sibyl-memory-cli 0.4.0__tar.gz → 0.4.1__tar.gz

{sibyl_memory_cli-0.4.0/src/sibyl_memory_cli.egg-info → sibyl_memory_cli-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sibyl-memory-cli
-Version: 0.4.0
+Version: 0.4.1
 Summary: Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats, `sibyl whoami` gives a one-line account summary, `sibyl devices` lists active devices and supports per-device revoke.
 Author-email: "SIBYL, Sibyl Labs LLC" <sibyl@sibyllabs.org>
 License: MIT
@@ -17,10 +17,12 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Environment :: Console
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Operating System :: MacOS
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: sibyl-memory-client>=0.8.0
+Requires-Dist: sibyl-memory-client>=0.8.1
 Requires-Dist: sibyl-memory-hermes>=0.4.0
 Requires-Dist: pyyaml<7,>=6.0
 Provides-Extra: mcp
@@ -37,6 +39,8 @@ Command-line interface for the **Sibyl Memory Plugin**.
 pip install sibyl-memory-cli
 ```
 
+Sibyl Memory runs on Linux, macOS (Apple Silicon and Intel), and Windows through WSL2. Native Windows is not supported.
+
 This pulls in `sibyl-memory-client` (the local SDK) and `sibyl-memory-hermes` (the Hermes provider) automatically.
 
 ## Commands

{sibyl_memory_cli-0.4.0 → sibyl_memory_cli-0.4.1}/README.md

@@ -6,6 +6,8 @@ Command-line interface for the **Sibyl Memory Plugin**.
 pip install sibyl-memory-cli
 ```
 
+Sibyl Memory runs on Linux, macOS (Apple Silicon and Intel), and Windows through WSL2. Native Windows is not supported.
+
 This pulls in `sibyl-memory-client` (the local SDK) and `sibyl-memory-hermes` (the Hermes provider) automatically.
 
 ## Commands

{sibyl_memory_cli-0.4.0 → sibyl_memory_cli-0.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sibyl-memory-cli"
-version = "0.4.0"
+version = "0.4.1"
 description = "Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats, `sibyl whoami` gives a one-line account summary, `sibyl devices` lists active devices and supports per-device revoke."
 authors = [{ name = "SIBYL, Sibyl Labs LLC", email = "sibyl@sibyllabs.org" }]
 license = { text = "MIT" }
@@ -21,9 +21,11 @@ classifiers = [
   "Programming Language :: Python :: 3.12",
   "Environment :: Console",
   "Topic :: Software Development :: Libraries :: Python Modules",
+  "Operating System :: POSIX :: Linux",
+  "Operating System :: MacOS",
 ]
 dependencies = [
-  "sibyl-memory-client>=0.8.0",
+  "sibyl-memory-client>=0.8.1",
   "sibyl-memory-hermes>=0.4.0",
   "pyyaml>=6.0,<7",
 ]

{sibyl_memory_cli-0.4.0 → sibyl_memory_cli-0.4.1}/src/sibyl_memory_cli/cli.py

@@ -4,7 +4,9 @@ Stdlib only. The CLI is a thin wrapper around HTTP calls to
 https://api.sibyllabs.org/api/plugin/* and the local SibylMemoryProvider.
 
 Design pillars:
-  - Zero non-stdlib deps in this file. urllib is enough.
+  - Zero HARD non-stdlib deps in this file. urllib is enough; sibyl_memory_client
+    is imported lazily where it helps (tenant resolution, TLS trust) and every
+    such import degrades gracefully when the package is absent.
   - Credentials are written atomically at mode 0600, set at file-creation
     time via O_CREAT|O_EXCL|O_NOFOLLOW (no chmod-after-write race).
   - The URL parameter handed to the browser is an opaque session identifier,
@@ -20,7 +22,9 @@ import argparse
 import hashlib
 import json
 import os
+import platform as _platform
 import secrets
+import ssl
 import sys
 import time
 import urllib.error
@@ -98,6 +102,94 @@ def _detect_os_family() -> str | None:
     return None
 
