plexus-python 0.11.3__tar.gz → 0.11.5__tar.gz

{plexus_python-0.11.3 → plexus_python-0.11.5}/API.md

@@ -35,6 +35,7 @@ curl -X POST https://gateway.plexus.company/ingest \
   -H "Content-Type: application/json" \
   -d '{
     "points": [{
+      "class": "metric",
       "metric": "temperature",
       "value": 72.5,
       "timestamp": 1699900000,
@@ -83,6 +84,7 @@ x-api-key: plx_xxxxx
 {
   "points": [
     {
+      "class": "metric",
       "metric": "temperature",
       "value": 72.5,
       "timestamp": 1699900000.123,
@@ -163,7 +165,7 @@ For real-time UI-controlled streaming, devices connect via WebSocket.
 1. Device connects to the gateway
 2. Device authenticates with API key (and advertises any registered commands)
 3. Device streams `telemetry` frames
-4. Dashboard/API invokes registered commands via `typed_command`
+4. Plexus invokes registered commands via `typed_command` (see the note under Commands)
 
 ### Device Authentication
 
@@ -216,16 +218,18 @@ Devices authenticate using an API key. The gateway echoes the declared `source_i
 {
   "type": "telemetry",
   "points": [
-    { "metric": "accel_x", "value": 0.12, "timestamp": 1699900000123 },
-    { "metric": "accel_y", "value": 0.05, "timestamp": 1699900000123 },
-    { "metric": "accel_z", "value": 9.81, "timestamp": 1699900000123 }
+    { "class": "metric", "metric": "accel_x", "value": 0.12, "timestamp": 1699900000123 },
+    { "class": "metric", "metric": "accel_y", "value": 0.05, "timestamp": 1699900000123 },
+    { "class": "metric", "metric": "accel_z", "value": 9.81, "timestamp": 1699900000123 }
   ]
 }
 ```
 
 ### Commands
 
-Dashboard/API actions reach the device as a single `typed_command` envelope; the device replies with `command_result` frames. Register handlers with `px.on_command(...)` before the first `send()`.
+Commands reach the device as a single `typed_command` envelope; the device replies with `command_result` frames. Register handlers with `px.on_command(...)` before the first `send()`.
+
+> **Note:** the public API route for sending commands (`POST /v1/sources/{id}/commands`) was turned off on 2026-09-21 and returns `410 Gone`. Nothing in Plexus can currently trigger a custom handler.
 
 ```json
 // Server → Device
@@ -251,6 +255,7 @@ requests.post(
     headers={"x-api-key": "plx_xxxxx"},
     json={
         "points": [{
+            "class": "metric",
             "metric": "temperature",
             "value": 72.5,
             "timestamp": time.time(),
@@ -297,6 +302,7 @@ import (
 func main() {
     points := map[string]interface{}{
         "points": []map[string]interface{}{{
+            "class":     "metric",
             "metric":    "temperature",
             "value":     72.5,
             "timestamp": float64(time.Now().Unix()),

