obsideo-cli 0.6.0__tar.gz → 0.6.1.post1__tar.gz

{obsideo_cli-0.6.0 → obsideo_cli-0.6.1.post1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: obsideo-cli
-Version: 0.6.0
+Version: 0.6.1.post1
 Summary: Obsideo Cloud CLI - client-side encrypted storage for people and AI agents: content is encrypted on your machine before upload. 12 GB free, no card. Save, browse, and sync from your terminal; agent integration contract at obsideo.io/agents.md
 License: MIT
 Project-URL: Homepage, https://obsideo.io
@@ -10,7 +10,8 @@ Keywords: encrypted storage,ai agents,agent storage,s3,backup,end-to-end encrypt
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: boto3>=1.28
+Requires-Dist: boto3>=1.42.43
+Requires-Dist: botocore>=1.42.43
 Requires-Dist: cryptography>=41.0
 Requires-Dist: certifi
 Dynamic: license-file

{obsideo_cli-0.6.0 → obsideo_cli-0.6.1.post1}/obsideo/__init__.py

@@ -1 +1 @@
-"""The general Obsideo CLI front-end (REPL + browse + sync) on obsideo_core."""
+"""The general Obsideo CLI front-end (REPL + browse + sync) on obsideo_core."""

{obsideo_cli-0.6.0 → obsideo_cli-0.6.1.post1}/obsideo/__main__.py

@@ -1,4 +1,4 @@
-from obsideo.cli import main
-
-if __name__ == "__main__":
-    main()
+from obsideo.cli import main
+
+if __name__ == "__main__":
+    main()

{obsideo_cli-0.6.0 → obsideo_cli-0.6.1.post1}/obsideo/manifest.py

@@ -1,59 +1,59 @@
-"""Local manifest for tracking synced files (lifted from Cloud_Terminal,
-re-homed under ~/.obsideo)."""
-
-import hashlib
-import json
-from datetime import datetime, timezone
-
-from obsideo_core import config
-
-_MANIFEST_FILE = config.CONFIG_DIR / "manifest.json"
-
-
-def _load() -> dict:
-    if not _MANIFEST_FILE.exists():
-        return {"files": {}}
-    try:
-        data = json.loads(_MANIFEST_FILE.read_text())
-        if not isinstance(data, dict):
-            return {"files": {}}
-        data.setdefault("files", {})
-        return data
-    except Exception:
-        return {"files": {}}
-
-
-def _save(m: dict) -> None:
-    _MANIFEST_FILE.parent.mkdir(parents=True, exist_ok=True)
-    _MANIFEST_FILE.write_text(json.dumps(m, indent=2, sort_keys=True))
-
-
-def upsert(name: str, remote_key: str, local_hash: str | None = None,
-           size: int | None = None, encrypted: bool = True) -> None:
-    m = _load()
-    m["files"][name] = {
-        "remote_key": remote_key,
-        "local_hash": local_hash,
-        "size": size,
-        "encrypted": encrypted,
-        "last_synced": datetime.now(timezone.utc).isoformat(),
-    }
-    _save(m)
-
-
-def remove(name: str) -> None:
-    m = _load()
-    m["files"].pop(name, None)
-    _save(m)
-
-
-def get_all() -> dict:
-    return _load()["files"]
-
-
-def file_sha256(filepath) -> str:
-    h = hashlib.sha256()
-    with open(filepath, "rb") as f:
-        for chunk in iter(lambda: f.read(8192), b""):
-            h.update(chunk)
-    return f"sha256:{h.hexdigest()}"
+"""Local manifest for tracking synced files (lifted from Cloud_Terminal,
+re-homed under ~/.obsideo)."""
+
+import hashlib
+import json
+from datetime import datetime, timezone
+
+from obsideo_core import config
+
+_MANIFEST_FILE = config.CONFIG_DIR / "manifest.json"
+
+
+def _load() -> dict:
+    if not _MANIFEST_FILE.exists():
+        return {"files": {}}
+    try:
+        data = json.loads(_MANIFEST_FILE.read_text())
+        if not isinstance(data, dict):
+            return {"files": {}}
+        data.setdefault("files", {})
+        return data
+    except Exception:
+        return {"files": {}}
+
+
+def _save(m: dict) -> None:
+    _MANIFEST_FILE.parent.mkdir(parents=True, exist_ok=True)
+    _MANIFEST_FILE.write_text(json.dumps(m, indent=2, sort_keys=True))
+
+
+def upsert(name: str, remote_key: str, local_hash: str | None = None,
+           size: int | None = None, encrypted: bool = True) -> None:
+    m = _load()
+    m["files"][name] = {
+        "remote_key": remote_key,
+        "local_hash": local_hash,
+        "size": size,
+        "encrypted": encrypted,
+        "last_synced": datetime.now(timezone.utc).isoformat(),
+    }
+    _save(m)
+
+
+def remove(name: str) -> None:
+    m = _load()
+    m["files"].pop(name, None)
+    _save(m)
+
+
+def get_all() -> dict:
+    return _load()["files"]
+
+
+def file_sha256(filepath) -> str:
+    h = hashlib.sha256()
+    with open(filepath, "rb") as f:
+        for chunk in iter(lambda: f.read(8192), b""):
+            h.update(chunk)
+    return f"sha256:{h.hexdigest()}"

