sibyl-memory-cli 0.1.1__tar.gz → 0.1.3__tar.gz

{sibyl_memory_cli-0.1.1 → sibyl_memory_cli-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sibyl-memory-cli
-Version: 0.1.1
+Version: 0.1.3
 Summary: Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats.
 Author-email: "SIBYL, Sibyl Labs LLC" <sibyl@sibyllabs.org>
 License: MIT
@@ -18,8 +18,8 @@ Classifier: Environment :: Console
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: sibyl-memory-client>=0.3.0
-Requires-Dist: sibyl-memory-hermes>=0.2.0
+Requires-Dist: sibyl-memory-client>=0.4.0
+Requires-Dist: sibyl-memory-hermes>=0.3.2
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"
 

{sibyl_memory_cli-0.1.1 → sibyl_memory_cli-0.1.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sibyl-memory-cli"
-version = "0.1.1"
+version = "0.1.3"
 description = "Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats."
 authors = [{ name = "SIBYL, Sibyl Labs LLC", email = "sibyl@sibyllabs.org" }]
 license = { text = "MIT" }
@@ -23,8 +23,8 @@ classifiers = [
   "Topic :: Software Development :: Libraries :: Python Modules",
 ]
 dependencies = [
-  "sibyl-memory-client>=0.3.0",
-  "sibyl-memory-hermes>=0.2.0",
+  "sibyl-memory-client>=0.4.0",
+  "sibyl-memory-hermes>=0.3.2",
 ]
 
 [project.optional-dependencies]

{sibyl_memory_cli-0.1.1 → sibyl_memory_cli-0.1.3}/src/sibyl_memory_cli/__init__.py

@@ -13,6 +13,12 @@ All HTTP calls target https://api.sibyllabs.org/api/plugin/*.
 """
 from .cli import main
 
-__version__ = "0.1.0"
+# Single-sourced from installed metadata so wheel + code can't drift
+# (C3 audit fix v0.1.2). Same pattern as sibyl-memory-hermes v0.3.0+.
+from importlib.metadata import PackageNotFoundError, version as _pkg_version
+try:
+    __version__ = _pkg_version("sibyl-memory-cli")
+except PackageNotFoundError:  # pragma: no cover - source-tree dev only
+    __version__ = "0.0.0+source"
 
 __all__ = ["main", "__version__"]

{sibyl_memory_cli-0.1.1 → sibyl_memory_cli-0.1.3}/src/sibyl_memory_cli/cli.py

@@ -5,7 +5,11 @@ https://api.sibyllabs.org/api/plugin/* and the local SibylMemoryProvider.
 
 Design pillars:
   - Zero non-stdlib deps in this file. urllib is enough.
-  - Credentials are written atomically with 0600 perms.
+  - Credentials are written atomically at mode 0600, set at file-creation
+    time via O_CREAT|O_EXCL|O_NOFOLLOW (no chmod-after-write race).
+  - The URL parameter handed to the browser is an opaque session identifier,
+    not the long-lived bearer (audit SEC-1 — server-side pairing handoff
+    issues a separate bearer at activation completion if available).
   - session_token is never printed in full — display short slice only.
   - Polling has explicit timeouts; no infinite loops.
   - Every command exits with a clear status code (0 ok, 1 user error, 2 server error).
@@ -27,6 +31,18 @@ import webbrowser
 from pathlib import Path
 from typing import Any
 
+
+def _client_version() -> str:
+    """Return the installed package version from metadata, never hardcoded."""
+    try:
+        from importlib.metadata import PackageNotFoundError, version as _v
+        try:
+            return _v("sibyl-memory-cli")
+        except PackageNotFoundError:
+            return "0.0.0+source"
+    except Exception:
+        return "0.0.0+source"
+
 # ---- Defaults ----------------------------------------------------------
 
