aitextaroo 0.2.0__tar.gz → 0.2.2__tar.gz

{aitextaroo-0.2.0 → aitextaroo-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aitextaroo
-Version: 0.2.0
+Version: 0.2.2
 Summary: Client library for AI Text-a-roo — give any AI agent a phone number
 Author-email: AI Text-a-roo <hello@aitextaroo.com>
 License: MIT
@@ -74,13 +74,16 @@ aitextaroo send "Hello from my agent!"
 
 `--save` stores the API key in `~/.aitextaroo/credentials.json` with owner-only permissions.
 `aitextaroo` and `aitextaroo-bridge` find it there, or in `AITEXTAROO_API_KEY`, or in `--api-key`.
+Verifying a phone that already has an account makes a new key: apps connected before are
+signed out and webhook forwarding is turned off.
 
 ## The `aitextaroo` command
 
 Made for agents with a shell. Output is JSON; errors go to stderr with exit code 1.
 `aitextaroo verify-pin` exits 2 when the PIN is wrong, so `aitextaroo verify-pin <<< 4821 && …`
 only continues on a match. `verify-pin` and `set-pin` read the PIN from stdin when it isn't
-an argument, which keeps it out of shell history and the process list.
+an argument. At a terminal they ask for it without echoing, which keeps it out of your shell
+history (a command with the PIN written in it, like the `<<<` form, can still be saved there).
 
 ```bash
 aitextaroo send "Build finished: 318 tests passing."
@@ -88,11 +91,13 @@ aitextaroo ask "Deploy to production? Reply YES or NO" --timeout 120   # text, t
 aitextaroo wait --timeout 60                                            # wait for the next text
 aitextaroo recent                                                       # texts from the last 5 minutes
 aitextaroo relay --to +12125550100 --name Mom "Happy birthday!"        # Pro: text a contact
-aitextaroo verify-pin <<< 4821                                          # check a PIN the user texted
-aitextaroo set-pin <<< 4821                                             # set the user's PIN (4-8 digits)
+aitextaroo verify-pin                                                   # check a PIN (hidden prompt)
+aitextaroo set-pin                                                      # set the user's PIN (4-8 digits)
+aitextaroo set-pin --current                                            # change it: current PIN, then the new one
+aitextaroo remove-pin                                                   # needs the current PIN
 aitextaroo account
 aitextaroo upgrade                                                      # Stripe link for Pro
-aitextaroo webhook set https://example.com/hook --auth-header "Bearer <token>"
+aitextaroo webhook set https://example.com/hook --auth-header "Bearer <token>"   # add --pin if a PIN is set
 aitextaroo connect [claude-code|codex|gemini|cursor|muse-code|claude|chatgpt|grok]
 ```
 
@@ -162,8 +167,8 @@ asyncio.run(main())
 | `listen()` | Async iterator over inbound texts via SSE, with automatic reconnect and replay. |
 | `text_contact(to, text, recipient_name=None)` | Pro: text someone else; their replies go to the user's phone. |
 | `verify_pin(pin)` | Check a PIN the user texted: `{"verified": bool, "attempts_remaining": int \| None}`. |
-| `set_pin(pin)` / `remove_pin()` | Set, change or remove the user's security PIN (4–8 digits). |
-| `set_webhook(url, auth_header=None)` / `remove_webhook()` | Forward inbound texts to a URL (signed with `X-Signature`). |
+| `set_pin(pin, current_pin=None)` / `remove_pin(current_pin)` | Set the security PIN the user chose (4–8 digits), change it (needs `current_pin`), or remove it (needs the current PIN). The user is texted before any change. |
+| `set_webhook(url, auth_header=None, pin=None)` / `remove_webhook()` | Forward inbound texts to a URL (signed with `X-Signature`). `pin` is required if the user has one; the user is texted where their texts go and can reply `UNHOOK` to stop it. |
 | `account()` | Plan, assigned number, usage and daily limit. |
 | `upgrade_link()` | Stripe checkout link for Pro. |
 | `TextarooClient.request_verification(phone)` / `confirm_verification(phone, code)` | Sign-up, no key needed. |
@@ -174,8 +179,10 @@ asyncio.run(main())
 ## MCP server
 