{obsideo_cli-0.6.0 → obsideo_cli-0.6.1.post1}/obsideo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: obsideo-cli
-Version: 0.6.0
+Version: 0.6.1.post1
 Summary: Obsideo Cloud CLI - client-side encrypted storage for people and AI agents: content is encrypted on your machine before upload. 12 GB free, no card. Save, browse, and sync from your terminal; agent integration contract at obsideo.io/agents.md
 License: MIT
 Project-URL: Homepage, https://obsideo.io
@@ -10,7 +10,8 @@ Keywords: encrypted storage,ai agents,agent storage,s3,backup,end-to-end encrypt
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: boto3>=1.28
+Requires-Dist: boto3>=1.42.43
+Requires-Dist: botocore>=1.42.43
 Requires-Dist: cryptography>=41.0
 Requires-Dist: certifi
 Dynamic: license-file

{obsideo_cli-0.6.0 → obsideo_cli-0.6.1.post1}/obsideo_cli.egg-info/SOURCES.txt

@@ -20,4 +20,5 @@ obsideo_core/login.py
 obsideo_core/names.py
 obsideo_core/storage.py
 tests/test_cli.py
-tests/test_core.py
+tests/test_core.py
+tests/test_send_buffer.py

obsideo_cli-0.6.1.post1/obsideo_cli.egg-info/requires.txt

@@ -0,0 +1,4 @@
+boto3>=1.42.43
+botocore>=1.42.43
+cryptography>=41.0
+certifi

{obsideo_cli-0.6.0 → obsideo_cli-0.6.1.post1}/obsideo_core/__init__.py

@@ -1,4 +1,4 @@
-"""Obsideo core — the shared client layer for the Obsideo CLI and the mlvault
-extension: storage seam, signing identity, account-level crypto, email-OTP login,
-and config. Client encrypts; Obsideo sees ciphertext only (Principle 1).
-"""
+"""Obsideo core — the shared client layer for the Obsideo CLI and the mlvault
+extension: storage seam, signing identity, account-level crypto, email-OTP login,
+and config. Client encrypts; Obsideo sees ciphertext only (Principle 1).
+"""

