#ended <id>'. No-op when the variable is unset or the id is not header-safe.
+    Never raises."""
+    try:
+        path = _report_path()
+        if not path or not isinstance(session_id, str) or not _SESSION_ID_RE.fullmatch(session_id):
+            return
+        with open(path, "a", encoding="utf-8", newline="\n") as fh:
+            fh.write(f"#ended {session_id}\n")
+    except Exception:
+        pass
+
+
+def reported_session_id() -> str | None:
+    """The last active (not ended) header-safe id in $FIREKEEP_SESSION_REPORT_FILE.
+    A line '#ended <id>' marks an id as ended; scanning in order, the last active
+    id is returned, or None. A file whose mtime is older than the session stash
+    TTL is ignored (a stale file must not attribute a new day's work to a dead
+    session). Handles non-UTF-8 bytes gracefully."""
+    try:
+        path = _report_path()
+        if not path:
+            return None
+        if time.time() - os.path.getmtime(path) > _session_stash_ttl_seconds():
+            return None
+        last = None
+        with open(path, encoding="utf-8", errors="replace") as fh:
+            for line in fh:
+                line = line.strip()
+                if line.startswith("#ended "):
+                    # Extract the id after "#ended "
+                    ended_id = line[7:]  # len("#ended ") == 7
+                    # Deliberately fail-closed: a tombstone clears only the
+                    # most recent id, so "K1, K2, #ended K2" yields None even
+                    # if K1 is still live. Tracking a set of ended ids would
+                    # revive sessions that ended without writing a tombstone.
+                    if ended_id == last:
+                        last = None
+                elif _SESSION_ID_RE.fullmatch(line):
+                    last = line
+        return last
+    except Exception:
+        return None
+
+
+def current_session_id(agent_id: str) -> str | None:
+    """The Keep session this agent is working in: the fresh stash, else the
+    Studio report file (which survives the stash clear a resumed runtime's
+    session_start performs). Never raises."""
+    try:
+        stash = read_session_stash(agent_id) or {}
+        return stash.get("session_id") or reported_session_id()
+    except Exception:
+        return None
+
+
 # --- runbook bundle store (Enforced Runbooks Phase B) ------------------------
 #
 # Spec: docs/superpowers/specs/2026-08-15-enforced-runbooks-design.md ("Bundle").

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/firekeep_client/updater.py

@@ -1,7 +1,7 @@
 """Release-manifest fetch, version compare, and verified download for `firekeep update`.
 
 Stdlib-only (import boundary). Optional non-stdlib import: truststore (guarded) — OS-trust
-for RELEASE-HOST fetches only. The GitLab host is NEVER hardcoded: the bootstrap knows the
+for RELEASE-HOST fetches only. The release host is NEVER hardcoded: the bootstrap knows the
 URL it was fetched from and records it as [dist] base_url in ~/.firekeep/config, which is the
 only place this module learns it from.
 """
@@ -18,7 +18,7 @@ from firekeep_client.transport import TransportError, get_json
 
 
 def dist_ssl_context() -> "ssl.SSLContext | None":
-    """OS-trust SSL context for release-host fetches ONLY (GitHub Pages / GitLab sit
+    """OS-trust SSL context for release-host fetches ONLY (a release host can sit
     behind corporate TLS interception; the managed CPython's default bundle lacks the
     interception CA). Scoped on purpose — truststore.inject_into_ssl() would replace
     ssl.SSLContext process-wide and widen office ca_path pinning to 'pin OR OS store'

{firekeep_client-1.7.2 → firekeep_client-1.8.0/firekeep_client.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: firekeep-client
-Version: 1.7.2
+Version: 1.8.0
 Summary: Client for Firekeep, the self-hosted operating layer for connected AI agents.
 License-Expression: LicenseRef-Firekeep-BUSL-1.1
 Project-URL: Homepage, https://firekeep.ai

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/firekeep_client.egg-info/SOURCES.txt

