getbased-agent-stack 0.5.9__tar.gz → 0.6.0__tar.gz

{getbased_agent_stack-0.5.9/src/getbased_agent_stack.egg-info → getbased_agent_stack-0.6.0}/PKG-INFO

@@ -1,18 +1,18 @@
 Metadata-Version: 2.4
 Name: getbased-agent-stack
-Version: 0.5.9
+Version: 0.6.0
 Summary: One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard
 License-Expression: AGPL-3.0-or-later
-Requires-Python: >=3.10
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: getbased-mcp>=0.2.9
-Requires-Dist: getbased-rag>=0.7.5
-Requires-Dist: getbased-dashboard>=0.6.8
+Requires-Dist: getbased-mcp>=0.3.0
+Requires-Dist: getbased-rag>=0.8.0
+Requires-Dist: getbased-dashboard>=0.7.0
 Provides-Extra: full
-Requires-Dist: getbased-rag[full]>=0.7.5; extra == "full"
+Requires-Dist: getbased-rag[full]>=0.8.0; extra == "full"
 Provides-Extra: test
-Requires-Dist: pytest>=8.0; extra == "test"
+Requires-Dist: pytest>=9.1.1; extra == "test"
 Requires-Dist: httpx>=0.27; extra == "test"
 Requires-Dist: pytest-timeout>=2.3; extra == "test"
 Dynamic: license-file
@@ -25,6 +25,10 @@ Part of the [getbased-agents monorepo](https://github.com/elkimek/getbased-agent
 
 ## Install
 
+Requires Python 3.11 or newer. To rebuild an existing Python 3.10 tool
+environment while preserving configuration and library data, follow the
+[migration instructions](../../README.md#migrating-an-existing-python-310-installation).
+
 Linux, one command:
 
 ```bash
@@ -44,7 +48,7 @@ That setup payload contains private credentials. Keep it out of logs and public
 Manual — pipx:
 
 ```bash
-pipx install --include-deps "getbased-agent-stack[full]"
+pipx install --python python3.12 --include-deps "getbased-agent-stack[full]"
 ```
 
 The `--include-deps` flag is required — it exposes `getbased-mcp`, `lens`, and `getbased-dashboard` alongside `getbased-stack` on your PATH. Without it, pipx only links the stack's own entry point and the MCP/rag/dashboard binaries stay hidden inside the venv.
@@ -53,6 +57,7 @@ Manual — uv (0.11+):
 
 ```bash
 uv tool install \
+  --python 3.12 \
   --with-executables-from getbased-rag \
   --with-executables-from getbased-dashboard \
   --with-executables-from getbased-mcp \
@@ -177,6 +182,7 @@ The dashboard is likewise stateless — it proxies rag for Knowledge operations,
 | 0.2.x | ≥0.2.2 | ≥0.6.0 | ≥0.5.0 | v1 (+ streaming ingest, per-library models) |
 | 0.4.x | ≥0.2.3 | ≥0.7.1 | ≥0.6.1 | v1 (+ shared env file, `getbased-stack init`, systemd units) |
 | 0.5.x | ≥0.2.9 | ≥0.7.5 | ≥0.6.8 | v1 (+ `getbased-stack connect`, multi-client setup targets; explicit local-only scripted init) |
+| 0.6.x | ≥0.3.0 | ≥0.8.0 | ≥0.7.0 | v1 (Python ≥3.11, ONNX Runtime ≥1.31, security updates) |
 
 Bump the meta's major when sibling protocols break; bump siblings freely for normal features.
 

{getbased_agent_stack-0.5.9 → getbased_agent_stack-0.6.0}/README.md

@@ -6,6 +6,10 @@ Part of the [getbased-agents monorepo](https://github.com/elkimek/getbased-agent
 
 ## Install
 
+Requires Python 3.11 or newer. To rebuild an existing Python 3.10 tool
+environment while preserving configuration and library data, follow the
+[migration instructions](../../README.md#migrating-an-existing-python-310-installation).
+
 Linux, one command:
 
 ```bash
@@ -25,7 +29,7 @@ That setup payload contains private credentials. Keep it out of logs and public
 Manual — pipx:
 
