sibyl-memory-cli 0.1.0__tar.gz → 0.1.2__tar.gz

{sibyl_memory_cli-0.1.0 → sibyl_memory_cli-0.1.2}/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.4
 Name: sibyl-memory-cli
-Version: 0.1.0
+Version: 0.1.2
 Summary: Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats.
-Author-email: Sibyl Labs <sibyl@sibyllabs.org>
+Author-email: "SIBYL, Sibyl Labs LLC" <sibyl@sibyllabs.org>
 License: MIT
 Project-URL: Homepage, https://sibyllabs.org/plugin
 Project-URL: Documentation, https://docs.sibyllabs.org/memory/
@@ -18,8 +18,8 @@ Classifier: Environment :: Console
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: sibyl-memory-client>=0.3.0
-Requires-Dist: sibyl-memory-hermes>=0.2.0
+Requires-Dist: sibyl-memory-client>=0.3.3
+Requires-Dist: sibyl-memory-hermes>=0.3.1
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"
 

{sibyl_memory_cli-0.1.0 → sibyl_memory_cli-0.1.2}/pyproject.toml

@@ -4,9 +4,9 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sibyl-memory-cli"
-version = "0.1.0"
+version = "0.1.2"
 description = "Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats."
-authors = [{ name = "Sibyl Labs", email = "sibyl@sibyllabs.org" }]
+authors = [{ name = "SIBYL, Sibyl Labs LLC", email = "sibyl@sibyllabs.org" }]
 license = { text = "MIT" }
 readme = "README.md"
 requires-python = ">=3.10"
@@ -23,8 +23,8 @@ classifiers = [
   "Topic :: Software Development :: Libraries :: Python Modules",
 ]
 dependencies = [
-  "sibyl-memory-client>=0.3.0",
-  "sibyl-memory-hermes>=0.2.0",
+  "sibyl-memory-client>=0.3.3",
+  "sibyl-memory-hermes>=0.3.1",
 ]
 
 [project.optional-dependencies]

{sibyl_memory_cli-0.1.0 → sibyl_memory_cli-0.1.2}/src/sibyl_memory_cli/__init__.py

@@ -13,6 +13,12 @@ All HTTP calls target https://api.sibyllabs.org/api/plugin/*.
 """
 from .cli import main
 
-__version__ = "0.1.0"
+# Single-sourced from installed metadata so wheel + code can't drift
+# (C3 audit fix v0.1.2). Same pattern as sibyl-memory-hermes v0.3.0+.
+from importlib.metadata import PackageNotFoundError, version as _pkg_version
+try:
+    __version__ = _pkg_version("sibyl-memory-cli")
+except PackageNotFoundError:  # pragma: no cover - source-tree dev only
+    __version__ = "0.0.0+source"
 
