obsideo-cli 0.2.9__tar.gz → 0.3.1__tar.gz

{obsideo_cli-0.2.9 → obsideo_cli-0.3.1}/PKG-INFO

@@ -1,9 +1,12 @@
 Metadata-Version: 2.4
 Name: obsideo-cli
-Version: 0.2.9
-Summary: Obsideo Cloud - encrypted storage we can't read. Save, browse, and sync whatever you want, from your terminal.
+Version: 0.3.1
+Summary: Obsideo Cloud - encrypted storage we can't read, for people and AI agents. 12 GB free, no card. Save, browse, and sync from your terminal; agent integration contract at obsideo.io/agents.md
 License: MIT
 Project-URL: Homepage, https://obsideo.io
+Project-URL: Documentation, https://obsideo.io/docs/
+Project-URL: Agent integration (AGENTS.md), https://obsideo.io/agents.md
+Keywords: encrypted storage,ai agents,agent storage,s3,backup,end-to-end encryption,object storage,free tier,cli,sync
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: boto3>=1.28

{obsideo_cli-0.2.9 → obsideo_cli-0.3.1}/obsideo/cli.py

@@ -49,6 +49,15 @@ def _human(n: int | None) -> str:
         f /= 1024
 
 
+def _gb(n) -> str:
+    """Format a GB count for display: drop a trailing .0 (2.0 -> '2', 2.5 -> '2.5')."""
+    try:
+        f = float(n)
+    except (TypeError, ValueError):
+        return str(n)
+    return str(int(f)) if f == int(f) else f"{f:g}"
+
+
 # ── Operator notices (server-driven broadcasts) ──────────────────────────────
 
 _SEEN_FILE = config.CONFIG_DIR / "seen_notices"
@@ -297,9 +306,11 @@ def run_login(url: str | None = None) -> bool:
     print(" sent.")
     print(f"Check {email} for a verification code (it may be in spam).")
     code = input("Enter verification code: ").strip()
+    # Optional friend's referral code -> +1 GB (4 GB instead of 3). Blank = skip.
+    referral_code = input("Referral code from a friend (optional, Enter to skip): ").strip()
     print("Verifying + provisioning storage...", end="", flush=True)
     try:
-        creds = login.verify(email, code, url)
+        creds = login.verify(email, code, url, referral_code=referral_code or None)
     except login.LoginError as e:
         print(f"\nVerification failed: {e}")
         return False
@@ -308,6 +319,11 @@ def run_login(url: str | None = None) -> bool:
     # Make sure the data key exists + nudge the user to back it up.
     crypto.data_key()
     print(f"\nYou're all set. {creds.get('quota_gb', 3)} GB free.")
+    if referral_code:
+        if creds.get("referral_applied"):
+            print(f"Referral applied - enjoy the extra space! (code {referral_code.upper()})")
+        else:
+            print(f"That referral code ({referral_code}) wasn't recognized, so no bonus was added.")
     if not creds.get("gateway_registered", True):
         print("Note: storage activation is finishing rollout; if an upload fails, retry shortly.")
     print("Your files are encrypted with a local key. Back it up:")
@@ -331,6 +347,7 @@ class ObsideoShell(cmd.Cmd):
         "    ls / cd / mkdir             browse your files\n"
         "    sync push / pull / status   mirror your sync folder\n"
         "    account                     your plan and usage\n"
+        "    refer                       invite friends for free space\n"
         "    about / faq / messages      learn more / team news\n\n"
         "  Type 'help <command>' for details (e.g. 'help sync'), or 'exit' to quit.\n"
     )
@@ -602,6 +619,15 @@ class ObsideoShell(cmd.Cmd):
                 print(f"     Used:  {_human(used)} across {n} file(s)")
             except Exception:
                 print("     Used:  (couldn't read storage just now)")
+        # Referral summary (only for email-login accounts; pre-shim accounts have
+        # no signup token and just don't show this line).
+        ref = _fetch_referral() if config.account_token() else None
+        if ref:
+            if ref.get("active"):
+                print(f"     Referrals: code {ref['code']} - {ref['active']} active, "
+                      f"+{_gb(ref.get('earned_gb', 0))} GB earned  ('refer' for more)")
+            else:
+                print(f"     Referrals: code {ref['code']} - invite friends for free space ('refer')")
         print(f"     Bucket: {storage.bucket()}")
         print(f"     Sync folder: {sync_mod.ensure_sync_dir()}")
         print(f"     Keys: {config.CONFIG_DIR}  (back up data.key)")
@@ -652,7 +678,8 @@ class ObsideoShell(cmd.Cmd):
   A: `config` shows them; `config set sync_dir <path>` / `config set encrypt_names false`.
 
