studylife-cli 1.9.0__tar.gz → 1.9.2__tar.gz

{studylife_cli-1.9.0 → studylife_cli-1.9.2}/.github/workflows/ci.yml

@@ -10,6 +10,11 @@ concurrency:
   group: ci-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+# Least-privilege default for GITHUB_TOKEN (CodeQL actions/missing-workflow-permissions):
+# jobs that need more declare it themselves.
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -41,6 +46,19 @@ jobs:
   # (unlike studylife-webhooks/studylife-developers): this is a CLI, it
   # never runs as a server, so there's nothing to containerize.
   # ---------------------------------------------------------------------
+  # Coverage-guided fuzzing of the API models and the login callback parser (fuzz/): a short
+  # fixed budget per run, enough to catch a crash on the next code change.
+  fuzz:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: "0.5.8"
+      - run: uv python install 3.12
+      - run: uv sync --frozen --group fuzz
+      - run: uv run python fuzz/fuzz_models_and_callback.py -max_total_time=30 -rss_limit_mb=1024
+
   get-version:
     needs: [lint, test]
     if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch')

studylife_cli-1.9.2/.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,77 @@
+name: Dependabot auto-merge
+
+# Merges Dependabot patch and minor updates once every required check is green; majors stay
+# manual. Runs on pull_request_target so the base branch's workflow definition and the repo
+# secrets apply (a Dependabot-triggered pull_request run gets neither). Merges with
+# AUTOMERGE_TOKEN, a fine-grained PAT (contents + pull requests: write): a merge performed with
+# GITHUB_TOKEN would never start the release workflow, because GitHub does not run workflows for
+# events caused by GITHUB_TOKEN. Deliberately no checkout - PR code is never executed here.
+on:
+  pull_request_target:
+    # auto_merge_enabled: a PR that is already behind when someone arms auto-merge would
+    # otherwise wait for the next push to be brought up to date.
+    types: [opened, synchronize, reopened, auto_merge_enabled]
+  # Safety net for a PR armed while behind when nothing else is pushed for a while.
+  schedule:
+    - cron: "23 * * * *"
+  # The default branch requires pull requests to be up to date before they merge (ruleset).
+  # Every push to it therefore leaves the open Dependabot PRs "behind"; the update-stale job
+  # below brings them back onto the tip so their auto-merge can proceed without a manual rebase.
+  push:
+    branches: [main]
+
+# GITHUB_TOKEN only reads PR metadata; the merge itself runs with AUTOMERGE_TOKEN (above).
+permissions:
+  pull-requests: read
+
+jobs:
+  auto-merge:
+    if: github.event_name == 'pull_request_target' && github.event.action != 'auto_merge_enabled' && github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    env:
+      HAS_TOKEN: ${{ secrets.AUTOMERGE_TOKEN != '' }}
+    steps:
+      - id: meta
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - if: env.HAS_TOKEN == 'true' && (steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor')
+        env:
+          GH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}
+        run: gh pr merge --auto --merge "${{ github.event.pull_request.html_url }}"
+      - if: env.HAS_TOKEN != 'true'
+        run: echo "AUTOMERGE_TOKEN is not set - leaving this PR for a manual merge"
+
+  update-stale:
+    if: github.event_name == 'push' || github.event_name == 'schedule' || github.event.action == 'auto_merge_enabled'
+    runs-on: ubuntu-latest
+    env:
+      HAS_TOKEN: ${{ secrets.AUTOMERGE_TOKEN != '' }}
+    steps:
+      - if: env.HAS_TOKEN == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}
+          REPO: ${{ github.repository }}
+        # The default branch requires PRs to be up to date before they merge, so every push
+        # here leaves the other open PRs "behind". This brings them back onto the tip: every
+        # non-draft PR that has auto-merge enabled or was opened by a person (a Dependabot PR
+        # left for a manual decision, i.e. a major bump, is not rebuilt on every push - whoever
+        # merges it updates it). GitHub computes the merge state lazily after a push, so UNKNOWN
+        # is polled for a while; DIRTY (conflicts) cannot be updated automatically.
+        run: |
+          for n in $(gh pr list --repo "$REPO" --state open --json number --jq '.[].number'); do
+            info="$(gh pr view "$n" --repo "$REPO" --json isDraft,author,autoMergeRequest --jq '"\(.isDraft) \(.author.login) \(.autoMergeRequest != null)"')"
+            set -- $info
+            draft=$1; author=$2; auto=$3
+            [ "$draft" = "true" ] && continue
+            if [ "$auto" != "true" ] && [ "$author" = "app/dependabot" ]; then continue; fi
+            for attempt in 1 2 3 4 5 6; do
+              state="$(gh pr view "$n" --repo "$REPO" --json mergeStateStatus --jq .mergeStateStatus)"
+              [ "$state" != "UNKNOWN" ] && break
+              sleep 10
+            done
+            echo "#$n ($author, auto-merge=$auto): $state"
+            if [ "$state" = "BEHIND" ]; then
+              gh api -X PUT "repos/$REPO/pulls/$n/update-branch" >/dev/null && echo "  updated onto main" || echo "::warning::could not update #$n"
+            fi
+          done

