@pydantic/logfire-cli-linux-arm64 0.1.3 → 0.1.5

package/README.md

@@ -1,180 +1,140 @@
 # Logfire CLI
 
-Rust command-line tools for [Pydantic Logfire](https://pydantic.dev/logfire).
+Set up [Pydantic Logfire](https://pydantic.dev/logfire), query your telemetry,
+and manage projects and tokens without leaving the terminal.
 
-`logfire` authenticates against the hosted (or self-hosted) Logfire API, drives
-the public Logfire MCP server, runs bundled agent skills, points a project
-at Logfire, and exposes the typed Platform API — with first-class machine output
-for scripts and coding agents.
+[Getting started](docs/getting-started.md) · [Install](docs/installation.md) ·
+[User guide](docs/README.md) · [Develop the CLI](dev-docs/README.md)
 
-## Quickstart
+## Get started
+
+Install the native CLI with `uv`:
 
 ```bash
-cargo install --path crates/logfire-cli   # see docs/installation.md for details
-logfire --region us signup --org acme --project my-project
-logfire auth                              # browser OAuth into the OS keychain
-logfire mcp tools list                    # use that session against public MCP
+uv tool install logfire-cli
+logfire --version
 ```
 
-## Commands
-
-| Command | What it does |
-| --- | --- |
-| [`logfire auth`](docs/authentication.md) | Browser OAuth shared by CLI and MCP |
-| [`logfire signup`](docs/commands/signup.md) | Create an account, first project, and local SDK credentials |
-| [`logfire init`](docs/commands/init.md) | Point a directory at a Logfire project |
-| [`logfire project`](docs/commands/project.md) | Validate and show the configured SDK project |
-| [`logfire setup`](docs/commands/setup.md) | Hand off repository instrumentation to Codex or Claude Code |
-| [`logfire skill`](docs/commands/skill.md) | Discover and run CLI-bundled Logfire agent skills |
-| [`logfire token`](docs/commands/token.md) | Mint a project read/write token and print it |
-| [`logfire api-key`](docs/commands/api-key.md) | Mint a project-scoped API key and print it |
-| [`logfire api`](docs/commands/api.md) | Typed Platform API endpoints |
-| [`logfire mcp`](docs/commands/mcp.md) | Discover and call the public Logfire MCP server |
-| [`logfire doctor`](docs/commands/doctor.md) | Diagnose local prerequisites without exposing secrets |
-
-Every command and group accepts concise `-h`/`--help`; use
-`logfire help <command>` for the detailed option reference.
-
-## Documentation
-
-The [**User Guide**](docs/README.md) covers everything in task-oriented pages:
-
-- [Installation](docs/installation.md) — the binary and shell completions
-- [Authentication](docs/authentication.md) — logins, regions, `LOGFIRE_TOKEN`, and OS-keychain storage
-- [Output contracts](docs/output-contracts.md) — human vs. `--output json`/`jsonl`, the envelope, exit codes, and flag precedence
-
-Global options apply before or after every command. `--region us|eu` (env
-`PYDANTIC_LOGFIRE_REGION`) chooses a hosted region, while `--base-url <URL>`
-(env `LOGFIRE_BASE_URL`) targets a self-hosted or staging instance and overrides
-it. `--org <ORGANIZATION>` selects a saved organization-specific OAuth profile;
-`logfire auth status` lists profiles and `logfire auth switch <ORGANIZATION>`
-changes the default without opening the credential store.
-`--output human|json|jsonl`, `--no-input`, and `--color auto|always|never`
-provide the shared presentation and prompting contract.
-
-## Architecture
-
-The CLI is a Cargo workspace of small, single-purpose crates:
-
-| Crate | Role |
-| --- | --- |
-| `logfire-cli` | The `logfire` binary: argument parsing (clap) and command dispatch. |
-| `logfire-api` | The typed `logfire api` command surface over the generated client. |
-| `logfire-api-client` | Generated from the OpenAPI schemas (see below); never hand-edited. |
-| `logfire-auth` | Terminal UX, organization verification, and profile persistence around browser OAuth. |
-| `logfire-config` | Credential resolution, regions / base-URL, and the request context. |
-| `logfire-init` | `logfire init` project setup and the `.logfire/` credentials file. |
-| `logfire-mcp-core` | Pure, I/O-free decision core for global input/output, envelope, limit, and error-category contracts. |
-| `logfire-mcp-client` | Official `rmcp` transport, MCP challenge and token-exchange policy, bounded protocol I/O, and protocol-faithful fakes. |
-| `logfire-oauth` | Platform OAuth, strict SDK/HTTP policy, loopback callback, and confidential session lifecycle. |
-
-See [`dev-docs/ARCHITECTURE.md`](dev-docs/ARCHITECTURE.md) for the product
-boundaries and trust model, and [`dev-docs/CRATE_RULES.md`](dev-docs/CRATE_RULES.md)
-for each crate's dependency and I/O contract. The
-[`assurance model`](dev-docs/ASSURANCE_MODEL.md) maps critical invariants to unit,
-property, state-machine, mutation, boundary, smoke, and end-to-end evidence.
-
-### Design notes
-
-- **No `unsafe`.** The workspace sets `unsafe_code = "forbid"`; safe `std`/`nix`
-  APIs have covered every need, and `forbid` (unlike `deny`) can't be overridden
-  locally.
-- **Small release binary.** The release profile trades a little compile time for
-  size (`opt-level = "z"`, fat LTO, one codegen unit, `strip`, `panic = "abort"`),
-  taking the macOS arm64 binary from ~15 MB to ~3.6 MB. Because `panic = "abort"`
-  skips unwinding, a panic ends the process without running destructors — fine for
-  a CLI, but note a task panic aborts the whole process rather than just that task.
-- **TLS via `ring`, not `aws-lc`.** `reqwest`/`rustls` use the `ring` crypto
-  provider — much smaller, and no `cmake` at build time. Trade-off: `ring` cannot
-  verify P-521-signed certificates, so TLS can fail behind a corporate
-  TLS-inspection proxy or Cloudflare WARP that uses a P-521 CA. If you hit that,
-  the crypto provider is why; switching `reqwest` back to the default `rustls`
-  (`aws-lc`) provider fixes it.
-- **Quality bars are enforced in CI, not by convention.** Clippy runs at
-  `-D warnings` with the `pedantic` group and `unwrap`/`expect`/`panic` denied in
-  library and binary code; `cargo-deny` gates licenses and duplicate dependencies;
-  100% line/function coverage for every handwritten crate
-  (`scripts/check_coverage.py`) and an architecture
-  policy check (`scripts/check_policy.py`) block regressions; `cargo doc` runs
-  with warnings as errors. See [`CLAUDE.md`](CLAUDE.md) for the code-style rules
-  and [`dev-docs/RUST-CONVENTIONS.md`](dev-docs/RUST-CONVENTIONS.md) for the
-  reviewed conventions.
-
-## Generated API Client
-
-`crates/logfire-api-client` is generated exclusively from Logfire's documented
-Platform schema at `/api/openapi.json`. The client lives under
-`logfire_api_client::platform`; private or compatibility schemas are not shipped.
-
-The normalized inputs and their provenance are committed under `openapi/`. To
-refresh the snapshot from its reviewed public HTTPS URL, inspect the schema diff,
-and then regenerate the client:
+Want to try it first? Run either command without installing anything:
 
 ```bash
-make refresh-openapi
-make generate-api-client
+uvx logfire-cli --help
+npx logfire-cli --help
 ```
 
