mcli-framework 8.0.45__tar.gz → 8.0.47__tar.gz

{mcli_framework-8.0.45/src/mcli_framework.egg-info → mcli_framework-8.0.47}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcli-framework
-Version: 8.0.45
+Version: 8.0.47
 Summary: Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/workflows/, version with lockfile, run as daemon or cron job.
 Author-email: Luis Fernandez de la Vara <luis@lefv.io>
 Maintainer-email: Luis Fernandez de la Vara <luis@lefv.io>

{mcli_framework-8.0.45 → mcli_framework-8.0.47}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcli-framework"
-version = "8.0.45"
+version = "8.0.47"
 description = "Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/workflows/, version with lockfile, run as daemon or cron job."
 readme = "README.md"
  requires-python = ">=3.10"

{mcli_framework-8.0.45 → mcli_framework-8.0.47}/src/mcli/app/sync_cmd.py

@@ -7,6 +7,7 @@ Provides:
 """
 
 import json
+import os
 import shutil
 import subprocess
 import sys
@@ -460,19 +461,32 @@ def sync_push_command(global_mode: bool, description: str):
 @click.option("--output", "-o", type=click.Path(path_type=Path), help="Output file path")
 @click.option("--no-verify", is_flag=True, help="Skip hash verification")
 @click.option("--repo", "-r", help="Override repo name for IPNS resolution (cross-repo pull)")
+@click.option(
+    "--workflows-dir",
+    "-w",
+    type=click.Path(path_type=Path, file_okay=False),
+    help="Reconstruct script files into this directory (per-script CIDs in manifest)",
+)
 def sync_pull_command(
-    cid: Optional[str], output: Optional[Path], no_verify: bool, repo: Optional[str]
+    cid: Optional[str],
+    output: Optional[Path],
+    no_verify: bool,
+    repo: Optional[str],
+    workflows_dir: Optional[Path],
 ):
     """⬇️ Pull workflow state from IPFS.
 
     If CID is provided, retrieves that exact version. If CID is omitted and
-    MCLI_SYNC_KEY is set, automatically resolves the latest via IPNS.
+    MCLI_SYNC_KEY is set, automatically resolves the latest via IPNS. With
+    --workflows-dir, also reconstructs each command's script file from its
+    per-script CID embedded in the manifest.
 
     Examples:
-        mcli sync pull                           # Auto-resolve via IPNS
-        mcli sync pull QmXyZ123...               # Pull specific CID
-        mcli sync pull --repo other-project      # Pull from different repo
+        mcli sync pull                                 # Auto-resolve via IPNS
+        mcli sync pull QmXyZ123...                     # Pull specific CID
+        mcli sync pull --repo other-project            # Pull from different repo
         mcli sync pull QmXyZ123... -o my-cmds.json
+        mcli sync pull QmXyZ123... -w ./.mcli/workflows
     """
     import json
 
