stacktrace-cli 0.7.0__py3-none-any.whl → 0.7.1__py3-none-any.whl

stacktrace_cli/__init__.py

@@ -2,7 +2,7 @@
 
 import logging as _logging
 
-__version__ = "0.7.0"
+__version__ = "0.7.1"
 
 # Only the daemon attaches a handler (ADR-0048). Without this one, a WARNING
 # logged in any other process would reach Python's last-resort handler and

stacktrace_cli/daemon/cli.py

@@ -210,14 +210,13 @@ def _reject_unobservable_kinds(config: DaemonConfig) -> None:
 
 
 @daemon.command()
-def status() -> None:
+@click.option("--verbose", is_flag=True, help="Include detailed daemon diagnostics.")
+def status(verbose: bool) -> None:
     """Report whether this endpoint is working, without reading a log.
 
-    Every row answers a question someone asks when a machine looks quiet: a
-    watermark hours old means the scanner has stopped; a queue that grows with
-    a reader attached means the reader is not draining; a database that only
-    grows means retention is not pruning; and a configuration without its source
-    makes fleet-wide drift undebuggable (`docs/specs/daemon-scanning.md`).
+    The default output is a quick health check. Pass ``--verbose`` for the
+    diagnostic details used to investigate a quiet or misconfigured machine
+    (`docs/specs/daemon-scanning.md`).
     """
     from stacktrace_cli.build import version_label
 
@@ -242,7 +241,8 @@ def status() -> None:
     if live is not None:
         click.echo(f"version: {live.build}")
         click.echo(f"installed: {version_label()}")
-        click.echo(f"started: {live.started_at}")
+        if verbose:
+            click.echo(f"started: {live.started_at}")
 
     try:
         # One `_store()` call apiece, all against the same file: if the first
@@ -251,9 +251,10 @@ def status() -> None:
         # them can print a partial line before that first failure.
         click.echo(f"watermark: {_watermark_line(paths)}")
         click.echo(f"queue depth: {_queue_line(paths)}")
-        click.echo(f"cursors: {_cursor_line(paths)}")
         click.echo(f"parked: {_parked_line(paths)}")
-        click.echo(f"database: {_database_line(paths)}")
+        if verbose:
+            click.echo(f"cursors: {_cursor_line(paths)}")
+            click.echo(f"database: {_database_line(paths)}")
     except (sqlite3.DatabaseError, ValueError) as exc:
         # A corrupt file or a schema newer than this build reads raises here
         # (`_check_version`'s own refusal) -- precisely the moment the daemon
@@ -263,6 +264,9 @@ def status() -> None:
         click.echo(f"database: unreadable — {exc}")
     click.echo(f"last error: {last_error(paths.log) or 'none reported'}")
 
+    if not verbose:
+        return
+
     try:
         config = _effective_config(live.config if live is not None else None)
     except ValueError as exc:

stacktrace_cli/monitor/server.py

@@ -43,6 +43,10 @@ _ASSETS: dict[str, str] = {
     "/app.js": "app.js",
     "/styles.css": "styles.css",
     "/inventory.js": "inventory.js",
+    # The same icons Fleet's web app ships, copied rather than shared.
+    "/favicon.ico": "favicon.ico",
+    "/icon.svg": "icon.svg",
+    "/apple-icon.png": "apple-icon.png",
     # Vendored rather than fetched, so they are served rather than linked. An
     # allow-list of exact names is why they have to be named here: a font
     # missing from it 404s and the page falls back silently, which is the
@@ -57,6 +61,9 @@ _CONTENT_TYPES: dict[str, str] = {
     "app.js": "text/javascript; charset=utf-8",
     "styles.css": "text/css; charset=utf-8",
     "inventory.js": "text/javascript; charset=utf-8",
+    "favicon.ico": "image/x-icon",
+    "icon.svg": "image/svg+xml",
+    "apple-icon.png": "image/png",
     "fonts/dm-sans-latin.woff2": "font/woff2",
     "fonts/dm-mono-400-latin.woff2": "font/woff2",
     "fonts/dm-mono-500-latin.woff2": "font/woff2",

stacktrace_cli/monitor/site/icon.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" fill="none">
+<rect width="48" height="48" rx="11" fill="#17130e"></rect>
+<g transform="translate(24 24) scale(0.72) translate(-24 -24)"><path d="M38 8H18A8.5 8.5 0 0 0 18 25H20.5" stroke="#ede3d0" stroke-width="5" stroke-linecap="round" fill="none"></path>
+  <path d="M27.5 25H30A8.5 8.5 0 0 1 30 42H12" stroke="#ede3d0" stroke-width="5" stroke-linecap="round" fill="none"></path>
+  <circle cx="38" cy="8" r="5" fill="#e8681f"></circle>
+  <circle cx="12" cy="42" r="5" fill="#e8681f"></circle></g>
+</svg>

stacktrace_cli/monitor/site/index.html

@@ -4,6 +4,9 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Stacktrace — monitor</title>
+<link rel="icon" href="favicon.ico" sizes="any">
+<link rel="icon" href="icon.svg" type="image/svg+xml">
+<link rel="apple-touch-icon" href="apple-icon.png">
 <link rel="stylesheet" href="styles.css">
 </head>
 <body>

stacktrace_cli/remote/cli.py

@@ -15,12 +15,17 @@ openaca's is copied into this repository — not copying it is the point.
 from __future__ import annotations
 
 import json
+import os
+import pwd
+import re
+import sys
 from pathlib import Path
 
 import click
 import httpx
 from openaca.core import KindSelectionError, validate_kind_selection
 
