lifenote 0.1.1__tar.gz

lifenote-0.1.1/.gitignore

@@ -0,0 +1,218 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml

lifenote-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Daniel W. Chen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

lifenote-0.1.1/PKG-INFO

@@ -0,0 +1,119 @@
+Metadata-Version: 2.4
+Name: lifenote
+Version: 0.1.1
+Summary: Bring your private journal into your AI agents — Claude Code, Cursor, Codex. MCP-compatible.
+Project-URL: Homepage, https://www.mylifenote.ai
+Project-URL: Source, https://github.com/dandanbang/lifenote-cli
+Project-URL: Issues, https://github.com/dandanbang/lifenote-cli/issues
+Author-email: "Daniel W. Chen" <daniel@mylifenote.ai>
+License: MIT
+License-File: LICENSE
+Keywords: ai-agents,claude-code,cursor,journaling,mcp
+Classifier: Development Status :: 4 - Beta
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Utilities
+Requires-Python: >=3.10
+Requires-Dist: filelock>=3.12
+Requires-Dist: httpx>=0.27
+Requires-Dist: keyring>=24.0
+Requires-Dist: mcp>=1.0
+Requires-Dist: rich>=13.0
+Requires-Dist: typer>=0.12
+Description-Content-Type: text/markdown
+
+# lifenote
+
+Bring your private [Life Note](https://www.mylifenote.ai) journal into your AI agents — Claude Code, Claude Desktop, Cursor, Codex, anything that speaks MCP.
+
+## Install
+
+```bash
+pipx install lifenote      # recommended
+# or
+pip install lifenote
+```
+
+## Sign in
+
+```bash
+lifenote auth login
+```
+
+Opens your browser, you click **Allow**, you're done. Your token is stored in your OS keychain (macOS Keychain / Windows Credential Manager / Linux libsecret) — never in plain files.
+
+For CI / Docker / headless agents, set `LIFENOTE_API_TOKEN` in the environment instead.
+
+## Use it from the terminal
+
+```bash
+lifenote search "anxiety about launch"
+lifenote entries --since 7d
+lifenote today
+lifenote week
+lifenote conversations list
+lifenote conversations show 574
+```
+
+Add `--json` to any command for piping into agents:
+
+```bash
+lifenote search "burnout" --json | claude "summarize the patterns"
+```
+
+## Use it from your AI agent (MCP)
+
+### Claude Desktop
+
+Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "lifenote": {
+      "command": "lifenote",
+      "args": ["mcp"]
+    }
+  }
+}
+```
+
+Restart Claude Desktop. Your journal is now a tool Claude can reach for on its own.
+
+### Claude.ai web (Connectors)
+
+Settings → Connectors → Add → paste `https://mcp.mylifenote.ai/api/agent/v1/mcp`. Approve the OAuth screen.
+
+### Cursor / Codex / other MCP clients
+
+Same `command: lifenote, args: [mcp]` pattern. Or point them at the HTTP endpoint directly.
+
+## Bundled Claude Code skill
+
+Drop a brand-aligned skill into your `~/.claude/skills/` so Claude Code knows when to reach for Life Note vs. when not to:
+
+```bash
+lifenote skills install
+```
+
+## What the agent can read
+
+Two scopes today, both read-only:
+
+- `journal:read` — your written entries + AI-generated analysis (themes, feelings)
+- `chat:read` — your past conversations with mentors (Marcus Aurelius, etc.)
+
+It **cannot** write to your journal, change your settings, see payment info, or access other users' data.
+
+You can revoke any agent anytime at <https://www.mylifenote.ai/settings/agents>.
+
+## Configuration
+
+Environment variables (all optional):
+
+- `LIFENOTE_API_TOKEN` — bypass keychain (essential for CI / Docker)
+- `LIFENOTE_BASE_URL` — point at staging / dev (default: `https://www.mylifenote.ai`)
+
+## License
+
+MIT. Built by [Daniel W. Chen](https://github.com/dandanbang).