 ```bash
-pipx install --include-deps "getbased-agent-stack[full]"
+pipx install --python python3.12 --include-deps "getbased-agent-stack[full]"
 ```
 
 The `--include-deps` flag is required — it exposes `getbased-mcp`, `lens`, and `getbased-dashboard` alongside `getbased-stack` on your PATH. Without it, pipx only links the stack's own entry point and the MCP/rag/dashboard binaries stay hidden inside the venv.
@@ -34,6 +38,7 @@ Manual — uv (0.11+):
 
 ```bash
 uv tool install \
+  --python 3.12 \
   --with-executables-from getbased-rag \
   --with-executables-from getbased-dashboard \
   --with-executables-from getbased-mcp \
@@ -158,6 +163,7 @@ The dashboard is likewise stateless — it proxies rag for Knowledge operations,
 | 0.2.x | ≥0.2.2 | ≥0.6.0 | ≥0.5.0 | v1 (+ streaming ingest, per-library models) |
 | 0.4.x | ≥0.2.3 | ≥0.7.1 | ≥0.6.1 | v1 (+ shared env file, `getbased-stack init`, systemd units) |
 | 0.5.x | ≥0.2.9 | ≥0.7.5 | ≥0.6.8 | v1 (+ `getbased-stack connect`, multi-client setup targets; explicit local-only scripted init) |
+| 0.6.x | ≥0.3.0 | ≥0.8.0 | ≥0.7.0 | v1 (Python ≥3.11, ONNX Runtime ≥1.31, security updates) |
 
 Bump the meta's major when sibling protocols break; bump siblings freely for normal features.
 

{getbased_agent_stack-0.5.9 → getbased_agent_stack-0.6.0}/pyproject.toml

@@ -1,28 +1,28 @@
 [build-system]
-requires = ["setuptools>=83.0.0", "wheel"]
+requires = ["setuptools>=84.0.0", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [project]
 name = "getbased-agent-stack"
-version = "0.5.9"
+version = "0.6.0"
 description = "One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard"
 readme = "README.md"
 license = "AGPL-3.0-or-later"
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 # Pulls every sibling package. Bump this meta when a sibling protocol
 # bump requires coordinated release.
 dependencies = [
-    "getbased-mcp>=0.2.9",
-    "getbased-rag>=0.7.5",
-    "getbased-dashboard>=0.6.8",
+    "getbased-mcp>=0.3.0",
+    "getbased-rag>=0.8.0",
+    "getbased-dashboard>=0.7.0",
 ]
 
 [project.optional-dependencies]
 # `full` includes PDF/DOCX parsers and ONNX acceleration (pre-exported
 # weights — no PyTorch/transformers/optimum dance).
-full = ["getbased-rag[full]>=0.7.5"]
+full = ["getbased-rag[full]>=0.8.0"]
 # For contributors running the integration test harness.
-test = ["pytest>=8.0", "httpx>=0.27", "pytest-timeout>=2.3"]
+test = ["pytest>=9.1.1", "httpx>=0.27", "pytest-timeout>=2.3"]
 
 # In the monorepo (elkimek/getbased-agents), the workspace-root pyproject
 # overrides these with `workspace = true` sources. From PyPI, the

{getbased_agent_stack-0.5.9 → getbased_agent_stack-0.6.0}/src/getbased_agent_stack/__init__.py

@@ -5,4 +5,4 @@ plus a small CLI that proxies to the real binaries. Everything
 interesting lives in the sibling repos.
 """
 
-__version__ = "0.5.9"
+__version__ = "0.6.0"

{getbased_agent_stack-0.5.9 → getbased_agent_stack-0.6.0}/src/getbased_agent_stack/cli.py

@@ -42,8 +42,14 @@ def _ensure_api_key(path: Path) -> str:
         return path.read_text(encoding="utf-8").strip()
     path.parent.mkdir(parents=True, exist_ok=True)
     key = secrets.token_urlsafe(32)
-    path.write_text(key + "\n", encoding="utf-8")
-    os.chmod(path, 0o600)
+    try:
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    except FileExistsError:
+        # A concurrent initializer won; retain its key instead of rotating
+        # credentials behind the already-starting services.
+        return path.read_text(encoding="utf-8").strip()
+    with os.fdopen(fd, "w", encoding="utf-8") as stream:
+        stream.write(key + "\n")
     return key
 
