studylife-cli 1.8.2__tar.gz → 1.9.0__tar.gz

studylife_cli-1.9.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,24 @@
+name: Bug report
+description: Something does not work as documented
+labels: [bug]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened?
+      description: What did you do, what did you expect, what happened instead?
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Release or tag you are running (see the Releases page).
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs or screenshots
+      description: Relevant log lines or a screenshot. Please remove tokens and personal data.
+      render: text

studylife_cli-1.9.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/lukislp/studylife-cli/security/advisories/new
+    about: Please report security problems privately here, not as a public issue.

studylife_cli-1.9.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,16 @@
+name: Feature request
+description: Suggest an improvement
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem would this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+    validations:
+      required: true

studylife_cli-1.9.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,9 @@
+## What and why
+
+<!-- One or two sentences: what changes, and why. Link the issue if there is one. -->
+
+## Checklist
+
+- [ ] Conventional Commit title (`fix:`, `feat:`, `ci:`, `docs:`, ...) - it decides whether a release is cut
+- [ ] Tests or a manual verification note for behaviour changes
+- [ ] No secrets, tokens or personal data in code, tests or logs

{studylife_cli-1.8.2 → studylife_cli-1.9.0}/.github/workflows/ci.yml

@@ -14,8 +14,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: "0.5.8"
           cache-suffix: "lint"
@@ -27,8 +27,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: "0.5.8"
           cache-suffix: "test"
@@ -50,9 +50,32 @@ jobs:
     outputs:
       published: ${{ steps.semrel.outputs.new_release_published }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+      # Ruleset bypass for the release commit (2026-09-11 main-protection rollout): main is
+      # protected by a ruleset (pull request + green test stage) that the GitHub Actions app
+      # cannot be a bypass actor for on a personal repository, so semantic-release pushes over
+      # SSH as a write-enabled DEPLOY KEY instead, which can. No-op while the secret is unset -
+      # the push then goes through the GITHUB_TOKEN https remote exactly as before. Needed in
+      # get-version too: @semantic-release/git's verifyConditions runs `git push --dry-run`
+      # even in dry-run mode. Same mechanism as lukislp/studylife's ci-cd.yml.
+      - name: Push as the semantic-release deploy key (if configured)
+        env:
+          DEPLOY_KEY: ${{ secrets.SEMANTIC_RELEASE_DEPLOY_KEY }}
+        run: |
+          if [ -z "$DEPLOY_KEY" ]; then
+            echo "SEMANTIC_RELEASE_DEPLOY_KEY is not set - semantic-release pushes with GITHUB_TOKEN"
+            exit 0
+          fi
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/semantic_release
+          chmod 600 ~/.ssh/semantic_release
+          # github.com's published ed25519 host key, pinned instead of ssh-keyscan'd at runtime:
+          # https://docs.github.com/en/authentication/keychain/githubs-ssh-key-fingerprints
+          echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" >> ~/.ssh/known_hosts
+          git remote set-url origin "git@github.com:${{ github.repository }}.git"
+          echo "GIT_SSH_COMMAND=ssh -i ~/.ssh/semantic_release -o IdentitiesOnly=yes" >> "$GITHUB_ENV"
       - name: Sync to the current tip of main
         run: |
           git fetch origin main
@@ -80,9 +103,32 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+      # Ruleset bypass for the release commit (2026-09-11 main-protection rollout): main is
+      # protected by a ruleset (pull request + green test stage) that the GitHub Actions app
+      # cannot be a bypass actor for on a personal repository, so semantic-release pushes over
+      # SSH as a write-enabled DEPLOY KEY instead, which can. No-op while the secret is unset -
+      # the push then goes through the GITHUB_TOKEN https remote exactly as before. Needed in
+      # get-version too: @semantic-release/git's verifyConditions runs `git push --dry-run`
+      # even in dry-run mode. Same mechanism as lukislp/studylife's ci-cd.yml.
+      - name: Push as the semantic-release deploy key (if configured)
+        env:
+          DEPLOY_KEY: ${{ secrets.SEMANTIC_RELEASE_DEPLOY_KEY }}
+        run: |
+          if [ -z "$DEPLOY_KEY" ]; then
+            echo "SEMANTIC_RELEASE_DEPLOY_KEY is not set - semantic-release pushes with GITHUB_TOKEN"
+            exit 0
+          fi
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/semantic_release
+          chmod 600 ~/.ssh/semantic_release
+          # github.com's published ed25519 host key, pinned instead of ssh-keyscan'd at runtime:
+          # https://docs.github.com/en/authentication/keychain/githubs-ssh-key-fingerprints
+          echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" >> ~/.ssh/known_hosts
+          git remote set-url origin "git@github.com:${{ github.repository }}.git"
+          echo "GIT_SSH_COMMAND=ssh -i ~/.ssh/semantic_release -o IdentitiesOnly=yes" >> "$GITHUB_ENV"
       - id: semrel
         uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
         with:
@@ -124,14 +170,14 @@ jobs:
     permissions:
       id-token: write # trusted publishing (OIDC) - no PyPI token/secret needed
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           fetch-depth: 0 # full history + tags, so hatch-vcs can find the tag just created
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: "0.5.8"
           cache-suffix: "publish"
       - run: uv python install 3.12
       - run: uv build
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1

