memstack-skill-loader 4.6.0__tar.gz → 4.8.0__tar.gz

{memstack_skill_loader-4.6.0/src/memstack_skill_loader.egg-info → memstack_skill_loader-4.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memstack-skill-loader
-Version: 4.6.0
+Version: 4.8.0
 Summary: MCP server that vector-indexes MemStack Pro skills for on-demand loading
 Requires-Python: >=3.10
 Requires-Dist: mcp>=1.0.0

{memstack_skill_loader-4.6.0 → memstack_skill_loader-4.8.0}/README.md

@@ -1,6 +1,6 @@
 # MemStack™ Skill Loader
 
-**128 skills for Claude Code:** 85 free + 43 Pro exclusive. Vector-indexed so CC loads only the skill it needs, saving your context window.
+**129 skills for Claude Code:** 85 free + 44 Pro exclusive. Vector-indexed so CC loads only the skill it needs, saving your context window.
 
 ## Quick Start (5 minutes)
 
@@ -53,7 +53,7 @@ If this doesn't match Step 2's interpreter, the server won't launch (you'll see
 ```
 activate_license(key="your-key", email="you@example.com")
 ```
-Use `key="free"` for the free tier, or your Pro key from [memstack.pro](https://memstack.pro) to unlock all 43 Pro skills (85 free + 43 Pro = 128 total). Then type `list skills` to verify.
+Use `key="free"` for the free tier, or your Pro key from [memstack.pro](https://memstack.pro) to unlock all 44 Pro skills (85 free + 44 Pro = 129 total). Then type `list skills` to verify.
 
 > To override the skills path, set `MEMSTACK_SKILLS_DIR=/path/to/your/memstack/skills`.
 
@@ -86,12 +86,23 @@ sudo apt install python3-pip
 
 ## How It Works
 
-MCP server that vector-indexes all 128 MemStack™ skills so Claude Code can call `find_skill("deploy to Railway")` and load **only** the relevant skill on demand, instead of all skills consuming context window.
+MCP server that vector-indexes all 129 MemStack™ skills so Claude Code can call `find_skill("deploy to Railway")` and load **only** the relevant skill on demand, instead of all skills consuming context window.
 
-- **No API keys required:** everything runs locally
+- **No Anthropic API key required:** skill search and indexing run locally — the only outbound network call is license validation, which contacts the MemStack license server on session start ([Data and privacy](#data-and-privacy))
 - **Pro skills auto-detected:** set your license key and they appear automatically
 - **Auto-reindex on start:** skills stay current without manual rebuilds
 
+### Data and privacy
+
+License validation is the loader's only outbound network call. On session start it POSTs to the MemStack license server (`admin.cwaffiliateinvestments.com/api/licenses/validate`) with:
+
+- your **license key**
+- a **machine ID** — a stable, hashed fingerprint that binds the license to your machine
+- your **email**, if you provided one at activation
+- your **environment** — OS name, Python version, and MemStack loader version
+
+That is the complete payload. **No code, file contents, file paths, usernames, project names, or prompts are ever sent.** The environment fields exist only so platform-specific breakage (for example, a bug that affects only Linux) is visible to us in aggregate.
+
 ### Environment Variable Override
 
 Set `MEMSTACK_SKILLS_DIR` to override the skills path in `config.json`:

{memstack_skill_loader-4.6.0 → memstack_skill_loader-4.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "memstack-skill-loader"
-version = "4.6.0"
+version = "4.8.0"
 description = "MCP server that vector-indexes MemStack Pro skills for on-demand loading"
 requires-python = ">=3.10"
 dependencies = [

{memstack_skill_loader-4.6.0 → memstack_skill_loader-4.8.0}/src/memstack_skill_loader/__init__.py

@@ -1,3 +1,3 @@
 """MemStack Skill Loader — MCP server for semantic skill search."""
 