{obsideo_cli-0.6.0 → obsideo_cli-0.6.1.post1}/obsideo_core/identity.py

@@ -1,36 +1,36 @@
-"""Client-held signing identity (Ed25519).
-
-Obsideo external accounts require a customer Ed25519 signing public key — it
-authorizes destructive operations on your data (Principle 2: the network can't
-delete your data without your signature). The PRIVATE half is generated here and
-never leaves your machine; only the public key (obk_sig_…) is sent at signup.
-"""
-
-import base64
-
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-from cryptography.hazmat.primitives.serialization import (
-    Encoding, NoEncryption, PrivateFormat, PublicFormat,
-)
-
-from obsideo_core import config
-
-SIGNING_KEY_FILE = config.CONFIG_DIR / "signing.key"
-
-
-def _encode_pub(raw: bytes) -> str:
-    return "obk_sig_" + base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
-
-
-def get_or_create_signing_pubkey() -> str:
-    """Return the Ed25519 signing public key as 'obk_sig_<43 chars>',
-    generating + persisting the private key locally (0600) on first use."""
-    if SIGNING_KEY_FILE.exists():
-        raw = bytes.fromhex(SIGNING_KEY_FILE.read_text().strip())
-        priv = Ed25519PrivateKey.from_private_bytes(raw)
-    else:
-        priv = Ed25519PrivateKey.generate()
-        raw = priv.private_bytes(Encoding.Raw, PrivateFormat.Raw, NoEncryption())
-        config.write_secret_file(SIGNING_KEY_FILE, raw.hex())
-    pub = priv.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
-    return _encode_pub(pub)
+"""Client-held signing identity (Ed25519).
+
+Obsideo external accounts require a customer Ed25519 signing public key — it
+authorizes destructive operations on your data (Principle 2: the network can't
+delete your data without your signature). The PRIVATE half is generated here and
+never leaves your machine; only the public key (obk_sig_…) is sent at signup.
+"""
+
+import base64
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives.serialization import (
+    Encoding, NoEncryption, PrivateFormat, PublicFormat,
+)
+
+from obsideo_core import config
+
+SIGNING_KEY_FILE = config.CONFIG_DIR / "signing.key"
+
+
+def _encode_pub(raw: bytes) -> str:
+    return "obk_sig_" + base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
+
+
+def get_or_create_signing_pubkey() -> str:
+    """Return the Ed25519 signing public key as 'obk_sig_<43 chars>',
+    generating + persisting the private key locally (0600) on first use."""
+    if SIGNING_KEY_FILE.exists():
+        raw = bytes.fromhex(SIGNING_KEY_FILE.read_text().strip())
+        priv = Ed25519PrivateKey.from_private_bytes(raw)
+    else:
+        priv = Ed25519PrivateKey.generate()
+        raw = priv.private_bytes(Encoding.Raw, PrivateFormat.Raw, NoEncryption())
+        config.write_secret_file(SIGNING_KEY_FILE, raw.hex())
+    pub = priv.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
+    return _encode_pub(pub)

{obsideo_cli-0.6.0 → obsideo_cli-0.6.1.post1}/obsideo_core/names.py

@@ -1,65 +1,65 @@
-"""Deterministic filename encryption (Level 1 metadata privacy).
-
-Object keys (folder paths + filenames) would otherwise reach Obsideo in the clear,
-leaking the *shape* of your data even though contents are encrypted. This encrypts
-each path component client-side with **AES-SIV** (deterministic, misuse-resistant
-authenticated encryption) keyed off your data key, so `photos/tax.pdf` is stored
-as opaque tokens.
-
-Why deterministic: identical input → identical token, which is what lets the
-server still do prefix listing — `ls` lists under the encrypted prefix and the
-client decrypts the returned tokens back to real names. Residual leak (accepted at
-Level 1): the same name encrypts to the same token, so Obsideo can see that two
-objects share a name, never what it is; structure + sizes still show.
-
-SCHEME (so other clients — e.g. the SDK — can interop, same account same names):
-  name_key = HKDF-SHA256(ikm=data_key, salt="", info="obsideo-name-key-v1", len=64)
-  token    = base64url-nopad( AES-SIV-encrypt(name_key, utf8(component), aad=none) )
-  path     = "/".join(token(c) for c in path.split("/") if c)
-"""
-
-import base64
-
-from cryptography.hazmat.primitives import hashes
-from cryptography.hazmat.primitives.ciphers.aead import AESSIV
-from cryptography.hazmat.primitives.kdf.hkdf import HKDF
-
-from obsideo_core import crypto
-
-_INFO = b"obsideo-name-key-v1"
-
-
-def _name_key() -> bytes:
-    # Derived fresh from the data key (cheap); stays correct if the key changes.
-    return HKDF(algorithm=hashes.SHA256(), length=64, salt=None, info=_INFO).derive(crypto.data_key())
-
-
-def _b64e(b: bytes) -> str:
-    return base64.urlsafe_b64encode(b).rstrip(b"=").decode()
-
-
-def _b64d(s: str) -> bytes:
-    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))
-
-
-def encrypt_name(name: str) -> str:
-    return _b64e(AESSIV(_name_key()).encrypt(name.encode(), None))
-
-
-def decrypt_name(token: str) -> str:
-    return AESSIV(_name_key()).decrypt(_b64d(token), None).decode()
-
-
-def encrypt_path(path: str) -> str:
-    """Encrypt each '/'-separated component. Empty -> empty (root)."""
-    return "/".join(encrypt_name(c) for c in path.split("/") if c)
-
-
-def safe_decrypt_name(token: str) -> tuple[str, bool]:
-    """Decrypt a listed token. Returns (name, was_encrypted). Falls back to the
-    raw token for legacy clear-name objects (so listings never crash on a mixed
-    account)."""
-    try:
-        return decrypt_name(token), True
-    except Exception:
-        return token, False
+"""Deterministic filename encryption (Level 1 metadata privacy).
+
+Object keys (folder paths + filenames) would otherwise reach Obsideo in the clear,
+leaking the *shape* of your data even though contents are encrypted. This encrypts
+each path component client-side with **AES-SIV** (deterministic, misuse-resistant
+authenticated encryption) keyed off your data key, so `photos/tax.pdf` is stored
+as opaque tokens.
+
+Why deterministic: identical input → identical token, which is what lets the
+server still do prefix listing — `ls` lists under the encrypted prefix and the
+client decrypts the returned tokens back to real names. Residual leak (accepted at
+Level 1): the same name encrypts to the same token, so Obsideo can see that two
+objects share a name, never what it is; structure + sizes still show.
+
+SCHEME (so other clients — e.g. the SDK — can interop, same account same names):
+  name_key = HKDF-SHA256(ikm=data_key, salt="", info="obsideo-name-key-v1", len=64)
+  token    = base64url-nopad( AES-SIV-encrypt(name_key, utf8(component), aad=none) )
+  path     = "/".join(token(c) for c in path.split("/") if c)
+"""
+
+import base64
+
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.ciphers.aead import AESSIV
+from cryptography.hazmat.primitives.kdf.hkdf import HKDF
+
+from obsideo_core import crypto
+
+_INFO = b"obsideo-name-key-v1"
+
+
+def _name_key() -> bytes:
+    # Derived fresh from the data key (cheap); stays correct if the key changes.
+    return HKDF(algorithm=hashes.SHA256(), length=64, salt=None, info=_INFO).derive(crypto.data_key())
+
+
+def _b64e(b: bytes) -> str:
+    return base64.urlsafe_b64encode(b).rstrip(b"=").decode()
+
+
+def _b64d(s: str) -> bytes:
+    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))
+
+
+def encrypt_name(name: str) -> str:
+    return _b64e(AESSIV(_name_key()).encrypt(name.encode(), None))
+
+
+def decrypt_name(token: str) -> str:
+    return AESSIV(_name_key()).decrypt(_b64d(token), None).decode()
+
+
+def encrypt_path(path: str) -> str:
+    """Encrypt each '/'-separated component. Empty -> empty (root)."""
+    return "/".join(encrypt_name(c) for c in path.split("/") if c)
+
+
+def safe_decrypt_name(token: str) -> tuple[str, bool]:
+    """Decrypt a listed token. Returns (name, was_encrypted). Falls back to the
+    raw token for legacy clear-name objects (so listings never crash on a mixed
+    account)."""
+    try:
+        return decrypt_name(token), True
+    except Exception:
+        return token, False