+from stacktrace_cli.build import version_label
 from stacktrace_cli.detector.run import DEFAULT_BUDGET, DEFAULT_SAMPLE_BUDGET
 from stacktrace_cli.options import analyzer_option, resolve_analyzer
 from stacktrace_cli.remote.client import (
@@ -39,6 +44,7 @@ from stacktrace_cli.remote.config import (
 from stacktrace_cli.remote.policy import compile_remote_policy
 from stacktrace_cli.remote.policy_service import (
     ApplyResult,
+    EnrollmentReplacementRequired,
     PolicyServiceError,
     default_policy_service,
 )
@@ -111,7 +117,11 @@ def configure(token: str, api_url: str) -> None:
             # asset id are still the ones in effect. Purging first would delete
             # the backlog they need before the switch away from them ever lands.
             save_remote_config(
-                RemoteConfig(api_url=api_url, token=token, asset_id=preserved_asset_id),
+                RemoteConfig(
+                    api_url=api_url,
+                    token=token,
+                    asset_id=preserved_asset_id,
+                ),
                 config_path,
             )
             if preserved_asset_id is None and existing.asset_id is not None:
@@ -119,11 +129,51 @@ def configure(token: str, api_url: str) -> None:
     except (ConfigError, OSError) as exc:
         raise click.ClickException(str(exc)) from exc
     click.echo(f"Remote configured at {api_url} with token {_mask_token(token)}")
+    _update_policy_enrollment(api_url)
+
+
+def _update_policy_enrollment(api_url: str) -> None:
+    if not _stdin_is_tty():
+        return
+    runtime_version = _policy_runtime_version()
+    if runtime_version is None:
+        click.echo(
+            "Automatic policy sync is not installed; run https://stacktrace.ai/install.sh "
+            "to enable it"
+        )
+        return
+    if runtime_version != version_label():
+        click.echo(
+            f"Automatic policy sync uses stacktrace {runtime_version}; "
+            "rerun https://stacktrace.ai/install.sh to upgrade it"
+        )
+        return
+    click.echo("Updating automatic organization policy sync (administrator approval required)...")
+    try:
+        _install_policy_enrollment(user=_current_user(), api_url=api_url)
+    except PolicyServiceError as exc:
+        raise click.ClickException("automatic policy sync update failed") from exc
+
+
+def _policy_runtime_version() -> str | None:
+    return default_policy_service().runtime_version()
+
+
+def _install_policy_enrollment(*, user: str, api_url: str) -> None:
+    default_policy_service().install_via_sudo(user=user, expected_api_url=api_url)
+
+
+def _stdin_is_tty() -> bool:
+    return sys.stdin.isatty()
+
+
+def _current_user() -> str:
+    return pwd.getpwuid(os.getuid()).pw_name
 
 
 @main.command()
 def status() -> None:
-    """Show remote token and asset status."""
+    """Show remote connection and local asset registration."""
     try:
         config = load_remote_config(get_config_path())
     except ConfigError as exc:
@@ -134,29 +184,22 @@ def status() -> None:
     client = RemoteClient(api_url=config.api_url, token=config.token)
     try:
         me = client.get_me()
-        click.echo(f"Org: {me.org.name} ({me.org.id})")
-        click.echo(f"Token: {me.token.name} ({me.token.id})")
-        if config.asset_id is None:
-            click.echo(NO_ASSET_YET)
-            return
-        asset = client.get_asset(config.asset_id)
     except httpx.TransportError as exc:
         raise click.ClickException(f"Remote API unreachable: {exc}") from exc
     except RemoteClientError as exc:
         raise click.ClickException(str(exc)) from exc
 
-    click.echo(f"Asset: {asset.display_name} ({asset.id})")
-    # Per agent, because an asset has no BOM of its own: one upload per agent
-    # kind, each with its own id.
-    if asset.agents:
-        click.echo("Latest BOM:")
-        for agent in asset.agents:
-            coverage = f" ({agent.composition_coverage})" if agent.composition_coverage else ""
-            click.echo(f"  {agent.agent_kind}: {agent.latest_bom_id or 'none'}{coverage}")
+    # Printed only once `/me` has accepted the token, so it never claims a
+    # connection the server refused.
+    click.echo(f"Connected to {config.api_url}")
+    click.echo(f"Org: {me.org.name} ({me.org.id})")
+    click.echo(f"Token: {me.token.name} ({_mask_token(config.token)})")
+    if config.asset_id is None:
+        click.echo(NO_ASSET_YET)
     else:
-        click.echo("Latest BOM: none — no agent has synced yet")
-    click.echo(f"Last seen: {asset.last_seen_at or 'never'}")
-    click.echo(f"Components: {asset.component_count} components")
+        # Asset detail is a Clerk-authenticated dashboard surface. The local
+        # registration id is the collector-token-safe status this client owns.
+        click.echo(f"Asset: {config.asset_id}")
 