 `https://api.aitextaroo.com/mcp` (streamable HTTP). Tools: `send_text`, `wait_for_reply`,
-`get_recent_messages`, `text_contact`, `verify_pin`, `get_account`, `get_upgrade_link`.
-Clients sign in with OAuth, or send `Authorization: Bearer <API key>`:
+`get_recent_messages`, `text_contact`, `verify_pin`, `get_account`, `get_upgrade_link`,
+`set_webhook`, `remove_webhook`, and `get_help` (how it works and how it's secured, for
+answering the user's questions). Clients sign in with OAuth, or send
+`Authorization: Bearer <API key>`:
 
 ```bash
 claude mcp add --transport http --scope user aitextaroo https://api.aitextaroo.com/mcp \
@@ -217,8 +224,9 @@ Details: <https://aitextaroo.com/security>.
 
 ## Releasing
 
-Bump `version` in `pyproject.toml` and `__version__` in `aitextaroo/__init__.py`, merge to
-`main`, then push a matching tag: `git tag v0.2.1 && git push origin v0.2.1`. The
+Bump the version in `pyproject.toml`, `aitextaroo/__init__.py`, `plugin.json`,
+`.claude-plugin/plugin.json` and `gemini-extension.json`, merge to `main`, then push a
+matching tag: `git tag v0.2.2 && git push origin v0.2.2`. The
 [Release workflow](.github/workflows/release.yml) tests, builds and publishes to PyPI with
 Trusted Publishing.
 

{aitextaroo-0.2.0 → aitextaroo-0.2.2}/README.md

@@ -41,13 +41,16 @@ aitextaroo send "Hello from my agent!"
 
 `--save` stores the API key in `~/.aitextaroo/credentials.json` with owner-only permissions.
 `aitextaroo` and `aitextaroo-bridge` find it there, or in `AITEXTAROO_API_KEY`, or in `--api-key`.
+Verifying a phone that already has an account makes a new key: apps connected before are
+signed out and webhook forwarding is turned off.
 
 ## The `aitextaroo` command
 
 Made for agents with a shell. Output is JSON; errors go to stderr with exit code 1.
 `aitextaroo verify-pin` exits 2 when the PIN is wrong, so `aitextaroo verify-pin <<< 4821 && …`
 only continues on a match. `verify-pin` and `set-pin` read the PIN from stdin when it isn't
-an argument, which keeps it out of shell history and the process list.
+an argument. At a terminal they ask for it without echoing, which keeps it out of your shell
+history (a command with the PIN written in it, like the `<<<` form, can still be saved there).
 
