folio-cli 0.3.0__tar.gz → 0.3.1__tar.gz

{folio_cli-0.3.0/src/folio_cli.egg-info → folio_cli-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: folio-cli
-Version: 0.3.0
+Version: 0.3.1
 Summary: Local hybrid RAG over curated AI / MLOps / infra curricula — graphify-style CLI for any assistant
 Author: Iman Sharei
 License-Expression: Apache-2.0
@@ -29,8 +29,6 @@ Requires-Dist: sentence-transformers<6,>=3.3.0; extra == "rerank"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-cov>=5.0; extra == "dev"
-Requires-Dist: build>=1.2; extra == "dev"
-Requires-Dist: twine>=5.0; extra == "dev"
 Dynamic: license-file
 
 # folio
@@ -64,8 +62,10 @@ From a checkout (editable / unreleased):
 
 ```bash
 cd ~/Desktop/folio
+uv sync                 # creates .venv + uv.lock-backed env
+uv run folio status
+# or install the CLI globally from this tree:
 uv tool install --editable .
-# or: uv sync && uv run folio status
 ```
 
 Git install without waiting for PyPI:
@@ -138,7 +138,7 @@ folio uninstall --project [--purge]
 ## Tests
 
 ```bash
-uv sync --extra dev
+uv sync
 uv run pytest -q                  # all
 uv run pytest -q -m "not integration"   # fast (no Chroma embed)
 uv run pytest -q -m integration         # sync + ingest + retrieve + pack
@@ -159,8 +159,8 @@ One-time setup (API token **or** Trusted Publishing):
 After Trusted Publishing is configured, a version tag is enough:
 
 ```bash
-git tag -a v0.3.0 -m v0.3.0
-git push origin v0.3.0
+git tag -a v0.3.1 -m v0.3.1
+git push origin v0.3.1
 ```
 
 Manual local publish (token in env):

{folio_cli-0.3.0 → folio_cli-0.3.1}/README.md

@@ -29,8 +29,10 @@ From a checkout (editable / unreleased):
 
 ```bash
 cd ~/Desktop/folio
+uv sync                 # creates .venv + uv.lock-backed env
+uv run folio status
+# or install the CLI globally from this tree:
 uv tool install --editable .
-# or: uv sync && uv run folio status
 ```
 
 Git install without waiting for PyPI:
@@ -103,7 +105,7 @@ folio uninstall --project [--purge]
 ## Tests
 
 ```bash
-uv sync --extra dev
+uv sync
 uv run pytest -q                  # all
 uv run pytest -q -m "not integration"   # fast (no Chroma embed)
 uv run pytest -q -m integration         # sync + ingest + retrieve + pack
@@ -124,8 +126,8 @@ One-time setup (API token **or** Trusted Publishing):
 After Trusted Publishing is configured, a version tag is enough:
 
 ```bash
-git tag -a v0.3.0 -m v0.3.0
-git push origin v0.3.0
+git tag -a v0.3.1 -m v0.3.1
+git push origin v0.3.1
 ```
 
 Manual local publish (token in env):

{folio_cli-0.3.0 → folio_cli-0.3.1}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name (plain "folio" is taken by an unrelated static-site tool).
 # Import package + CLI command remain `folio`.
 name = "folio-cli"
-version = "0.3.0"
+version = "0.3.1"
 description = "Local hybrid RAG over curated AI / MLOps / infra curricula — graphify-style CLI for any assistant"
 readme = "README.md"
 license = "Apache-2.0"
@@ -30,9 +30,12 @@ dependencies = [
   "numpy>=1.26.0,<3",
 ]
 
+[dependency-groups]
+dev = ["pytest>=8.0", "pytest-cov>=5.0"]
+
 [project.optional-dependencies]
 rerank = ["sentence-transformers>=3.3.0,<6"]
-dev = ["pytest>=8.0", "pytest-cov>=5.0", "build>=1.2", "twine>=5.0"]
+dev = ["pytest>=8.0", "pytest-cov>=5.0"]
 
 [project.urls]
 Homepage = "https://github.com/Iman-Sharei/folio"
@@ -49,6 +52,10 @@ where = ["src"]
 [tool.setuptools.package-data]
 folio = ["assets/*"]
 
+[tool.uv]
+package = true
+default-groups = ["dev"]
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 markers = [

{folio_cli-0.3.0 → folio_cli-0.3.1}/src/folio/__init__.py

@@ -1,3 +1,3 @@
 """folio — local hybrid RAG over curated AI / MLOps / data curricula (graphify-style)."""
 