 
 @main.group()
@@ -215,11 +258,27 @@ def policy_apply() -> None:
 @click.option("--api-url", required=True, help="Administrator-confirmed Fleet API origin.")
 def policy_install_service(user: str, api_url: str) -> None:
     """Enroll and install automatic privileged policy reconciliation."""
+    service = default_policy_service()
     try:
-        result = default_policy_service().install(
+        result = service.install(
             user=user,
             expected_api_url=api_url,
         )
+    except EnrollmentReplacementRequired as exc:
+        click.confirm(
+            f"Switch automatic policy sync to {_sanitize_for_terminal(exc.new_org_name)}?\n"
+            "This removes the previous organization's managed policy",
+            abort=True,
+        )
+        try:
+            result = service.install(
+                user=user,
+                expected_api_url=api_url,
+                replace_enrollment=True,
+                confirmed_org_id=exc.new_org_id,
+            )
+        except PolicyServiceError as replacement_exc:
+            raise click.ClickException(replacement_exc.code) from replacement_exc
     except PolicyServiceError as exc:
         raise click.ClickException(exc.code) from exc
     if result.action == "no_policy":
@@ -424,6 +483,22 @@ def _print_upload_result(result: BomUploadResult) -> None:
     click.echo(f"Dashboard: {result.dashboard_url}")
 
 
+#: C0 controls and DEL: newline, carriage return, tab, and ESC (the lead byte
+#: of every ANSI escape sequence) among them. A name from Fleet is whoever
+#: holds a token to that org's own word, not this CLI's — stripping these
+#: before it reaches a destructive confirmation prompt is what keeps it from
+#: rewriting or hiding the warning beside it.
+_UNSAFE_TERMINAL_CHARS = re.compile(r"[\x00-\x1f\x7f]")
+_MAX_PROMPT_NAME_LENGTH = 200
+
+
+def _sanitize_for_terminal(value: str) -> str:
+    cleaned = _UNSAFE_TERMINAL_CHARS.sub("", value)
+    if len(cleaned) > _MAX_PROMPT_NAME_LENGTH:
+        cleaned = cleaned[:_MAX_PROMPT_NAME_LENGTH] + "…"
+    return cleaned
+
+
 def _mask_token(token: str) -> str:
     # Prefix + last 4 — the same last-4 the backend stores for console
     # display — so a user with several tokens can tell which one is
@@ -431,8 +506,8 @@ def _mask_token(token: str) -> str:
     # reveal little; real tokens are ot_ + 20+ chars.
     if token.startswith("ot_"):
         if len(token) >= 23:  # ot_ (3) + 20+ real secret chars
-            return f"ot_...{token[-4:]}"
-        return "ot_..."
+            return f"ot_••••{token[-4:]}"
+        return "ot_••••"
     return "***"
 
 

stacktrace_cli/remote/client.py

@@ -142,43 +142,6 @@ class PolicyEnvelope:
     revision: int
 
 
-@dataclass(frozen=True)
-class AgentStatusResult:
-    """One agent kind composed on an asset.
-
-    Fleet attaches a BOM to an agent rather than to the asset — an endpoint
-    running Claude Code and Cursor has one of each — so this is what
-    identifies an upload. The asset carries no BOM id at all.
-    """
-
-    agent_kind: str
-    agent_id: str | None
-    composition_source: str | None
-    composition_coverage: str | None
-    latest_bom_id: str | None
-    last_seen_at: str | None
-
-
-@dataclass(frozen=True)
-class AssetStatusResult:
-    id: str
-    asset_type: str
-    external_id: str
-    display_name: str
-    owner_clerk_user_id: str | None
-    team_name: str | None
-    metadata: JsonObject
-    last_seen_at: str | None
-    created_at: str
-    # Machine-level aggregates stay on the asset; BOM identity does not. An
-    # asset runs N agent kinds, so "the asset's latest BOM" names nothing —
-    # which is why Fleet moved it to the agent (its ADR-0018) rather than
-    # leaving a field that silently meant "whichever kind uploaded last".
-    component_count: int
-    # Empty for a machine that has registered but never synced.
-    agents: tuple[AgentStatusResult, ...] = ()
-
-
 class RemoteClient:
     def __init__(
         self,
@@ -269,22 +232,6 @@ class RemoteClient:
         """Compatibility surface for the manual one-shot compiler."""
         return self.get_policy_envelope().document
 
