agentgov-cli 0.1.0__tar.gz → 0.1.1__tar.gz

{agentgov_cli-0.1.0 → agentgov_cli-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentgov-cli
-Version: 0.1.0
+Version: 0.1.1
 Summary: AgentGov CLI — wrap Claude Code, bind work items, check gateway health.
 Author: AgentGov Contributors
 License: Apache-2.0

{agentgov_cli-0.1.0 → agentgov_cli-0.1.1}/agentgov_cli/commands/install.py

@@ -14,6 +14,7 @@ import shutil
 import sys
 from pathlib import Path
 
+import typer
 from rich.console import Console
 
 console = Console()
@@ -28,10 +29,22 @@ ASSET_ROOTS = [
 
 
 def run(
-    gateway_url: str = "http://localhost:8000",
-    force: bool = False,
+    gateway_url: str = typer.Option(
+        "http://localhost:8000",
+        "--gateway-url",
+        "--gateway",  # alias — earlier docs called it --gateway
+        envvar="AGENTGOV_GATEWAY_URL",
+        help="URL of the local AgentGov gateway (usually http://localhost:8000).",
+    ),
+    force: bool = typer.Option(False, "--force", help="Overwrite existing hooks/statusline."),
 ) -> None:
-    """Install hooks + statusline + slash commands into ~/.claude/."""
+    """Install hooks + statusline + slash commands into ~/.claude/.
+
+    Also writes a ready-to-copy managed-settings.json to
+    ~/.agentgov/managed-settings.json — save that file at the OS-managed path
+    (needs sudo/admin) to force ALL Claude Code processes on this machine —
+    terminal AND VS Code extension — through the gateway.
+    """
     src = _find_assets()
     dest = Path.home() / ".claude"
     dest.mkdir(exist_ok=True)
@@ -62,9 +75,34 @@ def run(
     console.print(f"[green]Copied[/] /workitem slash command → {commands_dest / 'workitem.md'}")
 
     settings = _build_managed_settings(gateway_url, hooks_dest, statusline_dest)
+    settings_json = json.dumps(settings, indent=2)
+
+    # Write to a stable local path so the admin can `sudo cp` it into place
+    # without having to redirect stdout carefully.
+    local_settings_path = Path.home() / ".agentgov" / "managed-settings.json"
+    local_settings_path.parent.mkdir(parents=True, exist_ok=True)
+    local_settings_path.write_text(settings_json + "\n")
+    local_settings_path.chmod(0o644)
+
+    target_path = _managed_settings_path()
     console.rule("[bold]managed-settings.json[/]")
-    console.print(f"Ask your admin to save this file at:\n  {_managed_settings_path()}\n")
-    console.print(json.dumps(settings, indent=2))
+    console.print(f"Written locally to: [cyan]{local_settings_path}[/]")
+    console.print(f"Target install path: [cyan]{target_path}[/]\n")
+    console.print("[bold]To govern the VS Code extension too, run:[/]")
+    if platform.system() == "Windows":
+        console.print(
+            f'  Copy-Item "{local_settings_path}" "{target_path}" -Force'
+        )
+    else:
+        parent = str(Path(target_path).parent)
+        console.print(
+            f"  sudo mkdir -p {parent} && sudo cp {local_settings_path} {target_path}"
+        )
+    console.print(
+        "\nThen fully quit VS Code and reopen — the extension now routes through the gateway."
+    )
+    console.print("\n[dim]Contents (for reference):[/]")
+    console.print(settings_json)
 
 
 def _find_assets() -> Path:

agentgov_cli-0.1.1/agentgov_cli/commands/login.py

@@ -0,0 +1,159 @@
+"""`agentgov login` — obtain an AgentGov dashboard session (CLAUDE.md §13.5).
+
+Two paths, mutually exclusive:
+
+  1. --invite <inv_...>   Accept an emailed invite: prompts for a username,
+                          POSTs /api/invites/<token>, and stores the returned
+                          sess_ token as the identity.
+
+  2. --token <sess_...|agentgov-dev-admin>
+                          Paste-in a pre-obtained token. Verified by hitting
+                          /api/devices with it (any authenticated GET works).
+
+The Auth0 device-code flow lands in Phase 5 and slots into path (2).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+
+import httpx
+import typer
+from rich.console import Console
+
+console = Console()
+
+
+def run(
+    tower_url: str = typer.Option(
+        None, "--tower", envvar="CONTROL_TOWER_URL", help="Control tower URL"
+    ),
+    token: str = typer.Option(
+        None,
+        "--token",
+        help="Paste a session token (sess_...) or 'agentgov-dev-admin' in dev.",
+    ),
+    invite: str = typer.Option(
+        None,
+        "--invite",
+        help="Accept an invite token (inv_...) from an email link.",
+    ),
+    username: str = typer.Option(
+        None,
+        "--username",
+        help="Username to claim when accepting an invite. Prompted if omitted.",
+    ),
+    display_name: str = typer.Option(
+        None, "--display-name", help="Optional display name when accepting an invite."
+    ),
+) -> None:
+    """Attach this machine to a user in the AgentGov control tower."""
+    tower = (tower_url or os.environ.get("CONTROL_TOWER_URL") or "http://localhost:3000").rstrip("/")
+
+    if invite and token:
+        console.print("[red]--invite and --token are mutually exclusive.[/]")
+        raise typer.Exit(2)
+
+    if invite:
+        resolved = _accept_invite(tower, invite.strip(), username, display_name)
+    else:
+        resolved = _paste_token(tower, token)
+
+    identity_path = Path.home() / ".agentgov" / "identity.json"
+    identity_path.parent.mkdir(parents=True, exist_ok=True)
+    identity_path.write_text(json.dumps(resolved, indent=2))
+    identity_path.chmod(0o600)
+    console.print(f"[green]✅ Logged in.[/] Identity saved to {identity_path}")
+    console.print("Next: [bold]agentgov register-device --name 'my-laptop'[/]")
+
+
+def _paste_token(tower: str, token: str | None) -> dict[str, object]:
+    if not token:
+        console.print(
+            "[bold]Paste your session token[/] (sess_... from signup/invite, or 'agentgov-dev-admin' in dev)."
+        )
+        token = typer.prompt("token", hide_input=True).strip()
+    else:
+        token = token.strip()
+
+    # Verify.
+    try:
+        r = httpx.get(
+            f"{tower}/api/devices",
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=10.0,
+        )
+    except Exception as e:
+        console.print(f"[red]Cannot reach control tower at {tower}: {e}[/]")
+        raise typer.Exit(2) from e
+    if r.status_code == 401:
+        console.print("[red]Token rejected by control tower.[/]")
+        raise typer.Exit(2)
+    if r.status_code >= 400:
+        console.print(f"[red]Unexpected response: {r.status_code} {r.text}[/]")
+        raise typer.Exit(2)
+
+    return {"tower_url": tower, "auth0_token": token}
+
+
+def _accept_invite(
+    tower: str,
+    invite_token: str,
+    username: str | None,
+    display_name: str | None,
+) -> dict[str, object]:
+    # Peek so the user sees what they're joining.
+    try:
+        peek = httpx.get(f"{tower}/api/invites/{invite_token}", timeout=10.0)
+    except Exception as e:
+        console.print(f"[red]Cannot reach control tower at {tower}: {e}[/]")
+        raise typer.Exit(2) from e
+    if peek.status_code != 200:
+        console.print(f"[red]Invite not valid: {peek.status_code} {peek.text}[/]")
+        raise typer.Exit(2)
+    preview = peek.json()
+    console.print(
+        f"Invite for [bold]{preview.get('email')}[/] to join "
+        f"[bold]{preview.get('tenant_name')}[/] as {preview.get('role')}."
+    )
+
+    if not username:
+        username = typer.prompt("Choose a username").strip()
+    if not display_name:
+        display_name = typer.prompt("Display name (optional)", default="").strip() or None
+
+    body: dict[str, object] = {"username": username}
+    if display_name:
+        body["display_name"] = display_name
+
+    try:
+        r = httpx.post(
+            f"{tower}/api/invites/{invite_token}",
+            json=body,
+            timeout=15.0,
+        )
+    except Exception as e:
+        console.print(f"[red]Accept failed: {e}[/]")
+        raise typer.Exit(2) from e
+    if r.status_code >= 400:
+        console.print(f"[red]Accept rejected: {r.status_code} {r.text}[/]")
+        raise typer.Exit(2)
+
+    resp = r.json()
+    session_token = resp.get("session_token")
+    if not session_token:
+        console.print("[red]Server did not return a session token.[/]")
+        raise typer.Exit(2)
+
+    console.print(
+        f"[green]Joined {resp.get('tenant_name')} as {resp.get('user', {}).get('username')}.[/]"
+    )
+    return {
+        "tower_url": tower,
+        "auth0_token": session_token,
+        "tenant_id": resp.get("tenant_id"),
+        "tenant_slug": resp.get("tenant_slug"),
+        "username": resp.get("user", {}).get("username"),
+    }

