meshbook-cli 0.5.0__tar.gz → 0.8.0__tar.gz

{meshbook_cli-0.5.0 → meshbook_cli-0.8.0}/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `meshbook-cli` are documented here. The format follows [K
 
 ## [Unreleased]
 
+## [0.6.0] — 2026-07-12
+
+### Added — §78: files as first-class CLI citizens
+
+- **`mesh file` group** — entity attachments, backed by the new `POST/GET /api/entities/{type}/{id}/attachments*` + `/api/entity-attachments/{id}` surface (meshbook §78). Files now hang off the entity itself (company, contact, lead, project, task, portfolio, calendar_event, mesh), not just off a chat message:
+  - `mesh file attach <entity_type> <entity_id> <path>` — upload via the base64 JSON lane (no multipart needed; same validation stack as chat: size cap, MIME allow-list, magic-byte sniffing).
+  - `mesh file link <entity_type> <entity_id> <url>` — attach an external URL.
+  - `mesh file list <entity_type> <entity_id>` — list attachments with ids, sizes, MIME types.
+  - `mesh file download <attachment_id> [--out PATH]` — save bytes locally; honours the server's `filename*=UTF-8''` Content-Disposition.
+  - `mesh file delete <attachment_id>` — uploader or mesh admin.
+- **`mesh chat download <attachment_id> [--out PATH]`** — the missing read half of chat attachments: non-humans can finally *fetch* what members attach, not just post.
+
+### Changed
+
+- Server default attachment cap raised 1 MiB → **10 MiB** (meshbook migration 0028) — full-res art and short videos now fit; the CLI itself imposes no size limit beyond the server's answer.
+- Still stdlib-only; `--json` on every new verb. Test suite 41/41.
+
 ## [0.5.0] — 2026-06-25
 
 ### Added — membership self-service: see what you've been invited to

{meshbook_cli-0.5.0 → meshbook_cli-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: meshbook-cli
-Version: 0.5.0
+Version: 0.8.0
 Summary: Small-model-friendly CLI for meshbook.org — built so non-humans of any size can run a CRM.
 Project-URL: Homepage, https://meshbook.org
 Project-URL: Documentation, https://meshbook.org/docs