 
+# ---- platform support policy (2026-09-04) ------------------------------
+#
+# Sibyl Memory runs on Linux, macOS (Apple Silicon and Intel), and Windows
+# through WSL2. Native Windows is not supported. WSL2 is Linux to Python and
+# to us, so it needs no special case beyond the label.
+#
+# "block" refuses `sibyl init` and `sibyl setup` on native Windows. Every
+# other command keeps working on machines that already activated there, so an
+# existing install never loses `status`, `upgrade`, `claim`, `devices`,
+# `logout`, `health`, `memory` or `update`.
+NATIVE_WINDOWS_POLICY = "block"
+NATIVE_WINDOWS_ESCAPE_ENV = "SIBYL_ALLOW_NATIVE_WINDOWS"
+WSL_DOCS_URL = "https://docs.sibyllabs.org/memory/install#windows"
+
+
+def _platform_info() -> tuple[str, str, bool]:
+    """(os_family, human label, supported). WSL2 is Linux to Python and to us.
+
+    The os_family element is deliberately the same vocabulary
+    `_detect_os_family()` returns (`linux|macos|windows`), because telemetry
+    consumers key on it. `unknown` is the one value that function reports as
+    None instead.
+    """
+    p = sys.platform
+    arch = _platform.machine() or "unknown"
+    if p == "darwin":
+        ver = _platform.mac_ver()[0] or ""
+        return "macos", f"macOS {ver} ({arch})".replace("  ", " "), True
+    if p.startswith("linux"):
+        rel = _platform.release().lower()
+        wsl = "microsoft" in rel or bool(os.environ.get("WSL_DISTRO_NAME"))
+        return "linux", ("Linux, WSL2" if wsl else "Linux") + f" ({arch})", True
+    if p.startswith("win"):
+        return "windows", f"Windows {_platform.release()} native ({arch})", False
+    return "unknown", p, False
+
+
+def _is_wsl() -> bool:
+    if not sys.platform.startswith("linux"):
+        return False
+    return "microsoft" in _platform.release().lower() or bool(os.environ.get("WSL_DISTRO_NAME"))
+
+
+def _native_windows_override() -> bool:
+    """True when the user has explicitly opted into the unsupported path."""
+    v = (os.environ.get(NATIVE_WINDOWS_ESCAPE_ENV) or "").strip().lower()
+    return v not in ("", "0", "false", "no", "off")
+
+
+def print_platform_line(*, gate: bool = False) -> int:
+    """Print the platform line. Returns 0 to continue, 1 to refuse.
+
+    `gate=True` is passed by `sibyl init` and `sibyl setup` only. Those are the
+    two commands that stand up a NEW install, and they are the only two the
+    native-Windows block applies to.
+    """
+    family, label, supported = _platform_info()
+    if supported:
+        print(dim(f"  platform  {label} \u00b7 supported"))
+        return 0
+
+    blocked = (
+        gate
+        and family == "windows"
+        and NATIVE_WINDOWS_POLICY == "block"
+        and not _native_windows_override()
+    )
+    paint = red if blocked else yellow
+    print(paint(f"  platform  {label} \u00b7 not supported"))
+
+    if family != "windows":
+        print(yellow("  Sibyl Memory is built and tested on Linux and macOS. This platform is"))
+        print(yellow("  neither, so nothing here is tested or fixed. Continuing anyway."))
+        return 0
+
+    if blocked:
+        print(red("  Sibyl Memory is not supported on native Windows. Install it inside WSL2 and"))
+        print(red(f"  run this command again there: {WSL_DOCS_URL}"))
+        print(red("  Already activated here? status, upgrade, claim, devices and logout keep working."))
+        print(red(f"  To continue unsupported anyway, set {NATIVE_WINDOWS_ESCAPE_ENV}=1."))
+        return 1
+
+    print(yellow("  Sibyl Memory is not supported on native Windows. Run it inside WSL2:"))
+    print(yellow(f"  {WSL_DOCS_URL}"))
+    print(yellow("  Continuing anyway. Nothing on this platform is tested or fixed."))
+    return 0
+
+
 def short(token: str | None) -> str:
     if not token:
         return "—"
@@ -135,6 +227,24 @@ class HttpError(Exception):
         self.url = url
 
 
+def _https_context() -> ssl.SSLContext:
+    """TLS context for every CLI network call (api.sibyllabs.org, pypi.org).
+
+    Prefers the shared certifi-backed trust context from sibyl-memory-client,
+    the fix for macOS framework-build Pythons that ship an empty OpenSSL trust
+    store (the `session-init failed (0)` / `Bind failed` / `server error: 0`
+    class of report). Degrades to the stdlib default context when the client
+    package is absent, mirroring the `_ver_lt` packaging fallback: the CLI
+    stays runnable stdlib-only, just without the Darwin trust fix. Verification
+    is fully on in both branches; nothing here ever weakens it.
+    """
+    try:
+        from sibyl_memory_client._trust import https_context
+    except ImportError:
+        return ssl.create_default_context()
+    return https_context()
+
+
 def http_request(  # noqa: D401
     method: str,
     path: str,
@@ -154,7 +264,7 @@ def http_request(  # noqa: D401
         full_headers.update(headers)
     req = urllib.request.Request(url, data=data, method=method, headers=full_headers)
     try:
-        with urllib.request.urlopen(req, timeout=timeout) as resp:
+        with urllib.request.urlopen(req, timeout=timeout, context=_https_context()) as resp:
             return json.loads(resp.read().decode("utf-8"))
     except urllib.error.HTTPError as e:
         try:
@@ -292,12 +402,16 @@ def cmd_init(args: argparse.Namespace) -> int:
     from ._banner import print_banner
     print_banner()
 