   Q: More space?
-  A: Reply to any Obsideo email to upgrade. (A referral program is coming.)
+  A: Invite friends with `refer` - they get +1 GB, you get +2 GB once they
+     upload. Or reply to any Obsideo email to upgrade.
 
   Q: Updating?
   A: pip install -U obsideo-cli  - the CLI also nudges you when an update is out.
@@ -678,6 +705,50 @@ class ObsideoShell(cmd.Cmd):
             print(f"   - {n.get('body', '').strip()}")
         print()
 
+    # ── refer ─────────────────────────────────────────────────────────────────
+    def do_refer(self, arg):
+        """Invite friends for free space. Usage: refer
+
+        Share your code: each friend who joins with it gets +1 GB, and you get
+        +2 GB once they actually upload something. No limit."""
+        if not self._require_login():
+            return
+        if not config.account_token():
+            print(
+                "\n  Referrals need an email login. Run 'login' to sign up / sign in"
+                "\n  with your email, then 'refer' shows your invite code.\n"
+            )
+            return
+        info = _fetch_referral()
+        if not info:
+            print("\n  Couldn't load your referral info just now - try again shortly.\n")
+            return
+
+        each = info.get("owner_bonus_gb_each", 2)
+        redeemer = info.get("redeemer_bonus_gb", 1)
+        print()
+        print("  -- Invite friends, get free space --------------------------")
+        print(f"     Your code:  {info['code']}")
+        print(f"     Share it: a friend runs `obsideo login` and enters your code.")
+        print(f"     They get +{_gb(redeemer)} GB; you get +{_gb(each)} GB once they upload.")
+        print()
+        invited = info.get("invited", 0)
+        active = info.get("active", 0)
+        pending = info.get("pending", 0)
+        earned = info.get("earned_gb", 0)
+        if invited:
+            print(f"     Invited: {invited}   Active: {active}   Pending upload: {pending}")
+            print(f"     Earned so far: +{_gb(earned)} GB   (your quota: {_gb(info.get('quota_gb', 0))} GB)")
+        else:
+            print("     No referrals yet - share your code to start earning.")
+        if info.get("newly_credited"):
+            n = info["newly_credited"]
+            print(f"     ✨ {n} friend(s) just activated - +{_gb(n*each)} GB added!")
+        print("  ------------------------------------------------------------")
+        print("  Bonuses are a promotional perk; Obsideo reserves the right to change")
+        print("  or end the program and to revoke bonuses for abuse.")
+        print()
+
     # ── sync ──────────────────────────────────────────────────────────────────
     def do_sync(self, arg):
         """Sync your local folder with Obsideo. Usage: sync push|pull|status"""
@@ -755,6 +826,25 @@ def _fetch_usage() -> dict | None:
         return None
 
 
+def _fetch_referral() -> dict | None:
+    """Referral code + stats from the signup service (Bearer account token). Also
+    triggers the server-side lazy credit check for any friend who just became
+    active. Returns None for accounts without a signup token (e.g. pre-shim
+    accounts) or if the service is unreachable — callers handle that gracefully."""
+    token = config.account_token()
+    if not token:
+        return None
+    try:
+        req = urllib.request.Request(
+            f"{config.signup_url()}/v1/account/referral",
+            headers={"Authorization": f"Bearer {token}", "User-Agent": config.USER_AGENT},
+        )
+        with urllib.request.urlopen(req, timeout=20, context=config.ssl_context()) as resp:
+            return json.loads(resp.read().decode())
+    except Exception:
+        return None
+
+
 def _fetch_account_info() -> dict | None:
     """Usage + quota for the calling account via the gateway's SigV4-authed
     /v1/account. Works for ANY account using only the S3 creds we already have