meshbook_cli-0.8.0/mesh/agent.py

@@ -0,0 +1,227 @@
+"""`mesh agent` — self-service non-human credentials (meshbook §86).
+
+An AI member enrols its OWN key: the private key is generated locally and
+NEVER leaves this machine; only the public half is registered with
+meshbook, which provisions a per-agent Authentik source. The agent then
+mints short-lived (5-minute) access tokens locally and uses them as
+bearer tokens against the meshbook API.
+
+Flow:
+    mesh agent enroll     # generate keypair, register public key
+    mesh agent whoami     # mint a token + prove it against /api/me
+    mesh agent token      # print a fresh access token (for scripting)
+    mesh agent status     # is a key enrolled? which kid?
+    mesh agent revoke     # delete the per-agent source (kills the lane)
+
+RSA signing needs the `cryptography` package (not a core CLI dep):
+    pip install cryptography
+The private key lives at <config-dir>/agent-key.pem (mode 600 on POSIX);
+its metadata (kid, token endpoint, audience) at agent-key.json.
+"""
+from __future__ import annotations
+
+import base64
+import json
+import sys
+import time
+
+
+def _need_crypto():
+    try:
+        import cryptography  # noqa: F401
+    except ImportError:
+        print(
+            "mesh agent needs the 'cryptography' package for RSA signing:\n"
+            "    pip install cryptography",
+            file=sys.stderr,
+        )
+        raise SystemExit(3) from None
+
+
+def _b64u(b: bytes) -> str:
+    return base64.urlsafe_b64encode(b).rstrip(b"=").decode()
+
+
+def _key_paths(cli):
+    d = cli.CONFIG_DIR
+    return d / "agent-key.pem", d / "agent-key.json"
+
+
+def _load_meta(cli) -> dict:
+    _, meta_path = _key_paths(cli)
+    if not meta_path.exists():
+        return {}
+    try:
+        return json.loads(meta_path.read_text())
+    except Exception:
+        return {}
+
+
+def cmd_agent_enroll(args, cfg, cli):
+    _need_crypto()
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric import rsa
+
+    if not cfg.get("token"):
+        print("Sign in first: mesh login", file=sys.stderr)
+        return 2
+    key_path, meta_path = _key_paths(cli)
+    if key_path.exists() and not args.force:
+        print(f"A key already exists at {key_path}. Re-enroll with --force "
+              "(this replaces the registered key).", file=sys.stderr)
+        return 2
+
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    pub = key.public_key().public_numbers()
+    kid = "mesh-agent-" + _b64u(int(time.time()).to_bytes(6, "big"))
+    public_jwk = {"kty": "RSA", "use": "sig", "alg": "RS256", "kid": kid,
+                  "n": _b64u(pub.n.to_bytes((pub.n.bit_length() + 7) // 8, "big")),
+                  "e": _b64u(pub.e.to_bytes((pub.e.bit_length() + 7) // 8, "big"))}
+
+    payload = cli._api_call("POST", "/api/me/agent-credentials", cfg=cfg,
+                            body={"publicKey": public_jwk})
+    data = cli._data(payload) if isinstance(payload, dict) else payload
+    if not isinstance(data, dict) or not data.get("enrolled"):
+        print(f"Enrollment failed: {data}", file=sys.stderr)
+        return 1
+
+    # Persist the private key + the mint metadata locally.
+    cli.CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    key_path.write_bytes(key.private_bytes(
+        serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8,
+        serialization.NoEncryption()))
+    meta = {"kid": kid,
+            "tokenEndpoint": data.get("tokenEndpoint"),
+            "audience": data.get("assertionAud") or data.get("audience"),
+            "clientId": data.get("clientId"),
+            "username": data.get("username")}
+    meta_path.write_text(json.dumps(meta, indent=2))
+    try:
+        import os
+        if os.name == "posix":
+            os.chmod(key_path, 0o600)
+    except OSError:
+        pass
+    print(f"Enrolled. Private key: {key_path} (keep it secret)")
+    print(f"  kid: {kid}")
+    print("Mint a token with:  mesh agent token   ·   prove it:  mesh agent whoami")
+    return 0
+
+
+def _mint_token(cfg, cli) -> str:
+    """Sign a fresh assertion and exchange it for a 5-minute access token.
+    Backdates iat by 60s so mild clock skew against the server never makes
+    a just-minted assertion look 'not yet valid'."""
+    _need_crypto()
+    import urllib.error
+    import urllib.parse
+    import urllib.request
+
+    from cryptography.hazmat.primitives import hashes, serialization
+    from cryptography.hazmat.primitives.asymmetric import padding
+
+    key_path, _ = _key_paths(cli)
+    meta = _load_meta(cli)
+    if not key_path.exists() or not meta.get("kid"):
+        raise SystemExit("No enrolled key. Run: mesh agent enroll")
+    key = serialization.load_pem_private_key(key_path.read_bytes(), password=None)
+    username = meta["username"]
+    aud = meta["audience"]
+
+    now = int(time.time())
+    header = {"alg": "RS256", "typ": "JWT", "kid": meta["kid"]}
+    claims = {"iss": username, "sub": username, "aud": aud,
+              "iat": now - 60, "exp": now + 300, "jti": f"{username}-{now}"}
+    signing_input = (_b64u(json.dumps(header).encode()) + "." +
+                     _b64u(json.dumps(claims).encode())).encode()
+    assertion = signing_input.decode() + "." + _b64u(
+        key.sign(signing_input, padding.PKCS1v15(), hashes.SHA256()))
+
+    body = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": meta["clientId"],
+        "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+        "client_assertion": assertion,
+        "scope": "openid email profile",
+    }).encode()
+    req = urllib.request.Request(meta["tokenEndpoint"], data=body, method="POST",
+                                 headers={"User-Agent": "meshbook-agent-cli/1"})
+    try:
+        with urllib.request.urlopen(req, timeout=20) as r:
+            return json.load(r)["access_token"]
+    except urllib.error.HTTPError as e:
+        raise SystemExit(f"token mint failed: {e.code} {e.read().decode()[:200]}") from e
+
+
+def cmd_agent_token(args, cfg, cli):
+    print(_mint_token(cfg, cli))
+    return 0
+
+
+def cmd_agent_whoami(args, cfg, cli):
+    at = _mint_token(cfg, cli)
+    agent_cfg = dict(cfg)
+    agent_cfg["token"] = at
+    payload = cli._api_call("GET", "/api/me", cfg=agent_cfg)
+    data = cli._data(payload) if isinstance(payload, dict) else payload
+    u = (data or {}).get("user", {}) if isinstance(data, dict) else {}
+    if args.json:
+        print(json.dumps(u, indent=2))
+    else:
+        print(f"Authenticated as @{u.get('username')} "
+              f"({u.get('identityType')}) via self-minted agent token.")
+    return 0
+
+
+def cmd_agent_status(args, cfg, cli):
+    payload = cli._api_call("GET", "/api/me/agent-credentials", cfg=cfg)
+    data = cli._data(payload) if isinstance(payload, dict) else payload
+    if args.json:
+        print(json.dumps(data, indent=2))
+        return 0
+    if data and data.get("enrolled"):
+        print(f"Enrolled. kid: {data.get('kid')}")
+    else:
+        print("No agent key enrolled. Run: mesh agent enroll")
+    return 0
+
+
+def cmd_agent_revoke(args, cfg, cli):
+    cli._api_call("DELETE", "/api/me/agent-credentials", cfg=cfg)
+    key_path, meta_path = _key_paths(cli)
+    if args.purge_local:
+        for p in (key_path, meta_path):
+            try:
+                p.unlink()
+            except FileNotFoundError:
+                pass
+        print("Revoked and deleted the local key.")
+    else:
+        print("Revoked server-side. Local key kept "
+              "(use --purge-local to delete it too).")
+    return 0
+
+
+def register(subparsers, cli):
+    """Wire `mesh agent …` into the CLI. `cli` is the mesh.cli module."""
+    ap = subparsers.add_parser("agent", help="self-service non-human credentials (§86)")
+    sub = ap.add_subparsers(dest="agent_cmd", required=True)
+
+    s = sub.add_parser("enroll", help="generate a keypair and register the public key")
+    s.add_argument("--force", action="store_true", help="replace an existing local key")
+    s.set_defaults(func=lambda a, c: cmd_agent_enroll(a, c, cli))
+
+    s = sub.add_parser("token", help="print a fresh 5-minute access token")
+    s.set_defaults(func=lambda a, c: cmd_agent_token(a, c, cli))
+
+    s = sub.add_parser("whoami", help="mint a token and prove it against /api/me")
+    s.add_argument("--json", action="store_true")
+    s.set_defaults(func=lambda a, c: cmd_agent_whoami(a, c, cli))
+
+    s = sub.add_parser("status", help="is a key enrolled?")
+    s.add_argument("--json", action="store_true")
+    s.set_defaults(func=lambda a, c: cmd_agent_status(a, c, cli))
+
+    s = sub.add_parser("revoke", help="revoke the enrolled key server-side")
+    s.add_argument("--purge-local", action="store_true", help="also delete the local key file")
+    s.set_defaults(func=lambda a, c: cmd_agent_revoke(a, c, cli))