{plexus_python-0.11.3 → plexus_python-0.11.5}/CHANGELOG.md

@@ -2,6 +2,61 @@
 
 ## [Unreleased]
 
+## [0.11.5] - 2026-09-21 - The commands API is off
+
+No code changes. The docs described a way to send commands to a device that
+no longer exists.
+
+### Changed
+
+- **`POST /v1/sources/{id}/commands` is turned off, and the docs now say so.**
+  Plexus turned the endpoint off on 2026-09-21. It returns `410 Gone`.
+  Any API key of any scope could send any command name to any device in
+  the org, which is not safe for commands that reach hardware.
+  - The agent skill no longer offers to send commands, and it tells agents
+    not to call the endpoint.
+  - README and `API.md` say plainly that nothing in Plexus can currently
+    trigger an `on_command` handler.
+  - `on_command` itself is unchanged.
+
+## [0.11.4] - 2026-09-08 - Docs that actually work
+
+No code changes. Every edit here is documentation or dead weight, but the
+first item was breaking people who copied from the docs.
+
+### Fixed
+
+- **Every raw-HTTP example in `API.md` would have returned 400.** The
+  gateway requires `class` on each point (`points[i].class is required`)
+  and not one of the five curl/Python/Go/WebSocket examples included it.
+  The SDK sets `class` for you, which is exactly why this survived so
+  long: the library path worked, and only people copying the HTTP
+  examples hit it.
+
+- **The documented `source_id` pattern rejected valid ids.** README and
+  the firmware skill both said `^[a-z0-9][a-z0-9_-]{1,62}$`, while
+  `client.py` enforces `^[a-z0-9][a-z0-9._-]*$` at 256 characters. Dotted
+  ids like `sat.01` are legal and read as forbidden.
+
+- **`SECURITY.md` declared the shipping version unsupported** — the table
+  stopped at `0.5.x` — and pointed at an address that isn't monitored.
+  It now says `0.11.x` and `info@plexus.company`.
+
+### Removed
+
+- **All references to the C SDK.** `plexus-oss/plexus-c` is deleted, so
+  the README, `ws.py` and `test_ws.py` were describing the wire protocol
+  by pointing at a repository that 404s. Now described as what it is: the
+  gateway's device wire protocol. `CHANGELOG` history is left alone.
+
+- **`scripts/plexus.service`** — a systemd unit running `plexus start`, a
+  subcommand that does not exist. Nothing referenced it, and the `/setup`
+  installer tells you to write your own unit.
+
+- **`scripts/scan_buses.py`** (17-line scratch script, undeclared
+  `smbus2` dependency, no callers) and a 7-byte `TODO.md`.
+
+
 ## [0.11.3] - 2026-09-02 - Let the CLI diagnose the CLI
 
 All three of these came out of one evening of actually using it.

{plexus_python-0.11.3 → plexus_python-0.11.5}/CONTRIBUTING.md

@@ -1,4 +1,4 @@
-# Contributing to Plexus Agent
+# Contributing to plexus-python
 
 Thanks for your interest in contributing! Here's how to get started.
 
@@ -6,7 +6,7 @@ Thanks for your interest in contributing! Here's how to get started.
 
 ```bash
 git clone https://github.com/plexus-oss/plexus-python.git
-cd agent
+cd plexus-python
 python -m venv .venv
 source .venv/bin/activate
 pip install -e ".[dev]"

{plexus_python-0.11.3 → plexus_python-0.11.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: plexus-python
-Version: 0.11.3
+Version: 0.11.5
 Summary: Thin Python SDK for Plexus — send telemetry in one line
 Project-URL: Homepage, https://plexus.company
 Project-URL: Documentation, https://docs.plexus.company
@@ -66,7 +66,7 @@ curl -sL https://app.plexus.company/setup | bash -s -- \
   --key plx_xxx --name drone-01
 ```
 
-The name must match `^[a-z0-9][a-z0-9_-]{1,62}$`. `setup.sh` refuses to run without `--name` (or without a TTY to prompt for one) — this is deliberate, because the previous `hostname` fallback silently merged telemetry from cloned SD-card images that all booted as `raspberrypi`.
+The name must match `^[a-z0-9][a-z0-9._-]*$` (max 256 chars). `setup.sh` refuses to run without `--name` (or without a TTY to prompt for one) — this is deliberate, because the previous `hostname` fallback silently merged telemetry from cloned SD-card images that all booted as `raspberrypi`.
 
 **Names are not auto-deduplicated.** The gateway echoes back whatever `source_id` you declare, unchanged — pick a unique name per device (that's what `--name` and `source_id=...` are for). Two devices that declare the same name write into the same source.
 
@@ -252,10 +252,10 @@ px.send("temperature", 72.5, timestamp=t)   # your timestamp, used as-is, no cor
 
 ## Transport
 
-By default the SDK connects over a **WebSocket** to `/ws/device` on the gateway — same wire protocol as the C SDK. This gives you:
+By default the SDK connects over a **WebSocket** to `/ws/device` on the gateway — the gateway's device wire protocol. This gives you:
 
 - lower-latency streaming of telemetry,
-- live command delivery from the UI / API to the device.
+- the channel that will carry actions triggered from a Plexus dashboard.
 
 If the socket is unavailable, sends transparently fall back to `POST /ingest` so no data is lost.
 
@@ -283,6 +283,8 @@ px.send("temperature", 72.5)   # opens the socket, waits for auth
 
 The SDK sends an `ack` frame before invoking the handler, then a `result` frame with whatever the handler returns (or an `error` frame if it raises).
 
