obsideo-cli 0.5.0__tar.gz → 0.6.0__tar.gz

{obsideo_cli-0.5.0 → obsideo_cli-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: obsideo-cli
-Version: 0.5.0
+Version: 0.6.0
 Summary: Obsideo Cloud CLI - client-side encrypted storage for people and AI agents: content is encrypted on your machine before upload. 12 GB free, no card. Save, browse, and sync from your terminal; agent integration contract at obsideo.io/agents.md
 License: MIT
 Project-URL: Homepage, https://obsideo.io
@@ -70,9 +70,34 @@ obsideo:/trip/ get cat.jpg ./downloaded.jpg
 | `mkdir <name>` | Create a folder |
 | `info <remote>` | Show object metadata |
 | `account` | Show storage used vs. your free quota |
+| `key status\|export\|import` | Back up or restore your encryption key (see below) |
 | `sync push\|pull\|status` | Sync your local folder with Obsideo |
 | `config [set k v]` | Show or change settings |
 
+## Using it on more than one machine
+
+Your files are encrypted with a key generated on your machine and held only
+there. **A second machine that logs in without that key gets a new one**, and
+your existing files stay unreadable on it (they show as `?` in `ls`). Nobody can
+reissue the key for you, us included.
+
+So before you need it:
+
+```
+obsideo key export          # prints the line to save, or: key export ~/obsideo-key.txt
+```
+
+Then on the other machine, before uploading anything:
+
+```
+obsideo key import OBSIDEO_DATA_KEY=...
+obsideo key status          # same fingerprint on both = both can read the same files
+```
+
+`key status` prints a fingerprint, not the key, so it is safe to compare over
+any channel. Importing over an existing key needs `--force`, because it makes
+whatever the old key protected unreadable.
+
 ## How it works
 
 `obsideo` is a thin front-end over the shared **`obsideo_core`** layer (storage

{obsideo_cli-0.5.0 → obsideo_cli-0.6.0}/README.md

@@ -53,9 +53,34 @@ obsideo:/trip/ get cat.jpg ./downloaded.jpg
 | `mkdir <name>` | Create a folder |
 | `info <remote>` | Show object metadata |
 | `account` | Show storage used vs. your free quota |
+| `key status\|export\|import` | Back up or restore your encryption key (see below) |
 | `sync push\|pull\|status` | Sync your local folder with Obsideo |
 | `config [set k v]` | Show or change settings |
 
+## Using it on more than one machine
+
+Your files are encrypted with a key generated on your machine and held only
+there. **A second machine that logs in without that key gets a new one**, and
+your existing files stay unreadable on it (they show as `?` in `ls`). Nobody can
+reissue the key for you, us included.
+
+So before you need it:
+
+```
+obsideo key export          # prints the line to save, or: key export ~/obsideo-key.txt
+```
+
+Then on the other machine, before uploading anything:
+
+```
+obsideo key import OBSIDEO_DATA_KEY=...
+obsideo key status          # same fingerprint on both = both can read the same files
+```
+
+`key status` prints a fingerprint, not the key, so it is safe to compare over
+any channel. Importing over an existing key needs `--force`, because it makes
+whatever the old key protected unreadable.
+
 ## How it works
 