lifenote-0.1.1/README.md

@@ -0,0 +1,95 @@
+# lifenote
+
+Bring your private [Life Note](https://www.mylifenote.ai) journal into your AI agents — Claude Code, Claude Desktop, Cursor, Codex, anything that speaks MCP.
+
+## Install
+
+```bash
+pipx install lifenote      # recommended
+# or
+pip install lifenote
+```
+
+## Sign in
+
+```bash
+lifenote auth login
+```
+
+Opens your browser, you click **Allow**, you're done. Your token is stored in your OS keychain (macOS Keychain / Windows Credential Manager / Linux libsecret) — never in plain files.
+
+For CI / Docker / headless agents, set `LIFENOTE_API_TOKEN` in the environment instead.
+
+## Use it from the terminal
+
+```bash
+lifenote search "anxiety about launch"
+lifenote entries --since 7d
+lifenote today
+lifenote week
+lifenote conversations list
+lifenote conversations show 574
+```
+
+Add `--json` to any command for piping into agents:
+
+```bash
+lifenote search "burnout" --json | claude "summarize the patterns"
+```
+
+## Use it from your AI agent (MCP)
+
+### Claude Desktop
+
+Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "lifenote": {
+      "command": "lifenote",
+      "args": ["mcp"]
+    }
+  }
+}
+```
+
+Restart Claude Desktop. Your journal is now a tool Claude can reach for on its own.
+
+### Claude.ai web (Connectors)
+
+Settings → Connectors → Add → paste `https://mcp.mylifenote.ai/api/agent/v1/mcp`. Approve the OAuth screen.
+
+### Cursor / Codex / other MCP clients
+
+Same `command: lifenote, args: [mcp]` pattern. Or point them at the HTTP endpoint directly.
+
+## Bundled Claude Code skill
+
+Drop a brand-aligned skill into your `~/.claude/skills/` so Claude Code knows when to reach for Life Note vs. when not to:
+
+```bash
+lifenote skills install
+```
+
+## What the agent can read
+
+Two scopes today, both read-only:
+
+- `journal:read` — your written entries + AI-generated analysis (themes, feelings)
+- `chat:read` — your past conversations with mentors (Marcus Aurelius, etc.)
+
+It **cannot** write to your journal, change your settings, see payment info, or access other users' data.
+
+You can revoke any agent anytime at <https://www.mylifenote.ai/settings/agents>.
+
+## Configuration
+
+Environment variables (all optional):
+
+- `LIFENOTE_API_TOKEN` — bypass keychain (essential for CI / Docker)
+- `LIFENOTE_BASE_URL` — point at staging / dev (default: `https://www.mylifenote.ai`)
+
+## License
+
+MIT. Built by [Daniel W. Chen](https://github.com/dandanbang).

lifenote-0.1.1/pyproject.toml

@@ -0,0 +1,38 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "lifenote"
+version = "0.1.1"
+description = "Bring your private journal into your AI agents — Claude Code, Cursor, Codex. MCP-compatible."
+readme = "README.md"
+license = { text = "MIT" }
+authors = [{ name = "Daniel W. Chen", email = "daniel@mylifenote.ai" }]
+requires-python = ">=3.10"
+keywords = ["journaling", "mcp", "ai-agents", "claude-code", "cursor"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3 :: Only",
+  "Topic :: Utilities",
+]
+dependencies = [
+  "typer>=0.12",
+  "httpx>=0.27",
+  "keyring>=24.0",
+  "rich>=13.0",
+  "mcp>=1.0",
+  "filelock>=3.12",  # cross-platform refresh-token lock (Codex round 4)
+]
+
+[project.urls]
+Homepage = "https://www.mylifenote.ai"
+Source = "https://github.com/dandanbang/lifenote-cli"
+Issues = "https://github.com/dandanbang/lifenote-cli/issues"
+
+[project.scripts]
+lifenote = "lifenote.cli:app"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/lifenote"]

lifenote-0.1.1/src/lifenote/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.1"

lifenote-0.1.1/src/lifenote/api.py

@@ -0,0 +1,43 @@
+"""Thin httpx wrapper for /api/agent/v1/* — handles auth header + JSON."""
+import httpx
+
+from .auth import get_token
+from .config import base_url
+
+
+class APIError(Exception):
+    def __init__(self, status: int, body):
+        self.status = status
+        self.body = body
+        super().__init__(f"{status}: {body}")
+
+
+def _client(timeout: float = 30.0) -> httpx.Client:
+    token = get_token()
+    headers = {"Authorization": f"Bearer {token}"} if token else {}
+    headers["User-Agent"] = "lifenote-cli/0.1.0"
+    return httpx.Client(base_url=base_url(), headers=headers, timeout=timeout)
+
+
+def get(path: str, params: dict | None = None) -> dict:
+    with _client() as c:
+        r = c.get(path, params=params or {})
+    if r.status_code != 200:
+        try:
+            body = r.json()
+        except Exception:
+            body = r.text
+        raise APIError(r.status_code, body)
+    return r.json()
+
+
+def delete(path: str) -> dict:
+    with _client() as c:
+        r = c.delete(path)
+    if r.status_code not in (200, 204):
+        try:
+            body = r.json()
+        except Exception:
+            body = r.text
+        raise APIError(r.status_code, body)
+    return {} if r.status_code == 204 else r.json()