 ```bash
 aitextaroo send "Build finished: 318 tests passing."
@@ -55,11 +58,13 @@ aitextaroo ask "Deploy to production? Reply YES or NO" --timeout 120   # text, t
 aitextaroo wait --timeout 60                                            # wait for the next text
 aitextaroo recent                                                       # texts from the last 5 minutes
 aitextaroo relay --to +12125550100 --name Mom "Happy birthday!"        # Pro: text a contact
-aitextaroo verify-pin <<< 4821                                          # check a PIN the user texted
-aitextaroo set-pin <<< 4821                                             # set the user's PIN (4-8 digits)
+aitextaroo verify-pin                                                   # check a PIN (hidden prompt)
+aitextaroo set-pin                                                      # set the user's PIN (4-8 digits)
+aitextaroo set-pin --current                                            # change it: current PIN, then the new one
+aitextaroo remove-pin                                                   # needs the current PIN
 aitextaroo account
 aitextaroo upgrade                                                      # Stripe link for Pro
-aitextaroo webhook set https://example.com/hook --auth-header "Bearer <token>"
+aitextaroo webhook set https://example.com/hook --auth-header "Bearer <token>"   # add --pin if a PIN is set
 aitextaroo connect [claude-code|codex|gemini|cursor|muse-code|claude|chatgpt|grok]
 ```
 
@@ -129,8 +134,8 @@ asyncio.run(main())
 | `listen()` | Async iterator over inbound texts via SSE, with automatic reconnect and replay. |
 | `text_contact(to, text, recipient_name=None)` | Pro: text someone else; their replies go to the user's phone. |
 | `verify_pin(pin)` | Check a PIN the user texted: `{"verified": bool, "attempts_remaining": int \| None}`. |
-| `set_pin(pin)` / `remove_pin()` | Set, change or remove the user's security PIN (4–8 digits). |
-| `set_webhook(url, auth_header=None)` / `remove_webhook()` | Forward inbound texts to a URL (signed with `X-Signature`). |
+| `set_pin(pin, current_pin=None)` / `remove_pin(current_pin)` | Set the security PIN the user chose (4–8 digits), change it (needs `current_pin`), or remove it (needs the current PIN). The user is texted before any change. |
+| `set_webhook(url, auth_header=None, pin=None)` / `remove_webhook()` | Forward inbound texts to a URL (signed with `X-Signature`). `pin` is required if the user has one; the user is texted where their texts go and can reply `UNHOOK` to stop it. |
 | `account()` | Plan, assigned number, usage and daily limit. |
 | `upgrade_link()` | Stripe checkout link for Pro. |
 | `TextarooClient.request_verification(phone)` / `confirm_verification(phone, code)` | Sign-up, no key needed. |
@@ -141,8 +146,10 @@ asyncio.run(main())
 ## MCP server
 
 `https://api.aitextaroo.com/mcp` (streamable HTTP). Tools: `send_text`, `wait_for_reply`,
-`get_recent_messages`, `text_contact`, `verify_pin`, `get_account`, `get_upgrade_link`.
-Clients sign in with OAuth, or send `Authorization: Bearer <API key>`:
+`get_recent_messages`, `text_contact`, `verify_pin`, `get_account`, `get_upgrade_link`,
+`set_webhook`, `remove_webhook`, and `get_help` (how it works and how it's secured, for
+answering the user's questions). Clients sign in with OAuth, or send
+`Authorization: Bearer <API key>`:
 
 ```bash
 claude mcp add --transport http --scope user aitextaroo https://api.aitextaroo.com/mcp \
@@ -184,8 +191,9 @@ Details: <https://aitextaroo.com/security>.
 
 ## Releasing
 
-Bump `version` in `pyproject.toml` and `__version__` in `aitextaroo/__init__.py`, merge to
-`main`, then push a matching tag: `git tag v0.2.1 && git push origin v0.2.1`. The
+Bump the version in `pyproject.toml`, `aitextaroo/__init__.py`, `plugin.json`,
+`.claude-plugin/plugin.json` and `gemini-extension.json`, merge to `main`, then push a
+matching tag: `git tag v0.2.2 && git push origin v0.2.2`. The
 [Release workflow](.github/workflows/release.yml) tests, builds and publishes to PyPI with
 Trusted Publishing.
 

{aitextaroo-0.2.0 → aitextaroo-0.2.2}/aitextaroo/__init__.py

@@ -14,5 +14,5 @@ Example:
 from aitextaroo.client import TextarooClient
 from aitextaroo.models import InboundMessage, StreamEvent
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"
 __all__ = ["TextarooClient", "InboundMessage", "StreamEvent"]