studylife_cli-1.9.0/.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,33 @@
+name: Dependabot auto-merge
+
+# Merges Dependabot patch and minor updates once every required check is green; majors stay
+# manual. Runs on pull_request_target so the base branch's workflow definition and the repo
+# secrets apply (a Dependabot-triggered pull_request run gets neither). Merges with
+# AUTOMERGE_TOKEN, a fine-grained PAT (contents + pull requests: write): a merge performed with
+# GITHUB_TOKEN would never start the release workflow, because GitHub does not run workflows for
+# events caused by GITHUB_TOKEN. Deliberately no checkout - PR code is never executed here.
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    env:
+      HAS_TOKEN: ${{ secrets.AUTOMERGE_TOKEN != '' }}
+    steps:
+      - id: meta
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - if: env.HAS_TOKEN == 'true' && (steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor')
+        env:
+          GH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}
+        run: gh pr merge --auto --merge "${{ github.event.pull_request.html_url }}"
+      - if: env.HAS_TOKEN != 'true'
+        run: echo "AUTOMERGE_TOKEN is not set - leaving this PR for a manual merge"

studylife_cli-1.9.0/.github/workflows/scorecard.yml

@@ -0,0 +1,33 @@
+name: OpenSSF Scorecard
+
+# Weekly supply-chain posture check (branch protection, pinned dependencies, token permissions,
+# vulnerabilities, ...). Results land in the Security tab as code-scanning alerts and on
+# https://securityscorecards.dev/viewer/?uri=github.com/lukislp/studylife-cli. Read-only, non-blocking.
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "17 4 * * 1"
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - uses: github/codeql-action/upload-sarif@faaca9a8f6edddba5725ffe5adefdab6669a2eca # v3.38.0
+        with:
+          sarif_file: results.sarif

{studylife_cli-1.8.2 → studylife_cli-1.9.0}/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [1.9.0](https://github.com/lukislp/studylife-cli/compare/v1.8.3...v1.9.0) (2026-09-11)
+
+
+### Features
+
+* **login:** PKCE for the StudyLife connect round trip ([de702d8](https://github.com/lukislp/studylife-cli/commit/de702d8b4ecff987cc9e6901f1a30a93435a8629))
+
+## [1.8.3](https://github.com/lukislp/studylife-cli/compare/v1.8.2...v1.8.3) (2026-09-11)
+
+
+### Bug Fixes
+
+* **ci:** push release commits as a deploy key so the default branch can be ruleset-protected ([deb7440](https://github.com/lukislp/studylife-cli/commit/deb7440b07cd58380deda44711e0bce342968c42))
+
 ## [1.8.2](https://github.com/lukislp/studylife-cli/compare/v1.8.1...v1.8.2) (2026-09-04)
 
 

{studylife_cli-1.8.2 → studylife_cli-1.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: studylife-cli
-Version: 1.8.2
+Version: 1.9.0
 Summary: Command-line client for StudyLife (self-hosted study organizer) - notes, sessions, course goals, and webhooks from your terminal.
 License-File: LICENSE
 Requires-Python: >=3.12

studylife_cli-1.9.0/SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report vulnerabilities privately through GitHub's private vulnerability reporting:
+https://github.com/lukislp/studylife-cli/security/advisories/new
+
+Do not open a public issue for security problems. You will get an acknowledgement within a few
+days and a fix or mitigation plan before any public disclosure.
+
+## Supported versions
+
+Only the latest release receives security fixes.