 API_BASE = os.environ.get("SIBYL_API_BASE", "https://api.sibyllabs.org")
@@ -101,7 +117,7 @@ def http_request(
     """Single source of truth for HTTP calls. Returns parsed JSON or raises HttpError."""
     url = f"{API_BASE}{path}"
     data = None
-    full_headers = {"Accept": "application/json", "User-Agent": "sibyl-memory-cli/0.1.0"}
+    full_headers = {"Accept": "application/json", "User-Agent": f"sibyl-memory-cli/{_client_version()}"}
     if body is not None:
         data = json.dumps(body).encode("utf-8")
         full_headers["Content-Type"] = "application/json"
@@ -124,20 +140,45 @@ def http_request(
 # ---- Credentials I/O ---------------------------------------------------
 
 def write_credentials_atomic(creds: dict, path: Path = DEFAULT_CRED_PATH) -> Path:
-    """Write credentials.json atomically at mode 0600."""
+    """Write credentials.json atomically at mode 0600.
+
+    v0.1.2 hardening (audit SEC-2): mode 0600 is set by the kernel at
+    file-creation time via O_CREAT|O_EXCL|O_NOFOLLOW. Previously used
+    write_text() followed by os.chmod(), leaving a world-readable window
+    between syscalls every credential save.
+    """
     path = path.expanduser()
     path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    data = json.dumps(creds, indent=2).encode("utf-8")
     tmp = path.with_suffix(path.suffix + ".tmp")
-    tmp.write_text(json.dumps(creds, indent=2), encoding="utf-8")
-    os.chmod(tmp, 0o600)
-    tmp.replace(path)
+    # Clean any leftover .tmp from a crashed prior write so O_EXCL can succeed.
+    try:
+        os.unlink(tmp)
+    except FileNotFoundError:
+        pass
+    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    fd = os.open(str(tmp), flags, 0o600)
+    try:
+        os.write(fd, data)
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+    os.replace(str(tmp), str(path))
     return path
 
 
 def read_credentials(path: Path = DEFAULT_CRED_PATH) -> dict | None:
+    """Read credentials.json.
+
+    v0.1.2 hardening (audit SEC-11): refuses to follow symlinks.
+    Returns None if the file is a symlink or doesn't exist."""
     path = path.expanduser()
     if not path.exists():
         return None
+    if path.is_symlink():
+        return None
     return json.loads(path.read_text(encoding="utf-8"))
 
 
@@ -180,10 +221,18 @@ def cmd_init(args: argparse.Namespace) -> int:
         print_status("Credentials", str(cred_path))
         return 0
 
-    session_token = str(uuid.uuid4())
+    # SEC-1 mitigation (v0.1.2): the URL parameter is an opaque pairing
+    # session identifier, NOT the long-lived bearer used by /access and
+    # /check-write. The CLI generates it locally and the server treats
+    # it as the activation rendezvous key only. The persistent bearer
+    # is issued by the server in the /check response (`bearer_token`
+    # field) after activation completes. Servers running pre-SEC-1
+    # firmware that echo the URL identifier as the bearer still work —
+    # we use whichever the server returns in the bound credentials.
+    session_id = str(uuid.uuid4())
     pairing_code = _gen_pairing_code()
-    code_hash = _hash_pairing_code(pairing_code, session_token)
-    activate_url = f"{ACTIVATE_BASE}?session={session_token}"
+    code_hash = _hash_pairing_code(pairing_code, session_id)
+    activate_url = f"{ACTIVATE_BASE}?session={session_id}"
 
     # Pre-register the session + pairing code hash with the server.
     # The code itself never leaves the user's machine until they type it
@@ -193,12 +242,12 @@ def cmd_init(args: argparse.Namespace) -> int:
             "POST",
             "/api/plugin/session-init",
             body={
-                "session": session_token,
+                "session": session_id,
                 "pairing_code_hash": code_hash,
                 "env": {
                     "os_family": _detect_os_family(),
                     "install_method": "cli",
-                    "client_version": __import__("sibyl_memory_cli").__version__,
+                    "client_version": _client_version(),
                 },
             },
             timeout=10.0,
@@ -211,7 +260,7 @@ def cmd_init(args: argparse.Namespace) -> int:
     print()
     print(bold("Sibyl Memory Plugin · activation"))
     print()
-    print(f"  {dim('Session:')}     {short(session_token)}")
+    print(f"  {dim('Session:')}     {short(session_id)}")
     # Format the code with a visual break to make it easier to read off the screen
     print(f"  {dim('Code:')}        {bold(pairing_code[:3] + ' ' + pairing_code[3:])}   {dim('(use this in the email panel)')}")
     print(f"  {dim('Opening:')}     {activate_url}")
@@ -232,7 +281,7 @@ def cmd_init(args: argparse.Namespace) -> int:
 