 `obsideo` is a thin front-end over the shared **`obsideo_core`** layer (storage

{obsideo_cli-0.5.0 → obsideo_cli-0.6.0}/obsideo/cli.py

@@ -462,6 +462,21 @@ def run_login(url: str | None = None, *, email: str | None = None,
         return False
     say(" done.")
     storage.reset_client()
+    # A machine with NO key signing in to an account that already holds objects
+    # is the one moment this goes irreversibly wrong: data_key() below mints a
+    # fresh key, and everything already uploaded becomes unreadable here with no
+    # way back. Say so while the user can still import the real one.
+    if not crypto.has_data_key():
+        existing = _fetch_account_info() or {}
+        held = existing.get("object_count") or 0
+        if held > 0:
+            say("")
+            say(f"  !! This account already holds {held} object(s), encrypted with a key this")
+            say("     machine does not have. A new key is about to be created, and those")
+            say("     files will NOT be readable here (they show as '?' in ls).")
+            say("     If you have the key from your other machine, stop now and run:")
+            say("       obsideo key import <your OBSIDEO_DATA_KEY line>")
+            say("")
     # Make sure the data key exists + nudge the user to back it up.
     crypto.data_key()
     if json_out:
@@ -492,6 +507,8 @@ def run_login(url: str | None = None, *, email: str | None = None,
         print("Note: storage activation is finishing rollout; if an upload fails, retry shortly.")
     print("Your files are encrypted with a local key. Back it up:")
     print(f"  {crypto.DATA_KEY_FILE}")
+    print("  Save a copy now with 'obsideo key export' - without it, nobody can")
+    print("  recover your files, including us.")
     # Create the sync folder now so it's ready (never make the user mkdir it).
     try:
         from obsideo import sync as _sync
@@ -548,7 +565,7 @@ class ObsideoShell(cmd.Cmd):
     # ── help ────────────────────────────────────────────────────────────────
     # Order the table reads in, roughly "get in, move around, move bytes, admin".
     _HELP_ORDER = ["login", "ls", "cd", "pwd", "put", "get", "rm", "mkdir",
-                   "info", "account", "sync", "config", "refer", "messages",
+                   "info", "account", "key", "sync", "config", "refer", "messages",
                    "about", "faq", "help", "exit"]
 
     def do_help(self, arg):
@@ -842,6 +859,59 @@ class ObsideoShell(cmd.Cmd):
         print("  ---------------------------------------------")
         print()
 
+    def do_key(self, arg):
+        """Back up, restore, or identify your encryption key. Usage: key status | key export [file] | key import <value|file> [--force]"""
+        toks = _tokens(arg)
+        sub = toks[0].lower() if toks else "status"
+        rest = toks[1:]
+
+        if sub == "status":
+            if not crypto.has_data_key():
+                print("  No encryption key on this machine yet.")
+                print("  One is created the first time you upload. If you already have an")
+                print("  account with files, run 'key import' FIRST or they stay unreadable here.")
+                return
+            print(f"  Key file:    {crypto.DATA_KEY_FILE}")
+            print(f"  Fingerprint: {crypto.data_key_fingerprint()}")
+            print("  Two machines showing the same fingerprint can read the same files.")
+            print("  Back it up with 'key export'. Lose it and the data is unreadable, by design.")
+
+        elif sub == "export":
+            target = next((t for t in rest if not t.startswith("--")), None)
+            hint = crypto.data_key_backup_hint()
+            if target:
+                path = Path(_unquote(target))
+                config.write_secret_file(path, hint + chr(10))
+                print(f"  Key written to {path}  (fingerprint {crypto.data_key_fingerprint()})")
+                print("  That file is as sensitive as everything it protects. Store it offline.")
+            else:
+                print("  Save this line somewhere safe. It is the only way to read your files")
+                print("  from another machine, and nobody can reissue it for you:")
+                print()
+                print(f"  {hint}")
+                print()
+                print("  On the other machine:  obsideo key import <that line>")
+
+        elif sub == "import":
+            if not rest:
+                print("Usage: key import <value|file> [--force]")
+                return
+            force = "--force" in rest
+            value = next((t for t in rest if not t.startswith("--")), "")
+            src = Path(_unquote(value))
+            try:
+                if src.exists():
+                    value = src.read_text(encoding="utf-8")
+                crypto.import_data_key(value, force=force)
+            except (ValueError, FileExistsError, OSError) as e:
+                print(f"  {e}")
+                return
+            print(f"  Key installed. Fingerprint: {crypto.data_key_fingerprint()}")
+            print("  Run 'ls' - files that showed as '?' should now show their real names.")
+
+        else:
+            print("Usage: key status | key export [file] | key import <value|file> [--force]")
+
     # ── about / faq / messages ────────────────────────────────────────────────
     def do_about(self, arg):
         """What Obsideo is."""