-__version__ = "0.3.0"
+__version__ = "0.3.1"

{folio_cli-0.3.0 → folio_cli-0.3.1}/src/folio/cli.py

@@ -17,10 +17,14 @@ from .sync import sync_sources
 
 
 def _cli_version() -> str:
+    # PyPI distribution is folio-cli; import package remains folio.
     try:
-        return pkg_version("folio")
+        return pkg_version("folio-cli")
     except PackageNotFoundError:
-        return __version__
+        try:
+            return pkg_version("folio")
+        except PackageNotFoundError:
+            return __version__
 
 
 def _cfg(args: argparse.Namespace) -> dict:

{folio_cli-0.3.0 → folio_cli-0.3.1}/src/folio/distribute.py

@@ -16,6 +16,7 @@ from .sync import sync_sources
 
 # Files/dirs included in a portable index pack (query-ready without sources).
 _PACK_MEMBERS = ("chroma", "bm25", "manifest.json", "config.yaml")
+_PACK_TOP = frozenset(_PACK_MEMBERS)
 
 
 def _release_url(cfg: dict[str, Any]) -> str:
@@ -23,6 +24,41 @@ def _release_url(cfg: dict[str, Any]) -> str:
     return (release.get("index_url") or "").strip()
 
 
+def _require_https_url(url: str) -> str:
+    """Bootstrap downloads must be https (blocks file:// and SSRF-ish schemes)."""
+    from urllib.parse import urlparse
+
+    parsed = urlparse(url)
+    if parsed.scheme != "https" or not parsed.netloc:
+        raise RuntimeError(
+            f"Refusing non-https index URL (scheme={parsed.scheme!r}). "
+            "Use https://… or pass a local --archive path."
+        )
+    return url
+
+
+def _safe_tar_members(tar: tarfile.TarFile) -> list[tarfile.TarInfo]:
+    """Allowlist pack members; reject path traversal, absolute paths, and links."""
+    safe: list[tarfile.TarInfo] = []
+    for member in tar.getmembers():
+        name = member.name
+        if name.startswith("./"):
+            name = name[2:]
+        parts = Path(name).parts
+        if not parts or parts[0] not in _PACK_TOP:
+            continue
+        if Path(name).is_absolute() or ".." in parts:
+            raise RuntimeError(f"Unsafe tar member path: {member.name!r}")
+        if member.issym() or member.islnk():
+            raise RuntimeError(f"Tar symlinks/hardlinks are not allowed: {member.name!r}")
+        # Re-bind normalized relative name for extract.
+        member.name = name
+        safe.append(member)
+    if not safe:
+        raise RuntimeError("Invalid index pack: no allowed members found")
+    return safe
+
+
 def pack_index(cfg: dict[str, Any], *, dest: Path | None = None) -> Path:
     """Create a tarball of the shared index for GitHub Release upload."""
     out = Path(cfg["paths"]["out_dir"])
@@ -51,8 +87,12 @@ def pack_index(cfg: dict[str, Any], *, dest: Path | None = None) -> Path:
 def _extract_pack(archive: Path, dest: Path) -> None:
     dest.mkdir(parents=True, exist_ok=True)
     with tarfile.open(archive, "r:gz") as tar:
-        # Python 3.12+ supports filter=; keep compatible extract.
-        tar.extractall(dest)  # noqa: S202 — local/trusted release asset
+        members = _safe_tar_members(tar)
+        # Prefer PEP 706 data filter when available (3.12+).
+        extract_kw: dict[str, Any] = {"path": dest, "members": members}
+        if hasattr(tarfile, "data_filter"):
+            extract_kw["filter"] = "data"
+        tar.extractall(**extract_kw)
 
 
 def bootstrap_index(
@@ -87,6 +127,8 @@ def bootstrap_index(
             "pass --url, or run `folio build` / `folio update --from-source`."
         )
 