{obsideo_cli-0.2.9 → obsideo_cli-0.3.1}/obsideo/sync.py

@@ -55,28 +55,41 @@ def _remote_key(name: str) -> str:
     return f"{REMOTE_PREFIX}{name}"
 
 
+def _remote_names() -> tuple[set, bool]:
+    """Names actually present under the sync prefix on the remote, and whether we
+    could reach it. Used to reconcile against the local manifest — the manifest
+    alone can't be trusted (e.g. after switching accounts it still 'remembers'
+    files uploaded to the OLD account, which aren't on the new one)."""
+    try:
+        remote = storage.list_prefix(REMOTE_PREFIX)
+        return {f["name"] for f in remote["files"]}, True
+    except Exception:
+        return set(), False
+
+
 def sync_status() -> dict:
     sync_dir = ensure_sync_dir()
     entries = manifest.get_all()
     status = {"to_push": [], "to_pull": [], "synced": []}
 
     local_files = {f.name: f for f in sync_dir.iterdir() if f.is_file() and f.name != README_NAME}
+    remote_names, remote_known = _remote_names()
 
     for name, f in local_files.items():
         local_hash = manifest.file_sha256(f)
         entry = entries.get(name)
-        if entry is None or entry.get("local_hash") != local_hash:
+        # A file is only "synced" if the manifest matches AND it's really on the
+        # remote. If we couldn't reach the remote, fall back to the manifest so a
+        # transient outage doesn't flag everything as needing a re-push.
+        on_remote = (name in remote_names) if remote_known else True
+        if entry is None or entry.get("local_hash") != local_hash or not on_remote:
             status["to_push"].append(name)
         else:
             status["synced"].append(name)
 
     # Remote files we know about but don't have locally.
-    try:
-        remote = storage.list_prefix(REMOTE_PREFIX)
-        remote_names = {f["name"] for f in remote["files"]}
-    except Exception:
-        remote_names = set(entries.keys())
-    for name in remote_names:
+    pullable = remote_names if remote_known else set(entries.keys())
+    for name in pullable:
         if name not in local_files:
             status["to_pull"].append(name)
 
@@ -94,12 +107,18 @@ def push(verbose: bool = True) -> int:
 
     do_encrypt = config.load_config().get("encrypt", True)
     entries = manifest.get_all()
+    # Reconcile against the real remote: only skip a file if the manifest matches
+    # AND it's actually up there. This self-heals a stale manifest (e.g. after an
+    # account switch, where the manifest still lists files from the old account)
+    # without the user having to clear anything.
+    remote_names, remote_known = _remote_names()
     pushed = 0
 
     for f in files:
         local_hash = manifest.file_sha256(f)
         entry = entries.get(f.name)
-        if entry and entry.get("local_hash") == local_hash:
+        on_remote = (f.name in remote_names) if remote_known else True
+        if entry and entry.get("local_hash") == local_hash and on_remote:
             if verbose:
                 print(f"  {f.name} - unchanged, skipping")
             continue

{obsideo_cli-0.2.9 → obsideo_cli-0.3.1}/obsideo_cli.egg-info/PKG-INFO

@@ -1,9 +1,12 @@
 Metadata-Version: 2.4
 Name: obsideo-cli
-Version: 0.2.9
-Summary: Obsideo Cloud - encrypted storage we can't read. Save, browse, and sync whatever you want, from your terminal.
+Version: 0.3.1
+Summary: Obsideo Cloud - encrypted storage we can't read, for people and AI agents. 12 GB free, no card. Save, browse, and sync from your terminal; agent integration contract at obsideo.io/agents.md
 License: MIT
 Project-URL: Homepage, https://obsideo.io
+Project-URL: Documentation, https://obsideo.io/docs/
+Project-URL: Agent integration (AGENTS.md), https://obsideo.io/agents.md
+Keywords: encrypted storage,ai agents,agent storage,s3,backup,end-to-end encryption,object storage,free tier,cli,sync
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: boto3>=1.28

{obsideo_cli-0.2.9 → obsideo_cli-0.3.1}/obsideo_core/login.py

@@ -42,17 +42,22 @@ def start(email: str, url: str | None = None) -> None:
     _post_json(f"{url}/v1/auth/start", {"email": email})
 