@@ -82,7 +82,6 @@ tests/test_bootstrap_reinstall.py
 tests/test_bootstrap_sh.py
 tests/test_bootstrap_symdex.py
 tests/test_bootstrap_venv_provisioning.py
-tests/test_ci_publishes_symdex.py
 tests/test_cli.py
 tests/test_cli_backup.py
 tests/test_cli_dex.py
@@ -100,6 +99,7 @@ tests/test_cli_personal.py
 tests/test_cli_uninstall.py
 tests/test_cli_uninstall_generic.py
 tests/test_cli_update.py
+tests/test_cli_whoami.py
 tests/test_config_migration.py
 tests/test_connect.py
 tests/test_decision_board_html.py
@@ -166,6 +166,7 @@ tests/test_sidecar.py
 tests/test_sidecar_robustness.py
 tests/test_signing.py
 tests/test_state.py
+tests/test_state_session_report.py
 tests/test_stdio_encoding.py
 tests/test_symdexindex.py
 tests/test_transport.py

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "firekeep-client"
-version = "1.7.2"
+version = "1.8.0"
 description = "Client for Firekeep, the self-hosted operating layer for connected AI agents."
 readme = "README.md"
 requires-python = ">=3.10"

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/tests/test_cli_install.py

@@ -596,10 +596,48 @@ def test_create_venv_recreates_a_pipless_venv(tmp_path, monkeypatch):
     calls = []
     monkeypatch.setattr(cli, "_run", lambda cmd, **kw: calls.append(list(cmd)))
     monkeypatch.setattr(cli, "_venv_has_pip", lambda v: False)
-    cli._create_venv(venv)
+    cli._create_venv(venv, tmp_path)
     assert calls and "--clear" in calls[0], f"expected a --clear rebuild, got {calls}"
 
 
+def test_create_venv_never_clears_the_live_venv(tmp_path, monkeypatch):
+    """Live incident 2026-10-12: a checkout `install` run while the checkout's version
+    equalled the installed one targeted venvs/<V> — the venv `current` points at. The
+    bootstrap's uv venv ships no pip, so the pip-less branch `--clear`ed it; executables
+    held by running sessions stopped the clear halfway, leaving Scripts/ with no stdlib
+    or pyvenv.cfg, and every hook on the machine failed. The live venv is never cleared."""
+    venv = tmp_path / "venvs" / "1.7.2"
+    bindir = venv / ("Scripts" if cli.os.name == "nt" else "bin")
+    bindir.mkdir(parents=True)
+    cli._point_current(tmp_path, venv)
+    calls = []
+    monkeypatch.setattr(cli, "_run", lambda cmd, **kw: calls.append(list(cmd)))
+    monkeypatch.setattr(cli, "_venv_has_pip", lambda v: False)  # exactly a uv venv
+    with pytest.raises(RuntimeError, match="current"):
+        cli._create_venv(venv, tmp_path)
+    assert calls == [], f"the live venv must not be rebuilt, got {calls}"
+    assert bindir.is_dir()
+
+
+def test_checkout_install_of_the_installed_version_leaves_the_live_venv(install_env, monkeypatch, tmp_path, capsys):
+    """The incident path end to end: the checkout reads the version already installed
+    (1.2.3 here), `current` points at venvs/1.2.3, and that bootstrap venv has no pip."""
+    home, runs, _ = install_env
+    live = home / "venvs" / "1.2.3"
+    (live / ("Scripts" if os.name == "nt" else "bin")).mkdir(parents=True)
+    cli._point_current(home, live)
+    monkeypatch.setattr(cli, "_venv_has_pip", lambda v: False)
+    pips = []
+    monkeypatch.setattr(cli, "_pip_install", lambda py, *pkgs, **k: pips.append(pkgs))
+    _checkout(tmp_path, monkeypatch)
+
+    rc = cli.main(["install", "--runtime", "claude"])
+    assert rc == 1
+    assert "install failed at 'create venv'" in capsys.readouterr().err
+    assert not [r for r in runs if "venv" in r], f"live venv rebuilt: {runs}"
+    assert pips == []
+
+
 def test_create_venv_skips_a_healthy_venv(tmp_path, monkeypatch):
     venv = tmp_path / "venv"
     bindir = venv / ("Scripts" if cli.os.name == "nt" else "bin")
@@ -607,7 +645,7 @@ def test_create_venv_skips_a_healthy_venv(tmp_path, monkeypatch):
     calls = []
     monkeypatch.setattr(cli, "_run", lambda cmd, **kw: calls.append(list(cmd)))
     monkeypatch.setattr(cli, "_venv_has_pip", lambda v: True)
-    cli._create_venv(venv)
+    cli._create_venv(venv, tmp_path)
     assert calls == []
 