-    def get_asset(self, asset_id: str) -> AssetStatusResult:
-        data = self._request("GET", f"/api/v1/assets/{asset_id}")
-        return AssetStatusResult(
-            id=_required_str(data, "id"),
-            asset_type=_required_str(data, "asset_type"),
-            external_id=_required_str(data, "external_id"),
-            display_name=_required_str(data, "display_name"),
-            owner_clerk_user_id=_optional_str(data, "owner_clerk_user_id"),
-            team_name=_optional_str(data, "team_name"),
-            metadata=_required_object(data, "metadata"),
-            last_seen_at=_optional_str(data, "last_seen_at"),
-            created_at=_required_str(data, "created_at"),
-            component_count=_required_int(data, "component_count"),
-            agents=_parse_agents(data),
-        )
-
     def _request(self, method: str, path: str, payload: JsonObject | None = None) -> JsonObject:
         url = f"{self._api_url}{path}"
         delays = [1.0, 4.0]
@@ -386,36 +333,6 @@ def _parse_rejected_sessions(data: JsonObject) -> tuple[RejectedSession, ...]:
     )
 
 
-def _parse_agents(data: JsonObject) -> tuple[AgentStatusResult, ...]:
-    """The asset's `agents` array, absent on a backend that predates it.
-
-    A malformed entry is skipped rather than raising: this feeds `remote
-    status`, a read-only report, and refusing to print an asset because one
-    agent row is odd is worse than printing the rest.
-    """
-    raw = data.get("agents")
-    if not isinstance(raw, list):
-        return ()
-    agents = []
-    for entry in raw:
-        if not isinstance(entry, dict):
-            continue
-        kind = entry.get("agent_kind")
-        if not isinstance(kind, str):
-            continue
-        agents.append(
-            AgentStatusResult(
-                agent_kind=kind,
-                agent_id=_optional_str(entry, "agent_id"),
-                composition_source=_optional_str(entry, "composition_source"),
-                composition_coverage=_optional_str(entry, "composition_coverage"),
-                latest_bom_id=_optional_str(entry, "latest_bom_id"),
-                last_seen_at=_optional_str(entry, "last_seen_at"),
-            )
-        )
-    return tuple(agents)
-
-
 def _optional_int(data: JsonObject, key: str) -> int | None:
     value = data.get(key)
     if value is None:

stacktrace_cli/remote/config.py

@@ -64,7 +64,11 @@ def load_remote_config(path: Path | None = None) -> RemoteConfig:
         raise ConfigError(f"invalid remote config at {config_path}: token must be a string")
     if asset_id is not None and not isinstance(asset_id, str):
         raise ConfigError(f"invalid remote config at {config_path}: asset_id must be a string")
-    return RemoteConfig(api_url=api_url, token=token, asset_id=asset_id)
+    return RemoteConfig(
+        api_url=api_url,
+        token=token,
+        asset_id=asset_id,
+    )
 
 
 def save_remote_config(config: RemoteConfig, path: Path | None = None) -> None:

stacktrace_cli/remote/policy_service.py

@@ -28,7 +28,7 @@ from pathlib import Path
 from typing import Any, Protocol, cast
 
 from stacktrace_cli.remote.client import MeResult, PolicyEnvelope, RemoteClient
-from stacktrace_cli.remote.config import ConfigError, load_remote_config
+from stacktrace_cli.remote.config import ConfigError, RemoteConfig, load_remote_config
 
 JsonObject = dict[str, Any]
 
@@ -47,6 +47,22 @@ class PolicyServiceError(Exception):
         self.code = code
 