 

{getbased_agent_stack-0.5.9 → getbased_agent_stack-0.6.0}/src/getbased_agent_stack/env_file.py

@@ -9,6 +9,7 @@ without `getbased-stack init` clobbering their comments.
 from __future__ import annotations
 
 import os
+import tempfile
 from pathlib import Path
 
 
@@ -82,8 +83,20 @@ def write_env_file(
         if not k or not all(c.isalnum() or c == "_" for c in k):
             raise ValueError(f"invalid env key: {k!r}")
         lines.append(f"{k}={v}\n")
-    p.write_text("".join(lines), encoding="utf-8")
-    os.chmod(p, 0o600)
+    # mkstemp creates an exclusive, private file before any secrets are
+    # written. Replace atomically so readers never see a partial update,
+    # and a destination symlink cannot redirect the write to another file.
+    fd, temporary_name = tempfile.mkstemp(prefix=f".{p.name}-", dir=p.parent)
+    temporary = Path(temporary_name)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as stream:
+            os.chmod(temporary, 0o600)
+            stream.write("".join(lines))
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.replace(temporary, p)
+    finally:
+        temporary.unlink(missing_ok=True)
     return p
 
 

{getbased_agent_stack-0.5.9 → getbased_agent_stack-0.6.0/src/getbased_agent_stack.egg-info}/PKG-INFO

@@ -1,18 +1,18 @@
 Metadata-Version: 2.4
 Name: getbased-agent-stack
-Version: 0.5.9
+Version: 0.6.0
 Summary: One-command install of the full getbased agent stack — getbased-mcp + getbased-rag + getbased-dashboard
 License-Expression: AGPL-3.0-or-later
-Requires-Python: >=3.10
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: getbased-mcp>=0.2.9
-Requires-Dist: getbased-rag>=0.7.5
-Requires-Dist: getbased-dashboard>=0.6.8
+Requires-Dist: getbased-mcp>=0.3.0
+Requires-Dist: getbased-rag>=0.8.0
+Requires-Dist: getbased-dashboard>=0.7.0
 Provides-Extra: full
-Requires-Dist: getbased-rag[full]>=0.7.5; extra == "full"
+Requires-Dist: getbased-rag[full]>=0.8.0; extra == "full"
 Provides-Extra: test
-Requires-Dist: pytest>=8.0; extra == "test"
+Requires-Dist: pytest>=9.1.1; extra == "test"
 Requires-Dist: httpx>=0.27; extra == "test"
 Requires-Dist: pytest-timeout>=2.3; extra == "test"
 Dynamic: license-file
@@ -25,6 +25,10 @@ Part of the [getbased-agents monorepo](https://github.com/elkimek/getbased-agent
 
 ## Install
 
+Requires Python 3.11 or newer. To rebuild an existing Python 3.10 tool
+environment while preserving configuration and library data, follow the
+[migration instructions](../../README.md#migrating-an-existing-python-310-installation).
+
 Linux, one command:
 
 ```bash
@@ -44,7 +48,7 @@ That setup payload contains private credentials. Keep it out of logs and public
 Manual — pipx:
 
 ```bash
-pipx install --include-deps "getbased-agent-stack[full]"
+pipx install --python python3.12 --include-deps "getbased-agent-stack[full]"
 ```
 
 The `--include-deps` flag is required — it exposes `getbased-mcp`, `lens`, and `getbased-dashboard` alongside `getbased-stack` on your PATH. Without it, pipx only links the stack's own entry point and the MCP/rag/dashboard binaries stay hidden inside the venv.
@@ -53,6 +57,7 @@ Manual — uv (0.11+):
 
