obvyr-cli 2.7.0__tar.gz → 2.9.0__tar.gz

{obvyr_cli-2.7.0 → obvyr_cli-2.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: obvyr-cli
-Version: 2.7.0
+Version: 2.9.0
 Summary: Command-line wrapper to allow Obvyr to capture evidence from any machine.
 License: Proprietary
 Author: Wyrd Technology Ltd
@@ -16,7 +16,6 @@ Requires-Dist: pydantic (==2.13.5)
 Requires-Dist: pydantic-settings (==2.15.0)
 Requires-Dist: python-dotenv (==1.2.4)
 Requires-Dist: tenacity (==9.1.4)
-Requires-Dist: toml (==0.10.2)
 Requires-Dist: zstandard (==0.25.0)
 Project-URL: Homepage, https://wyrd-technology.com
 Description-Content-Type: text/markdown
@@ -39,7 +38,7 @@ Command-line wrapper to run Obvyr agents locally or in CI.
 
 ## Python Support
 
-Python 3.12+
+Python 3.14+ (running through `uvx obvyr-cli` fetches it automatically)
 
 ## Licence
 

{obvyr_cli-2.7.0 → obvyr_cli-2.9.0}/README_PYPI.md

@@ -16,7 +16,7 @@ Command-line wrapper to run Obvyr agents locally or in CI.
 
 ## Python Support
 
-Python 3.12+
+Python 3.14+ (running through `uvx obvyr-cli` fetches it automatically)
 
 ## Licence
 

{obvyr_cli-2.7.0 → obvyr_cli-2.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [tool.poetry]
 name = "obvyr-cli"
-version = "2.7.0"
+version = "2.9.0"
 description = "Command-line wrapper to allow Obvyr to capture evidence from any machine."
 authors = ["Wyrd Technology Ltd"]
 license = "Proprietary"
@@ -34,7 +34,6 @@ pydantic = "2.13.5"
 pydantic-settings = "2.15.0"
 httpx = "0.28.1"
 tenacity = "9.1.4"
-toml = "0.10.2"
 orjson = "3.12.0"
 zstandard = "0.25.0"
 
@@ -46,7 +45,6 @@ pytest-cov = "7.1.0"
 black = "26.5.1"
 pyproject-fmt = "2.29.4"
 pytest-subprocess = "1.6.0"
-types-toml = "^0.10.8.20240310"
 poethepoet = "0.48.0"
 
 [tool.poetry.scripts]

{obvyr_cli-2.7.0 → obvyr_cli-2.9.0}/src/obvyr_cli/api_client.py

@@ -16,8 +16,6 @@ from obvyr_cli.logging_config import get_logger
 
 logger = get_logger("api_client")
 
-project_config = utils.get_project_config()
-
 
 class ObvyrAPIClient:
     """Client for sending execution data to the Obvyr API."""
@@ -43,7 +41,7 @@ class ObvyrAPIClient:
         """Generate headers for authentication."""
         return {
             "Authorization": (f"Bearer {self.api_key}"),
-            "User-Agent": f"obvyr-cli/{project_config['version']}",
+            "User-Agent": f"obvyr-cli/{utils.get_version()}",
         }
 
     @retry(

{obvyr_cli-2.7.0 → obvyr_cli-2.9.0}/src/obvyr_cli/archive_builder.py

@@ -9,6 +9,7 @@ import io
 import json
 import logging
 import mimetypes
+import os
 import pathlib
 import tarfile
 import tempfile
@@ -227,9 +228,6 @@ def build_artifacts_tar_zst(
         Invalid or oversized attachments are skipped with warning logs.
         Attachments are prioritized by value (XML/JSON > YAML/CSV > TXT/LOG).
     """
-    if tmp_dir is None:
-        tmp_dir = pathlib.Path(tempfile.gettempdir())
-
     # Select valid attachments with priority-based ordering
     selected_attachments: list[pathlib.Path] = []
     if attachment_paths:
@@ -237,9 +235,6 @@ def build_artifacts_tar_zst(
             attachment_paths
         )
 
-    # Create output file path
-    output_path = tmp_dir / "artifacts.tar.zst"
-
     # Prepare command.json data exactly as specified in the doc
     command_data = {
         "command": run_command_response.command,
@@ -288,8 +283,17 @@ def build_artifacts_tar_zst(
     compressor = zstd.ZstdCompressor(write_content_size=True)
     compressed_data = compressor.compress(tar_data)
 