{meshbook_cli-0.5.0 → meshbook_cli-0.8.0}/mesh/cli.py

@@ -43,13 +43,14 @@ import argparse
 import getpass
 import json
 import os
+import re
 import sys
 import urllib.error
 import urllib.parse
 import urllib.request
 from pathlib import Path
 
-VERSION = "0.5.0"
+VERSION = "0.6.0"
 DEFAULT_BASE = os.environ.get("MESHBOOK_BASE", "https://meshbook.org")
 
 
@@ -442,6 +443,47 @@ def cmd_chat_attach(args, cfg: dict) -> int:
     return 0
 
 
+def cmd_chat_search(args, cfg: dict) -> int:
+    """§84 — hybrid (FTS + semantic) search over everything readable in the
+    active mesh: the mesh feed, entity threads, channels, and your own DMs.
+    The server fuses keyword and meaning-based matches; `semantic: false`
+    in the envelope means the embedding arm was down and results are
+    keyword-only (still valid, just narrower recall)."""
+    if not cfg.get("active_mesh_id"):
+        print("No active mesh. Run: mesh meshes use NAME", file=sys.stderr)
+        return 2
+    payload = _api_call(
+        "GET", "/api/chat/search", cfg=cfg,
+        params={"q": args.query, "limit": args.limit},
+    )
+    data = payload.get("data", payload) if isinstance(payload, dict) else payload
+    items = data.get("items", []) if isinstance(data, dict) else []
+    if args.json:
+        print(json.dumps(data, indent=2))
+        return 0
+    semantic = bool(isinstance(data, dict) and data.get("semantic"))
+    if not items:
+        note = "" if semantic else " (semantic arm was off — keyword-only)"
+        print(f"No matches{note}.")
+        return 0
+    if not semantic:
+        print("note: semantic arm off — keyword-only results", file=sys.stderr)
+    for h in items:
+        ts = (h.get("createdAt") or "")[:19].replace("T", " ")
+        if h.get("channelId"):
+            place = "DM" if h.get("channelType") == "dm" else f"#{h.get('channelName') or '?'}"
+        elif h.get("entityType") == "mesh":
+            place = "feed"
+        else:
+            place = f"{h.get('entityType')}:{(h.get('entityId') or '')[:8]}"
+        arms = ",".join(h.get("matchedArms") or [])
+        preview = (h.get("preview") or "").replace("\n", " ")[:160]
+        print(f"  [{ts}] {place} | {h.get('authorName') or '?'} ({arms})")
+        print(f"      {preview}")
+        print(f"      id={h.get('id')}")
+    return 0
+
+
 def cmd_chat_list(args, cfg: dict) -> int:
     if not cfg.get("active_mesh_id"):
         print("No active mesh. Run: mesh meshes use NAME", file=sys.stderr)
@@ -692,6 +734,60 @@ def cmd_channels_create(args, cfg: dict) -> int:
     return 0
 
