agentgov-cli 0.1.0__tar.gz → 0.1.3__tar.gz

{agentgov_cli-0.1.0 → agentgov_cli-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentgov-cli
-Version: 0.1.0
+Version: 0.1.3
 Summary: AgentGov CLI — wrap Claude Code, bind work items, check gateway health.
 Author: AgentGov Contributors
 License: Apache-2.0

agentgov_cli-0.1.3/agentgov_cli/commands/gateway.py

@@ -0,0 +1,79 @@
+"""`agentgov gateway` — manage the local gateway process.
+
+`install` is the recommended path: a supervised service (systemd --user on
+Linux/WSL, launchd on macOS) that starts at login and restarts on failure, so
+the port Claude Code targets is bound whenever the developer is working.
+"""
+
+from __future__ import annotations
+
+import typer
+from rich.console import Console
+
+from .. import gateway_process as gp
+
+console = Console()
+
+app = typer.Typer(name="gateway", help="Manage the local AgentGov gateway process.")
+
+_GATEWAY_OPT = typer.Option(None, "--gateway", envvar="AGENTGOV_GATEWAY_URL")
+
+
+def _url(gateway_url: str | None) -> str:
+    return gateway_url or "http://localhost:8000"
+
+
+@app.command("install")
+def install(gateway_url: str = _GATEWAY_OPT) -> None:
+    """Install + start the gateway as a supervised background service."""
+    url = _url(gateway_url)
+    ok, detail = gp.install_service()
+    if not ok:
+        console.print(f"[yellow]Could not install a service:[/] {detail}")
+        console.print("Falling back to a detached one-off start.")
+        ok, detail = gp.ensure_running(url)
+        if not ok:
+            console.print(f"[red]Gateway did not start.[/] {detail}")
+            raise typer.Exit(1)
+        console.print(f"[green]Gateway running[/] at {url} ({detail})")
+        return
+
+    console.print(f"[green]{detail}[/]")
+    if gp.is_healthy(url, timeout_sec=10.0):
+        console.print(f"[green]Gateway healthy[/] at {url}")
+    else:
+        # The service manager accepted the unit but the process is not
+        # answering — surface the log rather than claiming success.
+        console.print(f"[yellow]Service installed but {url}/health did not answer yet.[/]")
+        console.print(gp.log_tail())
+        raise typer.Exit(1)
+
+
+@app.command("start")
+def start(gateway_url: str = _GATEWAY_OPT) -> None:
+    """Start the gateway now, detached from this terminal."""
+    url = _url(gateway_url)
+    ok, detail = gp.ensure_running(url)
+    if not ok:
+        console.print(f"[red]Gateway did not start.[/] {detail}")
+        raise typer.Exit(1)
+    console.print(f"[green]Gateway running[/] at {url} ({detail})")
+
+
+@app.command("status")
+def status(gateway_url: str = _GATEWAY_OPT) -> None:
+    """Report whether the gateway is answering."""
+    url = _url(gateway_url)
+    if gp.is_healthy(url):
+        console.print(f"[green]RUNNING[/] — {url}/health answered.")
+        return
+    console.print(f"[red]NOT RUNNING[/] — nothing answering at {url}/health.")
+    console.print("Start it with: [cyan]agentgov gateway install[/]")
+    console.print(gp.log_tail())
+    raise typer.Exit(1)
+
+
+@app.command("logs")
+def logs(lines: int = typer.Option(40, "--lines", "-n")) -> None:
+    """Show the tail of the gateway log."""
+    console.print(gp.log_tail(lines))

{agentgov_cli-0.1.0 → agentgov_cli-0.1.3}/agentgov_cli/commands/install.py

@@ -14,6 +14,7 @@ import shutil
 import sys
 from pathlib import Path
 
+import typer
 from rich.console import Console
 
 console = Console()
@@ -28,10 +29,22 @@ ASSET_ROOTS = [
 
 
 def run(
-    gateway_url: str = "http://localhost:8000",
-    force: bool = False,
+    gateway_url: str = typer.Option(
+        "http://localhost:8000",
+        "--gateway-url",
+        "--gateway",  # alias — earlier docs called it --gateway
+        envvar="AGENTGOV_GATEWAY_URL",
+        help="URL of the local AgentGov gateway (usually http://localhost:8000).",
+    ),
+    force: bool = typer.Option(False, "--force", help="Overwrite existing hooks/statusline."),
 ) -> None:
-    """Install hooks + statusline + slash commands into ~/.claude/."""
+    """Install hooks + statusline + slash commands into ~/.claude/.
+
+    Also writes a ready-to-copy managed-settings.json to
+    ~/.agentgov/managed-settings.json — save that file at the OS-managed path
+    (needs sudo/admin) to force ALL Claude Code processes on this machine —
+    terminal AND VS Code extension — through the gateway.
+    """
     src = _find_assets()
     dest = Path.home() / ".claude"
     dest.mkdir(exist_ok=True)
@@ -62,9 +75,34 @@ def run(
     console.print(f"[green]Copied[/] /workitem slash command → {commands_dest / 'workitem.md'}")
 