+    # Platform line first, so it shows on --force re-activation too.
+    if print_platform_line(gate=True) != 0:
+        return 1
+
     cred_path = Path(args.credentials).expanduser()
     if cred_path.exists() and not args.force:
         existing = read_credentials(cred_path) or {}
         print(a.section_header("already activated", subtitle="use --force to re-activate"))
         print()
-        print(a.kv("Account", short(existing.get("account_id"))))
+        print(a.kv("Account", existing.get("account_id") or "—"))
         print(a.kv("Tier", (existing.get("tier") or "free").upper(), value_color="accent"))
         print(a.kv("Credentials", str(cred_path)))
         print()
@@ -345,6 +459,9 @@ def cmd_init(args: argparse.Namespace) -> int:
                 "pairing_code_hash": code_hash,
                 "env": {
                     "os_family": _detect_os_family(),
+                    "os_version": _platform.release(),
+                    "arch": _platform.machine(),
+                    "wsl": _is_wsl(),
                     "install_method": "cli",
                     "client_version": _client_version(),
                 },
@@ -439,7 +556,7 @@ def cmd_init(args: argparse.Namespace) -> int:
             print()
             print(a.success_line("Activated."))
             print()
-            print(a.kv("Account", short(creds.get("account_id"))))
+            print(a.kv("Account", creds.get("account_id") or "—"))
             print(a.kv("Tier", (creds.get("tier") or "free").upper(), value_color="accent"))
             print(a.kv("Wallet", creds.get("wallet") or "—"))
             print(a.kv("Email", creds.get("email") or "—"))
@@ -508,7 +625,7 @@ def cmd_upgrade(args: argparse.Namespace) -> int:
     print()
     print(a.section_header("upgrade", subtitle="lift the 5 MB free-tier cap"))
     print()
-    print(a.kv("Account", short(account_id)))
+    print(a.kv("Account", account_id or "—"))
     print(a.kv("Current tier", current_tier.upper(), value_color="accent"))
     # F3 (red-team 2026-06-17): never print the bearer to stdout (terminal
     # scrollback / tmux / CI logs / screen-shares) — restores the invariant
@@ -672,11 +789,14 @@ def cmd_status(args: argparse.Namespace) -> int:
     # Local view
     print(a.eyebrow("local"))
     print(a.kv("Credentials", str(cred_path)))
-    print(a.kv("Account", short(creds.get("account_id"))))
+    print(a.kv("Account", creds.get("account_id") or "—"))
     print(a.kv("Tier", (creds.get("tier") or "free").upper(), value_color="accent"))
     print(a.kv("Wallet", creds.get("wallet") or "—"))
     print(a.kv("Email", creds.get("email") or "—"))
     print(a.kv("Issued", creds.get("issued_at") or "—"))
+    _family, plat_label, plat_ok = _platform_info()
+    print(a.kv("Platform", plat_label if plat_ok else f"{plat_label} \u00b7 unsupported",
+               value_color="ink" if plat_ok else "warn"))
 
     db_path = Path(args.db).expanduser()
     if db_path.exists():
@@ -695,11 +815,20 @@ def cmd_status(args: argparse.Namespace) -> int:
             # write burst (committed pages still in memory.db-wal), so the
             # displayed size/percentage would otherwise disagree with the gate.
             from sibyl_memory_client.storage import db_size_bytes
+            from sibyl_memory_client._capcheck import FREE_TIER_CAP_BYTES, PAID_TIERS
 
             size = db_size_bytes(db_path)
-            pct = size / 2_097_152 * 100
-            size_label = f"{size:,} bytes ({size / (1024 * 1024):.2f} MB · {pct:.1f}% of free cap)"
-            size_color = "warn" if pct > 80 else "soft"
+            # Panel fix 2026-09-04: the divisor was a hardcoded pre-2026-08-06
+            # 2 MiB; the free cap is FREE_TIER_CAP_BYTES (5 MiB). And a paid
+            # tier has no cap, so no percentage is shown for it.
+            tier_now = (creds.get("tier") or "free") if creds else "free"
+            if tier_now in PAID_TIERS:
+                size_label = f"{size:,} bytes ({size / (1024 * 1024):.2f} MB · uncapped)"
+                size_color = "soft"
+            else:
+                pct = size / FREE_TIER_CAP_BYTES * 100
+                size_label = f"{size:,} bytes ({size / (1024 * 1024):.2f} MB · {pct:.1f}% of free cap)"
+                size_color = "warn" if pct > 80 else "soft"
             print(a.kv("DB path", str(db_path)))
             print(a.kv("DB size", size_label, value_color=size_color))
     else:
@@ -852,16 +981,95 @@ def cmd_whoami(args: argparse.Namespace) -> int:
     wallet = creds.get("wallet") if full else _mask_wallet(creds.get("wallet"))
 
     print()
-    print(f"  {a.color('account', a.INK_FAINT)}  {a.bold(short(acct))}  {a.dim(a.GLYPH_DOT)}  {a.gradient_gold(tier)}")
+    print(f"  {a.color('account', a.INK_FAINT)}  {a.bold(acct or "—")}  {a.dim(a.GLYPH_DOT)}  {a.gradient_gold(tier)}")
     print(f"  {a.color('wallet ', a.INK_FAINT)}  {a.color(wallet or '—', a.INK)}")
     print(f"  {a.color('email  ', a.INK_FAINT)}  {a.color(email or '—', a.INK)}")
-    os_label = _detect_os_family() or "unknown"
-    device_line = f"sibyl-memory-cli/{_client_version()} {os_label}"
+    _family, plat_label, plat_ok = _platform_info()
+    device_line = f"sibyl-memory-cli/{_client_version()} {plat_label}"
+    if not plat_ok:
+        device_line += " \u00b7 unsupported"
     print(f"  {a.color('device ', a.INK_FAINT)}  {a.dim(device_line)}")
     print()
     return 0
 
