sibyl-memory-cli 0.3.10__tar.gz → 0.3.13__tar.gz

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sibyl-memory-cli
-Version: 0.3.10
+Version: 0.3.13
 Summary: Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats, `sibyl whoami` gives a one-line account summary, `sibyl devices` lists active devices and supports per-device revoke.
 Author-email: "SIBYL, Sibyl Labs LLC" <sibyl@sibyllabs.org>
 License: MIT

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.13}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sibyl-memory-cli"
-version = "0.3.10"
+version = "0.3.13"
 description = "Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats, `sibyl whoami` gives a one-line account summary, `sibyl devices` lists active devices and supports per-device revoke."
 authors = [{ name = "SIBYL, Sibyl Labs LLC", email = "sibyl@sibyllabs.org" }]
 license = { text = "MIT" }

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.13}/src/sibyl_memory_cli/cli.py

@@ -163,6 +163,13 @@ def write_credentials_atomic(creds: dict, path: Path = DEFAULT_CRED_PATH) -> Pat
     """
     path = path.expanduser()
     path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    # mkdir's mode is ignored when the dir already exists (bug, dor_alpha 2026-06-01):
+    # a pre-existing 0755 ~/.sibyl-memory left credentials world-readable. Tighten
+    # explicitly to cover the pre-existing-directory case.
+    try:
+        os.chmod(path.parent, 0o700)
+    except OSError:
+        pass
     data = json.dumps(creds, indent=2).encode("utf-8")
     tmp = path.with_suffix(path.suffix + ".tmp")
     # Clean any leftover .tmp from a crashed prior write so O_EXCL can succeed.
@@ -548,7 +555,15 @@ def cmd_status(args: argparse.Namespace) -> int:
     tier_cache = Path(args.tier_cache).expanduser()
     if tier_cache.exists():
         cache = json.loads(tier_cache.read_text(encoding="utf-8"))
-        print(a.kv("Tier cache", f"{cache.get('tier','?')} (checked {cache.get('checked_at','?')[:19]})"))
+        # checked_at is written by _capcheck.py as epoch seconds (float), but
+        # older caches / future formats may carry an ISO string. Render both;
+        # never index a float (TypeError on every `sibyl status` run with a
+        # populated tier cache; Discord report 2026-06-10).
+        checked = cache.get("checked_at")
+        if isinstance(checked, (int, float)) and not isinstance(checked, bool):
+            checked = time.strftime("%Y-%m-%dT%H:%M:%S", time.gmtime(checked))
+        checked = str(checked)[:19] if checked else "?"
+        print(a.kv("Tier cache", f"{cache.get('tier','?')} (checked {checked})"))
     else:
         print(a.kv("Tier cache", "—"))
 
@@ -1049,7 +1064,7 @@ def cmd_migrate(args: argparse.Namespace) -> int:
     io = _migrate_io()
     report = M.run_guided_setup(
         home=home, cwd=cwd, db_path=db_path, backup_parent=backup_parent,
-        io=io, debloat=not args.no_debloat,
+        io=io, debloat=not args.no_debloat, force=getattr(args, "force", False),
     )
 
     ph = report.get("phases", {})
@@ -1189,6 +1204,11 @@ def build_parser() -> argparse.ArgumentParser:
         "--yes", "-y", action="store_true",
         help="Skip the initial confirm (the trim step still always asks separately)",
     )
+    p_migrate.add_argument(
+        "--force", action="store_true",
+        help="Overwrite an existing non-sibyl memory provider when wiring a harness "
+             "(without this, migrate stops at that harness and tells you to re-run with --force)",
+    )
     p_migrate.set_defaults(func=cmd_migrate)
 
     return p

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.13}/src/sibyl_memory_cli/migrate.py