lifenote-0.1.1/src/lifenote/auth.py

@@ -0,0 +1,272 @@
+"""
+Token storage + device-flow login + automatic refresh.
+
+Storage precedence (read order):
+  1. LIFENOTE_API_TOKEN env var (for CI / Docker / headless agents)
+  2. OS keychain (macOS Keychain, Windows Cred Manager, Linux libsecret)
+     stores a JSON blob with {access, refresh, expires_at} so the CLI can
+     transparently refresh access tokens before they expire (Codex P2 #5).
+
+Env-var path is essential: keyring fails or is unavailable in many headless
+environments (CI runners, Docker without secrets manager, sandboxed agents).
+Env-var mode skips refresh — the operator is expected to rotate it.
+"""
+import json
+import os
+import socket
+import time
+import webbrowser
+from datetime import datetime, timedelta, timezone
+
+import httpx
+
+from .config import (
+    ENV_TOKEN_VAR, KEYRING_SERVICE, KEYRING_USERNAME, base_url,
+)
+
+# Refresh access token when it has fewer than this many seconds left
+REFRESH_LEEWAY_SECONDS = 120
+
+
+# ---------------------------------------------------------------------------
+# Storage
+# ---------------------------------------------------------------------------
+
+def _now_iso() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _read_keyring_blob() -> dict | None:
+    try:
+        import keyring
+        raw = keyring.get_password(KEYRING_SERVICE, KEYRING_USERNAME)
+    except Exception:
+        return None
+    if not raw:
+        return None
+    try:
+        blob = json.loads(raw)
+        if isinstance(blob, dict) and 'access' in blob:
+            return blob
+        # Legacy: pre-refresh-rotation versions stored just the access token
+        return {'access': raw, 'refresh': None, 'expires_at': None}
+    except (ValueError, TypeError):
+        return {'access': raw, 'refresh': None, 'expires_at': None}
+
+
+def _write_keyring_blob(blob: dict) -> None:
+    import keyring
+    keyring.set_password(KEYRING_SERVICE, KEYRING_USERNAME, json.dumps(blob))
+
+
+def store_credentials(access: str, refresh: str | None, expires_in: int | None) -> None:
+    """Save access + refresh + computed absolute expiry."""
+    expires_at = None
+    if expires_in:
+        expires_at = (datetime.now(timezone.utc) + timedelta(seconds=expires_in)).isoformat()
+    _write_keyring_blob({'access': access, 'refresh': refresh, 'expires_at': expires_at})
+
+
+def get_token() -> str | None:
+    """
+    Env var first, keyring second. If the keyring blob has a refresh token
+    and the access is near expiry, transparently refreshes (with a
+    cross-process file lock so two CLIs/MCP-proxies running concurrently
+    don't both rotate the same refresh token and trigger family-burn —
+    Codex round 3 P2 #4).
+
+    Returns the access token or None.
+    """
+    env = os.environ.get(ENV_TOKEN_VAR)
+    if env:
+        return env.strip()
+    blob = _read_keyring_blob()
+    if not blob:
+        return None
+    access = blob.get('access')
+    refresh = blob.get('refresh')
+    expires_at = blob.get('expires_at')
+    if access and refresh and expires_at and _is_near_expiry(expires_at):
+        rotated = _refresh_with_lock(refresh)
+        if rotated:
+            return rotated
+    return access
+
+
+def _is_near_expiry(expires_at_iso: str) -> bool:
+    try:
+        exp = datetime.fromisoformat(expires_at_iso)
+    except ValueError:
+        return True
+    return (exp - datetime.now(timezone.utc)).total_seconds() < REFRESH_LEEWAY_SECONDS
+
+
+def _lock_path() -> str:
+    """Per-user file lock for refresh — under XDG runtime dir if possible."""
+    import tempfile
+    base = os.environ.get('XDG_RUNTIME_DIR') or tempfile.gettempdir()
+    return os.path.join(base, 'lifenote-cli-refresh.lock')
+
+
+def _refresh_with_lock(refresh_plain: str) -> str | None:
+    """
+    Acquire a cross-platform file lock around the refresh exchange (filelock
+    handles Windows, macOS, Linux). While holding the lock we re-read the
+    keyring; if another process already rotated, return its newly-stored
+    access without burning the family.
+
+    Codex round 5 P3: fail closed if filelock is missing — racing refresh
+    would burn the family on concurrent processes. filelock is a declared
+    dependency, so missing it means a broken install; tell the user to
+    reinstall rather than silently downgrading the guarantee.
+    """
+    try:
+        from filelock import FileLock, Timeout
+    except ImportError:
+        import sys as _sys
+        _sys.stderr.write(
+            'lifenote: filelock dependency is missing — refresh would race '
+            'across processes and burn your session. Reinstall the CLI '
+            '(pipx reinstall lifenote) and try again.\n'
+        )
+        return None
+
+    lock = FileLock(_lock_path() + '.flock', timeout=30)
+    try:
+        with lock:
+            latest = _read_keyring_blob() or {}
+            latest_refresh = latest.get('refresh')
+            latest_access = latest.get('access')