{obsideo_cli-0.6.0 → obsideo_cli-0.6.1.post1}/obsideo_core/storage.py

@@ -28,6 +28,16 @@ _MULTIPART_CHUNK = 16 * 1024 * 1024  # 16 MiB
 # non-empty placeholder object rather than a zero-byte key.
 _FOLDER_MARKER = ".keep"
 
+# Windows only: the socket send buffer for upload connections. With the OS
+# default, one connection from a Windows desktop to s3.obsideo.io (62 ms RTT)
+# moved 3.3 MB/s however fast the line was; 1 MiB gave 25-30 MB/s and 4 MiB
+# 25-33 MB/s on the same part (measured 2026-10-17). 4 MiB keeps a far-away
+# uploader (150 ms+) off the same ceiling. Not set elsewhere: on Linux a fixed
+# SO_SNDBUF switches off the kernel's own tuning (and is capped by wmem_max),
+# which can make it slower. OBSIDEO_SEND_BUFFER=<bytes> overrides; 0 leaves
+# the OS default.
+_SEND_BUFFER_WINDOWS = 4 * 1024 * 1024
+
 
 def _names_on() -> bool:
     return config.load_config().get("encrypt_names", True)
@@ -100,9 +110,45 @@ def _s3():
 
     _client = boto3.client("s3", endpoint_url=_endpoint(),
                            aws_access_key_id=ak, aws_secret_access_key=sk, config=cfg)
+    _widen_send_buffer(_client)
     return _client
 