-`make refresh-openapi` replaces the snapshot and its SHA-256 provenance as one
-validated set. It deliberately leaves the generated checksum failing until
-`make generate-api-client` succeeds, so refreshed inputs cannot masquerade as a
-current client.
-
-The crate is derived output: **never hand-edit it.** The generator cannot produce
-it correctly on its own, so `scripts/generate-api-client.sh` applies a handful of
-fix-ups afterwards (crate-relative import rewriting, missing recursive-schema type
-aliases, bounded response reads, channel discriminators, and the lint config).
-Anything that needs to persist across a
-regeneration belongs in that script's fix-up section.
-
-The script requires Docker and uses OpenAPI Generator 7.22.0 through the exact OCI
-image digest recorded in `openapi/provenance.toml`. It constructs and formats a
-staging workspace, tests it against the exact lockfile, and only then replaces the
-client; a final locked compile remains rollback-protected. The committed checksum
-binds the schema snapshots, provenance, generation recipe, formatting config, and
-complete output tree, so ordinary CI detects input or generated-client drift without
-network access.
-
-## Development
-
-The hosted Logfire MCP server is the primary boundary for new remote product
-capabilities; the documented Platform OpenAPI is the secondary typed automation
-surface, and handwritten `/v1` calls are forbidden. See
-[`dev-docs/ARCHITECTURE.md`](dev-docs/ARCHITECTURE.md) and
-[`dev-docs/adr/0001-mcp-first-client.md`](dev-docs/adr/0001-mcp-first-client.md)
-before adding a command or remote dependency, and
-[`dev-docs/CHANGE_MAP.md`](dev-docs/CHANGE_MAP.md) for the files, tests, and docs
-that must change together. Pure MCP command contracts live in `logfire-mcp-core`;
-transport and OAuth stay in separate adapters.
-
-Run the fast stable checks used by CI:
+You can also install it with npm:
 
 ```bash
-make ci
+npm install --global logfire-cli
+logfire --version
 ```
 
-Before handing work off, run the pinned nightly formatter and Clippy lane too:
+### New to Logfire?
+
+From your application's directory, choose the organization and first project
+names you want:
 
 ```bash
-make ci-all
+logfire --region us signup --org acme --project my-app
 ```
 