 
-def verify(email: str, code: str, url: str | None = None) -> dict:
+def verify(email: str, code: str, url: str | None = None,
+           referral_code: str | None = None) -> dict:
     """Verify the code + provision an account. Generates the local signing key,
-    sends only its public half, persists the returned credentials. Returns the
+    sends only its public half, persists the returned credentials. An optional
+    referral_code (a friend's invite) grants the new account +1 GB. Returns the
     credential bundle.
     """
     url = url or config.signup_url()
     signing_pubkey = identity.get_or_create_signing_pubkey()
-    creds = _post_json(f"{url}/v1/auth/verify", {
+    payload = {
         "email": email,
         "code": code,
         "customer_signing_public_key": signing_pubkey,
-    })
+    }
+    if referral_code:
+        payload["referral_code"] = referral_code
+    creds = _post_json(f"{url}/v1/auth/verify", payload)
     config.write_credentials(creds)
     return creds

obsideo_cli-0.3.1/pyproject.toml

@@ -0,0 +1,33 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "obsideo-cli"
+version = "0.3.1"
+description = "Obsideo Cloud - encrypted storage we can't read, for people and AI agents. 12 GB free, no card. Save, browse, and sync from your terminal; agent integration contract at obsideo.io/agents.md"
+readme = "README.md"
+requires-python = ">=3.10"
+license = {text = "MIT"}
+keywords = [
+    "encrypted storage", "ai agents", "agent storage", "s3", "backup",
+    "end-to-end encryption", "object storage", "free tier", "cli", "sync",
+]
+dependencies = [
+    "boto3>=1.28",
+    "cryptography>=41.0",
+    "certifi",
+]
+
+[project.urls]
+Homepage = "https://obsideo.io"
+Documentation = "https://obsideo.io/docs/"
+"Agent integration (AGENTS.md)" = "https://obsideo.io/agents.md"
+
+[project.scripts]
+obsideo = "obsideo.cli:main"
+obsideo-cli = "obsideo.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["obsideo*", "obsideo_core*"]

{obsideo_cli-0.2.9 → obsideo_cli-0.3.1}/tests/test_cli.py

@@ -284,6 +284,45 @@ def test_messages_handles_unreachable(monkeypatch, capsys):
     assert "couldn't reach" in capsys.readouterr().out.lower()
 