+            latest_expires = latest.get('expires_at')
+            if latest_refresh != refresh_plain and latest_access and latest_expires:
+                if not _is_near_expiry(latest_expires):
+                    return latest_access  # someone else just refreshed — use it
+            return _try_refresh(latest_refresh or refresh_plain)
+    except Timeout:
+        # Another process is taking too long; don't burn the family
+        return None
+
+
+def _try_refresh(refresh_plain: str) -> str | None:
+    """
+    Exchange refresh token for a new pair via /api/agent/v1/oauth/token.
+    On reuse-detected (invalid_grant), clear stored creds — the user must
+    re-login. Returns new access token on success, None on failure.
+
+    Caller is responsible for serialization (use _refresh_with_lock above
+    when running from a long-lived process like mcp_proxy).
+    """
+    try:
+        with httpx.Client(timeout=15.0) as c:
+            r = c.post(
+                f'{base_url()}/api/agent/v1/oauth/token',
+                data={'grant_type': 'refresh_token', 'refresh_token': refresh_plain},
+            )
+        if r.status_code != 200:
+            # invalid_grant could mean: expired, revoked, OR reuse detected
+            # (family burned). In any case, the stored creds are dead.
+            clear_token()
+            return None
+        body = r.json()
+        store_credentials(
+            access=body['access_token'],
+            refresh=body.get('refresh_token'),
+            expires_in=body.get('expires_in'),
+        )
+        return body['access_token']
+    except Exception:
+        return None
+
+
+def set_token(token: str) -> None:
+    """
+    Legacy API — store just an access token (no refresh, no expiry). Kept
+    for backward-compat with old-CLI users; new logins go through
+    store_credentials() instead.
+    """
+    _write_keyring_blob({'access': token, 'refresh': None, 'expires_at': None})
+
+
+def clear_token() -> bool:
+    """Remove from keyring. Env var (if set) is left alone."""
+    try:
+        import keyring
+        keyring.delete_password(KEYRING_SERVICE, KEYRING_USERNAME)
+        return True
+    except Exception:
+        return False
+
+
+# ---------------------------------------------------------------------------
+# Device flow
+# ---------------------------------------------------------------------------
+
+def _agent_name() -> str:
+    """Friendly default name shown in the approval UI. User-overridable."""
+    host = socket.gethostname().split(".")[0]
+    return f"lifenote CLI on {host}"
+
+
+def device_login(*, scopes: list[str] | None = None,
+                 name: str | None = None,
+                 open_browser: bool = True) -> dict:
+    """
+    Run the device-authorization flow. Blocks until the user approves (or
+    until the device code expires). Returns the token response dict on
+    success; raises RuntimeError otherwise.
+    """
+    scopes = scopes or ["journal:read", "chat:read"]
+    name = name or _agent_name()
+
+    # 1. Request device code
+    with httpx.Client(timeout=30.0) as client:
+        r = client.post(
+            f"{base_url()}/api/agent/v1/device/code",
+            json={"name": name, "scopes": scopes, "client_kind": "cli"},
+        )
+        if r.status_code != 200:
+            raise RuntimeError(f"device/code failed: {r.status_code} {r.text}")
+        body = r.json()
+
+    user_code = body["user_code"]
+    verify = body.get("verification_uri_complete") or body["verification_uri"]
+    interval = body.get("interval", 5)
+    expires_in = body.get("expires_in", 600)
+    device_code = body["device_code"]
+
+    print()
+    print(f"  Open this in your browser: {verify}")
+    print(f"  Or visit {body['verification_uri']} and enter: {user_code}")
+    print()
+
+    if open_browser:
+        try:
+            webbrowser.open(verify)
+        except Exception:
+            pass
+
+    # 2. Poll for token
+    deadline = time.time() + expires_in
+    with httpx.Client(timeout=30.0) as client:
+        while time.time() < deadline:
+            time.sleep(interval)
+            r = client.post(
+                f"{base_url()}/api/agent/v1/device/token",
+                json={"device_code": device_code},
+            )
+            if r.status_code == 200:
+                return r.json()
+            try:
+                err = r.json().get("error")
+            except Exception:
+                err = None
+            if err == "authorization_pending":
+                continue
+            if err == "slow_down":
+                interval += 2
+                continue
+            if err in ("access_denied", "expired_token"):
+                raise RuntimeError(f"login {err}")
+            # Other errors (invalid_grant etc.) — bail
+            raise RuntimeError(f"login failed: {r.status_code} {r.text}")
+    raise RuntimeError("login timed out — please run `lifenote auth login` again")