@@ -330,7 +330,7 @@ class GuidedIO:
 def run_guided_setup(*, home=None, cwd=None, db_path=None, backup_parent=None,
                      io: Optional[GuidedIO] = None, wirers: Optional[dict] = None,
                      extract_fn: Optional[Callable[[Path, Path], None]] = None,
-                     debloat: bool = True, now=None) -> dict:
+                     debloat: bool = True, force: bool = False, now=None) -> dict:
     """The assembled guided flow: backup -> auto-wire each harness (instructions on
     failure) -> extraction handoff -> verify -> confirmed debloat. Returns a structured
     report. `extract_fn(backup_dir, db_path)` performs/simulates extraction; default
@@ -367,7 +367,7 @@ def run_guided_setup(*, home=None, cwd=None, db_path=None, backup_parent=None,
         if w.current_state().get("wired_with_sibyl"):
             wire_report[name] = "already"
             continue
-        outcome = w.wire()
+        outcome = w.wire(force=force)
         wire_report[name] = outcome.status
         if outcome.status not in ("wired", "already"):
             io.say(f"{name}: auto-wire incomplete ({outcome.message}). Do this manually:")

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.13}/src/sibyl_memory_cli/setup.py

@@ -222,6 +222,15 @@ class HermesWirer:
             loaded = yaml.safe_load(raw)
             if isinstance(loaded, dict):
                 cfg = loaded
+            elif loaded is not None:
+                # Fail fast: a non-mapping top level means the config is not
+                # something we can merge into. Silently reinitializing would
+                # destroy the user's existing Hermes settings.
+                raise ValueError(
+                    f"{self.config_path} top level is not a YAML mapping "
+                    f"(got {type(loaded).__name__}). Fix the file or move it "
+                    "aside and re-run; it was not modified."
+                )
         if not isinstance(cfg.get("memory"), dict):
             cfg["memory"] = {}
         cfg["memory"]["provider"] = "sibyl"
@@ -338,6 +347,7 @@ class ClaudeCodeWirer:
         settings_exists = self.settings_path.exists()
         mcp_servers: dict = {}
         sibyl_block: Optional[dict] = None
+        settings_parse_error: Optional[str] = None
         if settings_exists:
             try:
                 cfg = json.loads(self.settings_path.read_text(encoding="utf-8"))
@@ -346,8 +356,8 @@ class ClaudeCodeWirer:
                     if isinstance(raw_servers, dict):
                         mcp_servers = raw_servers
                         sibyl_block = mcp_servers.get("sibyl-memory")
-            except Exception:
-                pass
+            except Exception as e:
+                settings_parse_error = f"{type(e).__name__}: {e}"
         mcp_binary = self._mcp_binary_found()
         cli_registered = self._registered_via_cli()  # None when no `claude` CLI
         # Source of truth: when the claude CLI exists, trust `claude mcp get` (where
@@ -359,6 +369,7 @@ class ClaudeCodeWirer:
         return {
             "settings_path": str(self.settings_path),
             "settings_exists": settings_exists,
+            "settings_parse_error": settings_parse_error,
             "mcp_servers_count": len(mcp_servers),
             "sibyl_mcp": sibyl_block,
             "mcp_binary_found": mcp_binary,
@@ -392,8 +403,17 @@ class ClaudeCodeWirer:
         if rc != 0:
             return WireOutcome(self.name, "error",
                 f"`claude mcp add` failed (exit {rc}): {(err or out).strip()[:200]}")
+        # Post-wire verification (bug, cryptoxdylan 2026-06-01): a 0 exit from
+        # `claude mcp add` has been observed to not guarantee discovery. Confirm the
+        # server actually shows in `claude mcp get`, and surface concrete remediation
+        # instead of reporting a false success that leaves the MCP absent from /mcp.
+        if self._registered_via_cli() is False:
+            return WireOutcome(self.name, "error",
+                "ran `claude mcp add` (exit 0) but the server is not in `claude mcp list`. "
+                "restart Claude Code, then run `claude mcp list`; if still absent, run "
+                f"`claude mcp add --scope user {self.MCP_NAME} -- {binpath}` manually.")
         return WireOutcome(self.name, "wired",
-            "Registered sibyl-memory with Claude Code via `claude mcp add --scope user`.")
+            "Registered sibyl-memory with Claude Code via `claude mcp add --scope user` (verified in `claude mcp list`).")
 
