obsideo-cli 0.5.0__tar.gz → 0.6.1__tar.gz

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: obsideo-cli
-Version: 0.5.0
+Version: 0.6.1
 Summary: Obsideo Cloud CLI - client-side encrypted storage for people and AI agents: content is encrypted on your machine before upload. 12 GB free, no card. Save, browse, and sync from your terminal; agent integration contract at obsideo.io/agents.md
 License: MIT
 Project-URL: Homepage, https://obsideo.io
@@ -70,9 +70,34 @@ obsideo:/trip/ get cat.jpg ./downloaded.jpg
 | `mkdir <name>` | Create a folder |
 | `info <remote>` | Show object metadata |
 | `account` | Show storage used vs. your free quota |
+| `key status\|export\|import` | Back up or restore your encryption key (see below) |
 | `sync push\|pull\|status` | Sync your local folder with Obsideo |
 | `config [set k v]` | Show or change settings |
 
+## Using it on more than one machine
+
+Your files are encrypted with a key generated on your machine and held only
+there. **A second machine that logs in without that key gets a new one**, and
+your existing files stay unreadable on it (they show as `?` in `ls`). Nobody can
+reissue the key for you, us included.
+
+So before you need it:
+
+```
+obsideo key export          # prints the line to save, or: key export ~/obsideo-key.txt
+```
+
+Then on the other machine, before uploading anything:
+
+```
+obsideo key import OBSIDEO_DATA_KEY=...
+obsideo key status          # same fingerprint on both = both can read the same files
+```
+
+`key status` prints a fingerprint, not the key, so it is safe to compare over
+any channel. Importing over an existing key needs `--force`, because it makes
+whatever the old key protected unreadable.
+
 ## How it works
 
 `obsideo` is a thin front-end over the shared **`obsideo_core`** layer (storage

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/README.md

@@ -53,9 +53,34 @@ obsideo:/trip/ get cat.jpg ./downloaded.jpg
 | `mkdir <name>` | Create a folder |
 | `info <remote>` | Show object metadata |
 | `account` | Show storage used vs. your free quota |
+| `key status\|export\|import` | Back up or restore your encryption key (see below) |
 | `sync push\|pull\|status` | Sync your local folder with Obsideo |
 | `config [set k v]` | Show or change settings |
 
+## Using it on more than one machine
+
+Your files are encrypted with a key generated on your machine and held only
+there. **A second machine that logs in without that key gets a new one**, and
+your existing files stay unreadable on it (they show as `?` in `ls`). Nobody can
+reissue the key for you, us included.
+
+So before you need it:
+
+```
+obsideo key export          # prints the line to save, or: key export ~/obsideo-key.txt
+```
+
+Then on the other machine, before uploading anything:
+
+```
+obsideo key import OBSIDEO_DATA_KEY=...
+obsideo key status          # same fingerprint on both = both can read the same files
+```
+
+`key status` prints a fingerprint, not the key, so it is safe to compare over
+any channel. Importing over an existing key needs `--force`, because it makes
+whatever the old key protected unreadable.
+
 ## How it works
 
 `obsideo` is a thin front-end over the shared **`obsideo_core`** layer (storage

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/obsideo/__init__.py

@@ -1 +1 @@
-"""The general Obsideo CLI front-end (REPL + browse + sync) on obsideo_core."""
+"""The general Obsideo CLI front-end (REPL + browse + sync) on obsideo_core."""

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/obsideo/__main__.py

@@ -1,4 +1,4 @@
-from obsideo.cli import main
-
-if __name__ == "__main__":
-    main()
+from obsideo.cli import main
+
+if __name__ == "__main__":
+    main()

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/obsideo/cli.py

@@ -462,6 +462,21 @@ def run_login(url: str | None = None, *, email: str | None = None,
         return False
     say(" done.")
     storage.reset_client()
+    # A machine with NO key signing in to an account that already holds objects
+    # is the one moment this goes irreversibly wrong: data_key() below mints a
+    # fresh key, and everything already uploaded becomes unreadable here with no
+    # way back. Say so while the user can still import the real one.
+    if not crypto.has_data_key():
+        existing = _fetch_account_info() or {}
+        held = existing.get("object_count") or 0
+        if held > 0:
+            say("")
+            say(f"  !! This account already holds {held} object(s), encrypted with a key this")
+            say("     machine does not have. A new key is about to be created, and those")
+            say("     files will NOT be readable here (they show as '?' in ls).")
+            say("     If you have the key from your other machine, stop now and run:")
+            say("       obsideo key import <your OBSIDEO_DATA_KEY line>")
+            say("")
     # Make sure the data key exists + nudge the user to back it up.
     crypto.data_key()
     if json_out:
@@ -492,6 +507,8 @@ def run_login(url: str | None = None, *, email: str | None = None,
         print("Note: storage activation is finishing rollout; if an upload fails, retry shortly.")
     print("Your files are encrypted with a local key. Back it up:")
     print(f"  {crypto.DATA_KEY_FILE}")
+    print("  Save a copy now with 'obsideo key export' - without it, nobody can")
+    print("  recover your files, including us.")
     # Create the sync folder now so it's ready (never make the user mkdir it).
     try:
         from obsideo import sync as _sync
@@ -548,7 +565,7 @@ class ObsideoShell(cmd.Cmd):
     # ── help ────────────────────────────────────────────────────────────────
     # Order the table reads in, roughly "get in, move around, move bytes, admin".
     _HELP_ORDER = ["login", "ls", "cd", "pwd", "put", "get", "rm", "mkdir",
-                   "info", "account", "sync", "config", "refer", "messages",
+                   "info", "account", "key", "sync", "config", "refer", "messages",
                    "about", "faq", "help", "exit"]
 
     def do_help(self, arg):
@@ -842,6 +859,59 @@ class ObsideoShell(cmd.Cmd):
         print("  ---------------------------------------------")
         print()
 