+    resolved = _require_https_url(resolved)
+
     with tempfile.TemporaryDirectory(prefix="folio-bootstrap-") as tmp:
         tmp_path = Path(tmp) / "folio-index.tar.gz"
         print(f"[bootstrap] downloading {resolved}")
@@ -115,10 +157,16 @@ def _extract_into_out(archive: Path, out: Path) -> None:
                     shutil.rmtree(dest)
                 else:
                     dest.unlink()
+            if src.is_symlink():
+                raise RuntimeError(f"Refusing symlink pack member: {src}")
             if src.is_dir():
-                shutil.copytree(src, dest)
+                # symlinks=True copies link nodes as links (does not follow into secrets).
+                shutil.copytree(src, dest, symlinks=True, ignore_dangling_symlinks=False)
+                for p in dest.rglob("*"):
+                    if p.is_symlink():
+                        raise RuntimeError(f"Refusing symlink inside pack member {name}: {p}")
             else:
-                shutil.copy2(src, dest)
+                shutil.copy2(src, dest, follow_symlinks=False)
 
 
 def update_index(

{folio_cli-0.3.0 → folio_cli-0.3.1}/src/folio/store.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import json
 import os
 import pickle
 import shutil
@@ -13,6 +14,27 @@ from rank_bm25 import BM25Okapi
 
 from .chunk import Chunk
 
+# Legacy pickle allowlist (BM25Okapi is pure-Python; block __reduce__ gadgets).
+_PICKLE_ALLOWED = {
+    ("builtins", "dict"),
+    ("builtins", "list"),
+    ("builtins", "tuple"),
+    ("builtins", "str"),
+    ("builtins", "int"),
+    ("builtins", "float"),
+    ("builtins", "bool"),
+    ("builtins", "set"),
+    ("builtins", "frozenset"),
+    ("rank_bm25", "BM25Okapi"),
+}
+
+
+class _RestrictedBm25Unpickler(pickle.Unpickler):
+    def find_class(self, module: str, name: str) -> Any:
+        if (module, name) not in _PICKLE_ALLOWED:
+            raise pickle.UnpicklingError(f"Refusing to unpickle {module}.{name}")
+        return super().find_class(module, name)
+
 
 def _ensure_local_chroma_cache(model_cache_dir: Path | None = None) -> Path:
     """Keep ONNX model cache under the folio index home (sandbox-friendly).
@@ -103,18 +125,47 @@ def build_bm25(chunks: list[Chunk]) -> tuple[BM25Okapi, list[str], list[Chunk]]:
     return BM25Okapi(tokenized), [c.chunk_id for c in chunks], chunks
 
 
+def _bm25_json_path(path: Path) -> Path:
+    """Prefer index.json alongside (or instead of) legacy index.pkl."""
+    if path.suffix == ".json":
+        return path
+    return path.with_suffix(".json")
+
+
 def save_bm25(path: Path, bm25: BM25Okapi, ids: list[str], chunks: list[Chunk]) -> None:
+    """Persist BM25 corpus as JSON and rebuild the index on load (no pickle)."""
+    del bm25  # rebuilt from texts on load
     path.parent.mkdir(parents=True, exist_ok=True)
+    json_path = _bm25_json_path(path)
     payload = {
-        "bm25": bm25,
         "ids": ids,
         "texts": [c.text for c in chunks],
         "metadatas": [c.to_metadata() for c in chunks],
     }
-    with path.open("wb") as f:
-        pickle.dump(payload, f)
+    json_path.write_text(json.dumps(payload, ensure_ascii=False), encoding="utf-8")
+    # Remove legacy pickle so packs don't ship an RCE surface.
+    if path.suffix == ".pkl" and path.exists():
+        path.unlink()
 