 
+def _load_enrollment_config(path: Path) -> RemoteConfig:
+    try:
+        return load_remote_config(path)
+    except ConfigError as exc:
+        raise PolicyServiceError("enrollment_invalid") from exc
+
+
+class EnrollmentReplacementRequired(PolicyServiceError):
+    """A verified token belongs to another organization on the same host."""
+
+    def __init__(self, *, new_org_name: str, new_org_id: str) -> None:
+        super().__init__("re_enrollment_required")
+        self.new_org_name = new_org_name
+        self.new_org_id = new_org_id
+
+
 @dataclass(frozen=True)
 class ServicePaths:
     enrollment: Path
@@ -348,6 +364,8 @@ class PolicyService:
         *,
         user: str,
         expected_api_url: str,
+        replace_enrollment: bool = False,
+        confirmed_org_id: str | None = None,
     ) -> ApplyResult:
         self._require_root()
         account = self._account_resolver(user)
@@ -356,10 +374,8 @@ class PolicyService:
             self._paths.runtime.with_name("python"),
             trusted_uid=self._trusted_uid,
         )
-        try:
-            config = load_remote_config(account.home / ".config" / "stacktrace" / "remote.toml")
-        except ConfigError as exc:
-            raise PolicyServiceError("enrollment_invalid") from exc
+        config_path = account.home / ".config" / "stacktrace" / "remote.toml"
+        config = _load_enrollment_config(config_path)
         if config.token is None:
             raise PolicyServiceError("enrollment_missing")
         if config.api_url.rstrip("/") != expected_api_url.rstrip("/"):
@@ -379,6 +395,16 @@ class PolicyService:
             groups=account.groups,
             home=str(account.home),
         )
+        # Validated unconditionally, before any branch on `existing_enrollment`:
+        # a confirmed replacement call means the administrator approved this
+        # *specific* org from an earlier read. This call re-reads and
+        # re-verifies the config and token from scratch, so a `configure`
+        # racing the open confirm prompt — to a third org, or back to the one
+        # already enrolled — must refuse rather than have the branch below
+        # decide whether anything needs confirming, which would silently
+        # accept an outcome nobody confirmed.
+        if confirmed_org_id is not None and enrollment.org_id != confirmed_org_id:
+            raise PolicyServiceError("enrollment_confirmation_stale")
         _verify_state_storage(self._paths, trusted_uid=self._trusted_uid, create=True)
         with _policy_lock(
             self._paths.lock,
@@ -386,6 +412,20 @@ class PolicyService:
             trusted_uid=self._trusted_uid,
         ) as acquired:
             assert acquired
+            # `config` and `identity` were read before this lock was even
+            # requested, across a network call (`client.get_me()`) that can
+            # pause for a long time. A second, concurrent `configure()` can
+            # have rotated the developer's credentials and had its own
+            # `install()` call win this same lock first, in which case this
+            # call's stale capture must not now overwrite that fresher
+            # enrollment — re-verify the credentials this attempt targeted
+            # are still the ones on disk before touching anything.
+            current_config = _load_enrollment_config(config_path)
+            if (
+                current_config.api_url.rstrip("/") != config.api_url.rstrip("/")
+                or current_config.token != config.token
+            ):
+                raise PolicyServiceError("enrollment_attempt_stale")
             enrollment_exists = _trusted_state_file_exists(
                 self._paths.enrollment,
                 mode=0o600,
@@ -399,19 +439,19 @@ class PolicyService:
             if state_exists and not enrollment_exists:
                 raise PolicyServiceError("state_lost")
             bootstrap_needed = not enrollment_exists
+            replacing_org = False
             if enrollment_exists:
                 existing_enrollment = Enrollment.from_path(self._paths.enrollment)
                 if not state_exists and existing_enrollment.bootstrap_complete:
                     raise PolicyServiceError("state_lost")
-                same_deployment = (
+                same_endpoint = (
                     existing_enrollment.api_url == enrollment.api_url
-                    and existing_enrollment.org_id == enrollment.org_id
                     and existing_enrollment.user == enrollment.user
                     and existing_enrollment.uid == enrollment.uid
                     and existing_enrollment.gid == enrollment.gid
                     and existing_enrollment.home == enrollment.home
                 )
-                if not same_deployment:
+                if not same_endpoint:
                     raise PolicyServiceError("re_enrollment_unsupported")
                 if state_exists:
                     state = PolicyState.from_path(self._paths.state)
@@ -419,6 +459,14 @@ class PolicyService:
                         raise PolicyServiceError("re_enrollment_unsupported")
                 else:
                     state = PolicyState.initial(account.user)
+                if existing_enrollment.org_id != enrollment.org_id:
+                    if not replace_enrollment:
+                        raise EnrollmentReplacementRequired(
+                            new_org_name=identity.org.name,
+                            new_org_id=identity.org.id,
+                        )
+                    replacing_org = True
+                    state = PolicyState.initial(account.user)
                 if not existing_enrollment.bootstrap_complete:
                     if (
                         state != PolicyState.initial(account.user)
@@ -447,7 +495,21 @@ class PolicyService:
                     raise PolicyServiceError("state_lost")
                 state = PolicyState.initial(account.user)
             try:
-                if bootstrap_needed:
+                if replacing_org:
+                    try:
+                        self._manager.uninstall(self._paths)
+                    except (OSError, subprocess.SubprocessError) as exc:
+                        raise PolicyServiceError("service_uninstall_failed") from exc
+                    _remove_artifact(self._paths, trusted_uid=self._trusted_uid)
+                    # The timer is stopped and the previous artifact is gone before
+                    # the org-specific revision anchor changes. Write the reset
+                    # anchor first so a crash cannot leave a new incomplete
+                    # enrollment beside the previous org's revision state.
+                    _atomic_write_json(self._paths.state, state.to_json(), 0o644)
+                    incomplete = replace(enrollment, bootstrap_complete=False)
+                    _atomic_write_json(self._paths.enrollment, incomplete.to_json(), 0o600)
+                    _atomic_write_json(self._paths.enrollment, enrollment.to_json(), 0o600)
+                elif bootstrap_needed:
                     if not enrollment_exists:
                         incomplete = replace(enrollment, bootstrap_complete=False)
                         _atomic_write_json(self._paths.enrollment, incomplete.to_json(), 0o600)
@@ -464,6 +526,51 @@ class PolicyService:
                 raise PolicyServiceError("service_install_failed") from exc
         return self.apply()
 