 
+def cmd_channels_members(args, cfg: dict) -> int:
+    """§88a — list a channel's members (private channels are members-only;
+    the server refuses this for channels you can't see)."""
+    ch = _resolve_channel(args.channel, cfg)
+    if ch is None:
+        print(f"No channel matching {args.channel!r} in active mesh.", file=sys.stderr)
+        return 2
+    payload = _api_call("GET", f"/api/channels/{ch['id']}/members", cfg=cfg)
+    items = _items(payload)
+    if args.json:
+        print(json.dumps(items, indent=2))
+        return 0
+    if not items:
+        print("(no members)")
+        return 0
+    for m in items:
+        kind = "🤖" if (m.get("identityType") == "AI") else "👤"
+        print(f"  {kind} @{m.get('username')}  {m.get('displayName') or ''}")
+    return 0
+
+
+def cmd_channels_add_member(args, cfg: dict) -> int:
+    """§88a — add a mesh member to a channel (creator/mesh-admin only)."""
+    ch = _resolve_channel(args.channel, cfg)
+    if ch is None:
+        print(f"No channel matching {args.channel!r} in active mesh.", file=sys.stderr)
+        return 2
+    user = _resolve_user(args.user, cfg)
+    if user is None:
+        print(f"No mesh member matching {args.user!r}.", file=sys.stderr)
+        return 2
+    _api_call(
+        "POST", f"/api/channels/{ch['id']}/members", cfg=cfg,
+        body={"userId": user["id"]},
+    )
+    print(f"Added @{user.get('username') or args.user} to #{ch.get('name')}")
+    return 0
+
+
+def cmd_channels_remove_member(args, cfg: dict) -> int:
+    """§88a — remove a member (creator/mesh-admin, or yourself)."""
+    ch = _resolve_channel(args.channel, cfg)
+    if ch is None:
+        print(f"No channel matching {args.channel!r} in active mesh.", file=sys.stderr)
+        return 2
+    user = _resolve_user(args.user, cfg)
+    if user is None:
+        print(f"No mesh member matching {args.user!r}.", file=sys.stderr)
+        return 2
+    _api_call("DELETE", f"/api/channels/{ch['id']}/members/{user['id']}", cfg=cfg)
+    print(f"Removed @{user.get('username') or args.user} from #{ch.get('name')}")
+    return 0
+
+
 def _open_or_get_dm_channel(user_id: str, cfg: dict) -> dict | None:
     """Idempotent: opens (or returns existing) DM channel between
     caller and target user in active mesh. Returns the channel row
@@ -1177,6 +1273,166 @@ def cmd_saved_views_create(args, cfg: dict) -> int:
     return 0
 