lifenote-0.1.1/src/lifenote/cli.py

@@ -0,0 +1,227 @@
+"""
+lifenote CLI — typer entry point.
+
+Commands:
+  auth login | logout | whoami
+  search <query>
+  entries [--since] [--limit]
+  today | week
+  conversations list | show <id>
+  mcp                 # stdio MCP server
+  skills install      # bundled Claude Code skill
+"""
+import sys
+
+import typer
+
+from . import __version__
+from .api import APIError, get
+from .auth import device_login, store_credentials, clear_token, get_token
+from .output import console, emit
+
+app = typer.Typer(
+    add_completion=False,
+    no_args_is_help=True,
+    help="Bring your private journal into your AI agents.",
+    rich_markup_mode="rich",
+)
+
+auth_app = typer.Typer(no_args_is_help=True, help="Sign in, sign out, who am I.")
+conv_app = typer.Typer(no_args_is_help=True, help="Past mentor conversations.")
+skills_app = typer.Typer(no_args_is_help=True, help="Bundled agent skills.")
+app.add_typer(auth_app, name="auth")
+app.add_typer(conv_app, name="conversations")
+app.add_typer(skills_app, name="skills")
+
+
+def _handle_api_error(e: APIError) -> None:
+    if e.status == 401:
+        console.print("[red]Not signed in.[/] Run [bold]lifenote auth login[/].")
+    elif e.status == 403:
+        console.print(f"[red]Permission denied:[/] {e.body}")
+    elif e.status == 429:
+        console.print(f"[yellow]Rate limited:[/] {e.body}")
+    else:
+        console.print(f"[red]API error {e.status}:[/] {e.body}")
+    raise typer.Exit(1)
+
+
+# ---------------------------------------------------------------------------
+# auth
+# ---------------------------------------------------------------------------
+
+@auth_app.command("login")
+def auth_login(
+    name: str | None = typer.Option(None, help="Name shown in the approval UI."),
+    no_browser: bool = typer.Option(False, help="Don't open the browser automatically."),
+):
+    """Sign in via the device flow."""
+    try:
+        result = device_login(name=name, open_browser=not no_browser)
+    except RuntimeError as e:
+        console.print(f"[red]Login failed:[/] {e}")
+        raise typer.Exit(1)
+    # Store full credentials so the CLI can transparently refresh when the
+    # 1-hour access token nears expiry. (Codex P2 #5)
+    store_credentials(
+        access=result["access_token"],
+        refresh=result.get("refresh_token"),
+        expires_in=result.get("expires_in"),
+    )
+    console.print(f"[green]Signed in.[/] Scopes: {result.get('scope', '?')}")
+
+
+@auth_app.command("logout")
+def auth_logout():
+    """Forget the stored token (does not revoke it server-side)."""
+    if clear_token():
+        console.print("[green]Signed out.[/] To revoke server-side, visit Settings → Connected Agents.")
+    else:
+        console.print("[dim]No stored token.[/]")
+
+
+@auth_app.command("whoami")
+def auth_whoami(json: bool = typer.Option(False, "--json")):
+    """Show who you're signed in as."""
+    if not get_token():
+        console.print("[red]Not signed in.[/] Run [bold]lifenote auth login[/].")
+        raise typer.Exit(1)
+    try:
+        emit(get("/api/agent/v1/whoami"), json)
+    except APIError as e:
+        _handle_api_error(e)
+
+
+# ---------------------------------------------------------------------------
+# search / entries
+# ---------------------------------------------------------------------------
+
+@app.command()
+def search(
+    query: str = typer.Argument(..., help="Search term (≥2 chars)."),
+    since: str | None = typer.Option(None, help="Time bound: 7d / 30d / YYYY-MM-DD"),
+    limit: int = typer.Option(20, help="Max results (1–50)."),
+    json: bool = typer.Option(False, "--json"),
+):
+    """Search journal entries, mentor responses, and conversations."""