@@ -527,6 +541,22 @@ def sync_pull_command(
 
         if "version" in data:
             console.print(SyncMessages.VERSION_LABEL.format(version=data["version"]))
+
+        # Optional: reconstruct script files from per-script CIDs
+        if workflows_dir and cid:
+            try:
+                written = ipfs.pull_workflows(cid, workflows_dir, verify=not no_verify)
+            except ValueError as exc:
+                error(f"Hash verification failed: {exc}")
+                return
+            if written:
+                success(f"Restored {len(written)} script file(s) to {workflows_dir}")
+                for path in written:
+                    console.print(f"  [dim]{path}[/dim]")
+            else:
+                console.print(
+                    "[dim]No script files restored — manifest predates per-script CIDs.[/dim]"
+                )
     else:
         error(SyncMessages.FAILED_RETRIEVE_IPFS)
         info(SyncMessages.CID_INVALID_OR_NOT_PROPAGATED)
@@ -803,3 +833,111 @@ def sync_info(is_global: bool):
     else:
         console.print("  Installed: No")
         console.print("  [dim]Install with: brew install ipfs[/dim]")
+
+
+@sync_group.group(name="key")
+def sync_key_group():
+    """🔑 Manage the persistent IPNS sync key.
+
+    Generates / shows / sets / clears the shared secret used to derive
+    a deterministic IPNS name for cross-host workflow sync. The
+    ``MCLI_SYNC_KEY`` environment variable, if set, always wins over
+    the on-disk value.
+    """
+
+
+def _mask_key(key: str) -> str:
+    if len(key) <= 12:
+        return "*" * len(key)
+    return f"{key[:4]}...{key[-4:]}"
+
+
+@sync_key_group.command(name="gen")
+@click.option("--force", "-f", is_flag=True, help="Overwrite an existing key")
+@click.option("--show", is_flag=True, help="Print the full key (default masks it)")
+def sync_key_gen(force: bool, show: bool):
+    """Generate and persist a new 64-char hex sync key.
+
+    Examples:
+        mcli sync key gen
+        mcli sync key gen --show
+        mcli sync key gen --force --show
+    """
+    from mcli.lib.sync_key_store import SyncKeyStore
+
+    store = SyncKeyStore()
+    try:
+        key = store.generate(force=force)
+    except FileExistsError:
+        error("A sync key is already configured.")
+        info("Use --force to overwrite, or 'mcli sync key show' to view it.")
+        return 1
+
+    success(f"Generated sync key at {store.path}")
+    if show:
+        console.print(f"[bold cyan]{key}[/bold cyan]")
+    else:
+        console.print(f"[dim]Key: {_mask_key(key)} (use --show to print full)[/dim]")
+    console.print(
+        "[dim]Share this key with teammates / your other hosts. "
+        "Then run `mcli sync key set <key>` on each peer.[/dim]"
+    )
+    return 0
+
+
+@sync_key_group.command(name="set")
+@click.argument("key")
+def sync_key_set(key: str):
+    """Persist an existing 64-char hex sync key.
+
+    Use this on a second host after copying the key generated on the
+    first.
+    """
+    from mcli.lib.sync_key_store import SyncKeyStore
+
+    try:
+        SyncKeyStore().set(key.strip())
+    except ValueError as exc:
+        error(str(exc))
+        return 1
+    success("Sync key stored.")
+    return 0
+
+
+@sync_key_group.command(name="show")
+@click.option("--reveal", is_flag=True, help="Print the full key (default masks it)")
+def sync_key_show(reveal: bool):
+    """Show the currently configured sync key (masked unless --reveal)."""
+    from mcli.lib.sync_key_store import SyncKeyStore
+
+    env_value = os.environ.get("MCLI_SYNC_KEY")
+    stored = SyncKeyStore().get()
+
+    if not env_value and not stored:
+        info("No sync key configured.")
+        console.print("[dim]Generate one with: mcli sync key gen[/dim]")
+        return 1
+
+    if env_value:
+        label = "MCLI_SYNC_KEY env var (overrides on-disk value)"
+        value = env_value
+    else:
+        label = "stored at " + str(SyncKeyStore().path)
+        value = stored
+
+    console.print(f"[bold]Source:[/bold] {label}")
+    console.print(f"[bold]Key:[/bold] [cyan]{value if reveal else _mask_key(value)}[/cyan]")
+    if not reveal:
+        console.print("[dim]Use --reveal to print the full key.[/dim]")
+    return 0
+
+
+@sync_key_group.command(name="clear")
+@click.confirmation_option(prompt="Remove the stored sync key?")
+def sync_key_clear():
+    """Delete the persisted sync key (env var, if set, is untouched)."""
+    from mcli.lib.sync_key_store import SyncKeyStore
+
+    SyncKeyStore().clear()
+    success("Stored sync key removed.")
+    return 0

{mcli_framework-8.0.45 → mcli_framework-8.0.47}/src/mcli/lib/ipfs_sync.py

@@ -58,6 +58,7 @@ class IPFSSync:
 
     # Local IPFS daemon endpoint (default port)
     LOCAL_IPFS_API = "http://127.0.0.1:5001/api/v0/add"
+    LOCAL_IPFS_CAT = "http://127.0.0.1:5001/api/v0/cat"
 
     # Public IPFS gateways for retrieval
     RETRIEVE_GATEWAY = "https://ipfs.io/ipfs/{cid}"
@@ -280,6 +281,96 @@ class IPFSSync:
         logger.error(f"Failed to retrieve from all gateways: {cid}")
         return None
 