     def wire(self, *, force: bool = False, dry_run: bool = False,
              prompt_fn: Optional[Callable[..., str]] = None) -> WireOutcome:
@@ -484,12 +504,27 @@ class ClaudeCodeWirer:
     def _write_settings_with_sibyl(self) -> None:
         cfg: dict = {}
         if self.settings_path.exists():
-            try:
-                loaded = json.loads(self.settings_path.read_text(encoding="utf-8"))
+            raw = self.settings_path.read_text(encoding="utf-8")
+            if raw.strip():
+                try:
+                    loaded = json.loads(raw)
+                except ValueError as e:
+                    # Fail fast: never atomically replace a corrupt settings.json
+                    # with a sibyl-only file (that destroys the user's other
+                    # mcpServers, permissions, hooks, env).
+                    raise ValueError(
+                        f"{self.settings_path} is not valid JSON ({e}). "
+                        "Fix the file or move it aside and re-run setup; "
+                        "your settings were not modified."
+                    ) from e
                 if isinstance(loaded, dict):
                     cfg = loaded
-            except Exception:
-                cfg = {}
+                else:
+                    raise ValueError(
+                        f"{self.settings_path} top level is not a JSON object "
+                        f"(got {type(loaded).__name__}). Fix the file or move it "
+                        "aside and re-run setup; your settings were not modified."
+                    )
         if not isinstance(cfg.get("mcpServers"), dict):
             cfg["mcpServers"] = {}
         cfg["mcpServers"]["sibyl-memory"] = self.SIBYL_MCP_BLOCK

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.13}/src/sibyl_memory_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sibyl-memory-cli
-Version: 0.3.10
+Version: 0.3.13
 Summary: Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats, `sibyl whoami` gives a one-line account summary, `sibyl devices` lists active devices and supports per-device revoke.
 Author-email: "SIBYL, Sibyl Labs LLC" <sibyl@sibyllabs.org>
 License: MIT

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.13}/src/sibyl_memory_cli.egg-info/SOURCES.txt

@@ -13,8 +13,10 @@ src/sibyl_memory_cli.egg-info/entry_points.txt
 src/sibyl_memory_cli.egg-info/requires.txt
 src/sibyl_memory_cli.egg-info/top_level.txt
 tests/test_hermes_install_args.py
+tests/test_init_perms_guard.py
 tests/test_migrate.py
 tests/test_migrate_adversarial.py
+tests/test_migrate_force_2026_06_05.py
 tests/test_orchestrator.py
 tests/test_setup.py
 tests/test_wiring_fix.py

sibyl_memory_cli-0.3.13/tests/test_init_perms_guard.py

@@ -0,0 +1,22 @@
+"""Regression: a pre-existing loose `~/.sibyl-memory` must be tightened to 0700.
+
+`mkdir(mode=0o700)` is a no-op when the directory already exists, so a dir that
+was created earlier at 0755 kept loose permissions on the credentials directory.
+`write_credentials_atomic` now chmods the parent to 0700 explicitly.
+Source: beta security report (dor_alpha, 2026-06-01).
+"""
+import os
+import stat
+from sibyl_memory_cli.cli import write_credentials_atomic
+
+
+def test_preexisting_loose_dir_is_tightened(tmp_path):
+    d = tmp_path / ".sibyl-memory"
+    d.mkdir()
+    os.chmod(d, 0o755)  # simulate a pre-existing loose directory
+    assert stat.S_IMODE(d.stat().st_mode) == 0o755
+
+    write_credentials_atomic({"tenant_id": "t"}, path=d / "credentials.json")
+
+    assert stat.S_IMODE(d.stat().st_mode) == 0o700, "parent dir not tightened to 0700"
+    assert stat.S_IMODE((d / "credentials.json").stat().st_mode) == 0o600

