memorysync-cli 1.0.2__tar.gz → 1.1.0__tar.gz

{memorysync_cli-1.0.2 → memorysync_cli-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: memorysync-cli
-Version: 1.0.2
+Version: 1.1.0
 Summary: MemorySync from your terminal. Zero dependencies.
 Project-URL: Documentation, https://docs.memorysync.io/cli
 Project-URL: Homepage, https://memorysync.io/cli
@@ -42,6 +42,32 @@ externally-managed Pythons — Homebrew and most Linux distributions — with
 
 Requires Python 3.9 or newer.
 
+### `memorysync: command not found` after installing
+
+The install worked; your shell cannot see the directory `pipx` puts binaries in.
+Run `pipx ensurepath`, then reopen the terminal. Or invoke it by full path —
+`pipx list` prints the location.
+
+To skip `PATH` entirely:
+
+```bash
+pipx run --spec memorysync-cli memorysync <command>
+```
+
+`--spec` is needed because `pipx run memorysync-cli` looks for a console script
+named after the package, and this package's scripts are `memorysync` and `msync`.
+
+### Both CLIs installed? Only one `memorysync` can win
+
+The npm package installs the same two command names, so whichever directory comes
+first on `PATH` answers. To run *this* one specifically, use the full path from
+`pipx list`, or `pipx run --spec` as above.
+
+`python -m memorysync_cli` works only when the package is installed into that
+interpreter with `pip install`. After a `pipx` install it will report
+`No module named memorysync_cli`, because pipx deliberately isolates the package
+in its own virtualenv.
+
 ## Getting started
 
 ```bash

{memorysync_cli-1.0.2 → memorysync_cli-1.1.0}/README.md

@@ -17,6 +17,32 @@ externally-managed Pythons — Homebrew and most Linux distributions — with
 
 Requires Python 3.9 or newer.
 
+### `memorysync: command not found` after installing
+
+The install worked; your shell cannot see the directory `pipx` puts binaries in.
+Run `pipx ensurepath`, then reopen the terminal. Or invoke it by full path —
+`pipx list` prints the location.
+
+To skip `PATH` entirely:
+
+```bash
+pipx run --spec memorysync-cli memorysync <command>
+```
+
+`--spec` is needed because `pipx run memorysync-cli` looks for a console script
+named after the package, and this package's scripts are `memorysync` and `msync`.
+
+### Both CLIs installed? Only one `memorysync` can win
+
+The npm package installs the same two command names, so whichever directory comes
+first on `PATH` answers. To run *this* one specifically, use the full path from
+`pipx list`, or `pipx run --spec` as above.
+
+`python -m memorysync_cli` works only when the package is installed into that
+interpreter with `pip install`. After a `pipx` install it will report
+`No module named memorysync_cli`, because pipx deliberately isolates the package
+in its own virtualenv.
+
 ## Getting started
 
 ```bash

memorysync_cli-1.1.0/src/memorysync_cli/_version.py

@@ -0,0 +1 @@
+__version__ = "1.1.0"

{memorysync_cli-1.0.2 → memorysync_cli-1.1.0}/src/memorysync_cli/commands/admin.py

@@ -126,7 +126,7 @@ def whoami(ctx: dict) -> dict:
         "user": settings.get("user"),
         "project": settings.get("project"),
         "plan": plan.get("plan") or plan.get("name"),
-        "credential_source": credentials.describe_storage(),
+        "credential_source": credentials.describe_storage(settings["profile_name"]),
     }
 
     def render() -> str:
@@ -168,14 +168,23 @@ def doctor(ctx: dict) -> dict:
     )
     add("cli", True, f"memorysync-cli {__version__}")
     add("config", True, str(config_module.config_path()))
-    add("credential store", True, credentials.describe_storage())
+    add("credential store", True, credentials.describe_storage(settings["profile_name"]))
 
     key = credentials.read_key(settings["profile_name"])
     add(
         "api key",
         bool(key),
         f"found ({key[:8]}...)" if key else "not found",
-        None if key else "Run `memorysync init`, or set MEMORYSYNC_API_KEY.",
+        # Names the cross-CLI case explicitly. Someone who ran `init` moments ago
+        # and is told "not found" will otherwise reasonably conclude the CLI is
+        # broken, when on Windows the key is simply in the other CLI's store.
+        None
+        if key
+        else (
+            "Run `memorysync init`, or set MEMORYSYNC_API_KEY. If you stored a key "
+            "with the Node CLI on Windows, it is not shared: the two use different "
+            "ciphers, so run init here as well."
+        ),
     )
     add(
         "end user",