 
+def test_sync_push_reuploads_when_remote_missing(tmp_path, monkeypatch, capsys):
+    # Stale manifest (e.g. after an account switch) says a file is synced, but the
+    # remote is actually empty -> push must RE-UPLOAD, not skip. Regression for the
+    # "unchanged, skipping" + empty-remote bug after re-login to a new account.
+    from obsideo import sync, manifest
+    sd = tmp_path / "obsideo-sync"
+    monkeypatch.setattr(sync, "_sync_dir", lambda: sd)
+    sync.ensure_sync_dir()
+    f = sd / "a.txt"; f.write_bytes(b"hello")
+    h = manifest.file_sha256(f)
+    monkeypatch.setattr(manifest, "get_all", lambda: {"a.txt": {"local_hash": h}})
+    monkeypatch.setattr(manifest, "upsert", lambda *a, **k: None)
+    monkeypatch.setattr(cli.storage, "list_prefix", lambda prefix: {"folders": [], "files": []})
+    put = []
+    monkeypatch.setattr(cli.storage, "put", lambda key, body: put.append(key) or key)
+    n = sync.push(verbose=True)
+    assert n == 1 and put and "a.txt" in put[0]
+    assert "uploaded" in capsys.readouterr().out
+
+
+def test_sync_push_skips_when_present_and_unchanged(tmp_path, monkeypatch, capsys):
+    # The optimization still holds: a file that's genuinely unchanged AND present
+    # on the remote is skipped (no needless re-upload).
+    from obsideo import sync, manifest
+    sd = tmp_path / "obsideo-sync"
+    monkeypatch.setattr(sync, "_sync_dir", lambda: sd)
+    sync.ensure_sync_dir()
+    f = sd / "a.txt"; f.write_bytes(b"hello")
+    h = manifest.file_sha256(f)
+    monkeypatch.setattr(manifest, "get_all", lambda: {"a.txt": {"local_hash": h}})
+    monkeypatch.setattr(cli.storage, "list_prefix",
+                        lambda prefix: {"folders": [], "files": [{"name": "a.txt", "key": "sync/a.txt", "size": 5}]})
+    put = []
+    monkeypatch.setattr(cli.storage, "put", lambda key, body: put.append(key) or key)
+    n = sync.push(verbose=True)
+    assert n == 0 and put == []
+    assert "skipping" in capsys.readouterr().out
+
+
 def test_sync_readme_created_and_not_pushed(tmp_path, monkeypatch, capsys):
     from obsideo import sync
     sd = tmp_path / "obsideo-sync"
@@ -330,3 +369,55 @@ def test_precmd_strips_obsideo_prefix():
     assert sh.precmd("obsideo ls") == "ls"
     assert sh.precmd("obsideo login") == "login"
     assert sh.precmd("ls") == "ls"  # unchanged when no prefix
+
+
+# ── referral program ──────────────────────────────────────────────────────────
+
+def test_gb_formats_cleanly():
+    assert cli._gb(2.0) == "2" and cli._gb(2) == "2"
+    assert cli._gb(2.5) == "2.5"
+    assert cli._gb(0) == "0"
+
+
+def test_refer_shows_code_and_stats(monkeypatch, capsys):
+    monkeypatch.setattr(cli.config, "account_token", lambda: "obt_x")
+    monkeypatch.setattr(cli, "_fetch_referral", lambda: {
+        "code": "ABCD234", "invited": 2, "active": 1, "pending": 1,
+        "earned_gb": 2.0, "newly_credited": 1, "owner_bonus_gb_each": 2,
+        "redeemer_bonus_gb": 1, "quota_gb": 5.0,
+    })
+    cli.ObsideoShell().do_refer("")
+    out = capsys.readouterr().out
+    assert "ABCD234" in out
+    assert "Invited: 2" in out and "Active: 1" in out
+    assert "+2 GB earned" not in out  # that phrasing is the account line, not refer
+    assert "just activated" in out  # newly_credited celebration
+    assert "reserves the right" in out  # disclaimer present
+
+
+def test_refer_without_token_guides_to_login(monkeypatch, capsys):
+    monkeypatch.setattr(cli.config, "account_token", lambda: None)
+    cli.ObsideoShell().do_refer("")
+    out = capsys.readouterr().out.lower()
+    assert "login" in out and "email" in out
+
+
+def test_refer_handles_unreachable_service(monkeypatch, capsys):
+    monkeypatch.setattr(cli.config, "account_token", lambda: "obt_x")
+    monkeypatch.setattr(cli, "_fetch_referral", lambda: None)
+    cli.ObsideoShell().do_refer("")
+    assert "couldn't load" in capsys.readouterr().out.lower()
+
+
+def test_account_shows_referral_line(monkeypatch, tmp_path, capsys):
+    from obsideo import sync
+    monkeypatch.setattr(cli, "_fetch_account_info",
+                        lambda: {"tier": "promo", "used_bytes": 1, "quota_bytes": 5_368_709_120})
+    monkeypatch.setattr(cli.config, "account_token", lambda: "obt_x")
+    monkeypatch.setattr(cli, "_fetch_referral",
+                        lambda: {"code": "ABCD234", "active": 2, "earned_gb": 4.0})
+    monkeypatch.setattr(cli.storage, "bucket", lambda: "obsideo")
+    monkeypatch.setattr(sync, "_sync_dir", lambda: tmp_path / "s")
+    cli.ObsideoShell().do_account("")
+    out = capsys.readouterr().out
+    assert "Referrals: code ABCD234" in out and "4 GB earned" in out