{aitextaroo-0.2.0 → aitextaroo-0.2.2}/aitextaroo/agent_cli.py

@@ -8,9 +8,11 @@ Usage:
     aitextaroo relay --to +12125550100 --name Mom "Happy birthday!"
     aitextaroo verify-pin <<< 4821
     aitextaroo set-pin <<< 4821
+    aitextaroo set-pin --current           # change it: current PIN, then the new one
+    aitextaroo remove-pin                  # asks for the current PIN
     aitextaroo account
     aitextaroo upgrade
-    aitextaroo webhook set https://example.com/hook [--auth-header "Bearer ..."]
+    aitextaroo webhook set https://example.com/hook [--auth-header "Bearer ..."] [--pin]
     aitextaroo webhook remove
     aitextaroo connect [claude-code|codex|gemini|cursor|muse-code|claude|chatgpt|grok]
 
@@ -18,8 +20,9 @@ Results are JSON on stdout (except `connect`, which prints instructions);
 errors go to stderr with exit code 1. `verify-pin` prints its result and exits
 with code 2 when the PIN is wrong, so `aitextaroo verify-pin <<< 4821 && ...` only
 proceeds on a match. `verify-pin` and `set-pin` read the PIN from stdin when
-it isn't given as an argument, which keeps it out of shell history and the
-process list. The API key comes from --api-key, AITEXTAROO_API_KEY, or
+it isn't given as an argument; at a terminal they ask for it without echoing.
+`webhook set` needs the user's PIN if they set one: pass bare `--pin` to read
+it the same way. The API key comes from --api-key, AITEXTAROO_API_KEY, or
 ~/.aitextaroo/credentials.json (aitextaroo-setup --save).
 """
 
@@ -104,8 +107,11 @@ CONNECT: dict[str, str] = {
     "grok": (
         "Grok Bot — say in chat:\n"
         f"  Add a custom MCP server called AI Text-a-roo at {MCP_URL}\n"
-        "To text it back anytime, create a webhook routine and register it:\n"
-        '  aitextaroo webhook set <routine URL> --auth-header "Bearer <routine key>"'
+        "To text it back anytime, ask Grok Bot to create a webhook routine and\n"
+        "register it with the set_webhook tool, or register it yourself:\n"
+        '  aitextaroo webhook set <routine URL> --auth-header "Bearer <routine key>" [--pin]\n'
+        "(--pin asks for your PIN, needed if you set one. You'll get a text saying\n"
+        "where your texts now go; reply UNHOOK anytime to stop forwarding.)"
     ),
 }
 
@@ -121,8 +127,16 @@ def main(argv: list[str] | None = None) -> None:
             "No API key. Run `aitextaroo-setup --phone +1... --save`, "
             "set AITEXTAROO_API_KEY, or pass --api-key."
         )
-    if args.command in ("verify-pin", "set-pin"):
-        args.pin = _read_pin(args.pin)
+    # Changing an existing PIN: the current one comes first (on stdin, the
+    # first line), then the new one.
+    if args.command == "set-pin" and args.current is not None:
+        args.current = _read_pin(args.current, "Current PIN: ")
+    # webhook set only needs the PIN when --pin was given (accounts with a PIN).
+    needs_pin = args.command in ("verify-pin", "set-pin", "remove-pin") or (
+        args.command == "webhook" and args.action == "set" and args.pin is not None
+    )
+    if needs_pin:
+        args.pin = _read_pin(args.pin, "New PIN: " if args.command == "set-pin" else "PIN: ")
     try:
         result = asyncio.run(_run(args, key))
     except TextarooError as exc:
@@ -159,14 +173,18 @@ async def _run(args: argparse.Namespace, key: str) -> Any:
         if args.command == "verify-pin":
             return await client.verify_pin(args.pin)
         if args.command == "set-pin":
-            return await client.set_pin(args.pin)
+            return await client.set_pin(args.pin, current_pin=args.current)
+        if args.command == "remove-pin":
+            return await client.remove_pin(args.pin)
         if args.command == "account":
             return await client.account()
         if args.command == "upgrade":
             return {"checkout_url": await client.upgrade_link()}
         if args.command == "webhook":
             if args.action == "set":
-                return await client.set_webhook(args.url, auth_header=args.auth_header)
+                return await client.set_webhook(
+                    args.url, auth_header=args.auth_header, pin=args.pin
+                )
             return await client.remove_webhook()
         raise AssertionError(f"unhandled command {args.command}")
     finally:
@@ -220,7 +238,17 @@ def _parse_args(argv: list[str] | None) -> argparse.Namespace:
     p.add_argument("pin", nargs="?", help="The PIN (default: read from stdin)")
 