memorysync_cli-1.1.0/src/memorysync_cli/commands/init.py

@@ -0,0 +1,328 @@
+"""init: store a credential and pick defaults.
+
+The key is verified against the API before it is written. Storing an unverified key
+means the next command fails with something that looks like a network problem, and
+the person has no reason to suspect the thing they just typed.
+
+It is never written to the config file in plain text. It goes to the OS keychain
+where one is reachable, and otherwise to an owner-only encrypted file, and `init`
+says which of the two happened rather than implying a keychain that was never
+there.
+"""
+
+from __future__ import annotations
+
+import getpass
+import os
+import sys
+
+from .. import config as config_module
+from .. import credentials
+from ..errors import auth_error, usage_error
+from ..evaluation import CLAIM_HINT
+from ..http import ApiClient
+from ..output import style
+
+
+def _init_as_agent(ctx: dict, profile_name: str) -> dict:
+    """``init --agent`` — mint an evaluation key with no signup.
+
+    Stores the key exactly the way the interactive path does, so every later
+    command works with no further setup, and keeps the server's generated
+    end-user id as the profile default: an agent forced to invent one will invent
+    a different one next run and then wonder where its memories went.
+    """
+    flags, settings = ctx["flags"], ctx["settings"]
+
+    # No credential yet, by definition.
+    client = ApiClient(
+        base_url=settings["base_url"], api_key=None, timeout=settings["timeout"]
+    )
+    body = {}
+    if flags.get("agent_caller"):
+        body["agent_caller"] = flags["agent_caller"]
+    minted = client.mint_evaluation_key(body) or {}
+
+    api_key = minted.get("api_key")
+    if not api_key:
+        raise auth_error(
+            "The server did not return an evaluation key.",
+            'Try again, or run "memorysync init" with a key from https://memorysync.io.',
+        )
+
+    tier = credentials.write_key(api_key, profile_name)
+
+    data = config_module.load()
+    entry = data.setdefault("profiles", {}).setdefault(profile_name, {})
+    user = flags.get("user") or minted.get("default_user_id")
+    if user:
+        entry["user"] = user
+    if minted.get("project_id"):
+        entry["project"] = minted["project_id"]
+    if settings["base_url"] != config_module.DEFAULT_BASE_URL:
+        entry["base_url"] = settings["base_url"]
+    path = config_module.save(data)
+
+    payload = {
+        "profile": profile_name,
+        "mode": "agent",
+        "api_key": api_key,
+        "default_user_id": minted.get("default_user_id"),
+        "project_id": minted.get("project_id"),
+        "plan": minted.get("plan"),
+        "claimed": False,
+        "expires_at": minted.get("expires_at"),
+        "claim_command": minted.get("claim_command") or CLAIM_HINT,
+        "limits": minted.get("limits"),
+        "mcp_url": minted.get("mcp_url"),
+        "stored_in": tier,
+        "config": str(path),
+    }
+
+    def render() -> str:
+        where = (
+            "the OS keychain" if tier == "keychain" else "an owner-only encrypted file"
+        )
+        return "\n".join(
+            [
+                style.green("Agent mode active."),
+                f"{style.dim('default user')} {payload['default_user_id'] or '-'}",
+                f"{style.dim('plan        ')} {payload['plan'] or '-'}",
+                f"{style.dim('expires     ')} {payload['expires_at'] or '-'}",
+                f"{style.dim('key stored  ')} in {where}",
+                "",
+                style.dim('Try: memorysync add "I prefer TypeScript"'),
+                "",
+                style.yellow(
+                    "Nobody owns this account yet. To keep it and everything in it:"
+                ),
+                f"  {payload['claim_command']}",
+            ]
+        )
+
+    return {"data": payload, "text": render}
+
+
+def _init_by_claiming(ctx: dict, profile_name: str) -> dict:
+    """``init --email`` — claim the evaluation account behind the stored key.
+
+    Two steps in one command, chosen by whether ``--code`` is present, because
+    that is how a person experiences it: run it, read the email, run it again with
+    the code.
+    """
+    flags, settings = ctx["flags"], ctx["settings"]
+    email = str(flags.get("email") or "").strip()
+
+    if flags.get("code"):
+        # Completing needs no credential, so this works on a machine that never
+        # held the key.
+        client = ApiClient(
+            base_url=settings["base_url"], api_key=None, timeout=settings["timeout"]
+        )
+        body = {"email": email, "code": str(flags["code"]).strip()}
+        if flags.get("password"):
+            body["password"] = str(flags["password"])
+        claimed = client.complete_evaluation_claim(body) or {}
+
+        # Recorded locally so the per-command reminder stops. The key keeps its
+        # ``ms_eval_`` prefix after claiming, so the prefix alone cannot tell us.
+        data = config_module.load()
+        entry = data.setdefault("profiles", {}).setdefault(profile_name, {})
+        entry["claimed"] = True
+        config_module.save(data)
+
+        payload = {**claimed, "profile": profile_name, "mode": "claim-complete"}
+
+        def render_complete() -> str:
+            return "\n".join(
+                [
+                    style.green("Account claimed."),
+                    f"{style.dim('email  ')} {claimed.get('email') or email}",
+                    f"{style.dim('plan   ')} {claimed.get('plan') or '-'}",
+                    "",
+                    style.dim(
+                        "Your existing key keeps working and no longer expires. "
+                        "Everything stored during the evaluation is still there."
+                    ),
+                ]
+            )
+
+        return {"data": payload, "text": render_complete}
+
+    api_key = credentials.read_key(profile_name) or os.environ.get(
+        "MEMORYSYNC_API_KEY"
+    )
+    if not api_key:
+        raise usage_error(
+            "No stored key, so there is no evaluation account to claim.",
+            'Run "memorysync init --agent" first, or pass --code to finish a claim '
+            "you already started.",