studylife_cli-1.9.2/.github/workflows/dependabot-lockfiles.yml

@@ -0,0 +1,80 @@
+name: Dependabot lock files
+
+# Dependabot regenerates the lock file of the project whose manifest it bumped, but not the
+# lock files of the projects that depend on it (NuGet records a reference's dependencies in
+# the referencing project's packages.lock.json) - and its uv lock output has shipped unparsable
+# files. Locked-mode restores then fail on the PR. This job runs on Dependabot's own PRs,
+# regenerates every lock file with the same tool versions CI uses and pushes the result back
+# onto the PR branch, after which the normal CI run and the auto-merge proceed.
+#
+# Deliberately a plain pull_request run (no pull_request_target): the PR's own restore runs in
+# the untrusted context with a read-only GITHUB_TOKEN, and the only credential involved - the
+# push token - is a Dependabot secret, which GitHub exposes solely to runs Dependabot triggered
+# and only to the single step that pushes. Nothing from the PR ever sees it.
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  refresh:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    env:
+      HAS_TOKEN: ${{ secrets.AUTOMERGE_TOKEN != '' }}
+      HEAD_REF: ${{ github.head_ref }}
+    steps:
+      - if: env.HAS_TOKEN != 'true'
+        run: echo "AUTOMERGE_TOKEN is not set as a Dependabot secret - lock files are not refreshed automatically"
+      - if: env.HAS_TOKEN == 'true'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.head_ref }}
+          # Full history so the base branch's uv.lock is available locally (private repos
+          # cannot be fetched anonymously later, and the push token stays out of this step).
+          fetch-depth: 0
+          persist-credentials: false
+      - if: env.HAS_TOKEN == 'true' && hashFiles('**/packages.lock.json') != ''
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: "10.0.x"
+      - if: env.HAS_TOKEN == 'true' && hashFiles('**/packages.lock.json') != ''
+        name: Regenerate every packages.lock.json
+        run: |
+          set -eu
+          for lock in $(git ls-files '**/packages.lock.json' 'packages.lock.json'); do
+            proj="$(ls "$(dirname "$lock")"/*.csproj | head -1)"
+            echo "restoring $proj"
+            dotnet restore "$proj" --force-evaluate -p:RestoreLockedMode=false
+          done
+      - if: env.HAS_TOKEN == 'true' && hashFiles('uv.lock') != ''
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: "0.5.8"
+      - if: env.HAS_TOKEN == 'true' && hashFiles('uv.lock') != ''
+        name: Regenerate uv.lock
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          # Dependabot's own uv.lock output has been unparsable, and `uv lock` refuses to start
+          # from a broken file - so resolve from the base branch's lock plus the PR's pyproject.
+          git show "origin/$BASE_REF:uv.lock" > uv.lock
+          uv python install 3.12
+          uv lock
+      - if: env.HAS_TOKEN == 'true'
+        name: Push the refreshed lock files back onto the PR
+        env:
+          PUSH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}
+        run: |
+          # Only tracked files change here (the lock files); untracked build output stays out.
+          git add -u
+          if git diff --cached --quiet; then
+            echo "lock files already consistent"
+            exit 0
+          fi
+          git config user.name "lukislp"
+          git config user.email "koerber.lukas@t-online.de"
+          git commit -m "chore(deps): refresh the lock files after the Dependabot update"
+          git push "https://x-access-token:${PUSH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:refs/heads/${HEAD_REF}"