{studylife_cli-1.8.2 → studylife_cli-1.9.0}/src/studylife_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.8.2'
-__version_tuple__ = version_tuple = (1, 8, 2)
+__version__ = version = '1.9.0'
+__version_tuple__ = version_tuple = (1, 9, 0)
 
 __commit_id__ = commit_id = None

{studylife_cli-1.8.2 → studylife_cli-1.9.0}/src/studylife_cli/login.py

@@ -16,6 +16,8 @@ identity-contract-v1 §2 round trip this generalizes), with two real differences
 
 from __future__ import annotations
 
+import base64
+import hashlib
 import hmac
 import secrets
 import sys
@@ -164,13 +166,22 @@ def run_login(
     LoginError on any failure - callers decide how to present that (CLI prints and exits 1)."""
     base_url = instance_url.rstrip("/")
     state_token = secrets.token_urlsafe(32)
+    # PKCE (RFC 7636): the assertion comes back through a browser redirect, and StudyLife only
+    # redeems it together with the verifier matching this challenge - so a copy of the redirect
+    # URL alone (browser history, a proxy log) is worthless to anyone but this process.
+    code_verifier, code_challenge = _new_pkce_pair()
 
     callback_server = _bind_first_free_port(candidate_ports)
     redirect_uri = f"http://127.0.0.1:{callback_server.port}/callback"
-    connect_url = (
-        f"{base_url}/connect/client/{client_id}?"
-        f"{urlencode({'redirect_uri': redirect_uri, 'state': state_token})}"
+    connect_query = urlencode(
+        {
+            "redirect_uri": redirect_uri,
+            "state": state_token,
+            "code_challenge": code_challenge,
+            "code_challenge_method": "S256",
+        }
     )
+    connect_url = f"{base_url}/connect/client/{client_id}?{connect_query}"
 
     print(f"Opening your browser to log in to StudyLife:\n  {connect_url}")
     print("Waiting for you to finish logging in and approving the connection...")
@@ -197,12 +208,22 @@ def run_login(
             "been denied."
         )
 
-    user_id, api_key = _exchange_assertion(base_url, client_id, result.assertion)
+    user_id, api_key = _exchange_assertion(base_url, client_id, result.assertion, code_verifier)
     del user_id  # not needed locally - kept for symmetry with the server's response shape
     return Credentials(instance_url=base_url, client_id=client_id, api_key=api_key)
 
 
-def _exchange_assertion(base_url: str, client_id: str, assertion: str) -> tuple[int, str]:
+def _new_pkce_pair() -> tuple[str, str]:
+    """(code_verifier, code_challenge): 43 unreserved characters and the base64url SHA-256 of
+    them without padding, exactly the S256 shape StudyLife's connect endpoint validates."""
+    verifier = secrets.token_urlsafe(32)
+    digest = hashlib.sha256(verifier.encode("ascii")).digest()
+    return verifier, base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii")
+
+
+def _exchange_assertion(
+    base_url: str, client_id: str, assertion: str, code_verifier: str
+) -> tuple[int, str]:
     """Server-to-server exchange of the single-use assertion for the user id and a freshly
     issued, per-installation API key (generic flow - AuthController.10.OAuthClients.cs). No
     X-Api-Key is sent: this endpoint is [AllowAnonymous] by design, the assertion itself is the
@@ -210,7 +231,7 @@ def _exchange_assertion(base_url: str, client_id: str, assertion: str) -> tuple[
     try:
         response = httpx.post(
             f"{base_url}/api/auth/assertion-exchange",
-            json={"clientId": client_id, "assertion": assertion},
+            json={"clientId": client_id, "assertion": assertion, "codeVerifier": code_verifier},
             timeout=10.0,
         )
     except httpx.HTTPError as exc:

{studylife_cli-1.8.2 → studylife_cli-1.9.0}/tests/test_login.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import base64
+import hashlib
 import threading
 from urllib.parse import parse_qs, urlencode, urlparse
 from urllib.request import urlopen
@@ -83,7 +85,16 @@ def test_run_login_completes_full_round_trip(monkeypatch: pytest.MonkeyPatch) ->
         return True
 
     def fake_post(url: str, json: dict[str, object], timeout: float) -> httpx.Response:
-        assert json == {"clientId": "studylife-cli", "assertion": "the-assertion"}
+        assert url == "https://studylife.example.com/api/auth/assertion-exchange"
+        assert json["clientId"] == "studylife-cli"
+        assert json["assertion"] == "the-assertion"
+        # PKCE: the verifier sent here must hash to the challenge the browser was sent with.
+        query = parse_qs(urlparse(opened_urls[0]).query)
+        assert query["code_challenge_method"] == ["S256"]
+        digest = hashlib.sha256(str(json["codeVerifier"]).encode("ascii")).digest()
+        assert query["code_challenge"] == [
+            base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii")
+        ]
         return httpx.Response(200, json={"userId": 1, "apiKey": "the-api-key"})
 
     monkeypatch.setattr("studylife_cli.login.httpx.post", fake_post)