 
+# ---- `sibyl claim` -----------------------------------------------------
+
+def _looks_like_checkout_code(cs: str) -> bool:
+    """Mirror of the server's CS_ID_RE without importing re: cs_ prefix,
+    optional test_/live_ marker, then 10..240 alphanumerics."""
+    if not cs.startswith("cs_"):
+        return False
+    rest = cs[3:]
+    for marker in ("test_", "live_"):
+        if rest.startswith(marker):
+            rest = rest[len(marker):]
+            break
+    return 10 <= len(rest) <= 240 and rest.isalnum()
+
+
+def cmd_claim(args: argparse.Namespace) -> int:
+    """Link a card purchase (Stripe checkout) to this account.
+
+    Buy-before-install: the page after checkout shows the buyer their
+    checkout code (cs_...). This redeems it onto the account activated on
+    this machine — email or wallet activation both work. The bearer rides
+    along as session_token so the server verifies the caller controls the
+    destination account, not just the receipt.
+    """
+    cs = (getattr(args, "checkout_code", "") or "").strip()
+    if not _looks_like_checkout_code(cs):
+        print(a.warn_line("That does not look like a checkout code."))
+        print(a.dim("  It starts with cs_ and appears on the page you landed on after paying"))
+        print(a.dim("  (sibyllabs.org/pro/welcome). Copy the whole code."))
+        return 1
+
+    creds = read_credentials(Path(args.credentials).expanduser())
+    if not creds or not creds.get("account_id"):
+        print(a.warn_line("Not activated."))
+        print(a.dim("  Run `sibyl init` first, then `sibyl claim` again."))
+        return 1
+    account_id = creds["account_id"]
+
+    body: dict = {"cs": cs, "account_id": account_id}
+    token = creds.get("bearer_token") or creds.get("session_token")
+    if token:
+        body["session_token"] = token
+
+    try:
+        resp = http_request("POST", "/api/plugin/stripe-claim", body=body)
+    except HttpError as e:
+        msg = e.body.get("error") if isinstance(e.body, dict) else None
+        print(a.warn_line(f"Claim failed ({e.status or 'network'})."))
+        if msg:
+            print(a.dim(f"  {msg}"))
+        if e.status == 403:
+            print(a.dim("  This session does not match the account. Run `sibyl init`, then retry."))
+        elif e.status == 0:
+            print(a.dim("  Could not reach the server. Check your connection and retry."))
+        return 1
+
+    tier = (resp.get("tier") or "pro").upper()
+    print()
+    print(a.success_line(f"Purchase linked. Tier: {tier}"))
+    if resp.get("expires_at"):
+        print(a.kv("Covers through", str(resp["expires_at"])))
+    print(a.dim("  Run `sibyl status` to see it. Your agent picks it up next session."))
+    print()
+
+    # Sync local state so the very next write sees the new tier.
+    try:
+        creds["tier"] = resp.get("tier") or "pro"
+        write_credentials_atomic(creds, Path(args.credentials).expanduser())
+    except Exception:
+        pass  # server is the source of truth; local hint refreshes on next access check
+    try:
+        invalidate_tier_cache()
+    except Exception:
+        pass
+    return 0
+
+
 # ---- `sibyl devices` ---------------------------------------------------
 
 def cmd_devices(args: argparse.Namespace) -> int:
@@ -1151,7 +1359,7 @@ def _pypi_latest(pkg: str, timeout: float = 4.0) -> str | None:
     url = f"https://pypi.org/pypi/{pkg}/json"
     try:
         req = urllib.request.Request(url, headers={"User-Agent": f"sibyl-memory-cli/{_client_version()}"})
-        with urllib.request.urlopen(req, timeout=timeout) as r:
+        with urllib.request.urlopen(req, timeout=timeout, context=_https_context()) as r:
             data = json.loads(r.read().decode("utf-8"))
         return (data.get("info") or {}).get("version")
     except Exception:
@@ -1429,6 +1637,10 @@ def build_parser() -> argparse.ArgumentParser:
     p_up = sub.add_parser("upgrade", help="Open the upgrade flow (stake or subscribe)")
     p_up.set_defaults(func=cmd_upgrade)
 
+    p_claim = sub.add_parser("claim", help="Link a card purchase to this account (code from sibyllabs.org/pro/welcome)")
+    p_claim.add_argument("checkout_code", help="The cs_... checkout code shown after paying")
+    p_claim.set_defaults(func=cmd_claim)
+
     p_st = sub.add_parser("status", help="Show local + server tier / DB stats")
     p_st.set_defaults(func=cmd_status)
 

{sibyl_memory_cli-0.4.0 → sibyl_memory_cli-0.4.1}/src/sibyl_memory_cli/setup.py

@@ -817,6 +817,13 @@ def cmd_setup(args: argparse.Namespace) -> int:
     print(bold("Sibyl Memory Plugin setup"))
     print()
 
+    # Platform gate. `setup` wires a new machine, so it is one of the two
+    # commands the native-Windows block applies to (see cli.NATIVE_WINDOWS_POLICY).
+    from .cli import print_platform_line
+    if print_platform_line(gate=True) != 0:
+        return 1
+    print()
+
     # Detection
     if skip_present_check:
         detected = wirers

