sibyl-memory-cli 0.3.10__tar.gz → 0.3.11__tar.gz

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sibyl-memory-cli
-Version: 0.3.10
+Version: 0.3.11
 Summary: Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats, `sibyl whoami` gives a one-line account summary, `sibyl devices` lists active devices and supports per-device revoke.
 Author-email: "SIBYL, Sibyl Labs LLC" <sibyl@sibyllabs.org>
 License: MIT

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.11}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sibyl-memory-cli"
-version = "0.3.10"
+version = "0.3.11"
 description = "Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats, `sibyl whoami` gives a one-line account summary, `sibyl devices` lists active devices and supports per-device revoke."
 authors = [{ name = "SIBYL, Sibyl Labs LLC", email = "sibyl@sibyllabs.org" }]
 license = { text = "MIT" }

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.11}/src/sibyl_memory_cli/cli.py

@@ -163,6 +163,13 @@ def write_credentials_atomic(creds: dict, path: Path = DEFAULT_CRED_PATH) -> Pat
     """
     path = path.expanduser()
     path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    # mkdir's mode is ignored when the dir already exists (bug, dor_alpha 2026-06-01):
+    # a pre-existing 0755 ~/.sibyl-memory left credentials world-readable. Tighten
+    # explicitly to cover the pre-existing-directory case.
+    try:
+        os.chmod(path.parent, 0o700)
+    except OSError:
+        pass
     data = json.dumps(creds, indent=2).encode("utf-8")
     tmp = path.with_suffix(path.suffix + ".tmp")
     # Clean any leftover .tmp from a crashed prior write so O_EXCL can succeed.

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.11}/src/sibyl_memory_cli/setup.py

@@ -392,8 +392,17 @@ class ClaudeCodeWirer:
         if rc != 0:
             return WireOutcome(self.name, "error",
                 f"`claude mcp add` failed (exit {rc}): {(err or out).strip()[:200]}")
+        # Post-wire verification (bug, cryptoxdylan 2026-06-01): a 0 exit from
+        # `claude mcp add` has been observed to not guarantee discovery. Confirm the
+        # server actually shows in `claude mcp get`, and surface concrete remediation
+        # instead of reporting a false success that leaves the MCP absent from /mcp.
+        if self._registered_via_cli() is False:
+            return WireOutcome(self.name, "error",
+                "ran `claude mcp add` (exit 0) but the server is not in `claude mcp list`. "
+                "restart Claude Code, then run `claude mcp list`; if still absent, run "
+                f"`claude mcp add --scope user {self.MCP_NAME} -- {binpath}` manually.")
         return WireOutcome(self.name, "wired",
-            "Registered sibyl-memory with Claude Code via `claude mcp add --scope user`.")
+            "Registered sibyl-memory with Claude Code via `claude mcp add --scope user` (verified in `claude mcp list`).")
 
     def wire(self, *, force: bool = False, dry_run: bool = False,
              prompt_fn: Optional[Callable[..., str]] = None) -> WireOutcome:

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.11}/src/sibyl_memory_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sibyl-memory-cli
-Version: 0.3.10
+Version: 0.3.11
 Summary: Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats, `sibyl whoami` gives a one-line account summary, `sibyl devices` lists active devices and supports per-device revoke.
 Author-email: "SIBYL, Sibyl Labs LLC" <sibyl@sibyllabs.org>
 License: MIT

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.11}/src/sibyl_memory_cli.egg-info/SOURCES.txt

@@ -13,6 +13,7 @@ src/sibyl_memory_cli.egg-info/entry_points.txt
 src/sibyl_memory_cli.egg-info/requires.txt
 src/sibyl_memory_cli.egg-info/top_level.txt
 tests/test_hermes_install_args.py
+tests/test_init_perms_guard.py
 tests/test_migrate.py
 tests/test_migrate_adversarial.py
 tests/test_orchestrator.py

sibyl_memory_cli-0.3.11/tests/test_init_perms_guard.py

@@ -0,0 +1,22 @@
+"""Regression: a pre-existing loose `~/.sibyl-memory` must be tightened to 0700.
+
+`mkdir(mode=0o700)` is a no-op when the directory already exists, so a dir that
+was created earlier at 0755 kept loose permissions on the credentials directory.
+`write_credentials_atomic` now chmods the parent to 0700 explicitly.
+Source: beta security report (dor_alpha, 2026-06-01).
+"""
+import os
+import stat
+from sibyl_memory_cli.cli import write_credentials_atomic
+
+
+def test_preexisting_loose_dir_is_tightened(tmp_path):
+    d = tmp_path / ".sibyl-memory"
+    d.mkdir()
+    os.chmod(d, 0o755)  # simulate a pre-existing loose directory
+    assert stat.S_IMODE(d.stat().st_mode) == 0o755
+
+    write_credentials_atomic({"tenant_id": "t"}, path=d / "credentials.json")
+
+    assert stat.S_IMODE(d.stat().st_mode) == 0o700, "parent dir not tightened to 0700"
+    assert stat.S_IMODE((d / "credentials.json").stat().st_mode) == 0o600

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.11}/tests/test_wiring_fix.py

@@ -16,13 +16,20 @@ def _with_cli(monkeypatch):
 
 def _mock_run(monkeypatch, *, get_rc=1, add_rc=0, add_err="boom"):
     calls = []
+    state = {"added": False}
     def fake(cmd, *, timeout=20.0):
         calls.append(cmd)
         if cmd[:3] == ["claude", "mcp", "get"]:
-            return (get_rc, "", "")
+            # Model real CLI state: once a successful `add` has run the server is
+            # registered, so the post-wire verification `get` succeeds. Before that
+            # it returns get_rc (1 = not yet registered).
+            return (0, "", "") if state["added"] else (get_rc, "", "")
         if cmd[:3] == ["claude", "mcp", "add"]:
+            if add_rc == 0:
+                state["added"] = True
             return (add_rc, "", "" if add_rc == 0 else add_err)
         if cmd[:3] == ["claude", "mcp", "remove"]:
+            state["added"] = False
             return (0, "", "")
         return (0, "", "")
     monkeypatch.setattr(S, "_run", fake)