sibyl_memory_cli-0.3.13/tests/test_migrate_force_2026_06_05.py

@@ -0,0 +1,67 @@
+"""Regression (bugflow 2026-06-05): `sibyl migrate --force` must reach the wirers.
+
+Onboarding dead-end: when a detected harness already had a non-sibyl memory
+provider, the wirer refused with "Use --force to overwrite." but
+`run_guided_setup` called `wire()` with no `force`, and `sibyl migrate` had no
+`--force` flag to pass. The flag now threads cli -> run_guided_setup(force=) ->
+wire(force=force).
+"""
+from __future__ import annotations
+
+from sibyl_memory_cli import migrate as M
+from sibyl_memory_cli.setup import WireOutcome
+from sibyl_memory_client import MemoryClient
+
+
+class _RecordingWirer:
+    """A fake harness wirer that records the `force` kwarg it was called with."""
+
+    name = "rec"
+
+    def __init__(self):
+        self.seen_force = None
+
+    def is_present(self):
+        return True
+
+    def current_state(self):
+        return {"wired_with_sibyl": False}
+
+    def wire(self, *, force: bool = False, dry_run: bool = False, prompt_fn=None):
+        self.seen_force = force
+        return WireOutcome(self.name, "wired", "ok")
+
+
+def _home_with_memory(tmp_path):
+    h = tmp_path / "home"
+    (h / "proj").mkdir(parents=True)
+    (h / "proj" / "CLAUDE.md").write_text("# memory\n- a fact worth keeping\n")
+    db = h / ".sibyl-memory" / "memory.db"
+    db.parent.mkdir(parents=True)
+    return h, db
+
+
+def _fake_extract(_backup_dir, db_path):
+    MemoryClient.local(str(db_path), tenant_id="qa").set_entity("f", "a", {"v": 1})
+
+
+def test_force_true_threads_to_wirer(tmp_path):
+    h, db = _home_with_memory(tmp_path)
+    rec = _RecordingWirer()
+    M.run_guided_setup(
+        home=h, cwd=h / "proj", db_path=db, backup_parent=tmp_path / "bk",
+        io=M.GuidedIO(scripted=["n"]), wirers={"rec": rec},
+        extract_fn=_fake_extract, force=True,
+    )
+    assert rec.seen_force is True
+
+
+def test_force_defaults_false(tmp_path):
+    h, db = _home_with_memory(tmp_path)
+    rec = _RecordingWirer()
+    M.run_guided_setup(
+        home=h, cwd=h / "proj", db_path=db, backup_parent=tmp_path / "bk",
+        io=M.GuidedIO(scripted=["n"]), wirers={"rec": rec},
+        extract_fn=_fake_extract,
+    )
+    assert rec.seen_force is False

{sibyl_memory_cli-0.3.10 → sibyl_memory_cli-0.3.13}/tests/test_wiring_fix.py

@@ -16,13 +16,20 @@ def _with_cli(monkeypatch):
 
 def _mock_run(monkeypatch, *, get_rc=1, add_rc=0, add_err="boom"):
     calls = []
+    state = {"added": False}
     def fake(cmd, *, timeout=20.0):
         calls.append(cmd)
         if cmd[:3] == ["claude", "mcp", "get"]:
-            return (get_rc, "", "")
+            # Model real CLI state: once a successful `add` has run the server is
+            # registered, so the post-wire verification `get` succeeds. Before that
+            # it returns get_rc (1 = not yet registered).
+            return (0, "", "") if state["added"] else (get_rc, "", "")
         if cmd[:3] == ["claude", "mcp", "add"]:
+            if add_rc == 0:
+                state["added"] = True
             return (add_rc, "", "" if add_rc == 0 else add_err)
         if cmd[:3] == ["claude", "mcp", "remove"]:
+            state["added"] = False
             return (0, "", "")
         return (0, "", "")
     monkeypatch.setattr(S, "_run", fake)