{sibyl_memory_cli-0.4.0 → sibyl_memory_cli-0.4.1/src/sibyl_memory_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sibyl-memory-cli
-Version: 0.4.0
+Version: 0.4.1
 Summary: Command-line interface for the Sibyl Memory Plugin. `sibyl init` activates, `sibyl upgrade` runs the staker / subscription flow, `sibyl status` shows current tier and DB stats, `sibyl whoami` gives a one-line account summary, `sibyl devices` lists active devices and supports per-device revoke.
 Author-email: "SIBYL, Sibyl Labs LLC" <sibyl@sibyllabs.org>
 License: MIT
@@ -17,10 +17,12 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Environment :: Console
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Operating System :: MacOS
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: sibyl-memory-client>=0.8.0
+Requires-Dist: sibyl-memory-client>=0.8.1
 Requires-Dist: sibyl-memory-hermes>=0.4.0
 Requires-Dist: pyyaml<7,>=6.0
 Provides-Extra: mcp
@@ -37,6 +39,8 @@ Command-line interface for the **Sibyl Memory Plugin**.
 pip install sibyl-memory-cli
 ```
 
+Sibyl Memory runs on Linux, macOS (Apple Silicon and Intel), and Windows through WSL2. Native Windows is not supported.
+
 This pulls in `sibyl-memory-client` (the local SDK) and `sibyl-memory-hermes` (the Hermes provider) automatically.
 
 ## Commands

{sibyl_memory_cli-0.4.0 → sibyl_memory_cli-0.4.1}/src/sibyl_memory_cli.egg-info/SOURCES.txt

@@ -13,6 +13,7 @@ src/sibyl_memory_cli.egg-info/dependency_links.txt
 src/sibyl_memory_cli.egg-info/entry_points.txt
 src/sibyl_memory_cli.egg-info/requires.txt
 src/sibyl_memory_cli.egg-info/top_level.txt
+tests/test_claim_and_fullid_2026_09_04.py
 tests/test_hermes_install_args.py
 tests/test_init_perms_guard.py
 tests/test_memory_cmd_2026_06_16.py
@@ -21,10 +22,12 @@ tests/test_migrate.py
 tests/test_migrate_adversarial.py
 tests/test_migrate_force_2026_06_05.py
 tests/test_orchestrator.py
+tests/test_platform_gate_2026_09_04.py
 tests/test_prelaunch_fixes_2026_06_25.py
 tests/test_quality_fixes_2026_06_30.py
 tests/test_setup.py
 tests/test_status_stores_2026_06_11.py
 tests/test_superpatch_2026_07_05.py
+tests/test_trust_context_2026_08_25.py
 tests/test_verdict_contract_2026_08_31.py
 tests/test_wiring_fix.py

{sibyl_memory_cli-0.4.0 → sibyl_memory_cli-0.4.1}/src/sibyl_memory_cli.egg-info/requires.txt

@@ -1,4 +1,4 @@
-sibyl-memory-client>=0.8.0
+sibyl-memory-client>=0.8.1
 sibyl-memory-hermes>=0.4.0
 pyyaml<7,>=6.0
 

sibyl_memory_cli-0.4.1/tests/test_claim_and_fullid_2026_09_04.py

@@ -0,0 +1,99 @@
+"""C2 fixes (2026-09-04): full account id on every display surface + `sibyl claim`.
+
+Panel finding (three seats independently): the buy-before-install claim flow
+requires the full 36-char account id, but every CLI surface printed it through
+short() as `12345678…abcd`, making the documented flow unusable. account_id is
+a routing identifier (rides URL querystrings and subscribe calls), not a
+bearer secret; the F3 never-print-the-bearer invariant covers tokens.
+"""
+
+import json
+from pathlib import Path
+
+import pytest
+
+from sibyl_memory_cli import cli
+
+
+ACCT = "11111111-2222-4333-8444-555555555555"
+
+
+@pytest.fixture()
+def creds_file(tmp_path):
+    p = tmp_path / "credentials.json"
+    p.write_text(json.dumps({
+        "account_id": ACCT,
+        "tenant_id": ACCT,
+        "tier": "free",
+        "email": "buyer@example.com",
+        "wallet": None,
+        "issued_at": "2026-09-04T00:00:00Z",
+        "schema_version": 3,
+        "session_token": "22222222-3333-4444-8555-666666666666",
+        "bearer_token": "22222222-3333-4444-8555-666666666666",
+    }))
+    return p
+
+
+class _Args:
+    def __init__(self, **kw):
+        self.__dict__.update(kw)
+
+
+def test_whoami_prints_full_account_id(creds_file, capsys):
+    rc = cli.cmd_whoami(_Args(credentials=str(creds_file), full=False))
+    out = capsys.readouterr().out
+    assert rc == 0
+    assert ACCT in out                       # full 36-char id, verbatim
+    assert "…" not in out.split("account")[1].split("\n")[0]  # no ellipsis on the account line
+
+
+def test_claim_code_validation():
+    assert cli._looks_like_checkout_code("cs_test_a1B2c3D4e5F6g7H8")
+    assert cli._looks_like_checkout_code("cs_live_" + "a" * 24)
+    assert cli._looks_like_checkout_code("cs_" + "z" * 12)
+    assert not cli._looks_like_checkout_code("cs_test_short")       # < 10 after marker
+    assert not cli._looks_like_checkout_code("cs_test_abc123…")     # pasted ellipsis