 __all__ = ["main", "__version__"]

sibyl_memory_cli-0.1.2/src/sibyl_memory_cli/_banner.py

@@ -0,0 +1,117 @@
+"""ASCII banner for sibyl-memory-cli.
+
+Prints the SIBYL wordmark in ANSI Shadow boxchars with a 24-bit truecolor
+vertical gradient flowing from cream/white at the top through warm gold
+to deep ochre at the bottom — aligned with the lab visual identity per
+the operator's brand-discipline rule (creme palette, deep-ochre accent).
+
+Gracefully degrades:
+  - NO_COLOR env var set       → plain text fallback
+  - stdout is not a TTY        → plain text fallback (or skip entirely)
+  - TERM=dumb                  → plain text fallback
+
+Truecolor support is detected via $COLORTERM (truecolor / 24bit) — most
+modern terminals (iTerm2, Alacritty, Kitty, wezterm, Windows Terminal,
+modern xterm builds, Ghostty) advertise it. Falls back to 256-color
+gradient when not available.
+"""
+from __future__ import annotations
+
+import os
+import sys
+
+# ANSI Shadow rendering of "SIBYL" — 6 rows, 41 cols. Each row gets its
+# own gradient color (top = pale cream/white, bottom = deep ochre).
+_LINES = (
+    "███████╗██╗██████╗ ██╗   ██╗██╗     ",
+    "██╔════╝██║██╔══██╗╚██╗ ██╔╝██║     ",
+    "███████╗██║██████╔╝ ╚████╔╝ ██║     ",
+    "╚════██║██║██╔══██╗  ╚██╔╝  ██║     ",
+    "███████║██║██████╔╝   ██║   ███████╗",
+    "╚══════╝╚═╝╚═════╝    ╚═╝   ╚══════╝",
+)
+
+# Vertical gradient · cream → gold → deep ochre. One RGB tuple per row.
+# Tuned against the SIBYL palette: --paper #f5f1e6 (top blend),
+# --accent #8a6a2a (mid-bottom), with extra highlight + shadow stops
+# to give the wordmark visible dimension.
+_GRADIENT = (
+    (253, 251, 245),   # almost white, slight cream      (top highlight)
+    (244, 229, 184),   # pale gold                       (upper)
+    (224, 194, 119),   # mid gold                        (upper-mid)
+    (184, 146,  73),   # rich ochre gold                 (mid)
+    (138, 106,  42),   # deep ochre · brand --accent     (lower)
+    (106,  79,  31),   # deepest                         (bottom shadow)
+)
+
+_TAGLINE = "memory you can hold in your hand"
+
+
+def _supports_truecolor() -> bool:
+    """Detect 24-bit color support. Conservative — fall back gracefully."""
+    if os.environ.get("NO_COLOR"):
+        return False
+    if os.environ.get("TERM", "").lower() == "dumb":
+        return False
+    if not sys.stdout.isatty():
+        return False
+    colorterm = os.environ.get("COLORTERM", "").lower()
+    if "truecolor" in colorterm or "24bit" in colorterm:
+        return True
+    # Many modern terminals don't set COLORTERM but do support truecolor.
+    # Recognize the well-behaved emitters.
+    term_program = os.environ.get("TERM_PROGRAM", "").lower()
+    if term_program in {"iterm.app", "wezterm", "ghostty", "vscode", "tabby"}:
+        return True
+    term = os.environ.get("TERM", "").lower()
+    if any(k in term for k in ("256color", "kitty", "alacritty", "xterm-direct")):
+        return True
+    return False
+
+
+def _color_supported() -> bool:
+    """Plain ANSI color (3/4-bit). Stricter than truecolor."""
+    if os.environ.get("NO_COLOR"):
+        return False
+    if os.environ.get("TERM", "").lower() == "dumb":
+        return False
+    return sys.stdout.isatty()
+
+
+def _rgb(r: int, g: int, b: int) -> str:
+    return f"\033[38;2;{r};{g};{b}m"
+
+
+_RESET = "\033[0m"
+
+
+def render_banner(*, force_color: bool | None = None) -> str:
+    """Return the banner as a string ready to print.
+
+    Args:
+        force_color: Override auto-detection. None = auto, True = force
+            truecolor, False = force plain text. Useful for testing.
+    """
+    use_truecolor = force_color if force_color is not None else _supports_truecolor()
+
+    if not use_truecolor:
+        # Plain text — still visually clean, just no color.
+        body = "\n".join("  " + line for line in _LINES)
+        tagline = f"\n  {_TAGLINE}\n"
+        return body + tagline
+
+    # Colored — apply per-row gradient.
+    colored_lines = []
+    for line, (r, g, b) in zip(_LINES, _GRADIENT):
+        colored_lines.append(f"  {_rgb(r, g, b)}{line}{_RESET}")
+
+    body = "\n".join(colored_lines)
+    # Tagline in dim italic-feeling color (the deepest gold)
+    r, g, b = _GRADIENT[-1]
+    tagline = f"\n  {_rgb(r, g, b)}{_TAGLINE}{_RESET}\n"
+    return body + tagline
+
+
+def print_banner(*, force_color: bool | None = None) -> None:
+    """Print the banner. Safe to call unconditionally; honors NO_COLOR + TTY checks."""
+    print(render_banner(force_color=force_color))

{sibyl_memory_cli-0.1.0 → sibyl_memory_cli-0.1.2}/src/sibyl_memory_cli/cli.py

@@ -5,7 +5,11 @@ https://api.sibyllabs.org/api/plugin/* and the local SibylMemoryProvider.
 