{agentgov_cli-0.1.0 → agentgov_cli-0.1.1}/pyproject.toml

@@ -2,7 +2,7 @@
 # PyPI: `agentgov` was rejected as too similar to existing `agent-gov`.
 # Package name is agentgov-cli; the console command it installs is still `agentgov`.
 name = "agentgov-cli"
-version = "0.1.0"
+version = "0.1.1"
 description = "AgentGov CLI — wrap Claude Code, bind work items, check gateway health."
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -37,6 +37,22 @@ build-backend = "hatchling.build"
 [tool.hatch.build.targets.wheel]
 packages = ["agentgov_cli"]
 
+# Ship client_assets/ (sibling dir of cli/) as shared data. Installs to
+# <venv>/share/agentgov/client_assets/, which is exactly where
+# commands/install.py:ASSET_ROOTS[1] looks. Without this, a pip-installed CLI
+# can't find hooks/statusline/slash-command and `agentgov install` fails with
+# FileNotFoundError.
+[tool.hatch.build.targets.wheel.shared-data]
+"../client_assets" = "share/agentgov/client_assets"
+
+[tool.hatch.build.targets.sdist]
+include = [
+    "agentgov_cli/**",
+    "../client_assets/**",
+    "README.md",
+    "pyproject.toml",
+]
+
 [tool.ruff]
 line-length = 100
 target-version = "py310"

agentgov_cli-0.1.0/agentgov_cli/commands/login.py

@@ -1,74 +0,0 @@
-"""`agentgov login` — obtain an AgentGov session token (CLAUDE.md §13.5).
-
-v1 implements a DEV-ONLY stub: the CLI accepts a bearer token you paste
-(from the dashboard) and stores it in ~/.agentgov/identity.json (0600).
-The real OAuth device-code flow lands with Auth0 in Phase 5; the file
-layout + tower endpoint are already device-code-shaped so the swap is
-transparent to `wrap`.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-from pathlib import Path
-
-import httpx
-import typer
-from rich.console import Console
-
-console = Console()
-
-
-def run(
-    tower_url: str = typer.Option(
-        None, "--tower", envvar="CONTROL_TOWER_URL", help="Control tower URL"
-    ),
-    token: str = typer.Option(
-        None,
-        "--token",
-        help="Paste your dev-admin token (development mode only). Prompts if omitted.",
-        prompt=False,
-    ),
-) -> None:
-    """Attach this machine to a user in the AgentGov control tower."""
-    tower = tower_url or os.environ.get("CONTROL_TOWER_URL") or "http://localhost:3000"
-
-    if not token:
-        console.print(
-            "[bold]Dev-mode login[/] — paste a dev-admin token from the dashboard, or "
-            "the literal string 'agentgov-dev-admin' to use the seeded ADMIN.",
-        )
-        token = typer.prompt("token", hide_input=True).strip()
-    else:
-        token = token.strip()
-
-    # Verify the token can list /api/devices (a low-risk authenticated call).
-    try:
-        r = httpx.get(
-            f"{tower.rstrip('/')}/api/devices",
-            headers={"Authorization": f"Bearer {token}"},
-            timeout=10.0,
-        )
-    except Exception as e:
-        console.print(f"[red]Cannot reach control tower at {tower}: {e}[/]")
-        raise typer.Exit(2) from e
-    if r.status_code == 401:
-        console.print("[red]Token rejected by control tower.[/]")
-        raise typer.Exit(2)
-    if r.status_code >= 400:
-        console.print(f"[red]Unexpected response from control tower: {r.status_code} {r.text}[/]")
-        raise typer.Exit(2)
-
-    # Persist.
-    identity_path = Path.home() / ".agentgov" / "identity.json"
-    identity_path.parent.mkdir(parents=True, exist_ok=True)
-    payload = {
-        "tower_url": tower,
-        "auth0_token": token,
-        # user_id + tenant_id populated on register-device response.
-    }
-    identity_path.write_text(json.dumps(payload, indent=2))
-    identity_path.chmod(0o600)
-    console.print(f"[green]✅ Logged in.[/] Identity saved to {identity_path}")
-    console.print("Next: [bold]agentgov register-device --name 'my-laptop'[/]")