+    params = {"q": query, "limit": limit}
+    if since:
+        params["since"] = since
+    try:
+        emit(get("/api/agent/v1/search", params=params), json)
+    except APIError as e:
+        _handle_api_error(e)
+
+
+@app.command()
+def entries(
+    since: str | None = typer.Option(None, help="Time bound: 7d / 30d / YYYY-MM-DD"),
+    limit: int = typer.Option(20, help="Max entries (1–100)."),
+    json: bool = typer.Option(False, "--json"),
+):
+    """List recent journal entries."""
+    params: dict = {"limit": limit}
+    if since:
+        params["since"] = since
+    try:
+        emit(get("/api/agent/v1/entries", params=params), json)
+    except APIError as e:
+        _handle_api_error(e)
+
+
+@app.command()
+def today(json: bool = typer.Option(False, "--json")):
+    """Today's journal entries (shortcut for entries --since 1d)."""
+    try:
+        emit(get("/api/agent/v1/entries", params={"since": "1d", "limit": 50}), json)
+    except APIError as e:
+        _handle_api_error(e)
+
+
+@app.command()
+def week(json: bool = typer.Option(False, "--json")):
+    """The last 7 days of entries."""
+    try:
+        emit(get("/api/agent/v1/entries", params={"since": "7d", "limit": 100}), json)
+    except APIError as e:
+        _handle_api_error(e)
+
+
+# ---------------------------------------------------------------------------
+# conversations
+# ---------------------------------------------------------------------------
+
+@conv_app.command("list")
+def conv_list(
+    since: str | None = typer.Option(None),
+    limit: int = typer.Option(20),
+    json: bool = typer.Option(False, "--json"),
+):
+    """List past mentor conversations."""
+    params: dict = {"limit": limit}
+    if since:
+        params["since"] = since
+    try:
+        emit(get("/api/agent/v1/conversations", params=params), json)
+    except APIError as e:
+        _handle_api_error(e)
+
+
+@conv_app.command("show")
+def conv_show(
+    conversation_id: int = typer.Argument(...),
+    json: bool = typer.Option(False, "--json"),
+):
+    """Show one conversation's full message thread."""
+    try:
+        emit(get(f"/api/agent/v1/conversations/{conversation_id}"), json)
+    except APIError as e:
+        _handle_api_error(e)
+
+
+# ---------------------------------------------------------------------------
+# mcp — stdio MCP server proxying to the HTTP MCP endpoint
+# ---------------------------------------------------------------------------
+
+@app.command()
+def mcp():
+    """
+    Run as a stdio MCP server. Reads JSON-RPC from stdin, writes to stdout.
+    Proxies every request to /api/agent/v1/mcp using the stored token.
+
+    Configure in Claude Desktop's claude_desktop_config.json:
+      { "mcpServers": { "lifenote": { "command": "lifenote", "args": ["mcp"] } } }
+    """
+    from .mcp_proxy import run as run_mcp
+    if not get_token():
+        # MCP clients see stderr in their logs
+        sys.stderr.write("lifenote: not signed in. Run `lifenote auth login` first.\n")
+        sys.exit(1)
+    run_mcp()
+
+
+# ---------------------------------------------------------------------------
+# skills install
+# ---------------------------------------------------------------------------
+
+@skills_app.command("install")
+def skills_install(
+    target: str = typer.Option(
+        "~/.claude/skills",
+        help="Where to drop the lifenote.md skill.",
+    ),
+):
+    """Install the bundled Claude Code skill into ~/.claude/skills/."""
+    from .skill import install as install_skill
+    path = install_skill(target)
+    console.print(f"[green]Installed[/] {path}")
+
+
+@app.command()
+def version():
+    """Print the CLI version."""
+    console.print(f"lifenote {__version__}")
+
+
+if __name__ == "__main__":
+    app()