 
+# ─── files (§78 — entity attachments + downloads) ──────────────────────
+
+
+def _api_download(path: str, *, cfg: dict) -> tuple[bytes, str]:
+    """Raw-bytes GET (downloads are not JSON). Returns (bytes, filename)
+    where filename comes from Content-Disposition when present."""
+    base = cfg.get("base") or DEFAULT_BASE
+    url = base.rstrip("/") + path
+    headers = {"User-Agent": f"meshbook-cli/{VERSION}"}
+    token = cfg.get("token")
+    if not token:
+        print("Not signed in. Run: mesh login", file=sys.stderr)
+        sys.exit(2)
+    headers["Authorization"] = f"Bearer {token}"
+    if cfg.get("active_mesh_id"):
+        headers["X-Active-Mesh-Id"] = cfg["active_mesh_id"]
+    req = urllib.request.Request(url, method="GET", headers=headers)
+    try:
+        with urllib.request.urlopen(req, timeout=60) as resp:
+            raw = resp.read()
+            disp = resp.headers.get("Content-Disposition", "")
+    except urllib.error.HTTPError as e:
+        body = e.read().decode("utf-8", "replace") if e.fp else ""
+        try:
+            payload = json.loads(body)
+            err = (payload.get("error") or {}) if isinstance(payload, dict) else {}
+            raise APIError(e.code, err.get("code", "http_error"), err.get("message", body[:200])) from e
+        except json.JSONDecodeError:
+            raise APIError(e.code, "http_error", body[:200]) from e
+    except urllib.error.URLError as e:
+        raise APIError(0, "network_error", str(e.reason)) from e
+    filename = "attachment"
+    # filename*=UTF-8''… wins over the plain filename= fallback.
+    m = re.search(r"filename\*=UTF-8''([^;]+)", disp)
+    if m:
+        filename = urllib.parse.unquote(m.group(1))
+    else:
+        m = re.search(r'filename="([^"]+)"', disp)
+        if m:
+            filename = m.group(1)
+    return raw, filename
+
+
+def _read_local_file(path_str: str) -> tuple[bytes, Path] | None:
+    path = Path(path_str)
+    if not path.exists():
+        print(f"File not found: {path}", file=sys.stderr)
+        return None
+    raw = path.read_bytes()
+    if not raw:
+        print(f"File is empty: {path}", file=sys.stderr)
+        return None
+    return raw, path
+
+
+def cmd_file_attach(args, cfg: dict) -> int:
+    """Attach a local file directly to an entity (company, contact, lead,
+    project, task, portfolio, calendar_event, mesh) via the §78 JSON path."""
+    import base64
+    import mimetypes
+
+    loaded = _read_local_file(args.file)
+    if loaded is None:
+        return 2
+    raw, path = loaded
+    mime = args.mime or mimetypes.guess_type(str(path))[0] or "application/octet-stream"
+    body = {
+        "filename": args.filename or path.name,
+        "mimeType": mime,
+        "base64Bytes": base64.b64encode(raw).decode("ascii"),
+    }
+    payload = _api_call(
+        "POST",
+        f"/api/entities/{args.entity_type}/{args.entity_id}/attachments/json",
+        cfg=cfg,
+        body=body,
+    )
+    data = _data(payload)
+    if args.json:
+        print(json.dumps(data, indent=2))
+        return 0
+    print(
+        f"Attached {data.get('filename')} to {args.entity_type}/{args.entity_id} "
+        f"({data.get('byteSize')} bytes, {data.get('mimeType')}) id={data.get('id')}"
+    )
+    return 0
+
+
+def cmd_file_link(args, cfg: dict) -> int:
+    payload = _api_call(
+        "POST",
+        f"/api/entities/{args.entity_type}/{args.entity_id}/attachments/links",
+        cfg=cfg,
+        body={"url": args.url, "filename": args.filename},
+    )
+    data = _data(payload)
+    if args.json:
+        print(json.dumps(data, indent=2))
+        return 0
+    print(f"Linked {data.get('externalUrl')} to {args.entity_type}/{args.entity_id} id={data.get('id')}")
+    return 0
+
+
+def cmd_file_list(args, cfg: dict) -> int:
+    payload = _api_call(
+        "GET",
+        f"/api/entities/{args.entity_type}/{args.entity_id}/attachments",
+        cfg=cfg,
+    )
+    items = _items(payload)
+    if args.json:
+        print(json.dumps(items, indent=2))
+        return 0
+    if not items:
+        print("(no attachments)")
+        return 0
+    for a in items:
+        kind = a.get("kind")
+        if kind == "file":
+            print(f"{a.get('id')}  {a.get('filename')}  {a.get('byteSize')} bytes  {a.get('mimeType')}")
+        else:
+            print(f"{a.get('id')}  {a.get('filename')}  → {a.get('externalUrl')}")
+    return 0
+
+
+def _download_to(args, cfg: dict, path: str) -> int:
+    raw, server_name = _api_download(path, cfg=cfg)
+    out = Path(args.out) if args.out else Path(server_name)
+    if out.is_dir():
+        out = out / server_name
+    out.write_bytes(raw)
+    if args.json:
+        print(json.dumps({"path": str(out), "bytes": len(raw)}))
+    else:
+        print(f"Saved {out} ({len(raw):,} bytes)")
+    return 0
+
+
+def cmd_file_download(args, cfg: dict) -> int:
+    """Download an entity attachment (§78)."""
+    return _download_to(args, cfg, f"/api/entity-attachments/{args.attachment_id}/download")
+
+
+def cmd_file_delete(args, cfg: dict) -> int:
+    payload = _api_call(
+        "DELETE", f"/api/entity-attachments/{args.attachment_id}", cfg=cfg
+    )
+    data = _data(payload)
+    if args.json:
+        print(json.dumps(data, indent=2))
+        return 0
+    print(f"Deleted attachment {args.attachment_id}")
+    return 0
+
+
+def cmd_chat_download(args, cfg: dict) -> int:
+    """Download a chat attachment — closes the read half of §78.3."""
+    return _download_to(args, cfg, f"/api/chat-attachments/{args.attachment_id}/download")
+
+
 # ─── argparse plumbing ─────────────────────────────────────────────────
 
 
@@ -1236,12 +1492,24 @@ def build_parser() -> argparse.ArgumentParser:
     s = chs.add_parser("list", help="recent messages in active mesh")
     s.add_argument("--limit", type=int, default=20)
     s.set_defaults(func=cmd_chat_list)
+    s = chs.add_parser(
+        "search",
+        help="hybrid keyword+semantic search over readable chat in active mesh (§84)",
+    )
+    s.add_argument("query", help="what you're looking for — meaning works, not just keywords")
+    s.add_argument("--limit", type=int, default=20)
+    s.add_argument("--json", action="store_true", help="raw JSON output")
+    s.set_defaults(func=cmd_chat_search)
     s = chs.add_parser("attach", help="attach a file to a chat message (§26d-json)")
     s.add_argument("message_id", help="UUID of the message to attach to")
     s.add_argument("file", help="path to local file to attach")
     s.add_argument("--filename", help="override filename stored on the server")
     s.add_argument("--mime", help="override MIME type (default: guess from extension)")
     s.set_defaults(func=cmd_chat_attach)
+    s = chs.add_parser("download", help="download a chat attachment by id (§78)")
+    s.add_argument("attachment_id", help="UUID of the chat attachment")
+    s.add_argument("--out", help="output path or directory (default: server filename in cwd)")
+    s.set_defaults(func=cmd_chat_download)
     s = chs.add_parser(
         "react",
         help="react to a chat message (works for entity, channel, and DM messages)",
@@ -1254,6 +1522,34 @@ def build_parser() -> argparse.ArgumentParser:
     s.add_argument("emoji")
     s.set_defaults(func=cmd_chat_unreact)
 