     while time.time() < deadline:
         try:
-            resp = http_request("GET", f"/api/plugin/check?session={urllib.parse.quote(session_token)}", timeout=10.0)
+            resp = http_request("GET", f"/api/plugin/check?session={urllib.parse.quote(session_id)}", timeout=10.0)
         except HttpError as e:
             if e.status in (404, 503, 0):
                 # Session not yet created server-side, or transient — keep polling
@@ -244,12 +293,23 @@ def cmd_init(args: argparse.Namespace) -> int:
 
         if resp.get("bound") and resp.get("credentials"):
             creds = resp["credentials"]
-            # Sanity check: the server's session_token field MUST match what we sent
-            if creds.get("session_token") and creds["session_token"] != session_token:
+            # SEC-1: prefer the server-issued bearer_token (post-fix) over
+            # echoing the URL pairing-session id. Servers running pre-SEC-1
+            # firmware echo `session_token` back as the bearer — we use
+            # whichever the server returns. The CLI's session_id (URL
+            # identifier) is the rendezvous key, not the persistent bearer.
+            bearer = creds.get("bearer_token") or creds.get("session_token")
+            if not bearer:
+                # Fallback: pre-SEC-1 server flow where neither field is
+                # echoed back — inject the pairing session id so subsequent
+                # /access and /check-write calls have something to send.
+                bearer = session_id
+            # Sanity check on echoed session_token (pre-SEC-1 flow only)
+            if creds.get("session_token") and creds["session_token"] != session_id \
+                    and not creds.get("bearer_token"):
                 print(red("\nSession token mismatch — refusing to write credentials."))
                 return 2
-            # If server didn't echo session_token, inject our locally-generated one
-            creds.setdefault("session_token", session_token)
+            creds["session_token"] = bearer
             path = write_credentials_atomic(creds, cred_path)
             print(f"\r{' ' * 80}\r", end="")  # clear spinner line
             print(green("✓ Activated."))
@@ -259,9 +319,18 @@ def cmd_init(args: argparse.Namespace) -> int:
             print_status("Email", creds.get("email") or "—")
             print_status("Credentials", str(path))
             print()
-            print(dim("Wire the provider into Hermes:"))
+            print(dim("Activate Sibyl in Hermes:"))
+            print(dim("    sibyl-memory-hermes install-plugin"))
+            print(dim("    # then edit ~/.hermes/config.yaml:"))
+            print(dim("    #   memory:"))
+            print(dim("    #     provider: sibyl"))
+            print()
+            print(dim("Or use the MCP server (Claude Code / Codex / Cursor / Continue):"))
+            print(dim("    pip install sibyl-memory-mcp"))
+            print()
+            print(dim("Or call the SDK directly from any Python orchestration:"))
             print(dim("    from sibyl_memory_hermes import SibylMemoryProvider"))
-            print(dim("    agent = Agent(memory=SibylMemoryProvider())"))
+            print(dim("    provider = SibylMemoryProvider()"))
             return 0
 
         # Spinner tick

{sibyl_memory_cli-0.1.1 → sibyl_memory_cli-0.1.3}/src/sibyl_memory_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sibyl-memory-cli
-Version: 0.1.1
+Version: 0.1.3
 Summary: Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats.
 Author-email: "SIBYL, Sibyl Labs LLC" <sibyl@sibyllabs.org>
 License: MIT
@@ -18,8 +18,8 @@ Classifier: Environment :: Console
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: sibyl-memory-client>=0.3.0
-Requires-Dist: sibyl-memory-hermes>=0.2.0
+Requires-Dist: sibyl-memory-client>=0.4.0
+Requires-Dist: sibyl-memory-hermes>=0.3.2
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"
 

sibyl_memory_cli-0.1.3/src/sibyl_memory_cli.egg-info/requires.txt

@@ -0,0 +1,5 @@
+sibyl-memory-client>=0.4.0
+sibyl-memory-hermes>=0.3.2
+
+[dev]
+pytest>=7.0

sibyl_memory_cli-0.1.1/src/sibyl_memory_cli.egg-info/requires.txt

@@ -1,5 +0,0 @@
-sibyl-memory-client>=0.3.0
-sibyl-memory-hermes>=0.2.0
-
-[dev]
-pytest>=7.0