     settings = _build_managed_settings(gateway_url, hooks_dest, statusline_dest)
+    settings_json = json.dumps(settings, indent=2)
+
+    # Write to a stable local path so the admin can `sudo cp` it into place
+    # without having to redirect stdout carefully.
+    local_settings_path = Path.home() / ".agentgov" / "managed-settings.json"
+    local_settings_path.parent.mkdir(parents=True, exist_ok=True)
+    local_settings_path.write_text(settings_json + "\n")
+    local_settings_path.chmod(0o644)
+
+    target_path = _managed_settings_path()
     console.rule("[bold]managed-settings.json[/]")
-    console.print(f"Ask your admin to save this file at:\n  {_managed_settings_path()}\n")
-    console.print(json.dumps(settings, indent=2))
+    console.print(f"Written locally to: [cyan]{local_settings_path}[/]")
+    console.print(f"Target install path: [cyan]{target_path}[/]\n")
+    console.print("[bold]To govern the VS Code extension too, run:[/]")
+    if platform.system() == "Windows":
+        console.print(
+            f'  Copy-Item "{local_settings_path}" "{target_path}" -Force'
+        )
+    else:
+        parent = str(Path(target_path).parent)
+        console.print(
+            f"  sudo mkdir -p {parent} && sudo cp {local_settings_path} {target_path}"
+        )
+    console.print(
+        "\nThen fully quit VS Code and reopen — the extension now routes through the gateway."
+    )
+    console.print("\n[dim]Contents (for reference):[/]")
+    console.print(settings_json)
 
 
 def _find_assets() -> Path:

agentgov_cli-0.1.3/agentgov_cli/commands/login.py

@@ -0,0 +1,159 @@
+"""`agentgov login` — obtain an AgentGov dashboard session (CLAUDE.md §13.5).
+
+Two paths, mutually exclusive:
+
+  1. --invite <inv_...>   Accept an emailed invite: prompts for a username,
+                          POSTs /api/invites/<token>, and stores the returned
+                          sess_ token as the identity.
+
+  2. --token <sess_...|agentgov-dev-admin>
+                          Paste-in a pre-obtained token. Verified by hitting
+                          /api/devices with it (any authenticated GET works).
+
+The Auth0 device-code flow lands in Phase 5 and slots into path (2).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+
+import httpx
+import typer
+from rich.console import Console
+
+console = Console()
+
+
+def run(
+    tower_url: str = typer.Option(
+        None, "--tower", envvar="CONTROL_TOWER_URL", help="Control tower URL"
+    ),
+    token: str = typer.Option(
+        None,
+        "--token",
+        help="Paste a session token (sess_...) or 'agentgov-dev-admin' in dev.",
+    ),
+    invite: str = typer.Option(
+        None,
+        "--invite",
+        help="Accept an invite token (inv_...) from an email link.",
+    ),
+    username: str = typer.Option(
+        None,
+        "--username",
+        help="Username to claim when accepting an invite. Prompted if omitted.",
+    ),
+    display_name: str = typer.Option(
+        None, "--display-name", help="Optional display name when accepting an invite."
+    ),
+) -> None:
+    """Attach this machine to a user in the AgentGov control tower."""
+    tower = (tower_url or os.environ.get("CONTROL_TOWER_URL") or "http://localhost:3000").rstrip("/")
+
+    if invite and token:
+        console.print("[red]--invite and --token are mutually exclusive.[/]")
+        raise typer.Exit(2)
+
+    if invite:
+        resolved = _accept_invite(tower, invite.strip(), username, display_name)
+    else:
+        resolved = _paste_token(tower, token)
+
+    identity_path = Path.home() / ".agentgov" / "identity.json"
+    identity_path.parent.mkdir(parents=True, exist_ok=True)
+    identity_path.write_text(json.dumps(resolved, indent=2))
+    identity_path.chmod(0o600)
+    console.print(f"[green]✅ Logged in.[/] Identity saved to {identity_path}")
+    console.print("Next: [bold]agentgov register-device --name 'my-laptop'[/]")
+
+
+def _paste_token(tower: str, token: str | None) -> dict[str, object]:
+    if not token:
+        console.print(
+            "[bold]Paste your session token[/] (sess_... from signup/invite, or 'agentgov-dev-admin' in dev)."
+        )
+        token = typer.prompt("token", hide_input=True).strip()
+    else:
+        token = token.strip()
+
+    # Verify.
+    try:
+        r = httpx.get(
+            f"{tower}/api/devices",
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=10.0,
+        )
+    except Exception as e:
+        console.print(f"[red]Cannot reach control tower at {tower}: {e}[/]")
+        raise typer.Exit(2) from e
+    if r.status_code == 401:
+        console.print("[red]Token rejected by control tower.[/]")
+        raise typer.Exit(2)
+    if r.status_code >= 400:
+        console.print(f"[red]Unexpected response: {r.status_code} {r.text}[/]")
+        raise typer.Exit(2)
+
+    return {"tower_url": tower, "auth0_token": token}
+
+
+def _accept_invite(
+    tower: str,
+    invite_token: str,
+    username: str | None,
+    display_name: str | None,
+) -> dict[str, object]:
+    # Peek so the user sees what they're joining.
+    try:
+        peek = httpx.get(f"{tower}/api/invites/{invite_token}", timeout=10.0)
+    except Exception as e:
+        console.print(f"[red]Cannot reach control tower at {tower}: {e}[/]")
+        raise typer.Exit(2) from e
+    if peek.status_code != 200:
+        console.print(f"[red]Invite not valid: {peek.status_code} {peek.text}[/]")
+        raise typer.Exit(2)
+    preview = peek.json()
+    console.print(
+        f"Invite for [bold]{preview.get('email')}[/] to join "
+        f"[bold]{preview.get('tenant_name')}[/] as {preview.get('role')}."
+    )
+
+    if not username:
+        username = typer.prompt("Choose a username").strip()
+    if not display_name:
+        display_name = typer.prompt("Display name (optional)", default="").strip() or None
+
+    body: dict[str, object] = {"username": username}
+    if display_name:
+        body["display_name"] = display_name
+
+    try:
+        r = httpx.post(
+            f"{tower}/api/invites/{invite_token}",
+            json=body,
+            timeout=15.0,
+        )
+    except Exception as e:
+        console.print(f"[red]Accept failed: {e}[/]")
+        raise typer.Exit(2) from e
+    if r.status_code >= 400:
+        console.print(f"[red]Accept rejected: {r.status_code} {r.text}[/]")
+        raise typer.Exit(2)
+
+    resp = r.json()
+    session_token = resp.get("session_token")
+    if not session_token:
+        console.print("[red]Server did not return a session token.[/]")
+        raise typer.Exit(2)
+
+    console.print(
+        f"[green]Joined {resp.get('tenant_name')} as {resp.get('user', {}).get('username')}.[/]"
+    )
+    return {
+        "tower_url": tower,
+        "auth0_token": session_token,
+        "tenant_id": resp.get("tenant_id"),
+        "tenant_slug": resp.get("tenant_slug"),
+        "username": resp.get("user", {}).get("username"),
+    }

{agentgov_cli-0.1.0 → agentgov_cli-0.1.3}/agentgov_cli/commands/register_device.py

@@ -57,14 +57,27 @@ def run(
         console.print(f"[red]Invalid --mode {upstream_mode}[/]")
         raise typer.Exit(2)
 
-    tower = tower_url or os.environ.get("CONTROL_TOWER_URL") or "http://localhost:3000"
-
     identity_path = Path.home() / ".agentgov" / "identity.json"
     if not identity_path.exists():
         console.print("[red]No AgentGov identity found.[/] Run [bold]agentgov login[/] first.")
         raise typer.Exit(2)
     identity = json.loads(identity_path.read_text())
     token = identity.get("auth0_token") or ""
+
+    # Tower URL precedence: explicit --tower > CONTROL_TOWER_URL env >
+    # the tower we logged in against (identity.json) > localhost dev default.
+    #
+    # The identity.json fallback matters: `agentgov login --tower https://...`
+    # persists the tower, but a NEW shell won't have CONTROL_TOWER_URL set.
+    # Without this fallback register-device silently tried localhost:3000 and
+    # died with "Connection refused" even though login had just succeeded.
+    tower = (
+        tower_url
+        or os.environ.get("CONTROL_TOWER_URL")
+        or identity.get("tower_url")
+        or "http://localhost:3000"
+    )
+    console.print(f"[dim]Registering against control tower:[/] {tower}")
     if not token:
         console.print("[red]Identity file is missing auth0_token.[/] Re-run `agentgov login`.")
         raise typer.Exit(2)
@@ -110,16 +123,24 @@ def run(
     device = payload.get("device", {})
     gtw_token = payload.get("gateway_service_token") or ""
 