+    def do_key(self, arg):
+        """Back up, restore, or identify your encryption key. Usage: key status | key export [file] | key import <value|file> [--force]"""
+        toks = _tokens(arg)
+        sub = toks[0].lower() if toks else "status"
+        rest = toks[1:]
+
+        if sub == "status":
+            if not crypto.has_data_key():
+                print("  No encryption key on this machine yet.")
+                print("  One is created the first time you upload. If you already have an")
+                print("  account with files, run 'key import' FIRST or they stay unreadable here.")
+                return
+            print(f"  Key file:    {crypto.DATA_KEY_FILE}")
+            print(f"  Fingerprint: {crypto.data_key_fingerprint()}")
+            print("  Two machines showing the same fingerprint can read the same files.")
+            print("  Back it up with 'key export'. Lose it and the data is unreadable, by design.")
+
+        elif sub == "export":
+            target = next((t for t in rest if not t.startswith("--")), None)
+            hint = crypto.data_key_backup_hint()
+            if target:
+                path = Path(_unquote(target))
+                config.write_secret_file(path, hint + chr(10))
+                print(f"  Key written to {path}  (fingerprint {crypto.data_key_fingerprint()})")
+                print("  That file is as sensitive as everything it protects. Store it offline.")
+            else:
+                print("  Save this line somewhere safe. It is the only way to read your files")
+                print("  from another machine, and nobody can reissue it for you:")
+                print()
+                print(f"  {hint}")
+                print()
+                print("  On the other machine:  obsideo key import <that line>")
+
+        elif sub == "import":
+            if not rest:
+                print("Usage: key import <value|file> [--force]")
+                return
+            force = "--force" in rest
+            value = next((t for t in rest if not t.startswith("--")), "")
+            src = Path(_unquote(value))
+            try:
+                if src.exists():
+                    value = src.read_text(encoding="utf-8")
+                crypto.import_data_key(value, force=force)
+            except (ValueError, FileExistsError, OSError) as e:
+                print(f"  {e}")
+                return
+            print(f"  Key installed. Fingerprint: {crypto.data_key_fingerprint()}")
+            print("  Run 'ls' - files that showed as '?' should now show their real names.")
+
+        else:
+            print("Usage: key status | key export [file] | key import <value|file> [--force]")
+
     # ── about / faq / messages ────────────────────────────────────────────────
     def do_about(self, arg):
         """What Obsideo is."""

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/obsideo/manifest.py

@@ -1,59 +1,59 @@
-"""Local manifest for tracking synced files (lifted from Cloud_Terminal,
-re-homed under ~/.obsideo)."""
-
-import hashlib
-import json
-from datetime import datetime, timezone
-
-from obsideo_core import config
-
-_MANIFEST_FILE = config.CONFIG_DIR / "manifest.json"
-
-
-def _load() -> dict:
-    if not _MANIFEST_FILE.exists():
-        return {"files": {}}
-    try:
-        data = json.loads(_MANIFEST_FILE.read_text())
-        if not isinstance(data, dict):
-            return {"files": {}}
-        data.setdefault("files", {})
-        return data
-    except Exception:
-        return {"files": {}}
-
-
-def _save(m: dict) -> None:
-    _MANIFEST_FILE.parent.mkdir(parents=True, exist_ok=True)
-    _MANIFEST_FILE.write_text(json.dumps(m, indent=2, sort_keys=True))
-
-
-def upsert(name: str, remote_key: str, local_hash: str | None = None,
-           size: int | None = None, encrypted: bool = True) -> None:
-    m = _load()
-    m["files"][name] = {
-        "remote_key": remote_key,
-        "local_hash": local_hash,
-        "size": size,
-        "encrypted": encrypted,
-        "last_synced": datetime.now(timezone.utc).isoformat(),
-    }
-    _save(m)
-
-
-def remove(name: str) -> None:
-    m = _load()
-    m["files"].pop(name, None)
-    _save(m)
-
-
-def get_all() -> dict:
-    return _load()["files"]
-
-
-def file_sha256(filepath) -> str:
-    h = hashlib.sha256()
-    with open(filepath, "rb") as f:
-        for chunk in iter(lambda: f.read(8192), b""):
-            h.update(chunk)
-    return f"sha256:{h.hexdigest()}"
+"""Local manifest for tracking synced files (lifted from Cloud_Terminal,
+re-homed under ~/.obsideo)."""
+
+import hashlib
+import json
+from datetime import datetime, timezone
+
+from obsideo_core import config
+
+_MANIFEST_FILE = config.CONFIG_DIR / "manifest.json"
+
+
+def _load() -> dict:
+    if not _MANIFEST_FILE.exists():
+        return {"files": {}}
+    try:
+        data = json.loads(_MANIFEST_FILE.read_text())
+        if not isinstance(data, dict):
+            return {"files": {}}
+        data.setdefault("files", {})
+        return data
+    except Exception:
+        return {"files": {}}
+
+
+def _save(m: dict) -> None:
+    _MANIFEST_FILE.parent.mkdir(parents=True, exist_ok=True)
+    _MANIFEST_FILE.write_text(json.dumps(m, indent=2, sort_keys=True))
+
+
+def upsert(name: str, remote_key: str, local_hash: str | None = None,
+           size: int | None = None, encrypted: bool = True) -> None:
+    m = _load()
+    m["files"][name] = {
+        "remote_key": remote_key,
+        "local_hash": local_hash,
+        "size": size,
+        "encrypted": encrypted,
+        "last_synced": datetime.now(timezone.utc).isoformat(),
+    }
+    _save(m)
+
+
+def remove(name: str) -> None:
+    m = _load()
+    m["files"].pop(name, None)
+    _save(m)
+
+
+def get_all() -> dict:
+    return _load()["files"]
+
+
+def file_sha256(filepath) -> str:
+    h = hashlib.sha256()
+    with open(filepath, "rb") as f:
+        for chunk in iter(lambda: f.read(8192), b""):
+            h.update(chunk)
+    return f"sha256:{h.hexdigest()}"