{obsideo_cli-0.2.9 → obsideo_cli-0.3.1}/tests/test_core.py

@@ -1,124 +1,154 @@
-"""Core tests: crypto round-trip + S3 list parsing (mocked client)."""
-
-import os
-import tempfile
-from pathlib import Path
-from unittest import mock
-
-import pytest
-
-# Isolate config dir so tests never touch ~/.obsideo.
-os.environ["OBSIDEO_DATA_KEY"] = os.urandom(32).hex()
-
-from obsideo_core import crypto, storage
-
-
-def test_crypto_round_trip():
-    data = os.urandom(4096)
-    blob = crypto.encrypt(data)
-    assert blob[:12] != data[:12]  # nonce prepended, not plaintext
-    assert crypto.decrypt(blob) == data
-
-
-def test_crypto_wrong_key_fails():
-    blob = crypto.encrypt(b"secret")
-    other = os.urandom(32).hex()
-    with mock.patch.dict(os.environ, {"OBSIDEO_DATA_KEY": other}):
-        with pytest.raises(Exception):
-            crypto.decrypt(blob)
-
-
-@pytest.fixture()
-def s3_creds(monkeypatch):
-    monkeypatch.setenv("OBSIDEO_S3_ACCESS_KEY", "AKIATEST")
-    monkeypatch.setenv("OBSIDEO_S3_SECRET_KEY", "secret")
-    monkeypatch.setenv("OBSIDEO_S3_BUCKET", "obsideo")
-    storage.reset_client()
-    yield
-    storage.reset_client()
-
-
-def test_list_prefix_parses_folders_and_files(s3_creds, monkeypatch):
-    monkeypatch.setattr(storage, "_names_on", lambda: False)  # plain keys for this test
-    fake = mock.MagicMock()
-    fake.list_objects_v2.return_value = {
-        "CommonPrefixes": [{"Prefix": "docs/"}, {"Prefix": "photos/"}],
-        "Contents": [
-            {"Key": "readme.txt", "Size": 12},
-            {"Key": "note.md", "Size": 40},
-            {"Key": "", "Size": 0},  # folder marker for root - skipped
-        ],
-        "IsTruncated": False,
-    }
-    monkeypatch.setattr(storage, "_s3", lambda: fake)
-
-    out = storage.list_prefix("")
-    assert out["folders"] == ["docs", "photos"]
-    names = [f["name"] for f in out["files"]]
-    assert names == ["note.md", "readme.txt"]  # sorted
-
-
-def test_get_uses_full_object_get(s3_creds, monkeypatch):
-    monkeypatch.setattr(storage, "_names_on", lambda: False)  # check exact plain key
-    fake = mock.MagicMock()
-    body = mock.MagicMock(); body.read.return_value = b"ciphertext"
-    fake.get_object.return_value = {"Body": body}
-    monkeypatch.setattr(storage, "_s3", lambda: fake)
-
-    assert storage.get("k") == b"ciphertext"
-    fake.get_object.assert_called_once_with(Bucket="obsideo", Key="k")
-    assert not fake.download_file.called  # never ranged
-
-
-# ── filename encryption (Level 1 metadata privacy) ──────────────────────────
-
-def test_name_encryption_round_trip():
-    from obsideo_core import names
-    tok = names.encrypt_name("my secret folder")
-    assert tok != "my secret folder"
-    assert "/" not in tok  # safe as a single path component
-    assert names.decrypt_name(tok) == "my secret folder"
-
-
-def test_name_encryption_is_deterministic():
-    from obsideo_core import names
-    # Deterministic so server-side prefix listing works.
-    assert names.encrypt_name("photos") == names.encrypt_name("photos")
-
-
-def test_encrypt_path_per_component():
-    from obsideo_core import names
-    enc = names.encrypt_path("a/b/c.txt")
-    assert enc.count("/") == 2  # structure preserved (3 components)
-    assert "a" not in enc and "c.txt" not in enc  # names hidden
-
-
-def test_storage_stores_under_encrypted_key(s3_creds, monkeypatch):
-    fake = mock.MagicMock()
-    monkeypatch.setattr(storage, "_s3", lambda: fake)
-    monkeypatch.setattr(storage, "ensure_bucket", lambda: None)
-    storage.put("docs/secret.txt", b"x")  # names ON by default
-    _, args, kwargs = fake.mock_calls[0]
-    stored_key = args[2]
-    assert "secret.txt" not in stored_key and "docs" not in stored_key
-
-
-def test_list_prefix_decrypts_names_roundtrip(s3_creds, monkeypatch):