+    def runtime_version(self) -> str | None:
+        try:
+            _verify_runtime(self._paths.runtime, trusted_uid=self._trusted_uid)
+            _verify_runtime(
+                self._paths.runtime.with_name("python"),
+                trusted_uid=self._trusted_uid,
+            )
+            result = subprocess.run(
+                [str(self._paths.runtime), "--version"],
+                check=True,
+                capture_output=True,
+                text=True,
+                timeout=5,
+            )
+        except (OSError, subprocess.SubprocessError, PolicyServiceError):
+            return None
+        parts = result.stdout.strip().split()
+        if len(parts) < 2 or parts[0] != "stacktrace":
+            return None
+        return parts[1]
+
+    def install_via_sudo(self, *, user: str, expected_api_url: str) -> None:
+        _verify_runtime(self._paths.runtime, trusted_uid=self._trusted_uid)
+        _verify_runtime(
+            self._paths.runtime.with_name("python"),
+            trusted_uid=self._trusted_uid,
+        )
+        try:
+            subprocess.run(
+                [
+                    "/usr/bin/sudo",
+                    str(self._paths.runtime),
+                    "remote",
+                    "policy",
+                    "install-service",
+                    "--user",
+                    user,
+                    "--api-url",
+                    expected_api_url,
+                ],
+                check=True,
+            )
+        except (OSError, subprocess.SubprocessError) as exc:
+            raise PolicyServiceError("policy_service_update_failed") from exc
+
     def uninstall(self) -> None:
         self._require_root()
         _verify_state_storage(self._paths, trusted_uid=self._trusted_uid, create=True)
@@ -1014,6 +1121,24 @@ def _install_artifact(paths: ServicePaths, content: bytes, *, trusted_uid: int)
         os.close(directory_fd)
 
 
+def _remove_artifact(paths: ServicePaths, *, trusted_uid: int) -> None:
+    try:
+        paths.managed_directory.lstat()
+    except FileNotFoundError:
+        return
+    except OSError as exc:
+        raise PolicyServiceError("install_directory_untrusted") from exc
+    directory_fd = _open_trusted_directory(paths, trusted_uid=trusted_uid)
+    try:
+        try:
+            os.unlink(ARTIFACT_NAME, dir_fd=directory_fd)
+        except FileNotFoundError:
+            return
+        os.fsync(directory_fd)
+    finally:
+        os.close(directory_fd)
+
+
 def _open_trusted_directory(
     paths: ServicePaths,
     *,

stacktrace_cli/remote/sync.py

@@ -21,6 +21,7 @@ import fcntl
 import os
 from collections.abc import Callable, Iterator
 from contextlib import contextmanager
+from dataclasses import replace
 from pathlib import Path
 from typing import Any
 
@@ -373,7 +374,12 @@ def _advance_asset_id(*, config: RemoteConfig, config_path: Path, asset_id: str)
                 f"re-addressed {moved} pending upload(s) to the current asset",
                 err=True,
             )
-    new_config = RemoteConfig(api_url=config.api_url, token=config.token, asset_id=asset_id)
+    # Built from `current`, not `config`: every other field must survive this
+    # repoint, including one neither read above nor yet imagined, and `current`
+    # is the freshest on-disk value for all of them (`config`'s copy of fields
+    # other than api_url/token/asset_id can already be stale by the time this
+    # runs, the same way its credentials can).
+    new_config = replace(current, asset_id=asset_id)
     try:
         save_remote_config(new_config, config_path)
     except OSError as exc:

{stacktrace_cli-0.7.0.dist-info → stacktrace_cli-0.7.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stacktrace-cli
-Version: 0.7.0
+Version: 0.7.1
 Summary: CLI for Stacktrace — Detection and Response platform for AI Agents.
 Project-URL: Homepage, https://stacktrace.ai
 Author-email: "Stacktrace AI, Inc" <founders@stacktrace.ai>
@@ -51,7 +51,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.7.0 (openaca 0.8.0)
+stacktrace 0.7.1 (openaca 0.8.0)
 ```
 
 ## Quick start

{stacktrace_cli-0.7.0.dist-info → stacktrace_cli-0.7.1.dist-info}/RECORD

@@ -1,4 +1,4 @@
-stacktrace_cli/__init__.py,sha256=Kc2LCYeh6DI6-UmF0Nj5ISIRydY2SiHYtjb_mpuZvOE,390
+stacktrace_cli/__init__.py,sha256=V6ZJM6RZm-R-GR2nyKgnVM2f6rOQpWclQ5yFgmAWILA,390
 stacktrace_cli/__main__.py,sha256=F_tqj3PRzeBtY-uvBs923H8oc-s9bebhIh6UnAUwNYc,448
 stacktrace_cli/analysis.py,sha256=NZ9ENz65IP1pNztZH_A7zZGz6ywFUCNbJ1NOMrf1094,26969
 stacktrace_cli/build.py,sha256=lXMXBMoQtXC5qVMAWBsJavcVfXPmJiAZgV3cRBqUvyk,4846
@@ -19,7 +19,7 @@ stacktrace_cli/correlate/render.py,sha256=hJZhZcqE4bKAeXIegddY7uViCyp7NAPTQl1cj9
 stacktrace_cli/daemon/__init__.py,sha256=YP0eKpNcRl1GzKO1GXh9gOoigViU2duV-PEOw0lLLwQ,59
 stacktrace_cli/daemon/activity_log.py,sha256=0DRxWBpcDElsbJp6DXYURjxQ1jnJD3snQVyWqvGnnqc,3243
 stacktrace_cli/daemon/bom.py,sha256=Y0DIFTs_srqcgSSUrd5x0eySfMdiN6f0UKBb9SwZ0-M,2231
-stacktrace_cli/daemon/cli.py,sha256=TY5-PG_ROWuuFjqASo0RP-lO9dSHXBJrPlnMQUMA6LA,25664
+stacktrace_cli/daemon/cli.py,sha256=SN55aOpuyo4id3kYw-ZqL2jnuTfhcLAYkXgJNVpq9rw,25653
 stacktrace_cli/daemon/client.py,sha256=Enn2I5eZb0AMBkOAh2z1HCqFTPR4U1jP6l4oDdl8ttY,13928
 stacktrace_cli/daemon/composition.py,sha256=XCwTitMb7co1UMgE_xYQQIeSlPpLQIDaPkt9dlkEiTU,9867
 stacktrace_cli/daemon/config.py,sha256=drY0BGjLSj0ZoGnIedX8i7s7twBr7lA7Z2BjZyMgVEE,12090
@@ -64,12 +64,15 @@ stacktrace_cli/monitor/__init__.py,sha256=akhxzlSGyvbG-3WyC-5Ch5nuYP1E6xga8rzkJ6
 stacktrace_cli/monitor/inventory.py,sha256=chL3wfpmpAqSooXZfMX5-MqIj4m5bbGSzznjnsfz2e8,19640
 stacktrace_cli/monitor/reasoning.py,sha256=wYLxyqsuHf4xfaAygbsA07gUKAozsg6jlL5usHQEzSM,15128
 stacktrace_cli/monitor/render.py,sha256=0YdiBt-TyF_3LmjtiIoliAqntxluxPn_quNa3DfXhUE,34422
-stacktrace_cli/monitor/server.py,sha256=PuQWTktdGZ5ulTubBR8T_Fknzb-JnNwzP8b3DZ7tja8,32435
+stacktrace_cli/monitor/server.py,sha256=XNYV6vZ0FoGcX4qwD64cf-8KM1cDQdN7Sq7GDr5sOzQ,32714
 stacktrace_cli/monitor/state.py,sha256=CdzCU1MmMxLmKbccfVrfggxwuaNi10hfEsHH42EgZdA,10757
 stacktrace_cli/monitor/verdicts.py,sha256=-0IEiaQ1h4DYHuAcgaI14CMNqm5Buqw2J8BmL6-IVJQ,2277
 stacktrace_cli/monitor/watch.py,sha256=1obMQBrcoB-7zCf5JxIEi1PaQn5m-tA0-y8QsYpTzuI,38942
 stacktrace_cli/monitor/site/app.js,sha256=n_zTbQq4xj84uVN9V12fazPENzyiy50hYHrVv_0yG-Y,132729
-stacktrace_cli/monitor/site/index.html,sha256=hkk7keNearyLIoB5CSvLLF2FzIAb8w4DC3YPzfl4C_A,6686
+stacktrace_cli/monitor/site/apple-icon.png,sha256=TF3ch0XTFq53OYnnhs95RWLZunR1uImwXk7wOO8r-9s,10077
+stacktrace_cli/monitor/site/favicon.ico,sha256=wA-ZZy9P4qAvo2P6lQclOyqnBoRNLJ9fs3VPA6R19A0,8089
+stacktrace_cli/monitor/site/icon.svg,sha256=EqgzQS97ZOKFJQIf2HQlhhyW-hJ6oE0f6A2u74igDCk,564
+stacktrace_cli/monitor/site/index.html,sha256=RNeya9nGL49-Eqs6bqbK30aAlGdVWNSaU82T11ki5NM,6842
 stacktrace_cli/monitor/site/inventory.js,sha256=hLLGgSebEdti-m6cGzUrsstGZw_U_s2yA0YzXC70M8Q,24056
 stacktrace_cli/monitor/site/styles.css,sha256=3Y806hzVgrekm2pf_f_Ptb47fBQkIhKcEcDPuYo-07A,49135