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/obsideo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: obsideo-cli
-Version: 0.5.0
+Version: 0.6.1
 Summary: Obsideo Cloud CLI - client-side encrypted storage for people and AI agents: content is encrypted on your machine before upload. 12 GB free, no card. Save, browse, and sync from your terminal; agent integration contract at obsideo.io/agents.md
 License: MIT
 Project-URL: Homepage, https://obsideo.io
@@ -70,9 +70,34 @@ obsideo:/trip/ get cat.jpg ./downloaded.jpg
 | `mkdir <name>` | Create a folder |
 | `info <remote>` | Show object metadata |
 | `account` | Show storage used vs. your free quota |
+| `key status\|export\|import` | Back up or restore your encryption key (see below) |
 | `sync push\|pull\|status` | Sync your local folder with Obsideo |
 | `config [set k v]` | Show or change settings |
 
+## Using it on more than one machine
+
+Your files are encrypted with a key generated on your machine and held only
+there. **A second machine that logs in without that key gets a new one**, and
+your existing files stay unreadable on it (they show as `?` in `ls`). Nobody can
+reissue the key for you, us included.
+
+So before you need it:
+
+```
+obsideo key export          # prints the line to save, or: key export ~/obsideo-key.txt
+```
+
+Then on the other machine, before uploading anything:
+
+```
+obsideo key import OBSIDEO_DATA_KEY=...
+obsideo key status          # same fingerprint on both = both can read the same files
+```
+
+`key status` prints a fingerprint, not the key, so it is safe to compare over
+any channel. Importing over an existing key needs `--force`, because it makes
+whatever the old key protected unreadable.
+
 ## How it works
 
 `obsideo` is a thin front-end over the shared **`obsideo_core`** layer (storage

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/obsideo_cli.egg-info/SOURCES.txt

@@ -20,4 +20,5 @@ obsideo_core/login.py
 obsideo_core/names.py
 obsideo_core/storage.py
 tests/test_cli.py
-tests/test_core.py
+tests/test_core.py
+tests/test_send_buffer.py

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/obsideo_core/__init__.py

@@ -1,4 +1,4 @@
-"""Obsideo core — the shared client layer for the Obsideo CLI and the mlvault
-extension: storage seam, signing identity, account-level crypto, email-OTP login,
-and config. Client encrypts; Obsideo sees ciphertext only (Principle 1).
-"""
+"""Obsideo core — the shared client layer for the Obsideo CLI and the mlvault
+extension: storage seam, signing identity, account-level crypto, email-OTP login,
+and config. Client encrypts; Obsideo sees ciphertext only (Principle 1).
+"""