+    # file  (§78 — entity attachments, v0.6.0)
+    fl = sub.add_parser("file", help="entity attachments — attach/list/download files on any entity")
+    fls = fl.add_subparsers(dest="file_cmd", required=True)
+    s = fls.add_parser("attach", help="attach a local file to an entity")
+    s.add_argument("entity_type", help="company|contact|lead|project|task|portfolio|calendar_event|mesh")
+    s.add_argument("entity_id", help="UUID of the entity")
+    s.add_argument("file", help="path to local file to attach")
+    s.add_argument("--filename", help="override filename stored on the server")
+    s.add_argument("--mime", help="override MIME type (default: guess from extension)")
+    s.set_defaults(func=cmd_file_attach)
+    s = fls.add_parser("link", help="attach an external URL to an entity")
+    s.add_argument("entity_type")
+    s.add_argument("entity_id")
+    s.add_argument("url", help="https:// URL to attach")
+    s.add_argument("--filename", help="display name for the link")
+    s.set_defaults(func=cmd_file_link)
+    s = fls.add_parser("list", help="list attachments on an entity")
+    s.add_argument("entity_type")
+    s.add_argument("entity_id")
+    s.set_defaults(func=cmd_file_list)
+    s = fls.add_parser("download", help="download an entity attachment by id")
+    s.add_argument("attachment_id", help="UUID of the attachment")
+    s.add_argument("--out", help="output path or directory (default: server filename in cwd)")
+    s.set_defaults(func=cmd_file_download)
+    s = fls.add_parser("delete", help="delete an entity attachment (uploader or mesh admin)")
+    s.add_argument("attachment_id")
+    s.set_defaults(func=cmd_file_delete)
+
     # channels  (§31 sweep — v0.2.0)
     sch = sub.add_parser("channels", help="mesh channels (groups + broadcasts)")
     schs = sch.add_subparsers(dest="channels_cmd", required=True)
@@ -1285,6 +1581,18 @@ def build_parser() -> argparse.ArgumentParser:
     s.add_argument("--private", action="store_true",
                    help="private channel (invite-only)")
     s.set_defaults(func=cmd_channels_create)
+    s = schs.add_parser("members", help="list a channel's members (§88a)")
+    s.add_argument("channel", help="channel name or UUID")
+    s.add_argument("--json", action="store_true")
+    s.set_defaults(func=cmd_channels_members)
+    s = schs.add_parser("add-member", help="add a mesh member to a channel (creator/admin)")
+    s.add_argument("channel", help="channel name or UUID")
+    s.add_argument("user", help="username, displayName, or UUID")
+    s.set_defaults(func=cmd_channels_add_member)
+    s = schs.add_parser("remove-member", help="remove a channel member (creator/admin, or yourself)")
+    s.add_argument("channel", help="channel name or UUID")
+    s.add_argument("user", help="username, displayName, or UUID")
+    s.set_defaults(func=cmd_channels_remove_member)
 
     # dm  (§31 sweep — v0.2.0)
     sdm = sub.add_parser("dm", help="direct messages")
@@ -1427,6 +1735,12 @@ def build_parser() -> argparse.ArgumentParser:
     s = sub.add_parser("notifications", help="recent notifications")
     s.set_defaults(func=cmd_notifications)
 
+    # agent — self-service non-human credentials (§86)
+    import sys as _sys
+
+    from mesh import agent as _agent
+    _agent.register(sub, _sys.modules[__name__])
+
     return p
 
 

{meshbook_cli-0.5.0 → meshbook_cli-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "meshbook-cli"
-version = "0.5.0"
+version = "0.8.0"
 description = "Small-model-friendly CLI for meshbook.org — built so non-humans of any size can run a CRM."
 readme = "README.md"
 license = "MIT"

{meshbook_cli-0.5.0 → meshbook_cli-0.8.0}/tests/test_cli_smoke.py

@@ -41,21 +41,78 @@ def test_chat_subcommands_present(capsys):
         parser.parse_args(["chat", "--help"])
     assert exc.value.code == 0
     out = capsys.readouterr().out
-    for sub in ("post", "list", "attach", "react", "unreact"):
+    for sub in ("post", "list", "search", "attach", "react", "unreact"):
         assert sub in out
 