 ```bash
 uv tool install \
+  --python 3.12 \
   --with-executables-from getbased-rag \
   --with-executables-from getbased-dashboard \
   --with-executables-from getbased-mcp \
@@ -177,6 +182,7 @@ The dashboard is likewise stateless — it proxies rag for Knowledge operations,
 | 0.2.x | ≥0.2.2 | ≥0.6.0 | ≥0.5.0 | v1 (+ streaming ingest, per-library models) |
 | 0.4.x | ≥0.2.3 | ≥0.7.1 | ≥0.6.1 | v1 (+ shared env file, `getbased-stack init`, systemd units) |
 | 0.5.x | ≥0.2.9 | ≥0.7.5 | ≥0.6.8 | v1 (+ `getbased-stack connect`, multi-client setup targets; explicit local-only scripted init) |
+| 0.6.x | ≥0.3.0 | ≥0.8.0 | ≥0.7.0 | v1 (Python ≥3.11, ONNX Runtime ≥1.31, security updates) |
 
 Bump the meta's major when sibling protocols break; bump siblings freely for normal features.
 

getbased_agent_stack-0.6.0/src/getbased_agent_stack.egg-info/requires.txt

@@ -0,0 +1,11 @@
+getbased-mcp>=0.3.0
+getbased-rag>=0.8.0
+getbased-dashboard>=0.7.0
+
+[full]
+getbased-rag[full]>=0.8.0
+
+[test]
+pytest>=9.1.1
+httpx>=0.27
+pytest-timeout>=2.3

{getbased_agent_stack-0.5.9 → getbased_agent_stack-0.6.0}/tests/test_cli.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import io
 import os
+import stat
 import sys
 from pathlib import Path
 
@@ -65,6 +66,37 @@ def _run(argv: "list[str]") -> "tuple[int, str, str]":
 # ── help / version ────────────────────────────────────────────────────
 
 
+def test_api_key_is_private_before_first_write(tmp_path, monkeypatch):
+    path = tmp_path / "key"
+    fdopen = os.fdopen
+    modes = []
+
+    def check_fdopen(fd, *args, **kwargs):
+        modes.append(stat.S_IMODE(os.fstat(fd).st_mode))
+        return fdopen(fd, *args, **kwargs)
+
+    monkeypatch.setattr(os, "fdopen", check_fdopen)
+    previous_umask = os.umask(0)
+    try:
+        key = cli._ensure_api_key(path)
+    finally:
+        os.umask(previous_umask)
+    assert modes == [0o600]
+    assert path.read_text().strip() == key
+
+
+def test_api_key_preserves_concurrent_initializer_key(tmp_path, monkeypatch):
+    path = tmp_path / "key"
+
+    def concurrent_initializer(size):
+        path.write_text("synthetic-winning-key\n")
+        return "synthetic-losing-key"
+
+    monkeypatch.setattr(cli.secrets, "token_urlsafe", concurrent_initializer)
+    assert cli._ensure_api_key(path) == "synthetic-winning-key"
+    assert path.read_text() == "synthetic-winning-key\n"
+
+
 def test_bare_invocation_shows_help():
     rc, out, _ = _run([])
     assert rc == 0

{getbased_agent_stack-0.5.9 → getbased_agent_stack-0.6.0}/tests/test_env_file.py

@@ -62,6 +62,52 @@ def test_write_sets_mode_0600(tmp_env_path):
     assert mode == 0o600
 