 
+def _send_buffer() -> int:
+    env = os.environ.get("OBSIDEO_SEND_BUFFER", "").strip()
+    if env:
+        try:
+            return max(0, int(env))
+        except ValueError:
+            pass
+    return _SEND_BUFFER_WINDOWS if os.name == "nt" else 0
+
+
+def _widen_send_buffer(client) -> None:
+    """Give the client's connections a larger SO_SNDBUF (see _SEND_BUFFER_WINDOWS).
+
+    botocore has no public setting for socket options, so this adds one to the
+    options its connection pool already uses (TCP_NODELAY, keepalive). Done
+    before the first request, so every connection gets it. If botocore's
+    internals ever move, this does nothing and uploads run at the old speed;
+    it never fails a call.
+    """
+    size = _send_buffer()
+    if not size:
+        return
+    import socket
+    try:
+        sess = client._endpoint.http_session
+        opts = [o for o in (sess._socket_options or []) if o[:2] != (socket.SOL_SOCKET, socket.SO_SNDBUF)]
+        opts.append((socket.SOL_SOCKET, socket.SO_SNDBUF, size))
+        sess._socket_options = opts
+        managers = [sess._manager, *getattr(sess, "_proxy_managers", {}).values()]
+        for m in managers:
+            m.connection_pool_kw["socket_options"] = opts
+    except Exception:
+        pass
+
+
 def reset_client() -> None:
     """Drop the cached client (e.g. after login swaps credentials)."""
     global _client

{obsideo_cli-0.6.0 → obsideo_cli-0.6.1.post1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "obsideo-cli"
-version = "0.6.0"
+version = "0.6.1.post1"
 description = "Obsideo Cloud CLI - client-side encrypted storage for people and AI agents: content is encrypted on your machine before upload. 12 GB free, no card. Save, browse, and sync from your terminal; agent integration contract at obsideo.io/agents.md"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -14,7 +14,11 @@ keywords = [
     "end-to-end encryption", "object storage", "free tier", "cli", "sync",
 ]
 dependencies = [
-    "boto3>=1.28",
+    # botocore 1.42.43+ sends request bodies in 128 KB blocks; older ones use
+    # urllib3 2.x's 16 KB, which capped one Windows upload connection at
+    # ~3.3 MB/s (measured 2026-10-18). boto3 and botocore share version numbers.
+    "boto3>=1.42.43",
+    "botocore>=1.42.43",
     "cryptography>=41.0",
     "certifi",
 ]

obsideo_cli-0.6.1.post1/tests/test_send_buffer.py

@@ -0,0 +1,46 @@
+"""Upload speed: the Windows send buffer."""
+
+import socket
+
+import pytest
+
+from obsideo_core import config, storage
+
+
+@pytest.fixture
+def creds(monkeypatch, tmp_path):
+    monkeypatch.setattr(config, "CONFIG_DIR", tmp_path)
+    monkeypatch.setenv("OBSIDEO_S3_ACCESS_KEY", "AKTEST")
+    monkeypatch.setenv("OBSIDEO_S3_SECRET_KEY", "secret")
+    monkeypatch.setenv("OBSIDEO_S3_BUCKET", "obsideo")
+    storage.reset_client()
+    yield tmp_path
+    storage.reset_client()
+
+
+def test_send_buffer_windows_only(monkeypatch):
+    monkeypatch.delenv("OBSIDEO_SEND_BUFFER", raising=False)
+    monkeypatch.setattr(storage.os, "name", "nt")
+    assert storage._send_buffer() == 4 * 1024 * 1024
+    monkeypatch.setattr(storage.os, "name", "posix")
+    assert storage._send_buffer() == 0
+    monkeypatch.setenv("OBSIDEO_SEND_BUFFER", "1048576")
+    assert storage._send_buffer() == 1048576
+    monkeypatch.setenv("OBSIDEO_SEND_BUFFER", "0")
+    monkeypatch.setattr(storage.os, "name", "nt")
+    assert storage._send_buffer() == 0
+
+
+def test_client_connections_get_the_send_buffer(creds, monkeypatch):
+    monkeypatch.setenv("OBSIDEO_SEND_BUFFER", "2097152")
+    sess = storage._s3()._endpoint.http_session
+    want = (socket.SOL_SOCKET, socket.SO_SNDBUF, 2097152)
+    assert want in sess._socket_options
+    assert want in sess._manager.connection_pool_kw["socket_options"]
+    # botocore's own options (TCP_NODELAY) are kept
+    assert any(o[1] == socket.TCP_NODELAY for o in sess._socket_options)
+
+
+def test_widen_never_raises_on_unknown_client(monkeypatch):
+    monkeypatch.setenv("OBSIDEO_SEND_BUFFER", "1024")
+    storage._widen_send_buffer(object())

obsideo_cli-0.6.0/obsideo_cli.egg-info/requires.txt

@@ -1,3 +0,0 @@
-boto3>=1.28
-cryptography>=41.0
-certifi