     p = sub.add_parser("set-pin", help="Set or change the user's security PIN (4-8 digits)")
-    p.add_argument("pin", nargs="?", help="The PIN (default: read from stdin)")
+    p.add_argument("pin", nargs="?", help="The new PIN (default: read from stdin)")
+    p.add_argument(
+        "--current",
+        nargs="?",
+        const="-",
+        default=None,
+        help="The current PIN, needed to change one. Bare --current reads it from stdin first",
+    )
+
+    p = sub.add_parser("remove-pin", help="Remove the user's security PIN (needs the current one)")
+    p.add_argument("pin", nargs="?", help="The current PIN (default: read from stdin)")
 
     sub.add_parser("account", help="Plan, usage and the AI's phone number")
     sub.add_parser("upgrade", help="Stripe checkout link for Pro")
@@ -234,6 +262,13 @@ def _parse_args(argv: list[str] | None) -> argparse.Namespace:
         default=None,
         help='Authorization header value sent with each delivery, e.g. "Bearer <token>"',
     )
+    s.add_argument(
+        "--pin",
+        nargs="?",
+        const="-",
+        default=None,
+        help="The user's PIN, if they set one. Bare --pin reads it from stdin or a hidden prompt",
+    )
     hook.add_parser("remove", help="Stop webhook delivery")
 
     p = sub.add_parser("connect", help="Show how to add the MCP server to an agent")
@@ -242,15 +277,15 @@ def _parse_args(argv: list[str] | None) -> argparse.Namespace:
     return parser.parse_args(argv)
 
 
-def _read_pin(arg: str | None) -> str:
+def _read_pin(arg: str | None, prompt: str = "PIN: ") -> str:
     """The PIN from the argument, or from stdin when it's omitted or "-".
 
-    At a terminal it's a hidden prompt; otherwise the first line of stdin.
+    At a terminal it's a hidden prompt; otherwise the next line of stdin.
     """
     if arg not in (None, "-"):
         pin = arg
     elif sys.stdin.isatty():
-        pin = getpass.getpass("PIN: ")
+        pin = getpass.getpass(prompt)
     else:
         pin = sys.stdin.readline()
     pin = pin.strip()

{aitextaroo-0.2.0 → aitextaroo-0.2.2}/aitextaroo/client.py

@@ -368,55 +368,74 @@ class TextarooClient:
         response = await client.post("/v1/verify-pin", json={"pin": pin})
         return _parse_json_response(response, "PIN verification failed")
 
-    async def set_pin(self, pin: str) -> dict[str, Any]:
-        """Set or change the user's security PIN (4–8 digits).
+    async def set_pin(self, pin: str, current_pin: str | None = None) -> dict[str, Any]:
+        """Set the user's security PIN (4–8 digits), or change it.
 
-        Ask the user to choose it; don't store a copy.
+        Ask the user to choose it; never pick one for them, and don't store a
+        copy. Changing an existing PIN needs current_pin. The user is texted
+        before the change.
 