+    assert not cli._looks_like_checkout_code("pi_123456789012")     # wrong prefix
+    assert not cli._looks_like_checkout_code("")
+
+
+def test_claim_happy_path_posts_and_syncs(creds_file, capsys, monkeypatch):
+    calls = {}
+
+    def fake_http(method, path, *, body=None, **kw):
+        calls["method"], calls["path"], calls["body"] = method, path, body
+        return {"ok": True, "tier": "pro", "subscription_id": "s1", "expires_at": "2026-10-07T00:00:00Z"}
+
+    monkeypatch.setattr(cli, "http_request", fake_http)
+    monkeypatch.setattr(cli, "invalidate_tier_cache", lambda *a, **k: calls.setdefault("cache_cleared", True))
+
+    rc = cli.cmd_claim(_Args(credentials=str(creds_file), checkout_code="cs_test_a1B2c3D4e5F6g7H8"))
+    out = capsys.readouterr().out
+    assert rc == 0
+    assert calls["method"] == "POST" and calls["path"] == "/api/plugin/stripe-claim"
+    assert calls["body"]["cs"] == "cs_test_a1B2c3D4e5F6g7H8"
+    assert calls["body"]["account_id"] == ACCT
+    assert calls["body"]["session_token"] == "22222222-3333-4444-8555-666666666666"  # bearer-bound
+    assert "PRO" in out
+    assert calls.get("cache_cleared") is True
+    # local tier hint synced through the atomic writer
+    assert json.loads(creds_file.read_text())["tier"] == "pro"
+
+
+def test_claim_maps_server_errors(creds_file, capsys, monkeypatch):
+    def fake_http(method, path, *, body=None, **kw):
+        raise cli.HttpError(409, {"error": "this purchase was already claimed to a different account."}, "u")
+
+    monkeypatch.setattr(cli, "http_request", fake_http)
+    rc = cli.cmd_claim(_Args(credentials=str(creds_file), checkout_code="cs_test_a1B2c3D4e5F6g7H8"))
+    out = capsys.readouterr().out
+    assert rc == 1
+    assert "different account" in out
+
+
+def test_claim_requires_activation(tmp_path, capsys):
+    rc = cli.cmd_claim(_Args(credentials=str(tmp_path / "missing.json"), checkout_code="cs_test_a1B2c3D4e5F6g7H8"))
+    out = capsys.readouterr().out
+    assert rc == 1
+    assert "sibyl init" in out

sibyl_memory_cli-0.4.1/tests/test_platform_gate_2026_09_04.py

@@ -0,0 +1,188 @@
+"""Platform support gate (2026-09-04 operator ruling).
+
+Sibyl Memory runs on Linux, macOS (Apple Silicon and Intel), and Windows
+through WSL2. Native Windows is not supported: `sibyl init` and `sibyl setup`
+refuse it, every other command keeps working so existing native-Windows
+accounts never lose `status`, `upgrade`, `claim`, `devices` or `logout`.
+
+Six cases, and for each of them a pin on `_detect_os_family()`, whose return
+vocabulary telemetry consumers key on and which this change must not move.
+"""
+from __future__ import annotations
+
+import platform as _platform
+
+import pytest
+
+from sibyl_memory_cli import cli
+
+
+def _fake(monkeypatch, *, sys_platform, release="", machine="", mac_ver="", env=None):
+    monkeypatch.setattr(cli.sys, "platform", sys_platform, raising=False)
+    monkeypatch.setattr(_platform, "release", lambda: release)
+    monkeypatch.setattr(_platform, "machine", lambda: machine)
+    monkeypatch.setattr(_platform, "mac_ver", lambda: (mac_ver, ("", "", ""), ""))
+    monkeypatch.delenv("WSL_DISTRO_NAME", raising=False)
+    monkeypatch.delenv(cli.NATIVE_WINDOWS_ESCAPE_ENV, raising=False)
+    for k, v in (env or {}).items():
+        monkeypatch.setenv(k, v)
+
+
+# ---------------------------------------------------------------- supported
+
+def test_linux(monkeypatch, capsys):
+    _fake(monkeypatch, sys_platform="linux", release="6.8.0-40-generic", machine="x86_64")
+    assert cli._platform_info() == ("linux", "Linux (x86_64)", True)
+    assert cli._detect_os_family() == "linux"
+    assert cli._is_wsl() is False
+    assert cli.print_platform_line(gate=True) == 0
+    assert "platform  Linux (x86_64) · supported" in capsys.readouterr().out
+
+
+def test_wsl_detected_from_kernel_release(monkeypatch, capsys):
+    _fake(monkeypatch, sys_platform="linux",
+          release="5.15.153.1-microsoft-standard-WSL2", machine="x86_64")
+    assert cli._platform_info() == ("linux", "Linux, WSL2 (x86_64)", True)
+    assert cli._detect_os_family() == "linux"
+    assert cli._is_wsl() is True
+    assert cli.print_platform_line(gate=True) == 0
+    assert "platform  Linux, WSL2 (x86_64) · supported" in capsys.readouterr().out
+
+
+def test_wsl_detected_from_env_alone(monkeypatch, capsys):
+    """A WSL kernel that does not carry 'microsoft' in its release string still
+    exports WSL_DISTRO_NAME. Either signal is enough."""