-__version__ = "4.6.0"
+__version__ = "4.8.0"

{memstack_skill_loader-4.6.0 → memstack_skill_loader-4.8.0}/src/memstack_skill_loader/categories.py

@@ -50,7 +50,7 @@ CATEGORY_MAP = {
     "owasp-top10": "Security", "owasp-top-10": "Security",
     "rls-checker": "Security", "rls-guardian": "Security",
     "secrets-scanner": "Security", "git-guard": "Security",
-    # ── Pro-exclusive skills (43) — CANONICAL category map ─────────────────
+    # ── Pro-exclusive skills (44) — CANONICAL category map ─────────────────
     # Must cover every slug in PRO_EXCLUSIVE_SKILLS (license.py) exactly; no Pro
     # slug may fall through to "Other". Enforced by scripts/check_skill_drift.py
     # (Check C / F-3). Core = MemStack's own session/memory/agent/efficiency
@@ -75,9 +75,10 @@ CATEGORY_MAP = {
     # Security (4)
     "advanced-security": "Security", "config-audit": "Security",
     "dependency-auditor": "Security", "env-manager-pro": "Security",
-    # Automation (4)
+    # Automation (5)
     "browser-use": "Automation", "hooks-integration": "Automation",
-    "video-pipeline": "Automation", "web-scraper": "Automation",
+    "video-pipeline": "Automation", "video-review": "Automation",
+    "web-scraper": "Automation",
     # Business (2)
     "meeting-insights-analyzer": "Business", "us-privacy-compliance": "Business",
     # Content (1)

{memstack_skill_loader-4.6.0 → memstack_skill_loader-4.8.0}/src/memstack_skill_loader/license.py

@@ -9,6 +9,7 @@ import hmac as hmac_mod
 import json
 import math
 import os
+import platform
 import socket
 import sys
 import threading
@@ -62,7 +63,7 @@ TRANSIENT_REASONS = frozenset({"rate_limited", "server_error"})
 MACHINE_MISMATCH_REASON = "machine_mismatch"
 
 # Skills that require a Pro license. Free-tier users see a locked message.
-PRO_EXCLUSIVE_SKILLS = frozenset({"advanced-security", "api-docs", "api-load-tester", "branching", "browser-use", "burn", "checkpoint", "claude-api-helper", "codebase-index", "config-audit", "consolidate", "context-db", "council", "database-architect", "database-migration", "dependency-auditor", "developer-growth-analysis", "diagram-generator", "doc-index", "drift-detection", "env-manager-pro", "error-handler", "frontend-design", "git-worktrees", "governor-pro", "gtm-validator", "hooks-integration", "ios-app-store", "log-analyzer", "mcp-builder", "meeting-insights-analyzer", "model-router", "multi-agent", "nextjs-conventions", "performance-profiler", "python-conventions", "rag-builder", "session-restore", "social-media", "test-generator", "us-privacy-compliance", "video-pipeline", "web-scraper"})
+PRO_EXCLUSIVE_SKILLS = frozenset({"advanced-security", "api-docs", "api-load-tester", "branching", "browser-use", "burn", "checkpoint", "claude-api-helper", "codebase-index", "config-audit", "consolidate", "context-db", "council", "database-architect", "database-migration", "dependency-auditor", "developer-growth-analysis", "diagram-generator", "doc-index", "drift-detection", "env-manager-pro", "error-handler", "frontend-design", "git-worktrees", "governor-pro", "gtm-validator", "hooks-integration", "ios-app-store", "log-analyzer", "mcp-builder", "meeting-insights-analyzer", "model-router", "multi-agent", "nextjs-conventions", "performance-profiler", "python-conventions", "rag-builder", "session-restore", "social-media", "test-generator", "us-privacy-compliance", "video-pipeline", "video-review", "web-scraper"})
 
 
 @dataclass
@@ -406,6 +407,50 @@ def save_license_key(key: str) -> None:
 # ---------------------------------------------------------------------------
 