+        )
+
+    client = ApiClient(
+        base_url=settings["base_url"], api_key=api_key, timeout=settings["timeout"]
+    )
+    started = client.start_evaluation_claim({"email": email}) or {}
+    payload = {**started, "profile": profile_name, "mode": "claim-start"}
+
+    def render_start() -> str:
+        target = started.get("email") or email
+        return "\n".join(
+            [
+                style.green("Claim code sent."),
+                f"{style.dim('email  ')} {target}",
+                f"{style.dim('expires')} {started.get('expires_in_minutes') or '-'} minutes",
+                "",
+                style.dim("Check your email, then run:"),
+                f"  memorysync init --email {target} --code <CODE>",
+            ]
+        )
+
+    return {"data": payload, "text": render_start}
+
+
+def identify(ctx: dict) -> dict:
+    """``identify <name>`` — replace the profile's default end-user id.
+
+    Purely local. Renaming the default cannot rename memories already stored under
+    the old id, and pretending otherwise would be worse than saying so: the output
+    names the previous id so it can still be read back with ``--user``.
+    """
+    positionals = ctx.get("positionals") or []
+    name = (positionals[0] if positionals else "").strip()
+    if not name:
+        raise usage_error("No name given.", "Try: memorysync identify alice")
+
+    profile_name = ctx["settings"]["profile_name"]
+    data = config_module.load()
+    entry = data.setdefault("profiles", {}).setdefault(profile_name, {})
+    previous = entry.get("user")
+    entry["user"] = name
+    config_module.save(data)
+
+    payload = {
+        "profile": profile_name,
+        "end_user": name,
+        "previous_end_user": previous,
+    }
+
+    def render() -> str:
+        lines = [style.green(f"Default end user is now {name}.")]
+        if previous and previous != name:
+            lines.append(
+                style.dim(
+                    f'Memories stored as "{previous}" keep that id - '
+                    f"read them with --user {previous}."
+                )
+            )
+        else:
+            lines.append(style.dim("Nothing was stored under a different id."))
+        return "\n".join(lines)
+
+    return {"data": payload, "text": render}
+
+
+def init(ctx: dict) -> dict:
+    flags, settings = ctx["flags"], ctx["settings"]
+    profile_name = settings["profile_name"]
+
+    # Claiming acts on the account behind an existing key rather than creating a
+    # profile, so it runs before the overwrite guard.
+    if flags.get("email"):
+        if flags.get("agent"):
+            raise usage_error(
+                "--agent mints a new account and --email claims the current one.",
+                'Run "memorysync init --agent" first, then '
+                '"memorysync init --email <address>".',
+            )
+        return _init_by_claiming(ctx, profile_name)
+
+    if flags.get("agent") and flags.get("api_key"):
+        raise usage_error(
+            "--agent mints a key, so there is nothing to pass with --api-key.",
+            "Drop one of the two.",
+        )
+
+    existing = config_module.profile(profile_name)
+    if existing and not flags.get("force"):
+        stored = credentials.read_key(profile_name)
+        if stored:
+            raise usage_error(
+                f'Profile "{profile_name}" already has a key.',
+                "Pass --force to replace it, or --profile <name> to add another.",
+            )
+
+    if flags.get("agent"):
+        return _init_as_agent(ctx, profile_name)
+
+    api_key = flags.get("api_key") or os.environ.get("MEMORYSYNC_API_KEY")
+    if not api_key:
+        if not sys.stdin.isatty():
+            raise usage_error(
+                "No API key given and no terminal to prompt from.",
+                "Pass --api-key, or set MEMORYSYNC_API_KEY.",
+            )
+        # getpass, so the key is not echoed into the terminal or the scrollback.
+        api_key = getpass.getpass("MemorySync API key: ").strip()
+
+    if not api_key:
+        raise usage_error("No API key given.")
+
+    # Verified before storing. A key that cannot read its own plan is not usable,
+    # and finding that out now is far cheaper than on the next command.
+    probe = ApiClient(
+        base_url=settings["base_url"],
+        api_key=api_key,
+        timeout=settings["timeout"],
+    )
+    try:
+        plan = probe.current_plan() or {}
+    except Exception as error:  # noqa: BLE001 - re-raised as an auth failure below
+        raise auth_error(
+            f"That key was refused: {error}",
+            "Check it in the dashboard, or pass --base-url if you are not on production.",
+        ) from None
+
+    tier = credentials.write_key(api_key, profile_name)
+
+    data = config_module.load()
+    entry = data.setdefault("profiles", {}).setdefault(profile_name, {})
+    if flags.get("user"):
+        entry["user"] = flags["user"]
+    if flags.get("project"):
+        entry["project"] = flags["project"]
+    if settings["base_url"] != config_module.DEFAULT_BASE_URL:
+        entry["base_url"] = settings["base_url"]
+    path = config_module.save(data)
+
+    payload = {
+        "profile": profile_name,
+        "stored_in": tier,
+        "config": str(path),
+        "user": entry.get("user"),
+        "project": entry.get("project"),
+        "plan": plan.get("plan") or plan.get("name"),
+    }
+
+    def render() -> str:
+        where = (
+            "the OS keychain"
+            if tier == "keychain"
+            else "an owner-only encrypted file"
+        )
+        lines = [
+            f"{style.green('Ready.')} Profile {style.bold(profile_name)} is set up.",
+            f"{style.dim('key      ')} stored in {where}",
+            f"{style.dim('config   ')} {path}",
+        ]
+        if entry.get("user"):
+            lines.append(f"{style.dim('user     ')} {entry['user']}")
+        else:
+            lines.append(
+                style.dim("no default user; pass --user on each call or re-run with --user")
+            )
+        if payload["plan"]:
+            lines.append(f"{style.dim('plan     ')} {payload['plan']}")
+        return "\n".join(lines)
+
+    return {"data": payload, "text": render}