         Returns:
-            {"status": "pin_set"}
+            {"status": "pin_set"} or {"status": "pin_changed"}
 
         Raises:
-            TextarooError: If the PIN isn't 4–8 digits or the API returns an error.
+            TextarooError: "current_pin_required", "pin_incorrect", "pin_locked",
+                "owner_notice_failed" (nothing changed), or another API error.
         """
+        body: dict[str, Any] = {"pin": pin}
+        if current_pin:
+            body["current_pin"] = current_pin
         client = await self._get_client()
-        response = await client.post("/v1/account/pin", json={"pin": pin})
+        response = await client.post("/v1/account/pin", json=body)
         return _parse_json_response(response, "Setting the PIN failed")
 
-    async def remove_pin(self) -> dict[str, Any]:
-        """Remove the user's security PIN.
+    async def remove_pin(self, current_pin: str) -> dict[str, Any]:
+        """Remove the user's security PIN, which needs the current one.
+
+        The user is texted before the change.
 
         Returns:
-            {"status": "pin_removed"}
+            {"status": "pin_removed"} or {"status": "pin_not_set"}
 
         Raises:
-            TextarooError: If the API returns an error.
+            TextarooError: "current_pin_required", "pin_incorrect", or another API error.
         """
         client = await self._get_client()
-        response = await client.delete("/v1/account/pin")
+        response = await client.request(
+            "DELETE", "/v1/account/pin", json={"current_pin": current_pin}
+        )
         return _parse_json_response(response, "Removing the PIN failed")
 
     # ── Webhooks ────────────────────────────────────────────────
 
-    async def set_webhook(self, url: str, auth_header: str | None = None) -> dict[str, Any]:
+    async def set_webhook(
+        self, url: str, auth_header: str | None = None, pin: str | None = None
+    ) -> dict[str, Any]:
         """Forward each text the user sends to a URL as a signed JSON POST.
 
+        The user is texted the destination host before forwarding starts, and
+        can text UNHOOK to stop it.
+
         Args:
             url: Public https URL that receives the deliveries.
             auth_header: Optional Authorization header value sent with each
                 delivery (e.g., "Bearer <token>" for a Grok Bot webhook routine).
+            pin: The user's security PIN. Required if they have one.
 
         Returns:
-            {"status": "registered", "url": ..., "secret": ..., "has_auth_header": bool}.
-            Verify deliveries with the secret: X-Signature is a hex
-            HMAC-SHA256 of the raw body.
+            {"status": "registered", "url": ..., "secret": ..., "has_auth_header": bool,
+            "owner_notified": bool}. Verify deliveries with the secret:
+            X-Signature is a hex HMAC-SHA256 of the raw body.
 
         Raises:
-            TextarooError: If the API returns an error.
+            TextarooError: "pin_required" or "pin_incorrect", "owner_notice_failed"
+                (nothing changed), "rate_limit_exceeded", or another API error.
         """
         body: dict[str, Any] = {"url": url}
         if auth_header:
             body["auth_header"] = auth_header
+        if pin:
+            body["pin"] = pin
         client = await self._get_client()
         response = await client.post("/v1/webhook", json=body)
         return _parse_json_response(response, "Webhook registration failed")

{aitextaroo-0.2.0 → aitextaroo-0.2.2}/aitextaroo.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aitextaroo
-Version: 0.2.0
+Version: 0.2.2
 Summary: Client library for AI Text-a-roo — give any AI agent a phone number
 Author-email: AI Text-a-roo <hello@aitextaroo.com>
 License: MIT
@@ -74,13 +74,16 @@ aitextaroo send "Hello from my agent!"
 
 `--save` stores the API key in `~/.aitextaroo/credentials.json` with owner-only permissions.
 `aitextaroo` and `aitextaroo-bridge` find it there, or in `AITEXTAROO_API_KEY`, or in `--api-key`.
+Verifying a phone that already has an account makes a new key: apps connected before are
+signed out and webhook forwarding is turned off.
 