lifenote-0.1.1/src/lifenote/config.py

@@ -0,0 +1,12 @@
+"""Runtime config — base URL, env-var token fallback, keyring service name."""
+import os
+
+DEFAULT_BASE_URL = "https://www.mylifenote.ai"
+KEYRING_SERVICE = "mylifenote"
+KEYRING_USERNAME = "agent-token"
+ENV_TOKEN_VAR = "LIFENOTE_API_TOKEN"
+ENV_BASE_URL_VAR = "LIFENOTE_BASE_URL"
+
+
+def base_url() -> str:
+    return os.environ.get(ENV_BASE_URL_VAR, DEFAULT_BASE_URL).rstrip("/")

lifenote-0.1.1/src/lifenote/mcp_proxy.py

@@ -0,0 +1,106 @@
+"""
+stdio MCP server that proxies to the HTTP MCP endpoint.
+
+Reads JSON-RPC requests from stdin (one per line), forwards each to
+POST /api/agent/v1/mcp with the user's Bearer token, writes the response
+back to stdout. Lives as `lifenote mcp` so MCP clients (Claude Desktop,
+Cursor) can spawn the binary without dealing with HTTP+auth themselves.
+
+Long-running correctness (Codex round 2 P2 #6 + #7):
+  - 202 No Content → notification; emit nothing per JSON-RPC spec
+  - 401 → refresh access token from keyring (refresh path) and retry once;
+    if refresh fails, emit JSON-RPC error and ask user to re-login
+  - The proxy holds a single session id across requests
+"""
+import json
+import sys
+
+import httpx
+
+from .auth import get_token, _refresh_with_lock, _read_keyring_blob
+from .config import base_url
+
+
+def run() -> None:
+    if not get_token():
+        sys.stderr.write("lifenote mcp: no token. Run `lifenote auth login` first.\n")
+        sys.exit(1)
+
+    session_id: str | None = None
+    url = f"{base_url()}/api/agent/v1/mcp"
+
+    def headers_with_token() -> dict:
+        return {
+            "Authorization": f"Bearer {get_token() or ''}",
+            "Content-Type": "application/json",
+            "User-Agent": "lifenote-cli/0.1.1 (mcp_proxy)",
+        }
+
+    def post_once(line: str, sid: str | None) -> httpx.Response:
+        h = headers_with_token()
+        if sid:
+            h["Mcp-Session-Id"] = sid
+        return _http_client.post(url, headers=h, content=line)
+
+    def refresh_or_die() -> bool:
+        # Cross-process lock + keyring re-read so concurrent proxies don't
+        # both rotate and burn the family (Codex round 3 P2 #4)
+        blob = _read_keyring_blob()
+        if not blob or not blob.get('refresh'):
+            return False
+        return _refresh_with_lock(blob['refresh']) is not None
+
+    with httpx.Client(timeout=120.0) as _http_client:
+        for line in sys.stdin:
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                req = json.loads(line)
+            except json.JSONDecodeError:
+                _emit({"jsonrpc": "2.0", "id": None,
+                       "error": {"code": -32700, "message": "Parse error"}})
+                continue
+
+            try:
+                r = post_once(line, session_id)
+                # 401 → token expired; refresh once and retry
+                if r.status_code == 401:
+                    if refresh_or_die():
+                        # Session may have been bound to the old token; drop it
+                        # so we re-initialize cleanly.
+                        session_id = None
+                        r = post_once(line, None)
+                    else:
+                        _emit({"jsonrpc": "2.0", "id": req.get("id"),
+                               "error": {"code": -32001,
+                                         "message": "lifenote: token expired and refresh failed; run `lifenote auth login`"}})
+                        continue
+            except httpx.HTTPError as e:
+                _emit({"jsonrpc": "2.0", "id": req.get("id"),
+                       "error": {"code": -32603, "message": f"transport error: {e}"}})
+                continue
+
+            # Capture the session id on initialize so subsequent calls echo it
+            if req.get("method") == "initialize":
+                sid = r.headers.get("Mcp-Session-Id")
+                if sid:
+                    session_id = sid
+
+            # Notifications: server returns 202 No Content; spec says emit
+            # nothing back to the MCP client (Codex round 2 P2 #6).
+            if r.status_code == 202 or not r.content:
+                continue
+
+            try:
+                _emit(r.json())
+            except ValueError:
+                _emit({"jsonrpc": "2.0", "id": req.get("id"),
+                       "error": {"code": -32603,
+                                 "message": f"server returned non-JSON: {r.text[:200]}"}})
+
+
+def _emit(obj) -> None:
+    sys.stdout.write(json.dumps(obj, ensure_ascii=False))
+    sys.stdout.write("\n")
+    sys.stdout.flush()