{memorysync_cli-1.0.2 → memorysync_cli-1.1.0}/src/memorysync_cli/config.py

@@ -1,9 +1,17 @@
 """Profiles and settings, resolved in one documented order.
 
 Precedence, highest first: an explicit flag, then the environment, then the config
-file, then a built-in default. That order is what people expect and, more
-importantly, it is what the Node CLI does, so a script that sets
-``MEMORYSYNC_USER`` behaves the same whichever CLI is installed.
+file, then a built-in default. That order is what people expect and it is what the
+Node CLI does.
+
+Environment variable names are the Node CLI's, which are also the ones the
+documentation lists. This module previously read ``MEMORYSYNC_USER`` and
+``MEMORYSYNC_PROJECT`` while Node read ``MEMORYSYNC_USER_ID`` and
+``MEMORYSYNC_PROJECT_ID``, and its own docstring claimed the two agreed. They did
+not: every documented example that exported a default user worked under one CLI
+and was silently ignored by the other, which then failed with "this command needs
+an end user" and no indication why. The shorter names are still accepted as
+aliases, because they were published and someone may have used them.
 
 The config file never holds a credential. It holds a profile name, a default end
 user, a project and a base URL - the things that are useful to read, commit to a
@@ -23,23 +31,23 @@ DEFAULT_TIMEOUT_MS = 60000
 
 
 def config_dir() -> Path:
-    """Where settings live.
+    """Where settings live: ``~/.memorysync``, the same place the Node CLI uses.
 
     ``MEMORYSYNC_CONFIG_DIR`` is honoured first so tests and CI can point at a
     scratch directory instead of a developer's real profile.
+
+    This used to follow per-platform conventions - ``%APPDATA%\\memorysync`` on
+    Windows, ``$XDG_CONFIG_HOME/memorysync`` elsewhere - which is defensible on its
+    own but meant the two CLIs kept separate profile files. Running ``init`` under
+    one and a command under the other produced "No API key found" from a machine
+    that plainly had one, and the documentation's ``~/.memorysync`` was simply
+    wrong for this CLI. One location, shared, so a profile created by either is
+    seen by both.
     """
     override = os.environ.get("MEMORYSYNC_CONFIG_DIR")
     if override:
         return Path(override)
-
-    if os.name == "nt":
-        base = os.environ.get("APPDATA") or str(Path.home() / "AppData" / "Roaming")
-        return Path(base) / "memorysync"
-
-    xdg = os.environ.get("XDG_CONFIG_HOME")
-    if xdg:
-        return Path(xdg) / "memorysync"
-    return Path.home() / ".config" / "memorysync"
+    return Path.home() / ".memorysync"
 
 
 def config_path() -> Path:
@@ -102,13 +110,20 @@ def resolve(flags: dict[str, Any]) -> dict[str, Any]:
     )
     stored = profile(profile_name)
 
-    def pick(flag_key: str, env_key: str, stored_key: str, fallback: Any = None) -> Any:
+    def pick(
+        flag_key: str,
+        env_keys: str | tuple[str, ...],
+        stored_key: str,
+        fallback: Any = None,
+    ) -> Any:
         value = flags.get(flag_key)
         if value not in (None, False):
             return value
-        env_value = os.environ.get(env_key)
-        if env_value:
-            return env_value
+        names = (env_keys,) if isinstance(env_keys, str) else env_keys
+        for name in names:
+            env_value = os.environ.get(name)
+            if env_value:
+                return env_value
         if stored.get(stored_key) is not None:
             return stored[stored_key]
         return fallback
@@ -124,9 +139,27 @@ def resolve(flags: dict[str, Any]) -> dict[str, Any]:
         "base_url": str(
             pick("base_url", "MEMORYSYNC_BASE_URL", "base_url", DEFAULT_BASE_URL)
         ).rstrip("/"),
-        "user": pick("user", "MEMORYSYNC_USER", "user"),
-        "project": pick("project", "MEMORYSYNC_PROJECT", "project"),
+        # ``_ID`` first: that is the documented name and what the Node CLI reads.
+        # The shorter form stays as an alias rather than being dropped, because it
+        # shipped and silently ignoring it would be a second surprise.
+        "user": pick("user", ("MEMORYSYNC_USER_ID", "MEMORYSYNC_USER"), "user"),
+        "project": pick(
+            "project", ("MEMORYSYNC_PROJECT_ID", "MEMORYSYNC_PROJECT"), "project"
+        ),
+        # Read here as well as in ``main`` so a format stored on the profile is
+        # honoured. Node resolves it from the profile too; omitting it meant
+        # `-o table` saved into a profile worked under one CLI only.
+        "output": pick("output", "MEMORYSYNC_OUTPUT", "output"),
         "timeout": timeout,
+        # Whether the evaluation account behind this profile has been claimed.
+        # Recorded locally by ``init --email ... --code ...`` because a claimed
+        # key keeps its ``ms_eval_`` prefix, so the prefix alone cannot tell us
+        # and the per-command reminder would never stop.
+        #
+        # Deliberately read straight off the profile rather than through ``pick``:
+        # it is a fact about the account, not a preference, so a flag or an
+        # environment variable must not be able to silence the reminder.
+        "claimed": stored.get("claimed") is True,
     }
 
 

{memorysync_cli-1.0.2 → memorysync_cli-1.1.0}/src/memorysync_cli/credentials.py

@@ -1,8 +1,27 @@
 """Where the API key lives.
 