 ## The `aitextaroo` command
 
 Made for agents with a shell. Output is JSON; errors go to stderr with exit code 1.
 `aitextaroo verify-pin` exits 2 when the PIN is wrong, so `aitextaroo verify-pin <<< 4821 && …`
 only continues on a match. `verify-pin` and `set-pin` read the PIN from stdin when it isn't
-an argument, which keeps it out of shell history and the process list.
+an argument. At a terminal they ask for it without echoing, which keeps it out of your shell
+history (a command with the PIN written in it, like the `<<<` form, can still be saved there).
 
 ```bash
 aitextaroo send "Build finished: 318 tests passing."
@@ -88,11 +91,13 @@ aitextaroo ask "Deploy to production? Reply YES or NO" --timeout 120   # text, t
 aitextaroo wait --timeout 60                                            # wait for the next text
 aitextaroo recent                                                       # texts from the last 5 minutes
 aitextaroo relay --to +12125550100 --name Mom "Happy birthday!"        # Pro: text a contact
-aitextaroo verify-pin <<< 4821                                          # check a PIN the user texted
-aitextaroo set-pin <<< 4821                                             # set the user's PIN (4-8 digits)
+aitextaroo verify-pin                                                   # check a PIN (hidden prompt)
+aitextaroo set-pin                                                      # set the user's PIN (4-8 digits)
+aitextaroo set-pin --current                                            # change it: current PIN, then the new one
+aitextaroo remove-pin                                                   # needs the current PIN
 aitextaroo account
 aitextaroo upgrade                                                      # Stripe link for Pro
-aitextaroo webhook set https://example.com/hook --auth-header "Bearer <token>"
+aitextaroo webhook set https://example.com/hook --auth-header "Bearer <token>"   # add --pin if a PIN is set
 aitextaroo connect [claude-code|codex|gemini|cursor|muse-code|claude|chatgpt|grok]
 ```
 
@@ -162,8 +167,8 @@ asyncio.run(main())
 | `listen()` | Async iterator over inbound texts via SSE, with automatic reconnect and replay. |
 | `text_contact(to, text, recipient_name=None)` | Pro: text someone else; their replies go to the user's phone. |
 | `verify_pin(pin)` | Check a PIN the user texted: `{"verified": bool, "attempts_remaining": int \| None}`. |
-| `set_pin(pin)` / `remove_pin()` | Set, change or remove the user's security PIN (4–8 digits). |
-| `set_webhook(url, auth_header=None)` / `remove_webhook()` | Forward inbound texts to a URL (signed with `X-Signature`). |
+| `set_pin(pin, current_pin=None)` / `remove_pin(current_pin)` | Set the security PIN the user chose (4–8 digits), change it (needs `current_pin`), or remove it (needs the current PIN). The user is texted before any change. |
+| `set_webhook(url, auth_header=None, pin=None)` / `remove_webhook()` | Forward inbound texts to a URL (signed with `X-Signature`). `pin` is required if the user has one; the user is texted where their texts go and can reply `UNHOOK` to stop it. |
 | `account()` | Plan, assigned number, usage and daily limit. |
 | `upgrade_link()` | Stripe checkout link for Pro. |
 | `TextarooClient.request_verification(phone)` / `confirm_verification(phone, code)` | Sign-up, no key needed. |
@@ -174,8 +179,10 @@ asyncio.run(main())
 ## MCP server
 