 Design pillars:
   - Zero non-stdlib deps in this file. urllib is enough.
-  - Credentials are written atomically with 0600 perms.
+  - Credentials are written atomically at mode 0600, set at file-creation
+    time via O_CREAT|O_EXCL|O_NOFOLLOW (no chmod-after-write race).
+  - The URL parameter handed to the browser is an opaque session identifier,
+    not the long-lived bearer (audit SEC-1 — server-side pairing handoff
+    issues a separate bearer at activation completion if available).
   - session_token is never printed in full — display short slice only.
   - Polling has explicit timeouts; no infinite loops.
   - Every command exits with a clear status code (0 ok, 1 user error, 2 server error).
@@ -27,6 +31,18 @@ import webbrowser
 from pathlib import Path
 from typing import Any
 
+
+def _client_version() -> str:
+    """Return the installed package version from metadata, never hardcoded."""
+    try:
+        from importlib.metadata import PackageNotFoundError, version as _v
+        try:
+            return _v("sibyl-memory-cli")
+        except PackageNotFoundError:
+            return "0.0.0+source"
+    except Exception:
+        return "0.0.0+source"
+
 # ---- Defaults ----------------------------------------------------------
 
 API_BASE = os.environ.get("SIBYL_API_BASE", "https://api.sibyllabs.org")
@@ -101,7 +117,7 @@ def http_request(
     """Single source of truth for HTTP calls. Returns parsed JSON or raises HttpError."""
     url = f"{API_BASE}{path}"
     data = None
-    full_headers = {"Accept": "application/json", "User-Agent": "sibyl-memory-cli/0.1.0"}
+    full_headers = {"Accept": "application/json", "User-Agent": f"sibyl-memory-cli/{_client_version()}"}
     if body is not None:
         data = json.dumps(body).encode("utf-8")
         full_headers["Content-Type"] = "application/json"
@@ -124,20 +140,45 @@ def http_request(
 # ---- Credentials I/O ---------------------------------------------------
 
 def write_credentials_atomic(creds: dict, path: Path = DEFAULT_CRED_PATH) -> Path:
-    """Write credentials.json atomically at mode 0600."""
+    """Write credentials.json atomically at mode 0600.
+
+    v0.1.2 hardening (audit SEC-2): mode 0600 is set by the kernel at
+    file-creation time via O_CREAT|O_EXCL|O_NOFOLLOW. Previously used
+    write_text() followed by os.chmod(), leaving a world-readable window
+    between syscalls every credential save.
+    """
     path = path.expanduser()
     path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    data = json.dumps(creds, indent=2).encode("utf-8")
     tmp = path.with_suffix(path.suffix + ".tmp")
-    tmp.write_text(json.dumps(creds, indent=2), encoding="utf-8")
-    os.chmod(tmp, 0o600)
-    tmp.replace(path)
+    # Clean any leftover .tmp from a crashed prior write so O_EXCL can succeed.
+    try:
+        os.unlink(tmp)
+    except FileNotFoundError:
+        pass
+    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    fd = os.open(str(tmp), flags, 0o600)
+    try:
+        os.write(fd, data)
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+    os.replace(str(tmp), str(path))
     return path
 
 
 def read_credentials(path: Path = DEFAULT_CRED_PATH) -> dict | None:
+    """Read credentials.json.
+
+    v0.1.2 hardening (audit SEC-11): refuses to follow symlinks.
+    Returns None if the file is a symlink or doesn't exist."""
     path = path.expanduser()
     if not path.exists():
         return None
+    if path.is_symlink():
+        return None
     return json.loads(path.read_text(encoding="utf-8"))
 