 Three tiers, in order: the environment, then the OS keychain, then an encrypted
-file readable only by the owner. Same order as the Node CLI, and reached through
-the same OS tools, so a key stored by one CLI is found by the other.
+file readable only by the owner. Same order as the Node CLI and reached through the
+same OS tools.
+
+How much is shared with the Node CLI, precisely, because the previous version of
+this docstring claimed "a key stored by one CLI is found by the other" and that
+was not true on any platform:
+
+  * ``MEMORYSYNC_API_KEY``  shared. Same variable, wins everywhere.
+  * keychain (macOS/Linux)  shared. Both use service ``memorysync-cli`` with the
+                            profile name as the account. The account strings used
+                            to differ, so neither found the other's entry.
+  * file (Windows)          NOT shared, and cannot be. Node encrypts with
+                            AES-256-GCM from ``node:crypto``; Python's standard
+                            library has no AES and this package takes no
+                            dependencies, so the two cannot read each other's
+                            blob. Running ``init`` under each is required.
+
+The file also moved from ``<config>/credentials`` to
+``<config>/credentials/<profile>.pyenc``. Now that both CLIs share
+``~/.memorysync``, a single file at that path would collide with the directory
+Node creates there, and writing to it would fail with "is a directory".
 
 Stated plainly, because it affects what a customer should expect:
 
@@ -38,11 +57,24 @@ ENV_VAR = "MEMORYSYNC_API_KEY"
 
 
 def _account(profile: str) -> str:
-    return f"{SERVICE}:{profile}"
+    """The keychain account, matching the Node CLI exactly.
+
+    Was ``f"{SERVICE}:{profile}"`` while Node used the bare profile name, under the
+    same service. Two entries, neither CLI finding the other's, on the two
+    platforms where a real keychain exists and sharing was actually possible.
+    """
+    return profile
 
 
-def _keyfile() -> Path:
-    return config_dir() / "credentials"
+def _keyfile(profile: str = "default") -> Path:
+    """One file per profile, inside the directory the Node CLI already uses.
+
+    A distinct extension rather than a distinct directory: the blobs are not
+    interchangeable (different ciphers) but they are the same kind of thing, and
+    keeping them together means ``credentials/`` is still the one place to look,
+    and to delete.
+    """
+    return config_dir() / "credentials" / f"{profile}.pyenc"
 
 
 def _obfuscation_key() -> bytes:
@@ -170,47 +202,37 @@ def _keychain_delete(profile: str) -> bool:
 
 
 def _file_read(profile: str) -> str | None:
-    path = _keyfile()
+    path = _keyfile(profile)
     try:
-        raw = path.read_text(encoding="utf-8")
-    except (FileNotFoundError, OSError):
+        blob = path.read_text(encoding="utf-8").strip()
+    except (FileNotFoundError, OSError, IsADirectoryError):
+        return None
+    if not blob:
+        return None
+    try:
+        return _xor(base64.b64decode(blob), _obfuscation_key()).decode("utf-8")
+    except Exception:  # noqa: BLE001 - a corrupt file is a miss, not a crash
         return None
-
-    for line in raw.splitlines():
-        name, _, blob = line.partition("=")
-        if name != profile or not blob:
-            continue
-        try:
-            return _xor(base64.b64decode(blob), _obfuscation_key()).decode("utf-8")
-        except Exception:  # noqa: BLE001 - a corrupt line is a miss, not a crash
-            return None
-    return None
 
 
 def _file_write(profile: str, key: str | None) -> None:
-    path = _keyfile()
-    path.parent.mkdir(parents=True, exist_ok=True)
-
-    entries: dict[str, str] = {}
-    try:
-        for line in path.read_text(encoding="utf-8").splitlines():
-            name, _, blob = line.partition("=")
-            if name and blob:
-                entries[name] = blob
-    except (FileNotFoundError, OSError):
-        pass
+    path = _keyfile(profile)
 
     if key is None:
-        entries.pop(profile, None)
-    else:
-        entries[profile] = base64.b64encode(_xor(key.encode("utf-8"), _obfuscation_key())).decode("ascii")
+        try:
+            path.unlink()
+        except (FileNotFoundError, OSError):
+            pass
+        return
 
-    # Written 0600 before any content lands, so there is no window where the file
+    path.parent.mkdir(parents=True, exist_ok=True)
+    blob = base64.b64encode(_xor(key.encode("utf-8"), _obfuscation_key())).decode("ascii")
+
+    # Opened 0600 before any content lands, so there is no window in which the file
     # exists with default permissions.
     descriptor = os.open(str(path), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
     with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
-        for name, blob in entries.items():
-            handle.write(f"{name}={blob}\n")
+        handle.write(blob + "\n")
 
 
 # ---------------------------------------------------------------------------
@@ -247,13 +269,16 @@ def delete_key(profile: str = "default") -> None:
     _file_write(profile, None)
 
 
-def describe_storage() -> str:
-    """Human description of where a key would be stored, for `doctor`."""
+def describe_storage(profile: str = "default") -> str:
+    """Human description of where a key would be stored, for `doctor`.
+
+    Says "this CLI only" on the file tier so a user who stored a key with the Node
+    CLI is told why it is not visible here, rather than being left to conclude the
+    key was never saved.
+    """
     tool = _keychain_tool()
     if tool == "security":
-        return "macOS keychain (security)"
+        return "macOS keychain (security), shared with the Node CLI"
     if tool == "secret-tool":
-        return "Linux keyring (secret-tool)"
-    if platform.system() == "Windows":
-        return f"encrypted file, owner-only ({_keyfile()})"
-    return f"encrypted file, owner-only ({_keyfile()}) - no keychain tool found"
+        return "Linux keyring (secret-tool), shared with the Node CLI"
+    return f"encrypted file, owner-only, this CLI only ({_keyfile(profile)})"