 

firekeep_client-1.8.0/tests/test_cli_whoami.py

@@ -0,0 +1,101 @@
+"""`firekeep whoami` — identity facts for local clients (Firekeep Studio 0.5,
+spec §7.1). Studio must never read ~/.firekeep/config itself: it holds the key."""
+import json
+import textwrap
+
+import pytest
+
+from firekeep_client import __version__, cli
+
+SECRET = "fk_live_do_not_print_me"
+
+CONFIG = textwrap.dedent(f"""\
+    [identity]
+    agent_id = tester
+
+    [server]
+    kind = ports
+    scheme = http
+    host = 10.0.0.5
+    verify_tls = false
+    api_key = {SECRET}
+""")
+
+
+@pytest.fixture
+def config_file(tmp_path, monkeypatch):
+    cfg = tmp_path / ".firekeep" / "config"
+    cfg.parent.mkdir(parents=True)
+    cfg.write_text(CONFIG, encoding="utf-8")
+    monkeypatch.setenv("FIREKEEP_CONFIG", str(cfg))
+    monkeypatch.setenv("FIREKEEP_CACHE_DIR", str(tmp_path / "cache"))
+    monkeypatch.delenv("FIREKEEP_AGENT_ID", raising=False)
+    monkeypatch.setattr("firekeep_client.state._private", lambda _p: None)
+    monkeypatch.setattr("firekeep_client.resolver.is_bypassed", lambda *a, **k: False)
+    return cfg
+
+
+def test_whoami_json_reports_identity(config_file, capsys):
+    assert cli.main(["whoami", "--json"]) == 0
+    out = capsys.readouterr().out
+    assert json.loads(out) == {
+        "agent_id": "tester",
+        "kit_version": __version__,
+        "personal_mode": False,
+        "server_configured": True,
+    }
+
+
+def test_whoami_never_prints_the_api_key(config_file, capsys):
+    cli.main(["whoami", "--json"])
+    cli.main(["whoami"])
+    captured = capsys.readouterr()
+    assert SECRET not in captured.out
+    assert SECRET not in captured.err
+
+
+def test_whoami_honours_agent_id_env(config_file, monkeypatch, capsys):
+    monkeypatch.setenv("FIREKEEP_AGENT_ID", "tester-studio-panel")
+    cli.main(["whoami", "--json"])
+    assert json.loads(capsys.readouterr().out)["agent_id"] == "tester-studio-panel"
+
+
+def test_whoami_reports_personal_mode(config_file, monkeypatch, capsys):
+    monkeypatch.setattr("firekeep_client.resolver.is_bypassed", lambda *a, **k: True)
+    cli.main(["whoami", "--json"])
+    assert json.loads(capsys.readouterr().out)["personal_mode"] is True
+
+
+def test_whoami_reports_bypass_env_as_personal_mode(config_file, monkeypatch, capsys):
+    monkeypatch.undo()  # drop is_bypassed patch; exercise the real predicate
+    monkeypatch.setenv("FIREKEEP_CONFIG", str(config_file))
+    monkeypatch.setenv("FIREKEEP_CACHE_DIR", str(config_file.parent / "cache"))
+    monkeypatch.setenv("FIREKEEP_BYPASS", "1")
+    cli.main(["whoami", "--json"])
+    assert json.loads(capsys.readouterr().out)["personal_mode"] is True
+
+
+def test_whoami_placeholder_agent_id_is_unconfigured(config_file, capsys):
+    config_file.write_text(
+        config_file.read_text(encoding="utf-8").replace("agent_id = tester", "agent_id = CHANGEME"),
+        encoding="utf-8",
+    )
+    assert cli.main(["whoami", "--json"]) == 1
+    assert json.loads(capsys.readouterr().out)["agent_id"] is None
+
+
+def test_whoami_without_config_is_null_not_a_crash(tmp_path, monkeypatch, capsys):
+    monkeypatch.setenv("FIREKEEP_CONFIG", str(tmp_path / "missing" / "config"))
+    monkeypatch.delenv("FIREKEEP_AGENT_ID", raising=False)
+    monkeypatch.setattr("firekeep_client.resolver.is_bypassed", lambda *a, **k: False)
+    assert cli.main(["whoami", "--json"]) == 1
+    data = json.loads(capsys.readouterr().out)
+    assert data["agent_id"] is None
+    assert data["server_configured"] is False
+
+
+def test_whoami_plain_text_is_one_fact_per_line(config_file, capsys):
+    assert cli.main(["whoami"]) == 0
+    out = capsys.readouterr().out.splitlines()
+    assert out[0] == "agent_id: tester"
+    assert f"kit_version: {__version__}" in out