obsideo_cli-0.6.1/obsideo_core/crypto.py

@@ -0,0 +1,94 @@
+"""Account-level AES-256-GCM encryption for the general CLI.
+
+One data key per account, held locally at ~/.obsideo/data.key. Every file is
+encrypted with that key and a fresh random nonce (prepended). Any file the
+account uploaded can be decrypted with this one key, which is what makes
+browse/download/sync work across machines — copy this key to a new machine and
+everything is readable.
+
+This differs from the mlvault extension's per-run keys (immutable ML bundles); a
+general file store wants one stable key. Lose the key, lose the data — by design.
+Back it up alongside your credentials.
+"""
+
+import os
+
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+from obsideo_core import config
+
+DATA_KEY_FILE = config.CONFIG_DIR / "data.key"
+
+
+def data_key() -> bytes:
+    """Load or generate the 32-byte account data key."""
+    env = os.environ.get("OBSIDEO_DATA_KEY", "").strip()
+    if env:
+        return bytes.fromhex(env)
+    if DATA_KEY_FILE.exists():
+        return bytes.fromhex(DATA_KEY_FILE.read_text().strip())
+    key = os.urandom(32)
+    config.write_secret_file(DATA_KEY_FILE, key.hex())
+    return key
+
+
+def encrypt(data: bytes) -> bytes:
+    """AES-256-GCM. Returns nonce(12) + ciphertext+tag."""
+    key = data_key()
+    nonce = os.urandom(12)
+    return nonce + AESGCM(key).encrypt(nonce, data, None)
+
+
+def decrypt(blob: bytes) -> bytes:
+    """Inverse of encrypt. Raises on auth failure / wrong key."""
+    key = data_key()
+    nonce, ct = blob[:12], blob[12:]
+    return AESGCM(key).decrypt(nonce, ct, None)
+
+
+def has_data_key() -> bool:
+    """True if a key is already materialised for this config dir. Callers use
+    this to detect the dangerous case: a machine with no key signing in to an
+    account that already holds objects, where generating a fresh key silently
+    orphans everything already uploaded."""
+    return bool(os.environ.get("OBSIDEO_DATA_KEY", "").strip()) or DATA_KEY_FILE.exists()
+
+
+def data_key_fingerprint() -> str:
+    """A short, non-secret identifier for the current key: the first 16 hex
+    chars of its SHA-256. Safe to print, log, or read down a phone line. Two
+    machines showing the same fingerprint hold the same key; different
+    fingerprints mean each can only read what it wrote."""
+    import hashlib
+    return hashlib.sha256(data_key()).hexdigest()[:16]
+
+
+def import_data_key(value: str, *, force: bool = False) -> None:
+    """Install a data key from an exported value.
+
+    Accepts the bare 64-char hex key or the full `OBSIDEO_DATA_KEY=<hex>` line
+    that `key export` prints, so pasting either works. Refuses to overwrite an
+    existing key unless force is set: overwriting is exactly as destructive as
+    losing the file, and it is not obvious from the command name.
+    """
+    raw = value.strip()
+    if "=" in raw:
+        raw = raw.split("=", 1)[1].strip()
+    raw = raw.strip("'\"")
+    try:
+        key = bytes.fromhex(raw)
+    except ValueError as e:
+        raise ValueError("Not a valid key: expected 64 hexadecimal characters.") from e
+    if len(key) != 32:
+        raise ValueError(f"Not a valid key: expected 32 bytes (64 hex chars), got {len(key)}.")
+    if DATA_KEY_FILE.exists() and not force:
+        raise FileExistsError(
+            f"A key already exists at {DATA_KEY_FILE}. Importing over it makes anything "
+            "encrypted with the current key unreadable. Back it up with 'obsideo key export' "
+            "first, then re-run with --force."
+        )
+    config.write_secret_file(DATA_KEY_FILE, key.hex())
+
+
+def data_key_backup_hint() -> str:
+    return f"OBSIDEO_DATA_KEY={data_key().hex()}"

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/obsideo_core/identity.py

@@ -1,36 +1,36 @@
-"""Client-held signing identity (Ed25519).
-
-Obsideo external accounts require a customer Ed25519 signing public key — it
-authorizes destructive operations on your data (Principle 2: the network can't
-delete your data without your signature). The PRIVATE half is generated here and
-never leaves your machine; only the public key (obk_sig_…) is sent at signup.
-"""
-
-import base64
-
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-from cryptography.hazmat.primitives.serialization import (
-    Encoding, NoEncryption, PrivateFormat, PublicFormat,
-)
-
-from obsideo_core import config
-
-SIGNING_KEY_FILE = config.CONFIG_DIR / "signing.key"
-
-
-def _encode_pub(raw: bytes) -> str:
-    return "obk_sig_" + base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
-
-
-def get_or_create_signing_pubkey() -> str:
-    """Return the Ed25519 signing public key as 'obk_sig_<43 chars>',
-    generating + persisting the private key locally (0600) on first use."""
-    if SIGNING_KEY_FILE.exists():
-        raw = bytes.fromhex(SIGNING_KEY_FILE.read_text().strip())
-        priv = Ed25519PrivateKey.from_private_bytes(raw)
-    else:
-        priv = Ed25519PrivateKey.generate()
-        raw = priv.private_bytes(Encoding.Raw, PrivateFormat.Raw, NoEncryption())
-        config.write_secret_file(SIGNING_KEY_FILE, raw.hex())
-    pub = priv.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
-    return _encode_pub(pub)
+"""Client-held signing identity (Ed25519).
+
+Obsideo external accounts require a customer Ed25519 signing public key — it
+authorizes destructive operations on your data (Principle 2: the network can't
+delete your data without your signature). The PRIVATE half is generated here and
+never leaves your machine; only the public key (obk_sig_…) is sent at signup.
+"""
+
+import base64
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives.serialization import (
+    Encoding, NoEncryption, PrivateFormat, PublicFormat,
+)
+
+from obsideo_core import config
+
+SIGNING_KEY_FILE = config.CONFIG_DIR / "signing.key"
+
+
+def _encode_pub(raw: bytes) -> str:
+    return "obk_sig_" + base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
+
+
+def get_or_create_signing_pubkey() -> str:
+    """Return the Ed25519 signing public key as 'obk_sig_<43 chars>',
+    generating + persisting the private key locally (0600) on first use."""
+    if SIGNING_KEY_FILE.exists():
+        raw = bytes.fromhex(SIGNING_KEY_FILE.read_text().strip())
+        priv = Ed25519PrivateKey.from_private_bytes(raw)
+    else:
+        priv = Ed25519PrivateKey.generate()
+        raw = priv.private_bytes(Encoding.Raw, PrivateFormat.Raw, NoEncryption())
+        config.write_secret_file(SIGNING_KEY_FILE, raw.hex())
+    pub = priv.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
+    return _encode_pub(pub)