 stacktrace_cli/monitor/site/fonts/OFL.txt,sha256=3eGN4fg4dKG6QBHOpLJobIeUAs3eQnmZBiykH5b-TGY,9975
@@ -77,18 +80,18 @@ stacktrace_cli/monitor/site/fonts/dm-mono-400-latin.woff2,sha256=_XUh81MaXM_GVbJ
 stacktrace_cli/monitor/site/fonts/dm-mono-500-latin.woff2,sha256=DiY9tSeXCG52NnnFT4Te2MwSSYebwn3KK9XdRG9tnzY,8724
 stacktrace_cli/monitor/site/fonts/dm-sans-latin.woff2,sha256=qlMHFrDTUYZq99v6Pu5BIPs28tBxuv-MI0GFFBhlx_8,62556
 stacktrace_cli/remote/__init__.py,sha256=Ba5yZEovOFNDWfgj0ycJkvglUTLN3C47RUQyX-r4opI,82
-stacktrace_cli/remote/cli.py,sha256=gG-rNClKkrh9wKWLb6cNBcO0Gy8qbjazqBF_vAZZ9kc,21904
-stacktrace_cli/remote/client.py,sha256=8iIETRe_RL2J8FbEzC3BSEO1gwsztlz3_vvQVy7SHbE,15454
-stacktrace_cli/remote/config.py,sha256=xBTLYfY2OX_JieeIYe3ZCrQqzk2-xKZ8MJfJDXDRlxY,4256
+stacktrace_cli/remote/cli.py,sha256=0sMlAjuAqczi_OvUVoc0ATFqWDg1DC6TG1fkgMxaNdI,24413
+stacktrace_cli/remote/client.py,sha256=bE51_nU0Vy_Iz9J3MWfml_E4JbxidmEYSC8B9ef5kN8,12323
+stacktrace_cli/remote/config.py,sha256=item5B6aqlON58AXSfWrFNiVNVe-ojBi1Fyx_K0F3Rg,4287
 stacktrace_cli/remote/detect_payload.py,sha256=EvdUsVj_5jH4C3f5Zg21D3YRUaUSowjcr_5uVeQNRG0,21643
 stacktrace_cli/remote/identity.py,sha256=CosDLK_k-SzpEveG09NKYz5yzkw1aUq4T4saT5QLIzc,13438
 stacktrace_cli/remote/payload.py,sha256=2lDlwHpA7xT7lfFXY3e-lHNag6g6RTCo-vmgUWEXKWg,17645
 stacktrace_cli/remote/policy.py,sha256=0pDZcPavCTXvul1Zs6oi7-J3K0YoXPNFa3j1aOJG3Zk,3202
-stacktrace_cli/remote/policy_service.py,sha256=SARzxeGZ3glKjN8hxkvZjZFzVvwMFiTcTwG-1bwQEyw,54033
+stacktrace_cli/remote/policy_service.py,sha256=RcCOfbo0HyPkfHd-GjCbsZyFWT728YRE-3ej3rYKvkM,59781
 stacktrace_cli/remote/policy_worker.py,sha256=SGW6TesL5O7D5JO95ZOCmWP9TiQffD5JphBVUHcOG3M,2042
 stacktrace_cli/remote/redact.py,sha256=0J3t2x_a7U-Yt3_aWcGrK_s72LsYSdLUo_ITCRJ_KKU,67631
 stacktrace_cli/remote/spool.py,sha256=uTKUGF5b48RUJyUiTsky_on6tnsi5NHjMljsNSN2LuI,20871
-stacktrace_cli/remote/sync.py,sha256=WW9GK1O_uHmdEBvj48b3X5SP6BQkCcrd1ZRd2qRbKyU,38468
+stacktrace_cli/remote/sync.py,sha256=WA9mRamkglAMltWGf7szfVWbRNQ3fqyVwr8Yc0mvV6Y,38822
 stacktrace_cli/remote/sync_detect.py,sha256=JI0U6RBsmIDZJM5gwgu9EfVYfSU95y_OnOWY1F3X8og,23043
 stacktrace_cli/remote/upload_contract.py,sha256=dITNGtjAkCLzCWczSzm99dnWsXmilM-4wEk22qcYiOc,45879
 stacktrace_cli/sessions/__init__.py,sha256=mWb3Z42sN_UqxFQCPpXpsa7Nqe8J9Vd3jspItXqtTmI,76
@@ -105,7 +108,7 @@ stacktrace_cli/telemetry/state.py,sha256=-7UmK8bBFj3Zh3bzX0kJwxn7-CvreMar_0x1NiZ
 stacktrace_cli/webhook/__init__.py,sha256=6knjTNQA1ErM-AO6fQ60_TZqZzbVjQeDMU1XIPPCpo0,35
 stacktrace_cli/webhook/cli.py,sha256=g-QlGkiW9bXqgxa11KDjhJmhcaU4mxZwdUS2-o2LFyQ,7491
 stacktrace_cli/webhook/config.py,sha256=Uv6_5xtKlO5RQG3FkhtSS8TFKYlc5CAZ0Kwd0CCq99c,8655
-stacktrace_cli-0.7.0.dist-info/METADATA,sha256=cLoG_IqM05oC1Z0HpRF3lBGunJG8yfx2dUzRwfP-zGI,9160
-stacktrace_cli-0.7.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-stacktrace_cli-0.7.0.dist-info/entry_points.txt,sha256=HXQBr0nneh_o4A5t-4kZzmhjbh358P0G4M59kWdnejc,111
-stacktrace_cli-0.7.0.dist-info/RECORD,,
+stacktrace_cli-0.7.1.dist-info/METADATA,sha256=1NqRSL7HM02qgkMxfFgqLFEqQvBR9PLwshb4YZC9wK8,9160
+stacktrace_cli-0.7.1.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+stacktrace_cli-0.7.1.dist-info/entry_points.txt,sha256=HXQBr0nneh_o4A5t-4kZzmhjbh358P0G4M59kWdnejc,111
+stacktrace_cli-0.7.1.dist-info/RECORD,,