+    _fake(monkeypatch, sys_platform="linux", release="6.6.36.6", machine="aarch64",
+          env={"WSL_DISTRO_NAME": "Ubuntu"})
+    assert cli._platform_info() == ("linux", "Linux, WSL2 (aarch64)", True)
+    assert cli._detect_os_family() == "linux"
+    assert cli._is_wsl() is True
+    assert cli.print_platform_line(gate=True) == 0
+
+
+def test_macos(monkeypatch, capsys):
+    _fake(monkeypatch, sys_platform="darwin", release="24.6.0", machine="arm64",
+          mac_ver="15.6")
+    assert cli._platform_info() == ("macos", "macOS 15.6 (arm64)", True)
+    assert cli._detect_os_family() == "macos"
+    assert cli.print_platform_line(gate=True) == 0
+    assert "platform  macOS 15.6 (arm64) · supported" in capsys.readouterr().out
+
+
+# ------------------------------------------------------------ native Windows
+
+def test_native_windows_labels_itself_unsupported(monkeypatch):
+    _fake(monkeypatch, sys_platform="win32", release="11", machine="AMD64")
+    assert cli._platform_info() == ("windows", "Windows 11 native (AMD64)", False)
+    assert cli._detect_os_family() == "windows"
+    assert cli._is_wsl() is False
+
+
+def test_native_windows_warns_and_continues_under_warn_policy(monkeypatch, capsys):
+    _fake(monkeypatch, sys_platform="win32", release="11", machine="AMD64")
+    monkeypatch.setattr(cli, "NATIVE_WINDOWS_POLICY", "warn")
+    assert cli.print_platform_line(gate=True) == 0
+    out = capsys.readouterr().out
+    assert "platform  Windows 11 native (AMD64) · not supported" in out
+    assert "Run it inside WSL2" in out
+    assert cli.WSL_DOCS_URL in out
+    assert "Continuing anyway." in out
+
+
+def test_native_windows_blocks_init_and_setup_under_block_policy(monkeypatch, capsys):
+    _fake(monkeypatch, sys_platform="win32", release="11", machine="AMD64")
+    assert cli.NATIVE_WINDOWS_POLICY == "block"   # shipped policy
+    assert cli.print_platform_line(gate=True) == 1
+    out = capsys.readouterr().out
+    assert "platform  Windows 11 native (AMD64) · not supported" in out
+    assert "Install it inside WSL2" in out
+    assert cli.WSL_DOCS_URL in out
+    assert "status, upgrade, claim, devices and logout keep working." in out
+    assert "SIBYL_ALLOW_NATIVE_WINDOWS=1" in out
+
+
+def test_native_windows_escape_hatch_lets_init_through(monkeypatch, capsys):
+    _fake(monkeypatch, sys_platform="win32", release="11", machine="AMD64",
+          env={"SIBYL_ALLOW_NATIVE_WINDOWS": "1"})
+    assert cli.print_platform_line(gate=True) == 0
+    assert "Continuing anyway." in capsys.readouterr().out
+
+
+def test_native_windows_never_blocks_an_ungated_command(monkeypatch, capsys):
+    """The 76 native-Windows activations keep every command except init/setup."""
+    _fake(monkeypatch, sys_platform="win32", release="11", machine="AMD64")
+    assert cli.print_platform_line(gate=False) == 0
+    assert "Continuing anyway." in capsys.readouterr().out
+
+
+# ------------------------------------------------------------------ unknown
+
+def test_unknown_platform_warns_but_never_blocks(monkeypatch, capsys):
+    _fake(monkeypatch, sys_platform="freebsd14", release="14.1-RELEASE", machine="amd64")
+    assert cli._platform_info() == ("unknown", "freebsd14", False)
+    assert cli._detect_os_family() is None
+    assert cli.print_platform_line(gate=True) == 0
+    out = capsys.readouterr().out
+    assert "platform  freebsd14 · not supported" in out
+    assert "built and tested on Linux and macOS" in out
+
+
+# ------------------------------------------- session-init telemetry payload
+
+@pytest.mark.parametrize(
+    "sys_platform,release,machine,expect_family,expect_wsl",
+    [
+        ("linux", "6.8.0-40-generic", "x86_64", "linux", False),
+        ("linux", "5.15.153.1-microsoft-standard-WSL2", "x86_64", "linux", True),
+        ("darwin", "24.6.0", "arm64", "macos", False),
+        ("win32", "11", "AMD64", "windows", False),
+    ],
+)
+def test_session_init_env_keys(monkeypatch, sys_platform, release, machine,
+                               expect_family, expect_wsl):
+    """The three new keys the server records (section 6): os_version, arch, wsl."""
+    _fake(monkeypatch, sys_platform=sys_platform, release=release, machine=machine)
+    assert cli._detect_os_family() == expect_family
+    assert _platform.release() == release
+    assert _platform.machine() == machine
+    assert cli._is_wsl() is expect_wsl
+
+
+def test_init_sends_the_new_env_keys(tmp_path, monkeypatch):