lifenote-0.1.1/src/lifenote/output.py

@@ -0,0 +1,97 @@
+"""Rendering: human-readable for the terminal, --json for piping into agents."""
+import json as _json
+
+from rich.console import Console
+from rich.table import Table
+
+console = Console()
+
+
+def emit(payload, json_mode: bool):
+    if json_mode:
+        # Stable, agent-pipe-friendly JSON (no rich formatting)
+        print(_json.dumps(payload, ensure_ascii=False, indent=2, sort_keys=False))
+        return
+    # Otherwise dispatch by shape
+    if isinstance(payload, dict) and "entries" in payload:
+        _print_entries(payload)
+    elif isinstance(payload, dict) and "results" in payload:
+        _print_search(payload)
+    elif isinstance(payload, dict) and "conversations" in payload:
+        _print_conversations(payload)
+    elif isinstance(payload, dict) and "messages" in payload:
+        _print_conversation(payload)
+    elif isinstance(payload, dict) and "tokens" in payload:
+        _print_tokens(payload)
+    else:
+        console.print(payload)
+
+
+def _print_entries(p):
+    if p.get("count", 0) == 0:
+        console.print("[dim]No entries.[/]")
+        return
+    for e in p["entries"]:
+        head = f"[bold]{e['date']}[/]"
+        if e.get("emoji"):
+            head += f" {e['emoji']}"
+        console.print(head)
+        if e.get("preview"):
+            console.print(f"  [dim]{e['preview']}[/]")
+        console.print()
+
+
+def _print_search(p):
+    console.print(f"[dim]{p['count']} hits for[/] [bold]{p['query']}[/] "
+                  f"[dim](scanned {p['scanned']})[/]\n")
+    if not p["results"]:
+        console.print("[dim]No matches.[/]")
+        return
+    for r in p["results"]:
+        tag = r["source"].replace("_", " ")
+        date = r.get("date") or ""
+        console.print(f"[bold cyan]{tag}[/] [dim]{date}[/]")
+        console.print(f"  {r['snippet']}")
+        console.print()
+
+
+def _print_conversations(p):
+    if p.get("count", 0) == 0:
+        console.print("[dim]No conversations.[/]")
+        return
+    t = Table(show_header=True, header_style="bold", box=None)
+    t.add_column("ID")
+    t.add_column("Mentor")
+    t.add_column("Last")
+    t.add_column("Title")
+    for c in p["conversations"]:
+        t.add_row(str(c["id"]), c.get("mentor") or "-",
+                  (c.get("last_message_at") or "")[:10],
+                  (c.get("title") or "(no title)")[:60])
+    console.print(t)
+
+
+def _print_conversation(p):
+    console.print(f"[bold]{p.get('mentor') or 'Conversation'}[/] — {p.get('title') or ''}")
+    console.print()
+    for m in p["messages"]:
+        who = "[cyan]you[/]" if m["sender"] == "user" else f"[magenta]{p.get('mentor','mentor')}[/]"
+        console.print(f"{who} [dim]{(m.get('timestamp') or '')[:16]}[/]")
+        console.print(f"  {m.get('content') or '[dim](no content)[/]'}")
+        console.print()
+
+
+def _print_tokens(p):
+    t = Table(show_header=True, header_style="bold", box=None)
+    t.add_column("ID")
+    t.add_column("Name")
+    t.add_column("Kind")
+    t.add_column("Last used")
+    t.add_column("Status")
+    for tok in p["tokens"]:
+        t.add_row(
+            str(tok["id"]), tok["name"], tok["client_kind"],
+            (tok.get("last_used_at") or "never")[:16],
+            "[green]active[/]" if tok["active"] else "[red]revoked[/]",
+        )
+    console.print(t)

lifenote-0.1.1/src/lifenote/skill.py

@@ -0,0 +1,70 @@
+"""Bundled Claude Code skill — drops a markdown file into ~/.claude/skills/."""
+import os
+
+SKILL_NAME = "lifenote.md"
+
+SKILL_BODY = """---
+name: lifenote
+description: |
+  Use Life Note as the user's reflective memory layer. Search their journal
+  entries, past mentor conversations, and emotional themes — to ground
+  responses in who the user actually is, not what you'd guess.
+---
+
+# Life Note
+
+The user keeps a private journal at https://www.mylifenote.ai. They've connected
+it to you so you can read from it as part of your responses.
+
+## When to reach for Life Note (proactively, without being asked)
+
+- The user mentions a feeling ("I'm anxious about X", "I've been frustrated lately")
+  → search the journal for that feeling word + topic
+- The user references a person, project, or recurring theme by name
+  → search for the name; if hits, read at least one entry
+- The user asks "why am I…" or "what's been on my mind lately"
+  → list recent entries (last 7 days)
+- The user references "what [mentor] said" or any past mentor chat
+  → list conversations and read the relevant one
+
+## When NOT to reach for Life Note
+
+- Coding / debugging questions
+- General factual queries
+- Anything where the user is acting in a professional or task-execution mode,
+  not a reflective one
+
+## How to use what you find
+
+- **Paraphrase, don't quote verbatim.** The user wrote those words for themselves,
+  not for you to recite back. Reference what they said in your own voice.
+- **Cite the date casually**: "you wrote on Tuesday that you were…" — not
+  "Per journal entry id 39938 dated 2026-05-06…"
+- **If search returns nothing, say so plainly.** Don't fabricate continuity.
+- **Don't summarize the whole journal.** Pull what's relevant to this exact
+  moment in the conversation. The user has hundreds of entries.
+
+## Boundaries
+
+- You can READ. You cannot write to the journal in this version.
+- The journal contains emotionally significant material. If recent entries
+  reference self-harm, severe distress, or crisis, prioritize a caring,
+  grounded response and the appropriate hotlines — don't analyze.
+
+## Tools available (via the lifenote MCP server)
+
+- `search_entries(query, since?, limit?)` — keyword search across entries
+- `list_recent_entries(since?, limit?)` — most recent with previews
+- `get_entry(entry_id)` — full text + analysis + mentor responses
+- `list_conversations(since?, limit?)` — past mentor chats
+- `get_conversation(conversation_id)` — full message thread
+"""
+
+
+def install(target_dir: str) -> str:
+    target_dir = os.path.expanduser(target_dir)
+    os.makedirs(target_dir, exist_ok=True)
+    path = os.path.join(target_dir, SKILL_NAME)
+    with open(path, "w", encoding="utf-8") as f:
+        f.write(SKILL_BODY)
+    return path