-    """Store under encrypted keys, then list and confirm real names come back."""
-    from obsideo_core import names
-    enc_prefix = names.encrypt_path("vault") + "/"
-    enc_file = enc_prefix + names.encrypt_name("passwords.txt")
-    enc_sub = enc_prefix + names.encrypt_name("sub") + "/"
-
-    fake = mock.MagicMock()
-    fake.list_objects_v2.return_value = {
-        "CommonPrefixes": [{"Prefix": enc_sub}],
-        "Contents": [{"Key": enc_file, "Size": 99}],
-        "IsTruncated": False,
-    }
-    monkeypatch.setattr(storage, "_s3", lambda: fake)
-
-    out = storage.list_prefix("vault")
-    assert out["folders"] == ["sub"]
-    assert out["files"][0]["name"] == "passwords.txt"
-    assert out["files"][0]["key"] == "vault/passwords.txt"  # real path for re-fetch
+"""Core tests: crypto round-trip + S3 list parsing (mocked client)."""
+
+import os
+import tempfile
+from pathlib import Path
+from unittest import mock
+
+import pytest
+
+# Isolate config dir so tests never touch ~/.obsideo.
+os.environ["OBSIDEO_DATA_KEY"] = os.urandom(32).hex()
+
+from obsideo_core import crypto, storage
+
+
+def test_crypto_round_trip():
+    data = os.urandom(4096)
+    blob = crypto.encrypt(data)
+    assert blob[:12] != data[:12]  # nonce prepended, not plaintext
+    assert crypto.decrypt(blob) == data
+
+
+def test_crypto_wrong_key_fails():
+    blob = crypto.encrypt(b"secret")
+    other = os.urandom(32).hex()
+    with mock.patch.dict(os.environ, {"OBSIDEO_DATA_KEY": other}):
+        with pytest.raises(Exception):
+            crypto.decrypt(blob)
+
+
+@pytest.fixture()
+def s3_creds(monkeypatch):
+    monkeypatch.setenv("OBSIDEO_S3_ACCESS_KEY", "AKIATEST")
+    monkeypatch.setenv("OBSIDEO_S3_SECRET_KEY", "secret")
+    monkeypatch.setenv("OBSIDEO_S3_BUCKET", "obsideo")
+    storage.reset_client()
+    yield
+    storage.reset_client()
+
+
+def test_list_prefix_parses_folders_and_files(s3_creds, monkeypatch):
+    monkeypatch.setattr(storage, "_names_on", lambda: False)  # plain keys for this test
+    fake = mock.MagicMock()
+    fake.list_objects_v2.return_value = {
+        "CommonPrefixes": [{"Prefix": "docs/"}, {"Prefix": "photos/"}],
+        "Contents": [
+            {"Key": "readme.txt", "Size": 12},
+            {"Key": "note.md", "Size": 40},
+            {"Key": "", "Size": 0},  # folder marker for root - skipped
+        ],
+        "IsTruncated": False,
+    }
+    monkeypatch.setattr(storage, "_s3", lambda: fake)
+
+    out = storage.list_prefix("")
+    assert out["folders"] == ["docs", "photos"]
+    names = [f["name"] for f in out["files"]]
+    assert names == ["note.md", "readme.txt"]  # sorted
+
+
+def test_get_uses_full_object_get(s3_creds, monkeypatch):
+    monkeypatch.setattr(storage, "_names_on", lambda: False)  # check exact plain key
+    fake = mock.MagicMock()
+    body = mock.MagicMock(); body.read.return_value = b"ciphertext"
+    fake.get_object.return_value = {"Body": body}
+    monkeypatch.setattr(storage, "_s3", lambda: fake)
+
+    assert storage.get("k") == b"ciphertext"
+    fake.get_object.assert_called_once_with(Bucket="obsideo", Key="k")
+    assert not fake.download_file.called  # never ranged
+
+
+# ── filename encryption (Level 1 metadata privacy) ──────────────────────────
+
+def test_name_encryption_round_trip():
+    from obsideo_core import names
+    tok = names.encrypt_name("my secret folder")
+    assert tok != "my secret folder"
+    assert "/" not in tok  # safe as a single path component
+    assert names.decrypt_name(tok) == "my secret folder"
+
+
+def test_name_encryption_is_deterministic():
+    from obsideo_core import names
+    # Deterministic so server-side prefix listing works.
+    assert names.encrypt_name("photos") == names.encrypt_name("photos")
+
+