-    with open(output_path, "wb") as output_file:
-        output_file.write(compressed_data)
+    # mkstemp creates a unique file readable and writable by the owner only
+    output_fd, output_name = tempfile.mkstemp(
+        prefix="obvyr-", suffix=".tar.zst", dir=tmp_dir
+    )
+    output_path = pathlib.Path(output_name)
+    try:
+        with os.fdopen(output_fd, "wb") as output_file:
+            output_file.write(compressed_data)
+    except Exception:
+        output_path.unlink(missing_ok=True)
+        raise
 
     return output_path
 

{obvyr_cli-2.7.0 → obvyr_cli-2.9.0}/src/obvyr_cli/cli.py

@@ -187,6 +187,29 @@ def fetch_active_profile(
     return active_profile
 
 
+def resolve_active_profile(
+    settings: Settings, profile_name: str | None = None
+) -> ProfileSettings | None:
+    """
+    Retrieve the active profile, or warn and return None when it is missing.
+
+    A missing profile must never stop the wrapped command from running, so the
+    caller carries on without reporting to Obvyr.
+    """
+    try:
+        return fetch_active_profile(settings, profile_name)
+    except ValueError as e:
+        display_name = (profile_name or "DEFAULT").strip().upper()
+        log_customer_friendly_error(
+            str(e),
+            f"Profile '{display_name}' not found, so nothing is being "
+            "reported to Obvyr. Your command will run unchanged. Set "
+            f"OBVYR_PROFILES__{display_name}__API_KEY to enable reporting.",
+            level=logging.WARNING,
+        )
+        return None
+
+
 def check_token_expiry(active_profile: ProfileSettings) -> None:
     """Warn when the active profile's API token is near or past expiry."""
     expiry = get_jwt_expiry(active_profile.API_KEY)
@@ -440,8 +463,10 @@ def cli_run_process(
         ):
             return
 
-        active_profile = fetch_active_profile(settings, profile)
-        check_token_expiry(active_profile)
+        active_profile = resolve_active_profile(settings, profile)
+
+        if active_profile:
+            check_token_expiry(active_profile)
 
         # Create streaming callback for real-time output display
         def stream_output(line: str) -> None:
@@ -454,15 +479,18 @@ def cli_run_process(
             config=execution_config,
         )
 
-        if dry_run:
-            show_dry_run_payload(active_profile, response)
-        elif active_profile.API_URL and active_profile.API_KEY:
-            send_to_api(active_profile, response)
+        if active_profile:
+            if dry_run:
+                show_dry_run_payload(active_profile, response)
+            elif active_profile.API_URL and active_profile.API_KEY:
+                send_to_api(active_profile, response)
 
         display_execution_summary(response)
 
         if response.returncode != 0:
             raise click.exceptions.Exit(response.returncode)
 
+    except click.exceptions.Exit:
+        raise
     except Exception as e:
         raise click.ClickException(str(e)) from e

{obvyr_cli-2.7.0 → obvyr_cli-2.9.0}/src/obvyr_cli/config.py

@@ -9,6 +9,7 @@ import logging
 import re
 import secrets
 from typing import Dict, Literal
+from urllib.parse import urlparse
 
 from dotenv import load_dotenv
 from pydantic import BaseModel, Field, field_validator, model_validator
@@ -29,6 +30,7 @@ class ProfileSettings(BaseModel):
     ATTACHMENT_MAX_AGE_SECONDS: int = 10
     TIMEOUT: float = 10.0
     VERIFY_SSL: bool = True
+    ALLOW_INSECURE_API_URL: bool = False
     TAGS: list[str] = Field(default_factory=list)
     ENV_MODE: Literal["allowlist", "none"] = "allowlist"
     ENV_INCLUDE: list[str] = Field(default_factory=list)
@@ -61,6 +63,17 @@ class ProfileSettings(BaseModel):
                 ) from error
         return value
 
+    @model_validator(mode="after")
+    def require_https_api_url(self) -> "ProfileSettings":
+        """Fail fast on an API_URL that would send the token and archive in clear text."""
+        is_https = urlparse(self.API_URL).scheme.lower() == "https"
+        if self.API_URL and not is_https and not self.ALLOW_INSECURE_API_URL:
+            raise ValueError(
+                f"API_URL '{self.API_URL}' must use HTTPS. "
+                "Set ALLOW_INSECURE_API_URL to true to override."
+            )
+        return self
+
     @model_validator(mode="after")
     def migrate_attachment_path(self) -> "ProfileSettings":
         """Migrate old ATTACHMENT_PATH to ATTACHMENT_PATHS."""

obvyr_cli-2.9.0/src/obvyr_cli/utils.py

@@ -0,0 +1,6 @@
+from importlib.metadata import version
+
+
+def get_version() -> str:
+    """Return the installed CLI version from package metadata."""
+    return version("obvyr-cli")

obvyr_cli-2.7.0/src/obvyr_cli/utils.py

@@ -1,13 +0,0 @@
-from importlib.metadata import version
-
-import toml
-
-
-def get_project_config(pyproject_path: str = "pyproject.toml") -> dict:
-    try:
-        with open(pyproject_path, "r") as file:
-            config = toml.load(file)
-            return config["tool"]["poetry"]
-    except (KeyError, FileNotFoundError):
-        # Fall back to package metadata for installed versions
-        return {"version": version("obvyr-cli")}