{memorysync_cli-1.0.2 → memorysync_cli-1.1.0}/src/memorysync_cli/errors.py

@@ -20,6 +20,8 @@ an empty database.
 
 from __future__ import annotations
 
+import platform
+
 from .registry import exit_codes
 
 _CODES = exit_codes()
@@ -79,12 +81,32 @@ def usage_error(message: str, hint: str | None = None) -> CliError:
     return CliError(message, exit_code=Exit.USAGE, code="usage_error", hint=hint)
 
 
+def _default_auth_hint() -> str:
+    """Why "no key" can be wrong-looking rather than wrong.
+
+    On Windows the two CLIs cannot share a stored key: Node encrypts with
+    AES-256-GCM and this package has no AES available without taking a dependency.
+    Someone who ran `memorysync init` seconds ago -- possibly reaching the *other*
+    CLI, since both install a binary of that name -- is otherwise told "No API key
+    found" by a machine that visibly has one, with nothing to act on.
+    """
+    base = "Run `memorysync init` to store a key, or set MEMORYSYNC_API_KEY."
+    if platform.system() == "Windows":
+        return (
+            base
+            + " On Windows the Node and Python CLIs keep separate key files, so a"
+            + " key stored by one is not visible to the other; run init here too,"
+            + " or set MEMORYSYNC_API_KEY, which both read."
+        )
+    return base
+
+
 def auth_error(message: str, hint: str | None = None) -> CliError:
     return CliError(
         message,
         exit_code=Exit.AUTH,
         code="auth_error",
-        hint=hint or "Run `memorysync init` to store a key, or set MEMORYSYNC_API_KEY.",
+        hint=hint or _default_auth_hint(),
     )
 
 

memorysync_cli-1.1.0/src/memorysync_cli/evaluation.py

@@ -0,0 +1,54 @@
+"""Evaluation-key awareness shared by every command.
+
+Mirrors ``sdk/cli/src/evaluation.mjs`` exactly. The two CLIs are documented as
+interchangeable, so a reminder that appears in one and not the other is a parity
+bug, not a cosmetic difference.
+
+An evaluation key is minted by an agent and expires in seven days unless a human
+claims it. The most expensive outcome is somebody building on one, never noticing
+it is temporary, and losing the account on day eight — so every command running
+on an unclaimed key ends with one line saying so, on stderr.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Mapping, Optional
+
+#: Prefix the server puts on anonymously minted keys.
+EVALUATION_KEY_PREFIX = "ms_eval_"
+
+#: The command a human runs to keep the account.
+CLAIM_HINT = "memorysync init --email you@example.com"
+
+
+def is_evaluation_key(key: Optional[str]) -> bool:
+    """True when *key* was minted anonymously."""
+    return isinstance(key, str) and key.startswith(EVALUATION_KEY_PREFIX)
+
+
+def claim_reminder(
+    api_key: Optional[str] = None,
+    profile: Optional[Mapping[str, Any]] = None,
+) -> Optional[str]:
+    """The reminder line for this invocation, or ``None``.
+
+    Reads ``claimed`` from the local profile rather than asking the API. Checking
+    on every command would add a round-trip to ``memorysync --help``, and the
+    claim path already knows the answer the moment it succeeds, so it records it.
+    """
+    if not is_evaluation_key(api_key):
+        return None
+    if profile and profile.get("claimed") is True:
+        return None
+    return (
+        "This is an unclaimed evaluation key and expires. "
+        f"Keep it: {CLAIM_HINT}"
+    )
+
+
+__all__ = [
+    "EVALUATION_KEY_PREFIX",
+    "CLAIM_HINT",
+    "is_evaluation_key",
+    "claim_reminder",
+]

{memorysync_cli-1.0.2 → memorysync_cli-1.1.0}/src/memorysync_cli/http.py

@@ -194,6 +194,37 @@ class ApiClient:
     # Named endpoints, so commands never carry raw paths
     # -----------------------------------------------------------------------
 
+    def mint_evaluation_key(self, body: dict) -> Any:
+        """Mint an evaluation key. The only endpoint here needing no credential.
+
+        Rate limited server-side per IP and per /24, failing closed, so a 429 is a
+        real answer rather than a transient error — it carries
+        ``retry_after_seconds`` pointing at the next UTC day.
+        """
+        return self.request("POST", "/evaluation/keys", body=body)
+
+    def start_evaluation_claim(self, body: dict) -> Any:
+        """Ask for a claim code by email. Needs the evaluation key."""
+        return self.request("POST", "/evaluation/claim/start", body=body)
+
+    def complete_evaluation_claim(self, body: dict) -> Any:
+        """Redeem a claim code.
+
+        Deliberately does not require the key: the code is the proof, so a claim
+        started on one machine can be finished on another — which is what happens
+        whenever somebody reads the code off their phone.
+        """
+        return self.request("POST", "/evaluation/claim/complete", body=body)
+
+    def evaluation_usage(self) -> Any:
+        """Remaining allowance for an evaluation key.
+
+        Evaluation keys are not granted ``billing:read``, so
+        ``/org/billing/usage`` is closed to them. This reports the same counters
+        without the pricing fields.
+        """
+        return self.request("GET", "/evaluation/usage")
+
     def add_memory(self, body: dict) -> Any:
         return self.request("POST", "/memory/add", body=body)
 