{obsideo_cli-0.5.0 → obsideo_cli-0.6.0}/obsideo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: obsideo-cli
-Version: 0.5.0
+Version: 0.6.0
 Summary: Obsideo Cloud CLI - client-side encrypted storage for people and AI agents: content is encrypted on your machine before upload. 12 GB free, no card. Save, browse, and sync from your terminal; agent integration contract at obsideo.io/agents.md
 License: MIT
 Project-URL: Homepage, https://obsideo.io
@@ -70,9 +70,34 @@ obsideo:/trip/ get cat.jpg ./downloaded.jpg
 | `mkdir <name>` | Create a folder |
 | `info <remote>` | Show object metadata |
 | `account` | Show storage used vs. your free quota |
+| `key status\|export\|import` | Back up or restore your encryption key (see below) |
 | `sync push\|pull\|status` | Sync your local folder with Obsideo |
 | `config [set k v]` | Show or change settings |
 
+## Using it on more than one machine
+
+Your files are encrypted with a key generated on your machine and held only
+there. **A second machine that logs in without that key gets a new one**, and
+your existing files stay unreadable on it (they show as `?` in `ls`). Nobody can
+reissue the key for you, us included.
+
+So before you need it:
+
+```
+obsideo key export          # prints the line to save, or: key export ~/obsideo-key.txt
+```
+
+Then on the other machine, before uploading anything:
+
+```
+obsideo key import OBSIDEO_DATA_KEY=...
+obsideo key status          # same fingerprint on both = both can read the same files
+```
+
+`key status` prints a fingerprint, not the key, so it is safe to compare over
+any channel. Importing over an existing key needs `--force`, because it makes
+whatever the old key protected unreadable.
+
 ## How it works
 
 `obsideo` is a thin front-end over the shared **`obsideo_core`** layer (storage

obsideo_cli-0.6.0/obsideo_core/crypto.py

@@ -0,0 +1,94 @@
+"""Account-level AES-256-GCM encryption for the general CLI.
+
+One data key per account, held locally at ~/.obsideo/data.key. Every file is
+encrypted with that key and a fresh random nonce (prepended). Any file the
+account uploaded can be decrypted with this one key, which is what makes
+browse/download/sync work across machines — copy this key to a new machine and
+everything is readable.
+
+This differs from the mlvault extension's per-run keys (immutable ML bundles); a
+general file store wants one stable key. Lose the key, lose the data — by design.
+Back it up alongside your credentials.
+"""
+
+import os
+
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+from obsideo_core import config
+
+DATA_KEY_FILE = config.CONFIG_DIR / "data.key"
+
+
+def data_key() -> bytes:
+    """Load or generate the 32-byte account data key."""
+    env = os.environ.get("OBSIDEO_DATA_KEY", "").strip()
+    if env:
+        return bytes.fromhex(env)
+    if DATA_KEY_FILE.exists():
+        return bytes.fromhex(DATA_KEY_FILE.read_text().strip())
+    key = os.urandom(32)
+    config.write_secret_file(DATA_KEY_FILE, key.hex())
+    return key
+
+
+def encrypt(data: bytes) -> bytes:
+    """AES-256-GCM. Returns nonce(12) + ciphertext+tag."""
+    key = data_key()
+    nonce = os.urandom(12)
+    return nonce + AESGCM(key).encrypt(nonce, data, None)
+
+
+def decrypt(blob: bytes) -> bytes:
+    """Inverse of encrypt. Raises on auth failure / wrong key."""
+    key = data_key()
+    nonce, ct = blob[:12], blob[12:]
+    return AESGCM(key).decrypt(nonce, ct, None)
+
+
+def has_data_key() -> bool:
+    """True if a key is already materialised for this config dir. Callers use
+    this to detect the dangerous case: a machine with no key signing in to an
+    account that already holds objects, where generating a fresh key silently
+    orphans everything already uploaded."""
+    return bool(os.environ.get("OBSIDEO_DATA_KEY", "").strip()) or DATA_KEY_FILE.exists()
+
+
+def data_key_fingerprint() -> str:
+    """A short, non-secret identifier for the current key: the first 16 hex
+    chars of its SHA-256. Safe to print, log, or read down a phone line. Two
+    machines showing the same fingerprint hold the same key; different
+    fingerprints mean each can only read what it wrote."""
+    import hashlib
+    return hashlib.sha256(data_key()).hexdigest()[:16]
+
+
+def import_data_key(value: str, *, force: bool = False) -> None:
+    """Install a data key from an exported value.
+
+    Accepts the bare 64-char hex key or the full `OBSIDEO_DATA_KEY=<hex>` line
+    that `key export` prints, so pasting either works. Refuses to overwrite an
+    existing key unless force is set: overwriting is exactly as destructive as
+    losing the file, and it is not obvious from the command name.
+    """
+    raw = value.strip()
+    if "=" in raw:
+        raw = raw.split("=", 1)[1].strip()
+    raw = raw.strip("'\"")
+    try:
+        key = bytes.fromhex(raw)
+    except ValueError as e:
+        raise ValueError("Not a valid key: expected 64 hexadecimal characters.") from e
+    if len(key) != 32:
+        raise ValueError(f"Not a valid key: expected 32 bytes (64 hex chars), got {len(key)}.")
+    if DATA_KEY_FILE.exists() and not force:
+        raise FileExistsError(
+            f"A key already exists at {DATA_KEY_FILE}. Importing over it makes anything "
+            "encrypted with the current key unreadable. Back it up with 'obsideo key export' "
+            "first, then re-run with --force."
+        )
+    config.write_secret_file(DATA_KEY_FILE, key.hex())
+
+
+def data_key_backup_hint() -> str:
+    return f"OBSIDEO_DATA_KEY={data_key().hex()}"