-Enforce 100% line and function coverage for every handwritten crate and render
-text/HTML reports:
+The CLI opens a short-lived signup page in your browser. After you approve the
+signup, it creates the organization and project and connects the current
+directory to that project. Use `--region eu` if your Logfire account belongs in
+the EU region.
+
+### Already have a Logfire account?
+
+Sign in, then create or choose a project interactively:
 
 ```bash
-make coverage
+logfire --region us auth --org acme
+logfire --org acme init
 ```
 
-The stable compiler is pinned in `rust-toolchain.toml`; the nightly formatter
-and lint toolchain is pinned by `NIGHTLY_TOOLCHAIN` in the `Makefile`. See
-[`dev-docs/VERIFICATION.md`](dev-docs/VERIFICATION.md) for scope, tool installation,
-and the rules for raising coverage floors.
+Browser credentials stay in your operating system's credential store. `init`
+writes the project's SDK credential to `.logfire/logfire_credentials.json` and
+keeps it out of version control.
+
+### Check it and do something useful
+
+```bash
+logfire --org acme project current
+logfire --org acme setup
+logfire --org acme mcp query run 'SELECT message FROM records LIMIT 20' --project my-app
+```
+
+- `project current` verifies which Logfire project this directory uses.
+- `project open` opens that validated project, while `--no-open` prints its URL.
+- `setup` prepares the account and project, then asks an installed Codex or
+  Claude Code agent to instrument and verify your application.
+- `mcp query run` queries your Logfire data through the hosted MCP server.
+
+For the complete walkthrough, including existing-project and automation flows,
+see [Getting started](docs/getting-started.md).
+
+## Common jobs
+
+| I want to… | Command | Guide |
+| --- | --- | --- |
+| Create my Logfire account and first project | `logfire signup` | [Signup](docs/commands/signup.md) |
+| Sign in to an existing account | `logfire auth` | [Authentication](docs/authentication.md) |
+| Connect this directory to a project | `logfire init` | [Project setup](docs/commands/init.md) |
+| Add application instrumentation | `logfire setup` | [Agent-assisted setup](docs/commands/setup.md) |
+| Try the beta AI Gateway integration | `logfire --beta agent gateway` or `logfire --beta agent proxy launch` | [Gateway setup](docs/commands/proxy.md) |
+| Run Python with automatic instrumentation | `logfire run` | [Run Python](docs/commands/run.md) |
+| Query traces and logs | `logfire mcp query` | [MCP](docs/commands/mcp.md) |
+| Open or inspect the current project | `logfire project` | [Project](docs/commands/project.md) |
+| Create a project read or write token | `logfire token` | [Tokens](docs/commands/token.md) |
+| Diagnose credentials or local setup | `logfire doctor` | [Doctor](docs/commands/doctor.md) |
+
+The CLI also includes beta typed Platform API commands, safe generic MCP calls,
+agent skills, and beta Codex telemetry setup. The [user guide](docs/README.md) lists
+every command by task.
+
+## Help that starts small
+
+```bash
+logfire --help
+logfire help signup
+logfire help init
+logfire help mcp query
+```
+
+Short help keeps common choices visible. `logfire help <command>` adds examples,
+effects, and advanced options.
+
+For scripts and coding agents, add `--no-input` and request `--output json` or
+`--output jsonl` instead of parsing human-readable output. See
+[Output contracts](docs/output-contracts.md).
+
+## Credentials stay in the right place
+
+- Browser OAuth credentials are scoped to one Logfire origin and organization
+  and stored in the operating system credential store.
+- Project write credentials stay with the local project under `.logfire/`.
+- Newly created secrets are printed once only when a token-creation command is
+  explicitly used.
+- `--org` always means the real organization name shown in Logfire.
+
+See [Authentication](docs/authentication.md) for multiple organizations,
+headless API keys, logout, and credential precedence.
+
+## Installation and updates
+
+PyPI provides native binaries for all 17 supported targets. npm covers the five
+common macOS, GNU/Linux, and Windows combinations. Repository readers can also
+download every prebuilt archive, plus checksums and verification evidence, from
+[GitHub Releases](https://github.com/pydantic/logfire-cli/releases/latest). Until
+this repository is public, that GitHub route requires Pydantic repository access.
+
+See [Installation](docs/installation.md) for supported platforms, one-off use,
+updates, and shell completions.
 
 ## Contributing and security
 
-See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the development and pull-request
-contract. Report vulnerabilities through the private process in
-[`SECURITY.md`](SECURITY.md), never through a public issue.
+Developing the CLI itself? Start with the [developer guide](dev-docs/README.md)
+and [contribution guide](CONTRIBUTING.md). Report vulnerabilities through the
+private process in [SECURITY.md](SECURITY.md), never through a public issue.
 
-The Logfire CLI is released under the [MIT License](LICENSE).
+Logfire CLI is released under the [MIT License](LICENSE).

package/package.json

@@ -14,5 +14,5 @@
   ],
   "preferUnplugged": true,
   "repository": "https://github.com/pydantic/logfire-cli",
-  "version": "0.1.3"
+  "version": "0.1.5"
 }