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/obsideo_core/names.py

@@ -1,65 +1,65 @@
-"""Deterministic filename encryption (Level 1 metadata privacy).
-
-Object keys (folder paths + filenames) would otherwise reach Obsideo in the clear,
-leaking the *shape* of your data even though contents are encrypted. This encrypts
-each path component client-side with **AES-SIV** (deterministic, misuse-resistant
-authenticated encryption) keyed off your data key, so `photos/tax.pdf` is stored
-as opaque tokens.
-
-Why deterministic: identical input → identical token, which is what lets the
-server still do prefix listing — `ls` lists under the encrypted prefix and the
-client decrypts the returned tokens back to real names. Residual leak (accepted at
-Level 1): the same name encrypts to the same token, so Obsideo can see that two
-objects share a name, never what it is; structure + sizes still show.
-
-SCHEME (so other clients — e.g. the SDK — can interop, same account same names):
-  name_key = HKDF-SHA256(ikm=data_key, salt="", info="obsideo-name-key-v1", len=64)
-  token    = base64url-nopad( AES-SIV-encrypt(name_key, utf8(component), aad=none) )
-  path     = "/".join(token(c) for c in path.split("/") if c)
-"""
-
-import base64
-
-from cryptography.hazmat.primitives import hashes
-from cryptography.hazmat.primitives.ciphers.aead import AESSIV
-from cryptography.hazmat.primitives.kdf.hkdf import HKDF
-
-from obsideo_core import crypto
-
-_INFO = b"obsideo-name-key-v1"
-
-
-def _name_key() -> bytes:
-    # Derived fresh from the data key (cheap); stays correct if the key changes.
-    return HKDF(algorithm=hashes.SHA256(), length=64, salt=None, info=_INFO).derive(crypto.data_key())
-
-
-def _b64e(b: bytes) -> str:
-    return base64.urlsafe_b64encode(b).rstrip(b"=").decode()
-
-
-def _b64d(s: str) -> bytes:
-    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))
-
-
-def encrypt_name(name: str) -> str:
-    return _b64e(AESSIV(_name_key()).encrypt(name.encode(), None))
-
-
-def decrypt_name(token: str) -> str:
-    return AESSIV(_name_key()).decrypt(_b64d(token), None).decode()
-
-
-def encrypt_path(path: str) -> str:
-    """Encrypt each '/'-separated component. Empty -> empty (root)."""
-    return "/".join(encrypt_name(c) for c in path.split("/") if c)
-
-
-def safe_decrypt_name(token: str) -> tuple[str, bool]:
-    """Decrypt a listed token. Returns (name, was_encrypted). Falls back to the
-    raw token for legacy clear-name objects (so listings never crash on a mixed
-    account)."""
-    try:
-        return decrypt_name(token), True
-    except Exception:
-        return token, False
+"""Deterministic filename encryption (Level 1 metadata privacy).
+
+Object keys (folder paths + filenames) would otherwise reach Obsideo in the clear,
+leaking the *shape* of your data even though contents are encrypted. This encrypts
+each path component client-side with **AES-SIV** (deterministic, misuse-resistant
+authenticated encryption) keyed off your data key, so `photos/tax.pdf` is stored
+as opaque tokens.
+
+Why deterministic: identical input → identical token, which is what lets the
+server still do prefix listing — `ls` lists under the encrypted prefix and the
+client decrypts the returned tokens back to real names. Residual leak (accepted at
+Level 1): the same name encrypts to the same token, so Obsideo can see that two
+objects share a name, never what it is; structure + sizes still show.
+
+SCHEME (so other clients — e.g. the SDK — can interop, same account same names):
+  name_key = HKDF-SHA256(ikm=data_key, salt="", info="obsideo-name-key-v1", len=64)
+  token    = base64url-nopad( AES-SIV-encrypt(name_key, utf8(component), aad=none) )
+  path     = "/".join(token(c) for c in path.split("/") if c)
+"""
+
+import base64
+
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.ciphers.aead import AESSIV
+from cryptography.hazmat.primitives.kdf.hkdf import HKDF
+
+from obsideo_core import crypto
+
+_INFO = b"obsideo-name-key-v1"
+
+
+def _name_key() -> bytes:
+    # Derived fresh from the data key (cheap); stays correct if the key changes.
+    return HKDF(algorithm=hashes.SHA256(), length=64, salt=None, info=_INFO).derive(crypto.data_key())
+
+
+def _b64e(b: bytes) -> str:
+    return base64.urlsafe_b64encode(b).rstrip(b"=").decode()
+
+
+def _b64d(s: str) -> bytes:
+    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))
+
+
+def encrypt_name(name: str) -> str:
+    return _b64e(AESSIV(_name_key()).encrypt(name.encode(), None))
+
+
+def decrypt_name(token: str) -> str:
+    return AESSIV(_name_key()).decrypt(_b64d(token), None).decode()
+
+
+def encrypt_path(path: str) -> str:
+    """Encrypt each '/'-separated component. Empty -> empty (root)."""
+    return "/".join(encrypt_name(c) for c in path.split("/") if c)
+
+
+def safe_decrypt_name(token: str) -> tuple[str, bool]:
+    """Decrypt a listed token. Returns (name, was_encrypted). Falls back to the
+    raw token for legacy clear-name objects (so listings never crash on a mixed
+    account)."""
+    try:
+        return decrypt_name(token), True
+    except Exception:
+        return token, False