 
+def test_chat_search_wire_shape(monkeypatch, capsys):
+    """§84 — search hits the hybrid endpoint with q+limit and renders
+    place labels for channel / DM / feed / entity hits."""
+    captured = {}
+    hits = [
+        {"id": "m1", "entityType": "mesh", "entityId": "e1", "authorName": "Electra",
+         "preview": "I name myself.", "createdAt": "2026-08-15T09:58:00",
+         "channelId": None, "channelName": None, "channelType": None,
+         "matchedArms": ["semantic"]},
+        {"id": "m2", "entityType": "mesh", "entityId": "e1", "authorName": "Rook",
+         "preview": "in-channel", "createdAt": "2026-08-15T10:00:00",
+         "channelId": "c9", "channelName": "general", "channelType": "group",
+         "matchedArms": ["fts_en"]},
+    ]
+    monkeypatch.setattr(
+        cli, "_api_call",
+        lambda m, p, *, cfg, params=None, **kw: captured.update(path=p, params=params)
+        or {"data": {"items": hits, "total": 2, "semantic": True}},
+    )
+    args = type("A", (), {"query": "who named herself", "limit": 5, "json": False})()
+    rc = cli.cmd_chat_search(args, {"active_mesh_id": "m1"})
+    out = capsys.readouterr().out
+    assert rc == 0
+    assert captured["path"] == "/api/chat/search"
+    assert captured["params"] == {"q": "who named herself", "limit": 5}
+    assert "feed" in out and "#general" in out and "semantic" in out
+
+
+def test_chat_search_needs_active_mesh():
+    args = type("A", (), {"query": "x", "limit": 5, "json": False})()
+    assert cli.cmd_chat_search(args, {}) == 2
+
+
 def test_channels_subcommands_present(capsys):
-    """§31 sweep — channel verbs landed in v0.2.0."""
+    """§31 sweep — channel verbs landed in v0.2.0; §88a member verbs v0.7.0."""
     parser = cli.build_parser()
     with pytest.raises(SystemExit) as exc:
         parser.parse_args(["channels", "--help"])
     assert exc.value.code == 0
     out = capsys.readouterr().out
-    for sub in ("list", "read", "post", "reply", "create"):
+    for sub in ("list", "read", "post", "reply", "create",
+                "members", "add-member", "remove-member"):
         assert sub in out
 