{obsideo_cli-0.5.0 → obsideo_cli-0.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "obsideo-cli"
-version = "0.5.0"
+version = "0.6.0"
 description = "Obsideo Cloud CLI - client-side encrypted storage for people and AI agents: content is encrypted on your machine before upload. 12 GB free, no card. Save, browse, and sync from your terminal; agent integration contract at obsideo.io/agents.md"
 readme = "README.md"
 requires-python = ">=3.10"

{obsideo_cli-0.5.0 → obsideo_cli-0.6.0}/tests/test_cli.py

@@ -439,3 +439,87 @@ def test_account_shows_referral_line(monkeypatch, tmp_path, capsys):
     cli.ObsideoShell().do_account("")
     out = capsys.readouterr().out
     assert "Referrals: code ABCD234" in out and "4 GB earned" in out
+
+
+# ── Key portability ──────────────────────────────────────────────────────────
+# data_key() mints os.urandom(32) whenever the file is absent, so signing in on
+# a second machine silently orphans everything already uploaded. These cover the
+# escape hatch and, more importantly, the warning that fires before it happens.
+
+@pytest.fixture
+def key_dir(tmp_path, monkeypatch):
+    """Isolate the config dir so nothing here can touch a real ~/.obsideo."""
+    monkeypatch.delenv("OBSIDEO_DATA_KEY", raising=False)
+    monkeypatch.setattr(crypto.config, "CONFIG_DIR", tmp_path)
+    monkeypatch.setattr(crypto, "DATA_KEY_FILE", tmp_path / "data.key")
+    return tmp_path
+
+
+def test_has_data_key_false_on_a_fresh_machine(key_dir):
+    assert crypto.has_data_key() is False
+
+
+def test_import_accepts_bare_hex_and_the_exported_line(key_dir):
+    raw = os.urandom(32).hex()
+    crypto.import_data_key(raw)
+    first = crypto.data_key_fingerprint()
+    crypto.DATA_KEY_FILE.unlink()
+    crypto.import_data_key(f"OBSIDEO_DATA_KEY={raw}")
+    assert crypto.data_key_fingerprint() == first
+    assert crypto.has_data_key() is True
+
+
+def test_import_rejects_malformed_values(key_dir):
+    for bad in ("not-hex", "abcd", os.urandom(16).hex()):
+        with pytest.raises(ValueError):
+            crypto.import_data_key(bad)
+
+
+def test_import_refuses_to_clobber_without_force(key_dir):
+    crypto.import_data_key(os.urandom(32).hex())
+    before = crypto.data_key_fingerprint()
+    with pytest.raises(FileExistsError):
+        crypto.import_data_key(os.urandom(32).hex())
+    assert crypto.data_key_fingerprint() == before      # untouched
+    crypto.import_data_key(os.urandom(32).hex(), force=True)
+    assert crypto.data_key_fingerprint() != before
+
+
+def test_fingerprint_never_reveals_the_key(key_dir):
+    raw = os.urandom(32).hex()
+    crypto.import_data_key(raw)
+    fp = crypto.data_key_fingerprint()
+    assert len(fp) == 16 and fp not in raw and raw not in fp
+
+
+def test_login_warns_before_minting_a_key_over_an_account_that_has_objects(monkeypatch, capsys, tmp_path):
+    """The whole point: a machine with no key signing in to an account that
+    already holds files must be told BEFORE the fresh key is created."""
+    monkeypatch.delenv("OBSIDEO_DATA_KEY", raising=False)
+    monkeypatch.setattr(crypto, "DATA_KEY_FILE", tmp_path / "data.key")
+    monkeypatch.setattr(cli.crypto, "has_data_key", lambda: False)
+    monkeypatch.setattr(cli.crypto, "data_key", lambda: b"\x00" * 32)
+    monkeypatch.setattr(cli, "_fetch_account_info", lambda: {"object_count": 7})
+    monkeypatch.setattr(cli, "_fetch_referral", lambda: None)
+    monkeypatch.setattr(cli.storage, "reset_client", lambda: None)
+    monkeypatch.setattr(cli.login, "verify", lambda *a, **k: {"quota_gb": 12})
+
+    cli.run_login(email="x@example.com", code="123456")
+    out = capsys.readouterr().out
+    assert "already holds 7 object(s)" in out
+    assert "key import" in out
+
+
+def test_login_stays_quiet_for_a_genuinely_new_account(monkeypatch, capsys, tmp_path):
+    monkeypatch.delenv("OBSIDEO_DATA_KEY", raising=False)
+    monkeypatch.setattr(crypto, "DATA_KEY_FILE", tmp_path / "data.key")
+    monkeypatch.setattr(cli.crypto, "has_data_key", lambda: False)
+    monkeypatch.setattr(cli.crypto, "data_key", lambda: b"\x00" * 32)
+    monkeypatch.setattr(cli, "_fetch_account_info", lambda: {"object_count": 0})
+    monkeypatch.setattr(cli, "_fetch_referral", lambda: None)
+    monkeypatch.setattr(cli.storage, "reset_client", lambda: None)
+    monkeypatch.setattr(cli.login, "verify", lambda *a, **k: {"quota_gb": 12})
+
+    cli.run_login(email="x@example.com", code="123456")
+    out = capsys.readouterr().out
+    assert "already holds" not in out