{memorysync_cli-1.0.2 → memorysync_cli-1.1.0}/src/memorysync_cli/main.py

@@ -21,6 +21,7 @@ from .args import parse_args, suggest
 from .commands import admin, init as init_command, memory, source as source_command, tooling
 from .credentials import read_key
 from .errors import CliError, Exit, auth_error, usage_error
+from .evaluation import claim_reminder
 from .http import ApiClient
 from .output import (
     emit,
@@ -37,8 +38,23 @@ Handler = Callable[[dict], dict]
 # which is the same reason the Node CLI keeps its HANDLERS map next to its own. A
 # name in the registry with no entry here fails as "not available" rather than
 # "unknown command", so `help --json` stays honest about what exists.
+def _note_unclaimed_key(api_key: str | None, settings: dict) -> None:
+    """Tell the user their evaluation key is temporary, once per command.
+
+    On stderr so stdout stays machine-parseable — an agent piping ``--json``
+    somewhere sees nothing extra, and a person sees the line. Silent for a claimed
+    key or a normal one. Matches the Node CLI line for line.
+    """
+    reminder = claim_reminder(
+        api_key, {"claimed": bool((settings or {}).get("claimed"))}
+    )
+    if reminder:
+        print(reminder, file=sys.stderr)
+
+
 _HANDLERS: dict[str, Handler] = {
     "init": init_command.init,
+    "identify": init_command.identify,
     "add": memory.add,
     "search": memory.search,
     "list": memory.list_memories,
@@ -260,6 +276,7 @@ def dispatch(argv: list[str]) -> int:
         # command list.
         if command_name == "help" and (agent_mode or fmt == "json"):
             write(json.dumps(result["data"], indent=2))
+            _note_unclaimed_key(api_key, settings)
             return Exit.OK
 
         if agent_mode:
@@ -274,6 +291,7 @@ def dispatch(argv: list[str]) -> int:
                     indent=2,
                 )
             )
+            _note_unclaimed_key(api_key, settings)
             return result.get("exit_code", Exit.OK)
 
         # `completion` and `mcp` emit text that must not be decorated or reshaped.
@@ -281,9 +299,13 @@ def dispatch(argv: list[str]) -> int:
             text = result["text"]()
             if text:
                 write(text)
+            # No reminder here: `completion` and `mcp` emit text that gets pasted
+            # into a shell profile or a config file, and a stray line would be
+            # pasted too.
             return result.get("exit_code", Exit.OK)
 
         emit(fmt=fmt, data=result["data"], text=result["text"])
+        _note_unclaimed_key(api_key, settings)
         return result.get("exit_code", Exit.OK)
 
     except CliError as error:

{memorysync_cli-1.0.2 → memorysync_cli-1.1.0}/src/memorysync_cli/output.py

@@ -33,10 +33,18 @@ _SEXAGESIMAL = re.compile(r"^\d+(:\d+)+$")
 
 
 def _colour_default() -> bool:
+    """Same decision the Node CLI makes, including ``TERM=dumb``.
+
+    ``TERM=dumb`` was honoured by Node and ignored here, so a terminal that
+    announces it cannot render ANSI got escape codes from one CLI and clean text
+    from the other.
+    """
     if os.environ.get("NO_COLOR"):
         return False
     if os.environ.get(_FORCE_COLOR):
         return True
+    if os.environ.get("TERM") == "dumb":
+        return False
     return bool(getattr(sys.stdout, "isatty", lambda: False)())
 
 

{memorysync_cli-1.0.2 → memorysync_cli-1.1.0}/src/memorysync_cli/registry.json

@@ -92,14 +92,38 @@
     {
       "name": "init",
       "summary": "Store a credential and pick a default user and project.",
-      "description": "Prompts for an API key, verifies it against the API, then writes a profile. The key is never written to the config file in plain text: it goes to the OS keychain where one is reachable, and otherwise to an encrypted file readable only by you.",
-      "usage": "memorysync init [--api-key <key>] [--user <id>] [--project <id>] [--force]",
+      "description": "Prompts for an API key, verifies it against the API, then writes a profile. The key is never written to the config file in plain text: it goes to the OS keychain where one is reachable, and otherwise to an encrypted file readable only by you.\n\nWith --agent it mints an evaluation key instead of asking for one, so a coding agent can get working memory with no email, no verification code and no human. That key expires after seven days and nobody owns it until somebody claims it with --email.",
+      "usage": "memorysync init [--api-key <key> | --agent | --email <address>] [--user <id>] [--project <id>] [--force]",
       "flags": [
         {
           "name": "--api-key",
           "value": "key",
           "description": "Skip the prompt and use this key."
         },
+        {
+          "name": "--agent",
+          "description": "Mint an evaluation key with no signup. Expires in 7 days unless claimed."
+        },
+        {
+          "name": "--agent-caller",
+          "value": "name",
+          "description": "Which tool is minting the key, e.g. claude-code. Attribution only."
+        },
+        {
+          "name": "--email",
+          "value": "address",
+          "description": "Claim the current evaluation account. Sends a code, then pass it with --code."
+        },
+        {
+          "name": "--code",
+          "value": "code",
+          "description": "The claim code from the email."
+        },
+        {
+          "name": "--password",
+          "value": "password",
+          "description": "Set a dashboard password while claiming. Optional."
+        },
         {
           "name": "--user",
           "short": "-u",
@@ -124,7 +148,29 @@
       ],
       "examples": [
         "memorysync init",
-        "memorysync init --api-key ms_live_xxx --user alice --force"
+        "memorysync init --api-key ms_live_xxx --user alice --force",
+        "memorysync init --agent --agent-caller claude-code",
+        "memorysync init --email you@example.com",
+        "memorysync init --email you@example.com --code K7MP-3XQR"
+      ],
+      "requires_auth": false
+    },
+    {
+      "name": "identify",
+      "summary": "Name the end user that later commands default to.",
+      "description": "An evaluation key starts with a generated end-user id like swift-otter-4821, because a key minted by an agent has nobody to name it after. This replaces it with something meaningful.\n\nOnly changes the local default: memories already stored under the old id keep that id, so pass --user explicitly to read them back.",
+      "usage": "memorysync identify <name> [--profile <name>]",
+      "flags": [
+        {
+          "name": "--profile",
+          "short": "-p",
+          "value": "name",
+          "description": "Profile to change. Default \"default\"."
+        }
+      ],
+      "examples": [
+        "memorysync identify alice",
+        "memorysync identify alice@example.com"
       ],
       "requires_auth": false
     },