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/obsideo_core/storage.py

@@ -28,6 +28,16 @@ _MULTIPART_CHUNK = 16 * 1024 * 1024  # 16 MiB
 # non-empty placeholder object rather than a zero-byte key.
 _FOLDER_MARKER = ".keep"
 
+# Windows only: the socket send buffer for upload connections. With the OS
+# default, one connection from a Windows desktop to s3.obsideo.io (62 ms RTT)
+# moved 3.3 MB/s however fast the line was; 1 MiB gave 25-30 MB/s and 4 MiB
+# 25-33 MB/s on the same part (measured 2026-10-17). 4 MiB keeps a far-away
+# uploader (150 ms+) off the same ceiling. Not set elsewhere: on Linux a fixed
+# SO_SNDBUF switches off the kernel's own tuning (and is capped by wmem_max),
+# which can make it slower. OBSIDEO_SEND_BUFFER=<bytes> overrides; 0 leaves
+# the OS default.
+_SEND_BUFFER_WINDOWS = 4 * 1024 * 1024
+
 
 def _names_on() -> bool:
     return config.load_config().get("encrypt_names", True)
@@ -100,9 +110,45 @@ def _s3():
 
     _client = boto3.client("s3", endpoint_url=_endpoint(),
                            aws_access_key_id=ak, aws_secret_access_key=sk, config=cfg)
+    _widen_send_buffer(_client)
     return _client
 
 
+def _send_buffer() -> int:
+    env = os.environ.get("OBSIDEO_SEND_BUFFER", "").strip()
+    if env:
+        try:
+            return max(0, int(env))
+        except ValueError:
+            pass
+    return _SEND_BUFFER_WINDOWS if os.name == "nt" else 0
+
+
+def _widen_send_buffer(client) -> None:
+    """Give the client's connections a larger SO_SNDBUF (see _SEND_BUFFER_WINDOWS).
+
+    botocore has no public setting for socket options, so this adds one to the
+    options its connection pool already uses (TCP_NODELAY, keepalive). Done
+    before the first request, so every connection gets it. If botocore's
+    internals ever move, this does nothing and uploads run at the old speed;
+    it never fails a call.
+    """
+    size = _send_buffer()
+    if not size:
+        return
+    import socket
+    try:
+        sess = client._endpoint.http_session
+        opts = [o for o in (sess._socket_options or []) if o[:2] != (socket.SOL_SOCKET, socket.SO_SNDBUF)]
+        opts.append((socket.SOL_SOCKET, socket.SO_SNDBUF, size))
+        sess._socket_options = opts
+        managers = [sess._manager, *getattr(sess, "_proxy_managers", {}).values()]
+        for m in managers:
+            m.connection_pool_kw["socket_options"] = opts
+    except Exception:
+        pass
+
+
 def reset_client() -> None:
     """Drop the cached client (e.g. after login swaps credentials)."""
     global _client

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/pyproject.toml

@@ -1,33 +1,33 @@
-[build-system]
-requires = ["setuptools>=61"]
-build-backend = "setuptools.build_meta"
-
-[project]
-name = "obsideo-cli"
-version = "0.5.0"
-description = "Obsideo Cloud CLI - client-side encrypted storage for people and AI agents: content is encrypted on your machine before upload. 12 GB free, no card. Save, browse, and sync from your terminal; agent integration contract at obsideo.io/agents.md"
-readme = "README.md"
-requires-python = ">=3.10"
-license = {text = "MIT"}
-keywords = [
-    "encrypted storage", "ai agents", "agent storage", "s3", "backup",
-    "end-to-end encryption", "object storage", "free tier", "cli", "sync",
-]
-dependencies = [
-    "boto3>=1.28",
-    "cryptography>=41.0",
-    "certifi",
-]
-
-[project.urls]
-Homepage = "https://obsideo.io"
-Documentation = "https://obsideo.io/docs/"
-"Agent integration (AGENTS.md)" = "https://obsideo.io/agents.md"
-
-[project.scripts]
-obsideo = "obsideo.cli:main"
-obsideo-cli = "obsideo.cli:main"
-
-[tool.setuptools.packages.find]
-where = ["."]
-include = ["obsideo*", "obsideo_core*"]
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "obsideo-cli"
+version = "0.6.1"
+description = "Obsideo Cloud CLI - client-side encrypted storage for people and AI agents: content is encrypted on your machine before upload. 12 GB free, no card. Save, browse, and sync from your terminal; agent integration contract at obsideo.io/agents.md"
+readme = "README.md"
+requires-python = ">=3.10"
+license = {text = "MIT"}
+keywords = [
+    "encrypted storage", "ai agents", "agent storage", "s3", "backup",
+    "end-to-end encryption", "object storage", "free tier", "cli", "sync",
+]
+dependencies = [
+    "boto3>=1.28",
+    "cryptography>=41.0",
+    "certifi",
+]
+
+[project.urls]
+Homepage = "https://obsideo.io"
+Documentation = "https://obsideo.io/docs/"
+"Agent integration (AGENTS.md)" = "https://obsideo.io/agents.md"
+
+[project.scripts]
+obsideo = "obsideo.cli:main"
+obsideo-cli = "obsideo.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["obsideo*", "obsideo_core*"]