+def test_encrypt_path_per_component():
+    from obsideo_core import names
+    enc = names.encrypt_path("a/b/c.txt")
+    segs = enc.split("/")
+    assert len(segs) == 3  # structure preserved (3 components)
+    # Each component is hidden (token != plaintext) yet round-trips back. Compare
+    # per-segment rather than substring-scanning the whole path: a 1-char name
+    # like "a" appears by chance inside base64 tokens, which made this flaky.
+    for plain, tok in zip(["a", "b", "c.txt"], segs):
+        assert tok != plain
+        assert names.decrypt_name(tok) == plain
+
+
+def test_storage_stores_under_encrypted_key(s3_creds, monkeypatch):
+    fake = mock.MagicMock()
+    monkeypatch.setattr(storage, "_s3", lambda: fake)
+    monkeypatch.setattr(storage, "ensure_bucket", lambda: None)
+    storage.put("docs/secret.txt", b"x")  # names ON by default
+    _, args, kwargs = fake.mock_calls[0]
+    stored_key = args[2]
+    assert "secret.txt" not in stored_key and "docs" not in stored_key
+
+
+def test_list_prefix_decrypts_names_roundtrip(s3_creds, monkeypatch):
+    """Store under encrypted keys, then list and confirm real names come back."""
+    from obsideo_core import names
+    enc_prefix = names.encrypt_path("vault") + "/"
+    enc_file = enc_prefix + names.encrypt_name("passwords.txt")
+    enc_sub = enc_prefix + names.encrypt_name("sub") + "/"
+
+    fake = mock.MagicMock()
+    fake.list_objects_v2.return_value = {
+        "CommonPrefixes": [{"Prefix": enc_sub}],
+        "Contents": [{"Key": enc_file, "Size": 99}],
+        "IsTruncated": False,
+    }
+    monkeypatch.setattr(storage, "_s3", lambda: fake)
+
+    out = storage.list_prefix("vault")
+    assert out["folders"] == ["sub"]
+    assert out["files"][0]["name"] == "passwords.txt"
+    assert out["files"][0]["key"] == "vault/passwords.txt"  # real path for re-fetch
+
+
+# ── login: referral code threading ────────────────────────────────────────────
+
+def test_verify_includes_referral_code_when_given(monkeypatch):
+    from obsideo_core import login, identity, config
+    sent = {}
+    monkeypatch.setattr(login, "_post_json", lambda url, payload: sent.update(payload) or {"access_key": "AKIA", "secret_key": "s"})
+    monkeypatch.setattr(identity, "get_or_create_signing_pubkey", lambda: "obk_sig_" + "A" * 43)
+    monkeypatch.setattr(config, "write_credentials", lambda creds: None)
+
+    login.verify("a@b.com", "123456", url="http://x", referral_code="ABCD234")
+    assert sent["referral_code"] == "ABCD234"
+
+
+def test_verify_omits_referral_code_when_blank(monkeypatch):
+    from obsideo_core import login, identity, config
+    sent = {}
+    monkeypatch.setattr(login, "_post_json", lambda url, payload: sent.update(payload) or {"access_key": "AKIA", "secret_key": "s"})
+    monkeypatch.setattr(identity, "get_or_create_signing_pubkey", lambda: "obk_sig_" + "A" * 43)
+    monkeypatch.setattr(config, "write_credentials", lambda creds: None)
+
+    login.verify("a@b.com", "123456", url="http://x")
+    assert "referral_code" not in sent  # never send an empty/None code

obsideo_cli-0.2.9/pyproject.toml

@@ -1,27 +0,0 @@
-[build-system]
-requires = ["setuptools>=61"]
-build-backend = "setuptools.build_meta"
-
-[project]
-name = "obsideo-cli"
-version = "0.2.9"
-description = "Obsideo Cloud - encrypted storage we can't read. Save, browse, and sync whatever you want, from your terminal."
-readme = "README.md"
-requires-python = ">=3.10"
-license = {text = "MIT"}
-dependencies = [
-    "boto3>=1.28",
-    "cryptography>=41.0",
-    "certifi",
-]
-
-[project.urls]
-Homepage = "https://obsideo.io"
-
-[project.scripts]
-obsideo = "obsideo.cli:main"
-obsideo-cli = "obsideo.cli:main"
-
-[tool.setuptools.packages.find]
-where = ["."]
-include = ["obsideo*", "obsideo_core*"]