+> **Note:** nothing in Plexus can currently trigger a custom handler. The API route for sending commands was turned off on 2026-09-21. Triggering handlers from a dashboard, with permissions and a record of every run, is being rebuilt.
+
 ## Environment Variables
 
 | Variable                | Description                  | Default                          |

{plexus_python-0.11.3 → plexus_python-0.11.5}/README.md

@@ -29,7 +29,7 @@ curl -sL https://app.plexus.company/setup | bash -s -- \
   --key plx_xxx --name drone-01
 ```
 
-The name must match `^[a-z0-9][a-z0-9_-]{1,62}$`. `setup.sh` refuses to run without `--name` (or without a TTY to prompt for one) — this is deliberate, because the previous `hostname` fallback silently merged telemetry from cloned SD-card images that all booted as `raspberrypi`.
+The name must match `^[a-z0-9][a-z0-9._-]*$` (max 256 chars). `setup.sh` refuses to run without `--name` (or without a TTY to prompt for one) — this is deliberate, because the previous `hostname` fallback silently merged telemetry from cloned SD-card images that all booted as `raspberrypi`.
 
 **Names are not auto-deduplicated.** The gateway echoes back whatever `source_id` you declare, unchanged — pick a unique name per device (that's what `--name` and `source_id=...` are for). Two devices that declare the same name write into the same source.
 
@@ -215,10 +215,10 @@ px.send("temperature", 72.5, timestamp=t)   # your timestamp, used as-is, no cor
 
 ## Transport
 
-By default the SDK connects over a **WebSocket** to `/ws/device` on the gateway — same wire protocol as the C SDK. This gives you:
+By default the SDK connects over a **WebSocket** to `/ws/device` on the gateway — the gateway's device wire protocol. This gives you:
 
 - lower-latency streaming of telemetry,
-- live command delivery from the UI / API to the device.
+- the channel that will carry actions triggered from a Plexus dashboard.
 
 If the socket is unavailable, sends transparently fall back to `POST /ingest` so no data is lost.
 
@@ -246,6 +246,8 @@ px.send("temperature", 72.5)   # opens the socket, waits for auth
 
 The SDK sends an `ack` frame before invoking the handler, then a `result` frame with whatever the handler returns (or an `error` frame if it raises).
 
+> **Note:** nothing in Plexus can currently trigger a custom handler. The API route for sending commands was turned off on 2026-09-21. Triggering handlers from a dashboard, with permissions and a record of every run, is being rebuilt.
+
 ## Environment Variables
 
 | Variable                | Description                  | Default                          |

{plexus_python-0.11.3 → plexus_python-0.11.5}/SECURITY.md

@@ -6,7 +6,7 @@ If you discover a security vulnerability in plexus-python, please report it resp
 
 **Do NOT open a public GitHub issue for security vulnerabilities.**
 
-Instead, email **support@plexus.company** with:
+Instead, email **info@plexus.company** with:
 
 - Description of the vulnerability
 - Steps to reproduce
@@ -23,8 +23,8 @@ Instead, email **support@plexus.company** with:
 
 | Version | Supported |
 | ------- | --------- |
-| 0.5.x   | Yes       |
-| < 0.5   | No        |
+| 0.11.x  | Yes       |
+| < 0.11  | No        |
 
 ## Disclosure Policy
 

{plexus_python-0.11.3 → plexus_python-0.11.5}/plexus/__init__.py

@@ -23,7 +23,7 @@ from plexus.client import (
 )
 from plexus.config import RetryConfig
 
-__version__ = "0.11.3"
+__version__ = "0.11.5"
 __all__ = [
     "AuthenticationError",
     "BatchSender",

{plexus_python-0.11.3 → plexus_python-0.11.5}/plexus/ws.py

@@ -1,7 +1,7 @@
 """
 WebSocket transport for the Plexus Python SDK.
 
-Wire-compatible with the C SDK (`plexus_ws.c`). Targets the gateway's
+Implements the gateway's device wire protocol. Targets its