 
@@ -166,6 +207,11 @@ def cmd_init(args: argparse.Namespace) -> int:
     The pairing code is printed in the terminal. If the user picks the
     email path in the browser, they type both their email and this code.
     No external email service is required."""
+    # Brand moment — gold/white gradient SIBYL wordmark.
+    # Honors NO_COLOR + TTY detection automatically; safe to always call.
+    from ._banner import print_banner
+    print_banner()
+
     cred_path = Path(args.credentials).expanduser()
     if cred_path.exists() and not args.force:
         existing = read_credentials(cred_path) or {}
@@ -175,10 +221,18 @@ def cmd_init(args: argparse.Namespace) -> int:
         print_status("Credentials", str(cred_path))
         return 0
 
-    session_token = str(uuid.uuid4())
+    # SEC-1 mitigation (v0.1.2): the URL parameter is an opaque pairing
+    # session identifier, NOT the long-lived bearer used by /access and
+    # /check-write. The CLI generates it locally and the server treats
+    # it as the activation rendezvous key only. The persistent bearer
+    # is issued by the server in the /check response (`bearer_token`
+    # field) after activation completes. Servers running pre-SEC-1
+    # firmware that echo the URL identifier as the bearer still work —
+    # we use whichever the server returns in the bound credentials.
+    session_id = str(uuid.uuid4())
     pairing_code = _gen_pairing_code()
-    code_hash = _hash_pairing_code(pairing_code, session_token)
-    activate_url = f"{ACTIVATE_BASE}?session={session_token}"
+    code_hash = _hash_pairing_code(pairing_code, session_id)
+    activate_url = f"{ACTIVATE_BASE}?session={session_id}"
 
     # Pre-register the session + pairing code hash with the server.
     # The code itself never leaves the user's machine until they type it
@@ -188,12 +242,12 @@ def cmd_init(args: argparse.Namespace) -> int:
             "POST",
             "/api/plugin/session-init",
             body={
-                "session": session_token,
+                "session": session_id,
                 "pairing_code_hash": code_hash,
                 "env": {
                     "os_family": _detect_os_family(),
                     "install_method": "cli",
-                    "client_version": __import__("sibyl_memory_cli").__version__,
+                    "client_version": _client_version(),
                 },
             },
             timeout=10.0,
@@ -206,7 +260,7 @@ def cmd_init(args: argparse.Namespace) -> int:
     print()
     print(bold("Sibyl Memory Plugin · activation"))
     print()
-    print(f"  {dim('Session:')}     {short(session_token)}")
+    print(f"  {dim('Session:')}     {short(session_id)}")
     # Format the code with a visual break to make it easier to read off the screen
     print(f"  {dim('Code:')}        {bold(pairing_code[:3] + ' ' + pairing_code[3:])}   {dim('(use this in the email panel)')}")
     print(f"  {dim('Opening:')}     {activate_url}")
@@ -227,7 +281,7 @@ def cmd_init(args: argparse.Namespace) -> int:
 
     while time.time() < deadline:
         try:
-            resp = http_request("GET", f"/api/plugin/check?session={urllib.parse.quote(session_token)}", timeout=10.0)
+            resp = http_request("GET", f"/api/plugin/check?session={urllib.parse.quote(session_id)}", timeout=10.0)
         except HttpError as e:
             if e.status in (404, 503, 0):
                 # Session not yet created server-side, or transient — keep polling
@@ -239,12 +293,23 @@ def cmd_init(args: argparse.Namespace) -> int:
 