agentgov_cli-0.1.0/tests/test_pathguard.py

@@ -1,84 +0,0 @@
-"""PreToolUse path-guard hook tests (§R-CC1 acceptance).
-
-The hook is a subprocess boundary; we invoke it as a subprocess with crafted
-stdin (like Claude Code does) and assert exit codes.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import subprocess
-import sys
-from pathlib import Path
-
-HOOK = (
-    Path(__file__).resolve().parent.parent.parent
-    / "client_assets"
-    / "hooks"
-    / "pretooluse_pathguard.py"
-)
-
-
-def _run(payload: dict, repo_root: Path) -> tuple[int, str]:
-    env = os.environ.copy()
-    env["AGENTGOV_REPO_ROOT"] = str(repo_root)
-    p = subprocess.run(
-        [sys.executable, str(HOOK)],
-        input=json.dumps(payload).encode(),
-        capture_output=True,
-        env=env,
-        timeout=5,
-    )
-    return p.returncode, p.stderr.decode()
-
-
-def test_allows_file_inside_repo(tmp_path: Path) -> None:
-    (tmp_path / "src").mkdir()
-    target = tmp_path / "src" / "hello.py"
-    target.write_text("# ok")
-    rc, err = _run({"tool_name": "Read", "tool_input": {"file_path": str(target)}}, tmp_path)
-    assert rc == 0, err
-
-
-def test_blocks_path_traversal(tmp_path: Path) -> None:
-    rc, err = _run({"tool_name": "Read", "tool_input": {"file_path": "../../etc/passwd"}}, tmp_path)
-    assert rc == 2
-    assert "outside" in err
-
-
-def test_blocks_absolute_escape(tmp_path: Path) -> None:
-    rc, err = _run({"tool_name": "Read", "tool_input": {"file_path": "/etc/passwd"}}, tmp_path)
-    assert rc == 2
-    assert "outside" in err
-
-
-def test_bash_cd_root_blocked(tmp_path: Path) -> None:
-    rc, _ = _run({"tool_name": "Bash", "tool_input": {"command": "cd / && ls"}}, tmp_path)
-    assert rc == 2
-
-
-def test_bash_relative_command_ok(tmp_path: Path) -> None:
-    rc, _err = _run(
-        {"tool_name": "Bash", "tool_input": {"command": "pytest tests/"}},
-        tmp_path,
-    )
-    assert rc == 0
-
-
-def test_tmp_claude_scratch_allowed(tmp_path: Path) -> None:
-    rc, _err = _run(
-        {"tool_name": "Read", "tool_input": {"file_path": "/tmp/claude-scratch/x.txt"}},
-        tmp_path,
-    )
-    assert rc == 0
-
-
-def test_fail_closed_on_bad_input(tmp_path: Path) -> None:
-    # Missing tool_input entirely — hook should not accept.
-    # Not-a-dict tool_input:
-    rc, _err = _run(
-        {"tool_name": "Read", "tool_input": "just a string"},  # type: ignore[dict-item]
-        tmp_path,
-    )
-    assert rc == 2