{obsideo_cli-0.5.0 → obsideo_cli-0.6.1}/tests/test_cli.py

@@ -439,3 +439,87 @@ def test_account_shows_referral_line(monkeypatch, tmp_path, capsys):
     cli.ObsideoShell().do_account("")
     out = capsys.readouterr().out
     assert "Referrals: code ABCD234" in out and "4 GB earned" in out
+
+
+# ── Key portability ──────────────────────────────────────────────────────────
+# data_key() mints os.urandom(32) whenever the file is absent, so signing in on
+# a second machine silently orphans everything already uploaded. These cover the
+# escape hatch and, more importantly, the warning that fires before it happens.
+
+@pytest.fixture
+def key_dir(tmp_path, monkeypatch):
+    """Isolate the config dir so nothing here can touch a real ~/.obsideo."""
+    monkeypatch.delenv("OBSIDEO_DATA_KEY", raising=False)
+    monkeypatch.setattr(crypto.config, "CONFIG_DIR", tmp_path)
+    monkeypatch.setattr(crypto, "DATA_KEY_FILE", tmp_path / "data.key")
+    return tmp_path
+
+
+def test_has_data_key_false_on_a_fresh_machine(key_dir):
+    assert crypto.has_data_key() is False
+
+
+def test_import_accepts_bare_hex_and_the_exported_line(key_dir):
+    raw = os.urandom(32).hex()
+    crypto.import_data_key(raw)
+    first = crypto.data_key_fingerprint()
+    crypto.DATA_KEY_FILE.unlink()
+    crypto.import_data_key(f"OBSIDEO_DATA_KEY={raw}")
+    assert crypto.data_key_fingerprint() == first
+    assert crypto.has_data_key() is True
+
+
+def test_import_rejects_malformed_values(key_dir):
+    for bad in ("not-hex", "abcd", os.urandom(16).hex()):
+        with pytest.raises(ValueError):
+            crypto.import_data_key(bad)
+
+
+def test_import_refuses_to_clobber_without_force(key_dir):
+    crypto.import_data_key(os.urandom(32).hex())
+    before = crypto.data_key_fingerprint()
+    with pytest.raises(FileExistsError):
+        crypto.import_data_key(os.urandom(32).hex())
+    assert crypto.data_key_fingerprint() == before      # untouched
+    crypto.import_data_key(os.urandom(32).hex(), force=True)
+    assert crypto.data_key_fingerprint() != before
+
+
+def test_fingerprint_never_reveals_the_key(key_dir):
+    raw = os.urandom(32).hex()
+    crypto.import_data_key(raw)
+    fp = crypto.data_key_fingerprint()
+    assert len(fp) == 16 and fp not in raw and raw not in fp
+
+
+def test_login_warns_before_minting_a_key_over_an_account_that_has_objects(monkeypatch, capsys, tmp_path):
+    """The whole point: a machine with no key signing in to an account that
+    already holds files must be told BEFORE the fresh key is created."""
+    monkeypatch.delenv("OBSIDEO_DATA_KEY", raising=False)
+    monkeypatch.setattr(crypto, "DATA_KEY_FILE", tmp_path / "data.key")
+    monkeypatch.setattr(cli.crypto, "has_data_key", lambda: False)
+    monkeypatch.setattr(cli.crypto, "data_key", lambda: b"\x00" * 32)
+    monkeypatch.setattr(cli, "_fetch_account_info", lambda: {"object_count": 7})
+    monkeypatch.setattr(cli, "_fetch_referral", lambda: None)
+    monkeypatch.setattr(cli.storage, "reset_client", lambda: None)
+    monkeypatch.setattr(cli.login, "verify", lambda *a, **k: {"quota_gb": 12})
+
+    cli.run_login(email="x@example.com", code="123456")
+    out = capsys.readouterr().out
+    assert "already holds 7 object(s)" in out
+    assert "key import" in out
+
+
+def test_login_stays_quiet_for_a_genuinely_new_account(monkeypatch, capsys, tmp_path):
+    monkeypatch.delenv("OBSIDEO_DATA_KEY", raising=False)
+    monkeypatch.setattr(crypto, "DATA_KEY_FILE", tmp_path / "data.key")
+    monkeypatch.setattr(cli.crypto, "has_data_key", lambda: False)
+    monkeypatch.setattr(cli.crypto, "data_key", lambda: b"\x00" * 32)
+    monkeypatch.setattr(cli, "_fetch_account_info", lambda: {"object_count": 0})
+    monkeypatch.setattr(cli, "_fetch_referral", lambda: None)
+    monkeypatch.setattr(cli.storage, "reset_client", lambda: None)
+    monkeypatch.setattr(cli.login, "verify", lambda *a, **k: {"quota_gb": 12})
+
+    cli.run_login(email="x@example.com", code="123456")
+    out = capsys.readouterr().out
+    assert "already holds" not in out