         if resp.get("bound") and resp.get("credentials"):
             creds = resp["credentials"]
-            # Sanity check: the server's session_token field MUST match what we sent
-            if creds.get("session_token") and creds["session_token"] != session_token:
+            # SEC-1: prefer the server-issued bearer_token (post-fix) over
+            # echoing the URL pairing-session id. Servers running pre-SEC-1
+            # firmware echo `session_token` back as the bearer — we use
+            # whichever the server returns. The CLI's session_id (URL
+            # identifier) is the rendezvous key, not the persistent bearer.
+            bearer = creds.get("bearer_token") or creds.get("session_token")
+            if not bearer:
+                # Fallback: pre-SEC-1 server flow where neither field is
+                # echoed back — inject the pairing session id so subsequent
+                # /access and /check-write calls have something to send.
+                bearer = session_id
+            # Sanity check on echoed session_token (pre-SEC-1 flow only)
+            if creds.get("session_token") and creds["session_token"] != session_id \
+                    and not creds.get("bearer_token"):
                 print(red("\nSession token mismatch — refusing to write credentials."))
                 return 2
-            # If server didn't echo session_token, inject our locally-generated one
-            creds.setdefault("session_token", session_token)
+            creds["session_token"] = bearer
             path = write_credentials_atomic(creds, cred_path)
             print(f"\r{' ' * 80}\r", end="")  # clear spinner line
             print(green("✓ Activated."))
@@ -254,9 +319,18 @@ def cmd_init(args: argparse.Namespace) -> int:
             print_status("Email", creds.get("email") or "—")
             print_status("Credentials", str(path))
             print()
-            print(dim("Wire the provider into Hermes:"))
+            print(dim("Activate Sibyl in Hermes:"))
+            print(dim("    sibyl-memory-hermes install-plugin"))
+            print(dim("    # then edit ~/.hermes/config.yaml:"))
+            print(dim("    #   memory:"))
+            print(dim("    #     provider: sibyl"))
+            print()
+            print(dim("Or use the MCP server (Claude Code / Codex / Cursor / Continue):"))
+            print(dim("    pip install sibyl-memory-mcp"))
+            print()
+            print(dim("Or call the SDK directly from any Python orchestration:"))
             print(dim("    from sibyl_memory_hermes import SibylMemoryProvider"))
-            print(dim("    agent = Agent(memory=SibylMemoryProvider())"))
+            print(dim("    provider = SibylMemoryProvider()"))
             return 0
 
         # Spinner tick

{sibyl_memory_cli-0.1.0 → sibyl_memory_cli-0.1.2}/src/sibyl_memory_cli.egg-info/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.4
 Name: sibyl-memory-cli
-Version: 0.1.0
+Version: 0.1.2
 Summary: Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats.
-Author-email: Sibyl Labs <sibyl@sibyllabs.org>
+Author-email: "SIBYL, Sibyl Labs LLC" <sibyl@sibyllabs.org>
 License: MIT
 Project-URL: Homepage, https://sibyllabs.org/plugin
 Project-URL: Documentation, https://docs.sibyllabs.org/memory/
@@ -18,8 +18,8 @@ Classifier: Environment :: Console
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: sibyl-memory-client>=0.3.0
-Requires-Dist: sibyl-memory-hermes>=0.2.0
+Requires-Dist: sibyl-memory-client>=0.3.3
+Requires-Dist: sibyl-memory-hermes>=0.3.1
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"
 

{sibyl_memory_cli-0.1.0 → sibyl_memory_cli-0.1.2}/src/sibyl_memory_cli.egg-info/SOURCES.txt

@@ -1,6 +1,7 @@
 README.md
 pyproject.toml
 src/sibyl_memory_cli/__init__.py
+src/sibyl_memory_cli/_banner.py
 src/sibyl_memory_cli/cli.py
 src/sibyl_memory_cli.egg-info/PKG-INFO
 src/sibyl_memory_cli.egg-info/SOURCES.txt

sibyl_memory_cli-0.1.2/src/sibyl_memory_cli.egg-info/requires.txt

@@ -0,0 +1,5 @@
+sibyl-memory-client>=0.3.3
+sibyl-memory-hermes>=0.3.1
+
+[dev]
+pytest>=7.0

sibyl_memory_cli-0.1.0/src/sibyl_memory_cli.egg-info/requires.txt

@@ -1,5 +0,0 @@
-sibyl-memory-client>=0.3.0
-sibyl-memory-hermes>=0.2.0
-
-[dev]
-pytest>=7.0