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/tests/test_e2e_bootstrap.py

@@ -83,8 +83,8 @@ VERSION = tomllib.loads((CLIENT / "pyproject.toml").read_text())["project"]["ver
 @pytest.fixture
 def release(tmp_path):
     """Build a REAL release: real wheel, real mirrored uv, real make_release.py — then fan it
-    out into the REAL version-addressed layout CI now publishes, exactly as the upload() loop
-    in .gitlab-ci.yml does: BASE/latest/{install.sh,install.ps1,latest.json} (the stable
+    out into the REAL version-addressed layout release.yml publishes:
+    BASE/latest/{install.sh,install.ps1,latest.json} (the stable
     entry point) + BASE/<version>/{SHA256SUMS,uv-<target>,wheel} (every version keeps its own
     directory). Serving flat (the old shape) would silently resurrect C1/C3 — a tag-pinned
     base whose latest.json points at the release it shipped inside, forever."""

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/tests/test_gateway_child_env.py

@@ -345,3 +345,9 @@ def test_every_env_name_a_child_reads_is_classified():
         "child may see it, CHILD_EXTRAS[<child>] if it is that child's own secret, "
         "NOT_FORWARDED if no gateway child needs it"
     )
+
+
+def test_session_report_file_reaches_backend_children():
+    from firekeep_client import childenv
+
+    assert "FIREKEEP_SESSION_REPORT_FILE" in childenv.ALLOWED_NAMES

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/tests/test_gateway_toolset.py

@@ -151,3 +151,44 @@ def test_chat_preset_is_exactly_the_decided_surface():
         "ctx_abandon_session", "ctx_list_sessions", "ctx_resume_session",
         "ctx_get_shadow",
     }
+
+
+STUDIO_SURFACE = frozenset({
+    "memory_recall", "memory_feedback",
+    "skill_list", "skill_recall",
+    "relay_who_is_online", "relay_read",
+    "ctx_list_sessions", "replay_timeline", "corpus_sources",
+})
+
+
+def test_studio_preset_is_exactly_the_decided_surface():
+    from firekeep_client.gateway import TOOLSET_PRESETS
+
+    assert TOOLSET_PRESETS["studio"] == STUDIO_SURFACE
+
+
+def test_studio_preset_cannot_write_sessions_or_memories():
+    """Studio reads the Keep and thumbs knowledge; it never owns a session
+    (spec §7.2) and never learns on the user's behalf."""
+    from firekeep_client.gateway import TOOLSET_PRESETS
+
+    forbidden = {"ctx_start_session", "ctx_resume_session", "ctx_update",
+                 "ctx_complete_session", "ctx_abandon_session", "memory_learn",
+                 "vault_retrieve", "skill_create"}
+    assert not (TOOLSET_PRESETS["studio"] & forbidden)
+
+
+def test_studio_preset_resolves_from_env(monkeypatch):
+    monkeypatch.delenv("FIREKEEP_TOOLS_ALLOW", raising=False)
+    monkeypatch.setenv("FIREKEEP_TOOLSET", "studio")
+    label, names = _active_toolset()
+    assert label == "studio"
+    assert names == STUDIO_SURFACE
+
+
+def test_unknown_preset_message_lists_studio(monkeypatch):
+    monkeypatch.delenv("FIREKEEP_TOOLS_ALLOW", raising=False)
+    monkeypatch.setenv("FIREKEEP_TOOLSET", "studoi")
+    with pytest.raises(SystemExit) as exc:
+        _active_toolset()
+    assert "chat, studio" in str(exc.value)

{firekeep_client-1.7.2 → firekeep_client-1.8.0}/tests/test_package.py

@@ -7,7 +7,7 @@ from pathlib import Path
 def test_package_imports_and_exposes_frozen_version():
     import firekeep_client
 
-    assert firekeep_client.__version__ == "1.7.2"
+    assert firekeep_client.__version__ == "1.8.0"
 
 
 def test_the_version_pins_agree():