{studylife_cli-1.9.0 → studylife_cli-1.9.2}/.gitignore

@@ -10,3 +10,8 @@ build/
 *.egg-info/
 .env
 credentials.json
+
+# libFuzzer crash artifacts written by fuzz/ harnesses
+crash-*
+leak-*
+timeout-*

{studylife_cli-1.9.0 → studylife_cli-1.9.2}/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [1.9.2](https://github.com/lukislp/studylife-cli/compare/v1.9.1...v1.9.2) (2026-09-12)
+
+
+### Bug Fixes
+
+* **login:** compare the callback state as bytes so non-ASCII input cannot crash the handler ([#23](https://github.com/lukislp/studylife-cli/issues/23)) ([4b8de15](https://github.com/lukislp/studylife-cli/commit/4b8de157801ee840c7081261cdd524746792283a))
+
+## [1.9.1](https://github.com/lukislp/studylife-cli/compare/v1.9.0...v1.9.1) (2026-09-11)
+
+
+### Bug Fixes
+
+* **ci:** read-only GITHUB_TOKEN in the Dependabot auto-merge workflow ([5d4eadf](https://github.com/lukislp/studylife-cli/commit/5d4eadf42f640133e46a8b27b2b2f724e9d8e829))
+
 # [1.9.0](https://github.com/lukislp/studylife-cli/compare/v1.8.3...v1.9.0) (2026-09-11)
 
 

{studylife_cli-1.9.0 → studylife_cli-1.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: studylife-cli
-Version: 1.9.0
+Version: 1.9.2
 Summary: Command-line client for StudyLife (self-hosted study organizer) - notes, sessions, course goals, and webhooks from your terminal.
 License-File: LICENSE
 Requires-Python: >=3.12
@@ -14,6 +14,11 @@ Description-Content-Type: text/markdown
 
 # studylife-cli
 
+[![CI](https://github.com/lukislp/studylife-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/lukislp/studylife-cli/actions/workflows/ci.yml) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/lukislp/studylife-cli/badge)](https://scorecard.dev/viewer/?uri=github.com/lukislp/studylife-cli) [![CodeQL](https://github.com/lukislp/studylife-cli/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/lukislp/studylife-cli/security/code-scanning)
+[![Release](https://img.shields.io/github/v/release/lukislp/studylife-cli)](https://github.com/lukislp/studylife-cli/releases)
+[![License: AGPL-3.0](https://img.shields.io/github/license/lukislp/studylife-cli)](LICENSE)
+[![Python](https://img.shields.io/badge/Python-3.12-3776AB)](https://www.python.org/)
+
 A command-line client for [StudyLife](https://github.com/lukislp/studylife), the self-hosted
 study organizer. Manage notes, sessions, course goals, and webhooks from your terminal, get study
 time reports and exports, or watch a live dashboard - scripts and shells welcome.