+    def add_file_to_ipfs(self, file_path: Path, max_retries: int = 3) -> Optional[str]:
+        """Add a single file to the local IPFS daemon and return its CID.
+
+        Used by push() to upload each workflow script body alongside the
+        manifest, so consumers can reconstruct the full workflows directory
+        on pull.
+        """
+        if not self._check_local_ipfs():
+            logger.error("Cannot add file to IPFS: local daemon unavailable")
+            return None
+
+        path = Path(file_path)
+        if not path.is_file():
+            logger.warning(f"Skipping IPFS add — file does not exist: {path}")
+            return None
+
+        def attempt_upload():
+            with open(path, "rb") as fh:
+                files = {"file": (path.name, fh.read())}
+            response = requests.post(self.LOCAL_IPFS_API, files=files, timeout=30)
+            if response.status_code == 200:
+                cid = response.json().get("Hash")
+                logger.info(f"Added {path.name} to IPFS: {cid}")
+                return (True, cid)
+            logger.warning(f"IPFS add failed for {path.name}: {response.status_code}")
+            return (False, None)
+
+        return self._retry_with_backoff(attempt_upload, max_retries=max_retries)
+
+    def fetch_file_from_ipfs(self, cid: str, timeout: int = 30) -> Optional[bytes]:
+        """Fetch raw bytes for a CID via the local daemon, falling back to gateways.
+
+        Used by pull_workflows() to reconstruct script files referenced by
+        per-script CIDs in the manifest.
+        """
+        # Local daemon first
+        if self._check_local_ipfs():
+            try:
+                response = requests.post(
+                    self.LOCAL_IPFS_CAT,
+                    params={"arg": cid},
+                    timeout=timeout,
+                )
+                if response.status_code == 200:
+                    return response.content
+                logger.warning(f"Local daemon cat failed for {cid}: {response.status_code}")
+            except Exception as e:
+                logger.warning(f"Local daemon cat error for {cid}: {e}")
+
+        # Public gateway fallback
+        for gateway_template in [self.RETRIEVE_GATEWAY] + self.ALT_GATEWAYS:
+            url = gateway_template.format(cid=cid)
+            try:
+                response = requests.get(url, timeout=timeout)
+                if response.status_code == 200:
+                    return response.content
+                logger.warning(
+                    f"Gateway {gateway_template} returned {response.status_code} for {cid}"
+                )
+            except Exception as e:
+                logger.warning(f"Gateway {gateway_template} error for {cid}: {e}")
+        return None
+
+    def _embed_script_cids(self, command_data: dict, workflows_dir: Path) -> dict:
+        """Augment a lockfile dict in-memory with per-script IPFS CIDs.
+
+        Reads each command's ``file`` from ``workflows_dir``, adds it to IPFS,
+        and stores the resulting CID as ``script_cid`` on the entry. Bumps
+        the manifest version to "2.1" to signal that script bodies are
+        retrievable.
+        """
+        commands = command_data.get("commands", {})
+        any_uploaded = False
+        for name, entry in commands.items():
+            script_filename = entry.get("file")
+            if not script_filename:
+                continue
+            script_path = workflows_dir / script_filename
+            if not script_path.is_file():
+                logger.warning(f"Skipping '{name}' — script file missing: {script_path}")
+                continue
+            cid = self.add_file_to_ipfs(script_path)
+            if cid:
+                entry["script_cid"] = cid
+                any_uploaded = True
+
+        if any_uploaded:
+            command_data["version"] = "2.1"
+        return command_data
+
     def push(self, command_lock_path: Path, description: str = "") -> Optional[str]:
         """
         Push command state to IPFS.
@@ -296,6 +387,12 @@ class IPFSSync:
             with open(command_lock_path) as f:
                 command_data = json.load(f)
 
+            # Add each workflow script to IPFS so consumers can reconstruct
+            # the full workflows directory on pull. Operates on the in-memory
+            # copy so the on-disk lockfile stays untouched.
+            workflows_dir = Path(command_lock_path).parent
+            command_data = self._embed_script_cids(command_data, workflows_dir)
+
             # Add sync metadata
             sync_data = {
                 "version": "1.0",
@@ -376,6 +473,74 @@ class IPFSSync:
 
         return data.get("commands", {})
 
+    def pull_workflows(
+        self,
+        cid: str,
+        workflows_dir: Path,
+        verify: bool = True,
+    ) -> list[Path]:
+        """Pull a manifest and reconstruct the workflow script files on disk.
+
+        Walks each command entry in the retrieved manifest, fetches its
+        ``script_cid`` (if present) from IPFS, verifies the recorded
+        ``content_hash``, and writes the file to ``workflows_dir``.
+
+        Returns the list of files written. If the manifest predates per-script
+        CIDs (lockfile schema < 2.1), the manifest is still pulled but no
+        files are written and a warning is logged.
+
+        Raises:
+            ValueError: when a fetched script's SHA-256 does not match the
+                ``content_hash`` recorded in the lockfile.
+        """
+        manifest = self.pull(cid, verify=verify)
+        if not manifest:
+            return []
+
+        commands = manifest.get("commands", {})
+        # `pull()` strips the outer envelope, so commands maps directly.
+        # Some callers still get the v2.x nested shape — handle both.
+        if (
+            isinstance(commands, dict)
+            and "commands" in commands
+            and isinstance(commands["commands"], dict)
+        ):
+            commands = commands["commands"]
+
+        if not commands:
+            return []
+
+        workflows_dir = Path(workflows_dir)
+        workflows_dir.mkdir(parents=True, exist_ok=True)
+
+        written: list[Path] = []
+        for name, entry in commands.items():
+            script_filename = entry.get("file")
+            script_cid = entry.get("script_cid")
+            if not script_filename or not script_cid:
+                logger.warning(f"Skipping '{name}': manifest predates per-script CID sync")
+                continue
+
+            payload = self.fetch_file_from_ipfs(script_cid)
+            if payload is None:
+                logger.error(f"Failed to fetch script for '{name}' (cid={script_cid})")
+                continue
+
+            expected_hash = entry.get("content_hash")
+            if expected_hash:
+                expected_value = expected_hash.split(":", 1)[-1]
+                actual = hashlib.sha256(payload).hexdigest()
+                if actual != expected_value:
+                    raise ValueError(
+                        f"hash mismatch for '{name}': expected {expected_value}, got {actual}"
+                    )
+
+            target = workflows_dir / script_filename
+            target.write_bytes(payload)
+            written.append(target)
+
+        return written
+
     def pull_latest(
         self,
         scope: str = "global",