obsideo_cli-0.6.1/tests/test_send_buffer.py

@@ -0,0 +1,46 @@
+"""Upload speed: the Windows send buffer."""
+
+import socket
+
+import pytest
+
+from obsideo_core import config, storage
+
+
+@pytest.fixture
+def creds(monkeypatch, tmp_path):
+    monkeypatch.setattr(config, "CONFIG_DIR", tmp_path)
+    monkeypatch.setenv("OBSIDEO_S3_ACCESS_KEY", "AKTEST")
+    monkeypatch.setenv("OBSIDEO_S3_SECRET_KEY", "secret")
+    monkeypatch.setenv("OBSIDEO_S3_BUCKET", "obsideo")
+    storage.reset_client()
+    yield tmp_path
+    storage.reset_client()
+
+
+def test_send_buffer_windows_only(monkeypatch):
+    monkeypatch.delenv("OBSIDEO_SEND_BUFFER", raising=False)
+    monkeypatch.setattr(storage.os, "name", "nt")
+    assert storage._send_buffer() == 4 * 1024 * 1024
+    monkeypatch.setattr(storage.os, "name", "posix")
+    assert storage._send_buffer() == 0
+    monkeypatch.setenv("OBSIDEO_SEND_BUFFER", "1048576")
+    assert storage._send_buffer() == 1048576
+    monkeypatch.setenv("OBSIDEO_SEND_BUFFER", "0")
+    monkeypatch.setattr(storage.os, "name", "nt")
+    assert storage._send_buffer() == 0
+
+
+def test_client_connections_get_the_send_buffer(creds, monkeypatch):
+    monkeypatch.setenv("OBSIDEO_SEND_BUFFER", "2097152")
+    sess = storage._s3()._endpoint.http_session
+    want = (socket.SOL_SOCKET, socket.SO_SNDBUF, 2097152)
+    assert want in sess._socket_options
+    assert want in sess._manager.connection_pool_kw["socket_options"]
+    # botocore's own options (TCP_NODELAY) are kept
+    assert any(o[1] == socket.TCP_NODELAY for o in sess._socket_options)
+
+
+def test_widen_never_raises_on_unknown_client(monkeypatch):
+    monkeypatch.setenv("OBSIDEO_SEND_BUFFER", "1024")
+    storage._widen_send_buffer(object())

obsideo_cli-0.5.0/obsideo_core/crypto.py

@@ -1,50 +0,0 @@
-"""Account-level AES-256-GCM encryption for the general CLI.
-
-One data key per account, held locally at ~/.obsideo/data.key. Every file is
-encrypted with that key and a fresh random nonce (prepended). Any file the
-account uploaded can be decrypted with this one key, which is what makes
-browse/download/sync work across machines — copy this key to a new machine and
-everything is readable.
-
-This differs from the mlvault extension's per-run keys (immutable ML bundles); a
-general file store wants one stable key. Lose the key, lose the data — by design.
-Back it up alongside your credentials.
-"""
-
-import os
-
-from cryptography.hazmat.primitives.ciphers.aead import AESGCM
-
-from obsideo_core import config
-
-DATA_KEY_FILE = config.CONFIG_DIR / "data.key"
-
-
-def data_key() -> bytes:
-    """Load or generate the 32-byte account data key."""
-    env = os.environ.get("OBSIDEO_DATA_KEY", "").strip()
-    if env:
-        return bytes.fromhex(env)
-    if DATA_KEY_FILE.exists():
-        return bytes.fromhex(DATA_KEY_FILE.read_text().strip())
-    key = os.urandom(32)
-    config.write_secret_file(DATA_KEY_FILE, key.hex())
-    return key
-
-
-def encrypt(data: bytes) -> bytes:
-    """AES-256-GCM. Returns nonce(12) + ciphertext+tag."""
-    key = data_key()
-    nonce = os.urandom(12)
-    return nonce + AESGCM(key).encrypt(nonce, data, None)
-
-
-def decrypt(blob: bytes) -> bytes:
-    """Inverse of encrypt. Raises on auth failure / wrong key."""
-    key = data_key()
-    nonce, ct = blob[:12], blob[12:]
-    return AESGCM(key).decrypt(nonce, ct, None)
-
-
-def data_key_backup_hint() -> str:
-    return f"OBSIDEO_DATA_KEY={data_key().hex()}"