 
+def test_write_publishes_private_complete_file(tmp_env_path, monkeypatch):
+    tmp_env_path.parent.mkdir(parents=True)
+    tmp_env_path.write_text("TOKEN=old\n")
+    replace = os.replace
+    published = []
+
+    def check_replace(source, destination):
+        source = Path(source)
+        assert stat.S_IMODE(source.stat().st_mode) == 0o600
+        assert source.read_text() == "TOKEN=synthetic-new\n"
+        assert tmp_env_path.read_text() == "TOKEN=old\n"
+        published.append(destination)
+        replace(source, destination)
+
+    monkeypatch.setattr(os, "replace", check_replace)
+    env_file.write_env_file({"TOKEN": "synthetic-new"}, path=tmp_env_path, header="")
+    assert published == [tmp_env_path]
+    assert tmp_env_path.read_text() == "TOKEN=synthetic-new\n"
+
+
+def test_write_failure_preserves_previous_file_and_cleans_temporary(tmp_env_path, monkeypatch):
+    tmp_env_path.parent.mkdir(parents=True)
+    tmp_env_path.write_text("TOKEN=old\n")
+
+    def fail_replace(source, destination):
+        raise OSError("synthetic replacement failure")
+
+    monkeypatch.setattr(os, "replace", fail_replace)
+    with pytest.raises(OSError, match="synthetic replacement failure"):
+        env_file.write_env_file({"TOKEN": "synthetic-new"}, path=tmp_env_path)
+    assert tmp_env_path.read_text() == "TOKEN=old\n"
+    assert list(tmp_env_path.parent.iterdir()) == [tmp_env_path]
+
+
+def test_write_does_not_follow_destination_symlink(tmp_env_path, tmp_path):
+    target = tmp_path / "unrelated"
+    target.write_text("retain this content")
+    tmp_env_path.parent.mkdir(parents=True)
+    tmp_env_path.symlink_to(target)
+
+    env_file.write_env_file({"TOKEN": "synthetic-new"}, path=tmp_env_path, header="")
+    assert target.read_text() == "retain this content"
+    assert not tmp_env_path.is_symlink()
+    assert tmp_env_path.read_text() == "TOKEN=synthetic-new\n"
+
+
 def test_write_rejects_invalid_keys(tmp_env_path):
     with pytest.raises(ValueError, match="invalid env key"):
         env_file.write_env_file({"has space": "x"}, path=tmp_env_path)

{getbased_agent_stack-0.5.9 → getbased_agent_stack-0.6.0}/tests/test_integration.py

@@ -14,6 +14,7 @@ from __future__ import annotations
 
 import asyncio
 import contextlib
+import math
 import os
 import socket
 import subprocess
@@ -153,6 +154,47 @@ def mcp_env(seeded_lens: dict, monkeypatch: pytest.MonkeyPatch):
 
 # ── Tests ────────────────────────────────────────────────────────────
 
+@pytest.mark.timeout(180)
+def test_local_embedder_dependency_round_trip() -> None:
+    """Validate the PyTorch fallback as well as the preferred ONNX backend.
+
+    The full-stack fixture uses ONNX, so it cannot catch incompatible
+    sentence-transformers / transformers upgrades on its own.
+    """
+    from lens.embedder import LocalEmbedder
+
+    embedder = LocalEmbedder("sentence-transformers/all-MiniLM-L6-v2")
+    vectors = embedder.encode([
+        "Synthetic dependency upgrade smoke test.",
+        "Another sentence for a batched embedding.",
+    ])
+
+    assert len(vectors) == 2
+    assert embedder.dimension() == 384
+    for vector in vectors:
+        assert len(vector) == 384
+        assert all(math.isfinite(value) for value in vector)
+        assert sum(value * value for value in vector) == pytest.approx(1, abs=1e-4)
+
+
+@pytest.mark.timeout(180)
+def test_onnx_embedder_batch_matches_individual_encodings() -> None:
+    """Native runtime upgrades must preserve unequal-length batch padding."""
+    from lens.embedder import OnnxEmbedder
+
+    embedder = OnnxEmbedder("sentence-transformers/all-MiniLM-L6-v2", provider="cpu")
+    texts = ["A short synthetic sentence.", "A longer synthetic sentence exercises padded embedding batches."]
+    batch = embedder.encode(texts)
+
+    assert len(batch) == len(texts)
+    assert embedder.dimension() == 384
+    for text, vector in zip(texts, batch):
+        assert len(vector) == 384
+        assert all(math.isfinite(value) for value in vector)
+        assert sum(value * value for value in vector) == pytest.approx(1, abs=1e-4)
+        assert vector == pytest.approx(embedder.encode([text])[0], abs=1e-5)
+
+
 def test_pdf_ingest_dependency_round_trip(tmp_path: Path) -> None:
     """Exercise the optional PDF parser pinned by the full stack extra.
 

getbased_agent_stack-0.5.9/src/getbased_agent_stack.egg-info/requires.txt

@@ -1,11 +0,0 @@
-getbased-mcp>=0.2.9
-getbased-rag>=0.7.5
-getbased-dashboard>=0.6.8
-
-[full]
-getbased-rag[full]>=0.7.5
-
-[test]
-pytest>=8.0
-httpx>=0.27
-pytest-timeout>=2.3