memorysync_cli-1.0.2/src/memorysync_cli/_version.py

@@ -1 +0,0 @@
-__version__ = "1.0.2"

memorysync_cli-1.0.2/src/memorysync_cli/commands/init.py

@@ -1,109 +0,0 @@
-"""init: store a credential and pick defaults.
-
-The key is verified against the API before it is written. Storing an unverified key
-means the next command fails with something that looks like a network problem, and
-the person has no reason to suspect the thing they just typed.
-
-It is never written to the config file in plain text. It goes to the OS keychain
-where one is reachable, and otherwise to an owner-only encrypted file, and `init`
-says which of the two happened rather than implying a keychain that was never
-there.
-"""
-
-from __future__ import annotations
-
-import getpass
-import os
-import sys
-
-from .. import config as config_module
-from .. import credentials
-from ..errors import auth_error, usage_error
-from ..http import ApiClient
-from ..output import style
-
-
-def init(ctx: dict) -> dict:
-    flags, settings = ctx["flags"], ctx["settings"]
-    profile_name = settings["profile_name"]
-
-    existing = config_module.profile(profile_name)
-    if existing and not flags.get("force"):
-        stored = credentials.read_key(profile_name)
-        if stored:
-            raise usage_error(
-                f'Profile "{profile_name}" already has a key.',
-                "Pass --force to replace it, or --profile <name> to add another.",
-            )
-
-    api_key = flags.get("api_key") or os.environ.get("MEMORYSYNC_API_KEY")
-    if not api_key:
-        if not sys.stdin.isatty():
-            raise usage_error(
-                "No API key given and no terminal to prompt from.",
-                "Pass --api-key, or set MEMORYSYNC_API_KEY.",
-            )
-        # getpass, so the key is not echoed into the terminal or the scrollback.
-        api_key = getpass.getpass("MemorySync API key: ").strip()
-
-    if not api_key:
-        raise usage_error("No API key given.")
-
-    # Verified before storing. A key that cannot read its own plan is not usable,
-    # and finding that out now is far cheaper than on the next command.
-    probe = ApiClient(
-        base_url=settings["base_url"],
-        api_key=api_key,
-        timeout=settings["timeout"],
-    )
-    try:
-        plan = probe.current_plan() or {}
-    except Exception as error:  # noqa: BLE001 - re-raised as an auth failure below
-        raise auth_error(
-            f"That key was refused: {error}",
-            "Check it in the dashboard, or pass --base-url if you are not on production.",
-        ) from None
-
-    tier = credentials.write_key(api_key, profile_name)
-
-    data = config_module.load()
-    entry = data.setdefault("profiles", {}).setdefault(profile_name, {})
-    if flags.get("user"):
-        entry["user"] = flags["user"]
-    if flags.get("project"):
-        entry["project"] = flags["project"]
-    if settings["base_url"] != config_module.DEFAULT_BASE_URL:
-        entry["base_url"] = settings["base_url"]
-    path = config_module.save(data)
-
-    payload = {
-        "profile": profile_name,
-        "stored_in": tier,
-        "config": str(path),
-        "user": entry.get("user"),
-        "project": entry.get("project"),
-        "plan": plan.get("plan") or plan.get("name"),
-    }
-
-    def render() -> str:
-        where = (
-            "the OS keychain"
-            if tier == "keychain"
-            else "an owner-only encrypted file"
-        )
-        lines = [
-            f"{style.green('Ready.')} Profile {style.bold(profile_name)} is set up.",
-            f"{style.dim('key      ')} stored in {where}",
-            f"{style.dim('config   ')} {path}",
-        ]
-        if entry.get("user"):
-            lines.append(f"{style.dim('user     ')} {entry['user']}")
-        else:
-            lines.append(
-                style.dim("no default user; pass --user on each call or re-run with --user")
-            )
-        if payload["plan"]:
-            lines.append(f"{style.dim('plan     ')} {payload['plan']}")
-        return "\n".join(lines)
-
-    return {"data": payload, "text": render}