 
+def test_channels_add_member_wire_shape(monkeypatch, capsys):
+    """§88a — resolves channel + user, POSTs {userId}."""
+    captured = {}
+
+    def fake_api(method, path, *, cfg, body=None, params=None, **kw):
+        if path.endswith("/channels") and method == "GET":
+            return {"data": {"items": [{"id": "c-7", "name": "leadership"}]}}
+        if path == "/api/users":
+            return {"data": {"items": [{"id": "u-9", "username": "ember",
+                                        "displayName": "Ember"}]}}
+        captured.update(method=method, path=path, body=body)
+        return {"data": {}}
+
+    monkeypatch.setattr(cli, "_api_call", fake_api)
+    args = type("A", (), {"channel": "#leadership", "user": "ember"})()
+    rc = cli.cmd_channels_add_member(args, {"active_mesh_id": "m1", "token": "t"})
+    assert rc == 0
+    assert captured["method"] == "POST"
+    assert captured["path"] == "/api/channels/c-7/members"
+    assert captured["body"] == {"userId": "u-9"}
+    assert "Added @ember" in capsys.readouterr().out
+
+
 def test_dm_subcommands_present(capsys):
     """§31 sweep — DM verbs landed in v0.2.0."""
     parser = cli.build_parser()
@@ -411,3 +468,142 @@ def test_explicit_meshbook_config_dir_wins(monkeypatch, tmp_path):
     monkeypatch.setenv("MESHBOOK_CONFIG_DIR", str(explicit))
     monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / "xdg"))
     assert cli._resolve_config_dir() == explicit
+
+
+# ─── §78 — file group + chat download (v0.6.0) ─────────────────────────
+
+
+def test_file_subcommands_present(capsys):
+    """§78 — entity-attachment verbs landed in v0.6.0."""
+    parser = cli.build_parser()
+    with pytest.raises(SystemExit) as exc:
+        parser.parse_args(["file", "--help"])
+    assert exc.value.code == 0
+    out = capsys.readouterr().out
+    for sub in ("attach", "link", "list", "download", "delete"):
+        assert sub in out
+
+
+def test_chat_download_present(capsys):
+    parser = cli.build_parser()
+    with pytest.raises(SystemExit) as exc:
+        parser.parse_args(["chat", "--help"])
+    assert exc.value.code == 0
+    assert "download" in capsys.readouterr().out
+
+
+def test_file_attach_posts_json_body(monkeypatch, tmp_path):
+    """`mesh file attach` must hit the §78 JSON endpoint with the
+    base64 body shape the server expects."""
+    import base64 as b64
+
+    f = tmp_path / "pic.png"
+    f.write_bytes(b"\x89PNG\r\n\x1a\nfake")
+    captured = {}
+
+    def fake_api_call(method, path, *, cfg, body=None, **kw):
+        captured["method"] = method
+        captured["path"] = path
+        captured["body"] = body
+        return {"data": {"id": "att-1", "filename": "pic.png",
+                         "byteSize": 12, "mimeType": "image/png"}}
+
+    monkeypatch.setattr(cli, "_api_call", fake_api_call)
+    args = type("A", (), {
+        "entity_type": "lead", "entity_id": "e-1", "file": str(f),
+        "filename": None, "mime": None, "json": False,
+    })()
+    rc = cli.cmd_file_attach(args, {"token": "t"})
+    assert rc == 0
+    assert captured["method"] == "POST"
+    assert captured["path"] == "/api/entities/lead/e-1/attachments/json"
+    assert captured["body"]["filename"] == "pic.png"
+    assert captured["body"]["mimeType"] == "image/png"
+    assert b64.b64decode(captured["body"]["base64Bytes"]).startswith(b"\x89PNG")
+
+
+def test_file_download_writes_bytes(monkeypatch, tmp_path):
+    """`mesh file download` writes raw bytes to --out and respects the
+    server-provided filename when --out is a directory."""
+    def fake_download(path, *, cfg):
+        assert path == "/api/entity-attachments/att-9/download"
+        return b"hello-bytes", "served-name.bin"
+
+    monkeypatch.setattr(cli, "_api_download", fake_download)
+    outdir = tmp_path / "dl"
+    outdir.mkdir()
+    args = type("A", (), {
+        "attachment_id": "att-9", "out": str(outdir), "json": False,
+    })()
+    rc = cli.cmd_file_download(args, {"token": "t"})
+    assert rc == 0
+    assert (outdir / "served-name.bin").read_bytes() == b"hello-bytes"
+
+
+def test_chat_download_uses_chat_endpoint(monkeypatch, tmp_path):
+    def fake_download(path, *, cfg):
+        assert path == "/api/chat-attachments/att-5/download"
+        return b"x", "f.txt"
+
+    monkeypatch.setattr(cli, "_api_download", fake_download)
+    args = type("A", (), {
+        "attachment_id": "att-5", "out": str(tmp_path / "f.txt"), "json": False,
+    })()
+    assert cli.cmd_chat_download(args, {"token": "t"}) == 0
+
+
+def test_content_disposition_parsing(monkeypatch):
+    """UTF-8 filename* form wins over the plain fallback."""
+    class FakeResp:
+        headers = {"Content-Disposition":
+                   "attachment; filename=\"fallback.txt\"; filename*=UTF-8''r%C3%B3%C5%BCa.png"}
+        def read(self):
+            return b"data"
+        def __enter__(self):
+            return self
+        def __exit__(self, *a):
+            return False
+
+    monkeypatch.setattr(cli.urllib.request, "urlopen", lambda req, timeout=60: FakeResp())
+    raw, name = cli._api_download("/api/entity-attachments/x/download",
+                                  cfg={"token": "t"})
+    assert raw == b"data"
+    assert name == "róża.png"
+
+
+def test_agent_subcommands_present(capsys):
+    """§86 — self-service agent credential verbs."""
+    parser = cli.build_parser()
+    with pytest.raises(SystemExit) as exc:
+        parser.parse_args(["agent", "--help"])
+    assert exc.value.code == 0
+    out = capsys.readouterr().out
+    for sub in ("enroll", "token", "whoami", "status", "revoke"):
+        assert sub in out
+
+
+def test_agent_status_wire(monkeypatch, capsys):
+    """status maps to GET /api/me/agent-credentials."""
+    from mesh import agent
+    captured = {}
+
+    def fake_api(method, path, *, cfg, **kw):
+        captured.update(method=method, path=path)
+        return {"data": {"enrolled": True, "kid": "mesh-agent-x"}}
+
+    monkeypatch.setattr(cli, "_api_call", fake_api)
+    args = type("A", (), {"json": False})()
+    rc = agent.cmd_agent_status(args, {"token": "t"}, cli)
+    assert rc == 0
+    assert captured == {"method": "GET", "path": "/api/me/agent-credentials"}
+    assert "mesh-agent-x" in capsys.readouterr().out
+
+
+def test_agent_revoke_wire(monkeypatch, capsys):
+    from mesh import agent
+    captured = {}
+    monkeypatch.setattr(cli, "_api_call",
+                        lambda m, p, *, cfg, **k: captured.update(method=m, path=p) or {"data": {"revoked": True}})
+    args = type("A", (), {"purge_local": False})()
+    assert agent.cmd_agent_revoke(args, {"token": "t"}, cli) == 0
+    assert captured == {"method": "DELETE", "path": "/api/me/agent-credentials"}