obsideo_cli-0.5.0/obsideo_core/crypto.py

@@ -1,50 +0,0 @@
-"""Account-level AES-256-GCM encryption for the general CLI.
-
-One data key per account, held locally at ~/.obsideo/data.key. Every file is
-encrypted with that key and a fresh random nonce (prepended). Any file the
-account uploaded can be decrypted with this one key, which is what makes
-browse/download/sync work across machines — copy this key to a new machine and
-everything is readable.
-
-This differs from the mlvault extension's per-run keys (immutable ML bundles); a
-general file store wants one stable key. Lose the key, lose the data — by design.
-Back it up alongside your credentials.
-"""
-
-import os
-
-from cryptography.hazmat.primitives.ciphers.aead import AESGCM
-
-from obsideo_core import config
-
-DATA_KEY_FILE = config.CONFIG_DIR / "data.key"
-
-
-def data_key() -> bytes:
-    """Load or generate the 32-byte account data key."""
-    env = os.environ.get("OBSIDEO_DATA_KEY", "").strip()
-    if env:
-        return bytes.fromhex(env)
-    if DATA_KEY_FILE.exists():
-        return bytes.fromhex(DATA_KEY_FILE.read_text().strip())
-    key = os.urandom(32)
-    config.write_secret_file(DATA_KEY_FILE, key.hex())
-    return key
-
-
-def encrypt(data: bytes) -> bytes:
-    """AES-256-GCM. Returns nonce(12) + ciphertext+tag."""
-    key = data_key()
-    nonce = os.urandom(12)
-    return nonce + AESGCM(key).encrypt(nonce, data, None)
-
-
-def decrypt(blob: bytes) -> bytes:
-    """Inverse of encrypt. Raises on auth failure / wrong key."""
-    key = data_key()
-    nonce, ct = blob[:12], blob[12:]
-    return AESGCM(key).decrypt(nonce, ct, None)
-
-
-def data_key_backup_hint() -> str:
-    return f"OBSIDEO_DATA_KEY={data_key().hex()}"