{studylife_cli-1.9.0 → studylife_cli-1.9.2}/README.md

@@ -1,5 +1,10 @@
 # studylife-cli
 
+[![CI](https://github.com/lukislp/studylife-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/lukislp/studylife-cli/actions/workflows/ci.yml) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/lukislp/studylife-cli/badge)](https://scorecard.dev/viewer/?uri=github.com/lukislp/studylife-cli) [![CodeQL](https://github.com/lukislp/studylife-cli/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/lukislp/studylife-cli/security/code-scanning)
+[![Release](https://img.shields.io/github/v/release/lukislp/studylife-cli)](https://github.com/lukislp/studylife-cli/releases)
+[![License: AGPL-3.0](https://img.shields.io/github/license/lukislp/studylife-cli)](LICENSE)
+[![Python](https://img.shields.io/badge/Python-3.12-3776AB)](https://www.python.org/)
+
 A command-line client for [StudyLife](https://github.com/lukislp/studylife), the self-hosted
 study organizer. Manage notes, sessions, course goals, and webhooks from your terminal, get study
 time reports and exports, or watch a live dashboard - scripts and shells welcome.

studylife_cli-1.9.2/fuzz/fuzz_models_and_callback.py

@@ -0,0 +1,68 @@
+"""Atheris fuzz harness for the API models and the login callback parser.
+
+Contract under test: the StudyLife DTO models either validate a JSON body or raise pydantic's
+ValidationError - never anything else; the loopback callback parser and the constant-time
+state comparison never raise for any query string.
+
+Run locally (Linux, needs the atheris wheel):
+    uv sync --frozen --group fuzz
+    uv run python fuzz/fuzz_models_and_callback.py -max_total_time=60
+CI runs the same harness for a short, fixed time budget (see .github/workflows/ci.yml).
+"""
+
+from __future__ import annotations
+
+import contextlib
+import sys
+
+import atheris
+from pydantic import ValidationError
+
+from studylife_cli.credentials import Credentials
+from studylife_cli.login import _parse_callback_query, _states_match
+from studylife_cli.models import (
+    Course,
+    CourseGoal,
+    MetricsSummary,
+    Note,
+    Session,
+    StudyProgramDetail,
+    StudyProgramSummary,
+    TimerState,
+    Webhook,
+    Whoami,
+)
+
+MODELS = (
+    Course,
+    CourseGoal,
+    MetricsSummary,
+    Note,
+    Session,
+    StudyProgramDetail,
+    StudyProgramSummary,
+    TimerState,
+    Webhook,
+    Whoami,
+    Credentials,
+)
+
+
+def test_one_input(data: bytes) -> None:
+    fdp = atheris.FuzzedDataProvider(data)
+    query = fdp.ConsumeUnicodeNoSurrogates(256)
+    result = _parse_callback_query(query)
+    _states_match(result.state, fdp.ConsumeUnicodeNoSurrogates(64))
+    body = fdp.ConsumeBytes(512)
+    for model in MODELS:
+        with contextlib.suppress(ValidationError):
+            model.model_validate_json(body)
+
+
+if __name__ == "__main__":
+    # instrument_all() instead of instrument_imports(): the package is loaded through uv's
+    # editable-install loader, which the import hook does not see (no coverage feedback,
+    # so libFuzzer would never grow its inputs past a few bytes).
+    atheris.instrument_all()
+    atheris.Setup(sys.argv, test_one_input)
+    atheris.Fuzz()

{studylife_cli-1.9.0 → studylife_cli-1.9.2}/pyproject.toml

@@ -68,3 +68,9 @@ extend-immutable-calls = ["typer.Argument", "typer.Option"]
 testpaths = ["tests"]
 asyncio_mode = "auto"
 pythonpath = ["src"]
+
+[dependency-groups]
+# Fuzzing harness (fuzz/), Linux only - the atheris wheel does not exist for Windows.
+fuzz = [
+    "atheris>=2.3",
+]

{studylife_cli-1.9.0 → studylife_cli-1.9.2}/src/studylife_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.9.0'
-__version_tuple__ = version_tuple = (1, 9, 0)
+__version__ = version = '1.9.2'
+__version_tuple__ = version_tuple = (1, 9, 2)
 