{mcli_framework-8.0.45 → mcli_framework-8.0.47}/src/mcli/lib/ipns_manager.py

@@ -174,8 +174,23 @@ def resolve_ipns(ipns_name: str) -> Optional[str]:
 
 
 def get_sync_key() -> Optional[str]:
-    """Return the MCLI_SYNC_KEY environment variable, or None if unset."""
-    return os.environ.get(EnvVars.MCLI_SYNC_KEY) or None
+    """Return the active sync key.
+
+    Resolution order:
+        1. ``MCLI_SYNC_KEY`` environment variable (lets users override per-shell).
+        2. The persistent on-disk store at ``$MCLI_HOME/sync_key.json``.
+
+    Returns ``None`` when neither source has a value.
+    """
+    env_key = os.environ.get(EnvVars.MCLI_SYNC_KEY)
+    if env_key:
+        return env_key
+
+    # Lazy import to avoid a hard dependency cycle if the store module is
+    # ever extended to read IPNS state.
+    from mcli.lib.sync_key_store import SyncKeyStore
+
+    return SyncKeyStore().get()
 
 
 def get_repo_name() -> str:

mcli_framework-8.0.47/src/mcli/lib/sync_key_store.py

@@ -0,0 +1,69 @@
+"""Persistent storage for the shared workflow sync key.
+
+The store keeps a 64-character hex secret on disk so users do not have
+to ``export MCLI_SYNC_KEY=...`` in every shell. The env var still wins
+when set — see :func:`mcli.lib.ipns_manager.get_sync_key`.
+
+File: ``$MCLI_HOME/sync_key.json`` (default ``~/.mcli/sync_key.json``)
+mode 0600. JSON shape: ``{"key": "<64 hex chars>"}``.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import secrets
+from pathlib import Path
+from typing import Optional
+
+from mcli.lib.paths import get_mcli_home
+
+_FILENAME = "sync_key.json"
+_HEX64 = re.compile(r"^[0-9a-fA-F]{64}$")
+
+
+class SyncKeyStore:
+    """Read/write the persistent sync key on disk."""
+
+    @property
+    def path(self) -> Path:
+        return get_mcli_home() / _FILENAME
+
+    def get(self) -> Optional[str]:
+        path = self.path
+        if not path.is_file():
+            return None
+        try:
+            data = json.loads(path.read_text())
+        except (json.JSONDecodeError, OSError):
+            return None
+        key = data.get("key")
+        return key if isinstance(key, str) and _HEX64.match(key) else None
+
+    def set(self, key: str) -> None:
+        if not isinstance(key, str) or not _HEX64.match(key):
+            raise ValueError("sync key must be a 64-char hex string")
+        self._write(key)
+
+    def generate(self, force: bool = False) -> str:
+        if self.path.exists() and not force:
+            raise FileExistsError(
+                f"sync key already exists at {self.path}; use force=True to overwrite"
+            )
+        key = secrets.token_hex(32)
+        self._write(key)
+        return key
+
+    def clear(self) -> None:
+        try:
+            self.path.unlink()
+        except FileNotFoundError:
+            pass
+
+    def _write(self, key: str) -> None:
+        path = self.path
+        path.parent.mkdir(parents=True, exist_ok=True)
+        # Write then chmod so the secret is never world-readable.
+        path.write_text(json.dumps({"key": key}))
+        os.chmod(path, 0o600)

{mcli_framework-8.0.45 → mcli_framework-8.0.47/src/mcli_framework.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcli-framework
-Version: 8.0.45
+Version: 8.0.47
 Summary: Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/workflows/, version with lockfile, run as daemon or cron job.
 Author-email: Luis Fernandez de la Vara <luis@lefv.io>
 Maintainer-email: Luis Fernandez de la Vara <luis@lefv.io>

{mcli_framework-8.0.45 → mcli_framework-8.0.47}/src/mcli_framework.egg-info/SOURCES.txt

@@ -53,6 +53,7 @@ src/mcli/lib/paths.py
 src/mcli/lib/script_loader.py
 src/mcli/lib/script_sync.py
 src/mcli/lib/script_watcher.py
+src/mcli/lib/sync_key_store.py
 src/mcli/lib/types.py
 src/mcli/lib/workflow_models.py
 src/mcli/lib/workspace_registry.py