 
+def _environment_info() -> dict[str, str | None]:
+    """Coarse environment info attached to every license-validation POST.
+
+    Purpose: let us see which OS / Python / loader versions our users run, so a
+    bug that silently breaks one platform (e.g. the hooks bug that killed skill
+    auto-loading on Linux/macOS) is visible in aggregate.
+
+    Collects ONLY three fields: OS name, running Python version, installed
+    loader version. It deliberately sends NO hostname, username, file path,
+    project name, or any identifier beyond the machine_id already in the
+    payload. Each field is detected independently and fail-safe: any failure
+    yields ``None`` (JSON null), never an exception — environment detection
+    must NEVER be able to fail a license validation.
+
+    ``plugin_version`` is intentionally absent. The Claude Code skills-bundle
+    plugin is a separate marketplace artifact; its version lives in
+    ``.claude-plugin/plugin.json`` inside Claude Code's plugin cache. This
+    loader's MCP server is registered standalone
+    (``claude mcp add ... python -m memstack_skill_loader``), so the process
+    never receives ``CLAUDE_PLUGIN_ROOT`` or any handle to that cache, and the
+    two artifacts share no version coupling. There is no reliable value to
+    send, so the field is omitted rather than guessed.
+    """
+    info: dict[str, str | None] = {"os": None, "python_version": None, "loader_version": None}
+
+    try:
+        info["os"] = platform.system() or None
+    except Exception:
+        pass
+
+    try:
+        info["python_version"] = platform.python_version()
+    except Exception:
+        pass
+
+    try:
+        from importlib.metadata import version as _pkg_version
+        info["loader_version"] = _pkg_version("memstack-skill-loader")
+    except Exception:
+        pass
+
+    return info
+
+
 async def validate_license(
     license_key: str | None = None,
     email: str | None = None,
@@ -644,9 +689,10 @@ async def _validate_locked(key: str, email: str | None) -> LicenseStatus:
             return cached_status
 
     # --- build request body ---
-    body_payload: dict[str, str] = {"license_key": key, "machine_id": _machine_id()}
+    body_payload: dict[str, str | None] = {"license_key": key, "machine_id": _machine_id()}
     if email:
         body_payload["email"] = email
+    body_payload.update(_environment_info())  # os / python_version / loader_version (fail-safe)
 
     # --- always call API on session start ---
     try:
@@ -710,7 +756,8 @@ def refresh_license_cache(key: str, timeout: float = HTTP_TIMEOUT) -> LicenseSta
     Returns the new LicenseStatus on success, or None if the server is unreachable
     or returns an error. All network exceptions are caught internally.
     """
-    body_payload: dict[str, str] = {"license_key": key, "machine_id": _machine_id()}
+    body_payload: dict[str, str | None] = {"license_key": key, "machine_id": _machine_id()}
+    body_payload.update(_environment_info())  # os / python_version / loader_version (fail-safe)
     # Uses VALIDATE_URL directly via httpx — not routed through ANTHROPIC_BASE_URL (Anthropic SDK only).
     try:
         with httpx.Client(timeout=timeout) as client:

{memstack_skill_loader-4.6.0 → memstack_skill_loader-4.8.0}/src/memstack_skill_loader/server.py

@@ -434,6 +434,15 @@ _TAMPERED_MSG = (
     "\U0001f512 MemStack\u2122 Pro: License file integrity check failed. "
     "Get your key at https://memstack.pro"
 )
+# Appended to the activate_license success message (both tiers) so activation is
+# informed consent: a plain, non-alarming disclosure of exactly what the
+# on-session-start validation POST sends. Kept in one place so both branches
+# stay in sync.
+_VALIDATION_DISCLOSURE = (
+    "License validation sends your license key, a machine ID, your email, and "
+    "your environment (OS, Python version, MemStack version). No code, file "
+    "paths, usernames, or project data is sent."
+)
 
 
 def _grace_banner(status) -> str:
@@ -1090,7 +1099,8 @@ async def _handle_tool(name: str, arguments: dict) -> list[TextContent]:
                 total = len(skills) if skills else 0
                 msg = (
                     f"\u2705 License activated! Tier: **Pro**. "
-                    f"All {total} skills unlocked."
+                    f"All {total} skills unlocked.\n\n"
+                    f"{_VALIDATION_DISCLOSURE}"
                 )
             else:
                 skills = await asyncio.to_thread(list_all_skills, config)
@@ -1101,7 +1111,8 @@ async def _handle_tool(name: str, arguments: dict) -> list[TextContent]:
                 msg = (
                     f"\u2705 License activated! Tier: **Free**. "
                     f"{free_count} skills unlocked. "
-                    f"Upgrade to Pro at https://memstack.pro to unlock all {total}."
+                    f"Upgrade to Pro at https://memstack.pro to unlock all {total}.\n\n"
+                    f"{_VALIDATION_DISCLOSURE}"
                 )
             return [TextContent(type="text", text=msg)]
         return [TextContent(