 __commit_id__ = commit_id = None

{studylife_cli-1.9.0 → studylife_cli-1.9.2}/src/studylife_cli/login.py

@@ -64,8 +64,12 @@ def _parse_callback_query(query_string: str) -> CallbackResult:
 
 def _states_match(received: str, expected: str) -> bool:
     """Constant-time comparison - the state isn't secret, but there's no reason to prefer a
-    timing-observable comparison over a safe one that's just as easy to write."""
-    return hmac.compare_digest(received, expected)
+    timing-observable comparison over a safe one that's just as easy to write.
+
+    Compared as UTF-8 bytes: hmac.compare_digest raises TypeError for str arguments with
+    non-ASCII characters, and `received` comes straight from whoever hits the loopback
+    callback URL (found by fuzz/fuzz_models_and_callback.py)."""
+    return hmac.compare_digest(received.encode("utf-8"), expected.encode("utf-8"))
 
 
 _CALLBACK_PAGE = """<!doctype html>

{studylife_cli-1.9.0 → studylife_cli-1.9.2}/uv.lock

@@ -32,6 +32,16 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/da/35/f2287558c17e29fafc8ef3daf819bb9834061cfa43bff8014f7df7f63bdc/anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494", size = 125813 },
 ]
 
+[[package]]
+name = "atheris"
+version = "3.1.0"
+source = { registry = "https://pypi.org/simple" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0a/88/fd6ad595dafa9c7ce56dbfcaff0c7244988dac3af86c771166c6516ccf6b/atheris-3.1.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ec5e11f21a4c197fe91f7aea2b2de88e623c73a21fc07b105ac6329a1588457b", size = 36875908 },
+    { url = "https://files.pythonhosted.org/packages/4e/18/e19718c384fd7d801d0da7485407daef9af6194b6d8c8818175bec5efec6/atheris-3.1.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f8a9f51ce8369026e8eb7b7174835e8c4c85a1a6db5d9add36c15100779d2a39", size = 36800563 },
+    { url = "https://files.pythonhosted.org/packages/c3/ff/ae7a5bfe99033e510bea4ed09934e636d93777317a48147369bc0dc2b71f/atheris-3.1.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:315a0b5c819852b1ffe1ca72efc389c7724881f2c33e4aacb8c6bcec49bd5011", size = 36772569 },
+]
+
 [[package]]
 name = "certifi"
 version = "2026.7.22"
@@ -395,7 +405,7 @@ wheels = [
 
 [[package]]
 name = "studylife-cli"
-version = "1.6.1.dev0+g47a9ecdea.d20260831"
+version = "1.9.2.dev9+g1002804fa.d20260912"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },
@@ -413,6 +423,9 @@ dev = [
     { name = "respx" },
     { name = "ruff" },
 ]
+fuzz = [
+    { name = "atheris" },
+]
 
 [package.metadata]
 requires-dist = [
@@ -431,6 +444,7 @@ dev = [
     { name = "respx", specifier = ">=0.21" },
     { name = "ruff", specifier = ">=0.7" },
 ]
+fuzz = [{ name = "atheris", specifier = ">=2.3" }]
 
 [[package]]
 name = "textual"

studylife_cli-1.9.0/.github/workflows/dependabot-auto-merge.yml

@@ -1,33 +0,0 @@
-name: Dependabot auto-merge
-
-# Merges Dependabot patch and minor updates once every required check is green; majors stay
-# manual. Runs on pull_request_target so the base branch's workflow definition and the repo
-# secrets apply (a Dependabot-triggered pull_request run gets neither). Merges with
-# AUTOMERGE_TOKEN, a fine-grained PAT (contents + pull requests: write): a merge performed with
-# GITHUB_TOKEN would never start the release workflow, because GitHub does not run workflows for
-# events caused by GITHUB_TOKEN. Deliberately no checkout - PR code is never executed here.
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  auto-merge:
-    if: github.actor == 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    env:
-      HAS_TOKEN: ${{ secrets.AUTOMERGE_TOKEN != '' }}
-    steps:
-      - id: meta
-        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-      - if: env.HAS_TOKEN == 'true' && (steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor')
-        env:
-          GH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}
-        run: gh pr merge --auto --merge "${{ github.event.pull_request.html_url }}"
-      - if: env.HAS_TOKEN != 'true'
-        run: echo "AUTOMERGE_TOKEN is not set - leaving this PR for a manual merge"