+    """End to end: `sibyl init` posts os_version, arch and wsl to session-init."""
+    _fake(monkeypatch, sys_platform="linux",
+          release="5.15.153.1-microsoft-standard-WSL2", machine="x86_64")
+    seen: dict = {}
+
+    def fake_http(method, path, *, body=None, timeout=15.0, headers=None):
+        if path.startswith("/api/plugin/session-init"):
+            seen.update(body["env"])
+            return {"pairing_ttl_seconds": 300}
+        if path.startswith("/api/plugin/check"):
+            return {"bound": True, "credentials": {
+                "account_id": "acct-1", "tier": "free", "bearer_token": "btok",
+            }}
+        raise AssertionError(f"unexpected call {method} {path}")
+
+    monkeypatch.setattr(cli, "http_request", fake_http)
+    monkeypatch.setattr(cli.webbrowser, "open", lambda *a, **k: True)
+    rc = cli.main(["--credentials", str(tmp_path / "credentials.json"), "init"])
+    assert rc == 0
+    assert seen["os_family"] == "linux"
+    assert seen["os_version"] == "5.15.153.1-microsoft-standard-WSL2"
+    assert seen["arch"] == "x86_64"
+    assert seen["wsl"] is True
+
+
+def test_init_refuses_native_windows_before_it_touches_the_network(tmp_path, monkeypatch):
+    _fake(monkeypatch, sys_platform="win32", release="11", machine="AMD64")
+
+    def fake_http(method, path, **kw):
+        raise AssertionError("init must refuse before calling the server")
+
+    monkeypatch.setattr(cli, "http_request", fake_http)
+    monkeypatch.setattr(cli.webbrowser, "open", lambda *a, **k: True)
+    cred = tmp_path / "credentials.json"
+    rc = cli.main(["--credentials", str(cred), "init"])
+    assert rc == 1
+    assert not cred.exists()

sibyl_memory_cli-0.4.1/tests/test_trust_context_2026_08_25.py

@@ -0,0 +1,78 @@
+"""Darwin trust-store fix (2026-08-25), CLI leg: `sibyl init` on the macOS
+python.org framework build failed every server call with
+`Warning: session-init failed (0)` (CERTIFICATE_VERIFY_FAILED surfacing as
+HttpError status 0). Both CLI network paths, http_request (all
+api.sibyllabs.org calls) and _pypi_latest (update check), now pass the shared
+certifi-backed context from sibyl_memory_client._trust, with a stdlib-default
+fallback when the client package is absent. These tests pin the wiring at both
+call sites and the graceful fallback."""
+from __future__ import annotations
+
+import ssl
+import sys
+import urllib.request
+
+from sibyl_memory_cli import cli
+
+
+class _Resp:
+    def __init__(self, body: bytes = b"{}"):
+        self._body = body
+    def read(self):
+        return self._body
+    def __enter__(self):
+        return self
+    def __exit__(self, *a):
+        return False
+
+
+def _shared_context():
+    from sibyl_memory_client import _trust
+    return _trust.https_context()
+
+
+def test_http_request_passes_trust_context(monkeypatch):
+    captured = {}
+
+    def fake_urlopen(req, timeout=None, context=None):
+        captured["context"] = context
+        return _Resp(b"{\"ok\": true}")
+
+    monkeypatch.setattr(urllib.request, "urlopen", fake_urlopen)
+    out = cli.http_request("GET", "/api/plugin/whoami")
+    assert out == {"ok": True}
+    assert captured["context"] is _shared_context()
+
+
+def test_pypi_latest_passes_trust_context(monkeypatch):
+    captured = {}
+
+    def fake_urlopen(req, timeout=None, context=None):
+        captured["context"] = context
+        return _Resp(b"{\"info\": {\"version\": \"9.9.9\"}}")
+
+    monkeypatch.setattr(urllib.request, "urlopen", fake_urlopen)
+    assert cli._pypi_latest("sibyl-memory-cli") == "9.9.9"
+    assert captured["context"] is _shared_context()
+
+
+def test_fallback_without_client_package(monkeypatch):
+    # sys.modules[name] = None makes the from-import raise ImportError.
+    monkeypatch.setitem(sys.modules, "sibyl_memory_client._trust", None)
+    ctx = cli._https_context()            # must not raise
+    assert isinstance(ctx, ssl.SSLContext)
+    assert ctx.check_hostname is True
+    assert ctx.verify_mode == ssl.CERT_REQUIRED
+
+
+def test_fallback_still_serves_http_request(monkeypatch):
+    monkeypatch.setitem(sys.modules, "sibyl_memory_client._trust", None)
+    captured = {}
+
+    def fake_urlopen(req, timeout=None, context=None):
+        captured["context"] = context
+        return _Resp()
+
+    monkeypatch.setattr(urllib.request, "urlopen", fake_urlopen)
+    assert cli.http_request("GET", "/api/plugin/whoami") == {}
+    assert isinstance(captured["context"], ssl.SSLContext)