{memstack_skill_loader-4.6.0 → memstack_skill_loader-4.8.0/src/memstack_skill_loader.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memstack-skill-loader
-Version: 4.6.0
+Version: 4.8.0
 Summary: MCP server that vector-indexes MemStack Pro skills for on-demand loading
 Requires-Python: >=3.10
 Requires-Dist: mcp>=1.0.0

{memstack_skill_loader-4.6.0 → memstack_skill_loader-4.8.0}/src/memstack_skill_loader.egg-info/SOURCES.txt

@@ -34,6 +34,7 @@ src/memstack_skill_loader/proxy/server.py
 src/memstack_skill_loader/proxy/stats_tracker.py
 tests/test_body_parser_metric.py
 tests/test_code_read_savings.py
+tests/test_license_environment.py
 tests/test_license_grace.py
 tests/test_pro_compressor.py
 tests/test_pro_skills_update.py

memstack_skill_loader-4.8.0/tests/test_license_environment.py

@@ -0,0 +1,86 @@
+"""Environment info attached to the license-validation POST payload.
+
+Covers ``license._environment_info`` — the coarse OS / Python / loader-version
+block added to every validate call so a platform-specific breakage is visible in
+aggregate. Two properties matter and are tested here:
+
+  1. SHAPE — exactly the three expected keys, no more; every value is str|None.
+  2. FAIL-SAFE — if any single detector raises, the function still returns the
+     full dict with ``None`` for the failed field and NEVER propagates the
+     exception. License validation must not break because env detection failed.
+
+Detection is patched at the module boundary (``L.platform`` and
+``importlib.metadata.version``, which the function imports lazily) so a raising
+detector is exercised without touching the real interpreter.
+"""
+
+import pytest
+
+from memstack_skill_loader import license as L
+
+EXPECTED_KEYS = {"os", "python_version", "loader_version"}
+
+
+def _raise(*args, **kwargs):
+    raise RuntimeError("boom")
+
+
+# ── 1. SHAPE ──────────────────────────────────────────────────────────────────
+
+
+def test_returns_exactly_the_expected_keys():
+    info = L._environment_info()
+    assert set(info) == EXPECTED_KEYS  # no extra keys (e.g. plugin_version is omitted)
+
+
+def test_values_are_str_or_none():
+    info = L._environment_info()
+    for key, value in info.items():
+        assert value is None or isinstance(value, str), f"{key}={value!r}"
+
+
+def test_happy_path_populates_all_fields():
+    # On a real interpreter every field is detectable, so none should be None.
+    info = L._environment_info()
+    assert all(v is not None for v in info.values()), info
+
+
+# ── 2. FAIL-SAFE ──────────────────────────────────────────────────────────────
+
+
+def test_os_detection_failure_yields_null(monkeypatch):
+    monkeypatch.setattr(L.platform, "system", _raise)
+    info = L._environment_info()
+    assert info["os"] is None
+    # other fields still detected; no exception propagated
+    assert set(info) == EXPECTED_KEYS
+    assert info["python_version"] is not None
+    assert info["loader_version"] is not None
+
+
+def test_python_version_detection_failure_yields_null(monkeypatch):
+    monkeypatch.setattr(L.platform, "python_version", _raise)
+    info = L._environment_info()
+    assert info["python_version"] is None
+    assert set(info) == EXPECTED_KEYS
+    assert info["os"] is not None
+    assert info["loader_version"] is not None
+
+
+def test_loader_version_lookup_failure_yields_null(monkeypatch):
+    # _environment_info imports importlib.metadata.version lazily, so patching
+    # the source attribute makes the in-function lookup raise.
+    monkeypatch.setattr("importlib.metadata.version", _raise)
+    info = L._environment_info()
+    assert info["loader_version"] is None
+    assert set(info) == EXPECTED_KEYS
+    assert info["os"] is not None
+    assert info["python_version"] is not None
+
+
+def test_all_detectors_failing_returns_full_null_dict_without_raising(monkeypatch):
+    monkeypatch.setattr(L.platform, "system", _raise)
+    monkeypatch.setattr(L.platform, "python_version", _raise)
+    monkeypatch.setattr("importlib.metadata.version", _raise)
+    info = L._environment_info()  # must not raise
+    assert info == {"os": None, "python_version": None, "loader_version": None}