 
 def load_bm25(path: Path) -> dict[str, Any]:
+    json_path = _bm25_json_path(path)
+
+    if json_path.exists():
+        data = json.loads(json_path.read_text(encoding="utf-8"))
+        texts: list[str] = data["texts"]
+        ids: list[str] = data["ids"]
+        metas: list[dict] = data["metadatas"]
+        tokenized = [t.lower().split() for t in texts]
+        bm25 = BM25Okapi(tokenized) if tokenized else BM25Okapi([["_"]])
+        return {"bm25": bm25, "ids": ids, "texts": texts, "metadatas": metas}
+
+    if not path.exists():
+        raise FileNotFoundError(path)
+
+    # Legacy pickle path: restricted unpickler only (blocks RCE gadgets).
     with path.open("rb") as f:
-        return pickle.load(f)
+        payload = _RestrictedBm25Unpickler(f).load()
+    if not isinstance(payload, dict) or "bm25" not in payload:
+        raise RuntimeError(f"Invalid legacy BM25 pickle at {path}")
+    return payload

{folio_cli-0.3.0 → folio_cli-0.3.1/src/folio_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: folio-cli
-Version: 0.3.0
+Version: 0.3.1
 Summary: Local hybrid RAG over curated AI / MLOps / infra curricula — graphify-style CLI for any assistant
 Author: Iman Sharei
 License-Expression: Apache-2.0
@@ -29,8 +29,6 @@ Requires-Dist: sentence-transformers<6,>=3.3.0; extra == "rerank"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-cov>=5.0; extra == "dev"
-Requires-Dist: build>=1.2; extra == "dev"
-Requires-Dist: twine>=5.0; extra == "dev"
 Dynamic: license-file
 
 # folio
@@ -64,8 +62,10 @@ From a checkout (editable / unreleased):
 
 ```bash
 cd ~/Desktop/folio
+uv sync                 # creates .venv + uv.lock-backed env
+uv run folio status
+# or install the CLI globally from this tree:
 uv tool install --editable .
-# or: uv sync && uv run folio status
 ```
 
 Git install without waiting for PyPI:
@@ -138,7 +138,7 @@ folio uninstall --project [--purge]
 ## Tests
 
 ```bash
-uv sync --extra dev
+uv sync
 uv run pytest -q                  # all
 uv run pytest -q -m "not integration"   # fast (no Chroma embed)
 uv run pytest -q -m integration         # sync + ingest + retrieve + pack
@@ -159,8 +159,8 @@ One-time setup (API token **or** Trusted Publishing):
 After Trusted Publishing is configured, a version tag is enough:
 
 ```bash
-git tag -a v0.3.0 -m v0.3.0
-git push origin v0.3.0
+git tag -a v0.3.1 -m v0.3.1
+git push origin v0.3.1
 ```
 
 Manual local publish (token in env):

{folio_cli-0.3.0 → folio_cli-0.3.1}/src/folio_cli.egg-info/requires.txt

@@ -7,8 +7,6 @@ numpy<3,>=1.26.0
 [dev]
 pytest>=8.0
 pytest-cov>=5.0
-build>=1.2
-twine>=5.0
 
 [rerank]
 sentence-transformers<6,>=3.3.0

{folio_cli-0.3.0 → folio_cli-0.3.1}/tests/test_distribute.py

@@ -44,7 +44,7 @@ def test_pack_and_bootstrap_roundtrip(
 
     assert (other / "manifest.json").exists()
     assert (other / "chroma").exists()
-    assert (other / "bm25" / "index.pkl").exists()
+    assert (other / "bm25" / "index.json").exists() or (other / "bm25" / "index.pkl").exists()
     assert (other / "config.yaml").exists()