-    # Persist gateway creds.
+    # Persist a COMPLETE gateway config so `agentgov-gateway` boots with zero
+    # environment variables. config.py reads this file when the corresponding
+    # env vars are absent; env still wins if explicitly set.
     creds_path = Path.home() / ".agentgov" / "gateway_creds.json"
     creds_path.write_text(
         json.dumps(
             {
                 "tower_url": tower,
+                "control_tower_url": tower,
                 "device_id": device.get("id"),
                 "device_name": device.get("name"),
-                "upstream_mode": device.get("upstream_mode"),
+                "upstream_mode": device.get("upstream_mode") or upstream_mode,
                 "gateway_service_token": gtw_token,
+                # Public verify-only key; the tower returns it at registration.
+                "policy_signing_public_key_b64": payload.get(
+                    "policy_signing_public_key_b64", ""
+                ),
+                "device_key_path": str(priv_path),
             },
             indent=2,
         )
@@ -129,9 +150,7 @@ def run(
     console.print(
         f"[green]✅ Device registered.[/] id={device.get('id')} mode={device.get('upstream_mode')}"
     )
-    console.print(f"gateway_service_token saved to {creds_path}")
+    console.print(f"Gateway config saved to {creds_path}")
     console.print()
-    console.print("Now start (or restart) the gateway with these env vars — see .env:")
-    console.print(f"  GATEWAY_SERVICE_TOKEN={gtw_token}")
-    console.print(f"  DEVICE_KEY_PATH={priv_path}")
-    console.print(f"  UPSTREAM_MODE={upstream_mode}")
+    console.print("[bold]Start the gateway — no environment variables needed:[/]")
+    console.print("  agentgov-gateway")

{agentgov_cli-0.1.0 → agentgov_cli-0.1.3}/agentgov_cli/commands/wrap.py

@@ -78,6 +78,13 @@ def run(
     target = list(cmd) if cmd else ["claude"]
     gateway = gateway_url or "http://localhost:8000"
 
+    # Never hand Claude Code a dead base URL. We are about to set
+    # ANTHROPIC_BASE_URL=<gateway>; if nothing is listening there, Claude Code
+    # fails with an opaque "API Error: Connection refused" from inside its own
+    # request path, with no mention of AgentGov. Verify first, and start a
+    # local gateway on demand.
+    _require_gateway(gateway)
+
     # Register the session with the gateway. Also send hook hashes so the
     # gateway can compare against expected values from the signed snapshot
     # (gap-P0-4 hook integrity check). Mismatch = warning + audit row;
@@ -130,6 +137,57 @@ def _wait_for_port(listener: LoopbackListener, timeout_sec: float = 2.0) -> None
         _time.sleep(0.01)
 
 
+def _is_loopback(gateway: str) -> bool:
+    """True if `gateway` points at this machine (so we may start it ourselves)."""
+    from urllib.parse import urlparse
+
+    host = (urlparse(gateway).hostname or "").lower()
+    return host in {"localhost", "127.0.0.1", "::1", "0.0.0.0"}
+
+
+def _require_gateway(gateway: str) -> None:
+    """Ensure a healthy gateway at `gateway`, or exit with actionable guidance.
+
+    Local gateways are started on demand (detached, so they outlive this
+    terminal). Remote gateways (§12 enterprise-remote) are never started by us —
+    we only report that they are unreachable.
+    """
+    from .. import gateway_process as gp
+
+    if gp.is_healthy(gateway):
+        return
+
+    if not _is_loopback(gateway):
+        console.print(
+            f"[red]AgentGov gateway at {gateway} is not reachable.[/]\n"
+            "This is a remote gateway, so this machine cannot start it. "
+            "Check the URL and your network, or contact your administrator."
+        )
+        raise typer.Exit(2)
+
+    console.print(f"[yellow]Gateway not running at {gateway} — starting it...[/]")
+    ok, detail = gp.start_detached(gateway)
+    if ok:
+        console.print(f"[green]Gateway started.[/] {detail}")
+        console.print(
+            "Tip: run [cyan]agentgov gateway install[/] once to have it start "
+            "automatically at login and restart on failure."
+        )
+        return
+
+    # Refuse to launch rather than hand Claude Code a dead URL.
+    console.print(f"[red]Could not start the AgentGov gateway at {gateway}.[/]\n{detail}")
+    console.print(
+        "\nClaude Code was NOT launched, because it would have failed with an "
+        "opaque connection error.\n"
+        "Fix the gateway, then retry:\n"
+        "  [cyan]agentgov gateway install[/]   # install as a supervised service\n"
+        "  [cyan]agentgov gateway logs[/]      # see why it is failing\n"
+        "  [cyan]agentgov doctor[/]            # full diagnosis"
+    )
+    raise typer.Exit(2)
+
+
 def _resolve_repo() -> tuple[Path, str]:
     try:
         root = subprocess.check_output(["git", "rev-parse", "--show-toplevel"], text=True).strip()