 `/ws/device` endpoint and exchanges the same JSON frames:
 
     client → {"type": "device_auth", "api_key": ..., "source_id": ...,
@@ -392,7 +392,7 @@ class WebSocketTransport:
         command = msg.get("command") or ""
         params = msg.get("params") or {}
 
-        # Ack immediately (matches C SDK: plexus_ws.c:275-280)
+        # Ack immediately, per the gateway wire contract
         self._send_frame({
             "type": "command_result",
             "id": cmd_id,
@@ -547,8 +547,7 @@ def _safe_json(raw: Any) -> dict[str, Any]:
 
 
 def _backoff_delay(attempt: int) -> float:
-    """Exponential backoff with ±25% jitter, capped at BACKOFF_MAX_S.
-    Matches plexus_ws.c:44-52."""
+    """Exponential backoff with ±25% jitter, capped at BACKOFF_MAX_S."""
     base = min(BACKOFF_BASE_S * (2 ** attempt), BACKOFF_MAX_S)
     jitter = base * 0.25 * (2 * random.random() - 1)
     return max(0.1, base + jitter)

{plexus_python-0.11.3 → plexus_python-0.11.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plexus-python"
-version = "0.11.3"
+version = "0.11.5"
 description = "Thin Python SDK for Plexus — send telemetry in one line"
 readme = "README.md"
 license = "Apache-2.0"

{plexus_python-0.11.3 → plexus_python-0.11.5}/skills/plexus/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: plexus
-description: Integrate with the Plexus telemetry API — send data, query metrics, subscribe to live streams, send commands to devices. Use when the user mentions Plexus, plexus.company, gateway.plexus.company, plexus-data-api.fly.dev, or plx_ API keys. ALSO USE when the request involves IoT/hardware telemetry, fleet observability, sending sensor data to a backend, querying device time-series, building a fleet dashboard, monitoring drones/satellites/robots/edge devices, or any phrase like "send my sensor readings somewhere", "store telemetry", "track a fleet", "ingest metrics", or "device observability" — even if "Plexus" is never said.
+description: Integrate with the Plexus telemetry API — send data, query metrics, subscribe to live streams. Use when the user mentions Plexus, plexus.company, gateway.plexus.company, plexus-data-api.fly.dev, or plx_ API keys. ALSO USE when the request involves IoT/hardware telemetry, fleet observability, sending sensor data to a backend, querying device time-series, building a fleet dashboard, monitoring drones/satellites/robots/edge devices, or any phrase like "send my sensor readings somewhere", "store telemetry", "track a fleet", "ingest metrics", or "device observability" — even if "Plexus" is never said.
 tools: Read, Write, Edit, Bash, WebFetch
 ---
 
@@ -13,7 +13,7 @@ Plexus is a telemetry/observability platform for hardware fleets (drones, satell
 Trigger on any of:
 
 - The user mentions "Plexus", "plexus.company", `plx_` keys, `gateway.plexus.company`, or `plexus-data-api.fly.dev`
-- The user wants to ingest telemetry, query device metrics, stream live points, or send commands to a device
+- The user wants to ingest telemetry, query device metrics, or stream live points
 - The user is building a dashboard, alert pipeline, or analysis on top of fleet telemetry
 - The user pastes a Plexus curl example and asks for help
 
@@ -27,7 +27,7 @@ Two base URLs. Authenticate with an `x-api-key` header on HTTP.
 | Purpose                                            | Host                             |
 | -------------------------------------------------- | -------------------------------- |
 | Ingest                                              | `https://gateway.plexus.company` |
-| Read API (sources, metrics, logs, fleet, commands, live stream) | `https://plexus-data-api.fly.dev` |
+| Read API (sources, metrics, logs, fleet, live stream) | `https://plexus-data-api.fly.dev` |
 
 ```
 x-api-key: plx_...
@@ -141,9 +141,9 @@ You do **not** need to answer application-level pings on this endpoint; keepaliv
 
 The gateway's own sockets (`/ws/device`, `/ws/browser`) are for the Python SDK and the Plexus app respectively. Don't write third-party clients against them. There is no `/v1/stream` on the gateway.
 
-### Control (data API)
+### Control
 
-`POST /v1/sources/{id}/commands` — body `{ command, params? }`, response `{ queued: bool }`. Confirm with the user before sending — these hit physical hardware.
+There is no API for sending commands to devices. `POST /v1/sources/{id}/commands` was turned off and returns `410 Gone`. Don't write code that calls it, and don't offer to trigger device behavior through the API.
 
 ## Standard scaffolding
 
@@ -216,7 +216,6 @@ let the pipeline settle first.
 - **Telemetry frames are batched** — `points` is an array. Handling one frame as one point silently drops data.
 - `start`/`end` are **ISO date-times on every endpoint** that takes them — `query`, `logs` and `fleet/metrics` alike. `last=1h` is easier and works on all three.
 - `auto_downsampled: true` in a query response means the bucket size was picked for you — surface it in the UI so users understand what they're looking at.
-- Commands queue on the device; they don't execute synchronously. Don't promise the user "it rebooted" — promise "reboot queued".
 
 ## When unsure
 

{plexus_python-0.11.3 → plexus_python-0.11.5}/skills/plexus-firmware/SKILL.md

@@ -61,7 +61,7 @@ Four things the gateway will reject you for. Get these right or nothing lands:
 1. **The array is `points`.** `"metrics": [...]` returns `400 {"error":"'points' array is required"}`.
 2. **Every point needs `class`**, either `"metric"` or `"event"`. There is no default.
 3. **`timestamp` is a number, never a string.** An ISO-8601 string returns `points[i].timestamp must be a number`. Epoch **milliseconds**; a positive value below `1e12` is read as **seconds** and scaled for you, so either unit works as long as it's numeric.
-4. **`source_id` must match `^[a-z0-9][a-z0-9_-]{1,62}$`** and is not deduplicated — two devices declaring the same id merge into one source. This is what SD-card clones do when they all boot as `raspberrypi`.
+4. **`source_id` must match `^[a-z0-9][a-z0-9._-]*$` (max 256 chars)** and is not deduplicated — two devices declaring the same id merge into one source. This is what SD-card clones do when they all boot as `raspberrypi`.
 
 `timestamp` is optional. Omit it and the gateway stamps the point with its receive time — which is the right move on a device whose clock has never been NTP-synced. Per-point `tags` (a flat string→string map) are supported and optional.
 

{plexus_python-0.11.3 → plexus_python-0.11.5}/tests/test_ws.py

@@ -2,7 +2,7 @@
 
 Spins up a tiny `websockets`-based server on localhost that impersonates the
 gateway's /ws/device endpoint and asserts the frames the SDK exchanges match
-the C SDK / gateway contract:
+the gateway contract:
 
     device_auth → authenticated → telemetry → heartbeat → typed_command roundtrip
 """

{plexus_python-0.11.3 → plexus_python-0.11.5}/uv.lock

@@ -425,7 +425,7 @@ wheels = [
 
 [[package]]
 name = "plexus-python"
-version = "0.11.2"
+version = "0.11.5"
 source = { editable = "." }
 dependencies = [
     { name = "websocket-client" },

plexus_python-0.11.3/TODO.md

@@ -1 +0,0 @@
-# TODO

plexus_python-0.11.3/scripts/plexus.service

@@ -1,27 +0,0 @@
-[Unit]
-Description=Plexus Agent
-Documentation=https://docs.plexus.company
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=pi
-ExecStart=/usr/local/bin/plexus start
-Restart=always
-RestartSec=10
-Environment=PLEXUS_CONFIG_DIR=/home/pi/.plexus
-
-# Logging
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=plexus
-
-# Security hardening
-NoNewPrivileges=true
-ProtectSystem=strict
-ProtectHome=read-only
-ReadWritePaths=/home/pi/.plexus
-
-[Install]
-WantedBy=multi-user.target

plexus_python-0.11.3/scripts/scan_buses.py

@@ -1,17 +0,0 @@
-from smbus2 import SMBus
-
-for bus in [0, 1, 10, 20, 21, 22]:
-    try:
-        s = SMBus(bus)
-        addrs = []
-        for a in range(0x03, 0x78):
-            try:
-                s.read_byte(a)
-                addrs.append(f'0x{a:02X}')
-            except OSError:
-                pass
-        s.close()
-        if addrs:
-            print(f'Bus {bus}: {addrs}')
-    except Exception as e:
-        print(f'Bus {bus}: {e}')