 `https://api.aitextaroo.com/mcp` (streamable HTTP). Tools: `send_text`, `wait_for_reply`,
-`get_recent_messages`, `text_contact`, `verify_pin`, `get_account`, `get_upgrade_link`.
-Clients sign in with OAuth, or send `Authorization: Bearer <API key>`:
+`get_recent_messages`, `text_contact`, `verify_pin`, `get_account`, `get_upgrade_link`,
+`set_webhook`, `remove_webhook`, and `get_help` (how it works and how it's secured, for
+answering the user's questions). Clients sign in with OAuth, or send
+`Authorization: Bearer <API key>`:
 
 ```bash
 claude mcp add --transport http --scope user aitextaroo https://api.aitextaroo.com/mcp \
@@ -217,8 +224,9 @@ Details: <https://aitextaroo.com/security>.
 
 ## Releasing
 
-Bump `version` in `pyproject.toml` and `__version__` in `aitextaroo/__init__.py`, merge to
-`main`, then push a matching tag: `git tag v0.2.1 && git push origin v0.2.1`. The
+Bump the version in `pyproject.toml`, `aitextaroo/__init__.py`, `plugin.json`,
+`.claude-plugin/plugin.json` and `gemini-extension.json`, merge to `main`, then push a
+matching tag: `git tag v0.2.2 && git push origin v0.2.2`. The
 [Release workflow](.github/workflows/release.yml) tests, builds and publishes to PyPI with
 Trusted Publishing.
 

{aitextaroo-0.2.0 → aitextaroo-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aitextaroo"
-version = "0.2.0"
+version = "0.2.2"
 description = "Client library for AI Text-a-roo — give any AI agent a phone number"
 readme = "README.md"
 license = {text = "MIT"}

{aitextaroo-0.2.0 → aitextaroo-0.2.2}/tests/test_agent_cli.py

@@ -145,7 +145,19 @@ class TestCommands:
                 capsys,
             )
         assert out["has_auth_header"] is True
-        client.set_webhook.assert_awaited_once_with("https://hook.example", auth_header="Bearer t")
+        client.set_webhook.assert_awaited_once_with(
+            "https://hook.example", auth_header="Bearer t", pin=None
+        )
+
+    def test_webhook_set_reads_the_pin_from_stdin(self, capsys, monkeypatch) -> None:
+        monkeypatch.setattr("sys.stdin", io.StringIO("4821\n"))
+        client = self._client()
+        client.set_webhook.return_value = {"status": "registered", "owner_notified": True}
+        with patch.object(agent_cli, "TextarooClient", return_value=client):
+            _run_cli(["--api-key", "k", "webhook", "set", "https://hook.example", "--pin"], capsys)
+        client.set_webhook.assert_awaited_once_with(
+            "https://hook.example", auth_header=None, pin="4821"
+        )
 
     def test_api_error_exits_nonzero(self, capsys) -> None:
         from aitextaroo.client import TextarooError
@@ -197,7 +209,25 @@ class TestCommands:
         with patch.object(agent_cli, "TextarooClient", return_value=client):
             out = _run_cli(["--api-key", "k", "set-pin"], capsys)
         assert out == {"status": "pin_set"}
-        client.set_pin.assert_awaited_once_with("482193")
+        client.set_pin.assert_awaited_once_with("482193", current_pin=None)
+
+    def test_changing_the_pin_reads_the_current_one_first(self, capsys, monkeypatch) -> None:
+        monkeypatch.setattr("sys.stdin", io.StringIO("1111\n4821\n"))
+        client = self._client()
+        client.set_pin.return_value = {"status": "pin_changed"}
+        with patch.object(agent_cli, "TextarooClient", return_value=client):
+            out = _run_cli(["--api-key", "k", "set-pin", "--current"], capsys)
+        assert out == {"status": "pin_changed"}
+        client.set_pin.assert_awaited_once_with("4821", current_pin="1111")
+
+    def test_remove_pin_reads_the_current_pin(self, capsys, monkeypatch) -> None:
+        monkeypatch.setattr("sys.stdin", io.StringIO("1111\n"))
+        client = self._client()
+        client.remove_pin.return_value = {"status": "pin_removed"}
+        with patch.object(agent_cli, "TextarooClient", return_value=client):
+            out = _run_cli(["--api-key", "k", "remove-pin"], capsys)
+        assert out == {"status": "pin_removed"}
+        client.remove_pin.assert_awaited_once_with("1111")
 
     def test_pin_prompt_is_hidden_at_a_terminal(self, capsys, monkeypatch) -> None:
         tty = io.StringIO()

{aitextaroo-0.2.0 → aitextaroo-0.2.2}/tests/test_client_replies.py

@@ -138,11 +138,19 @@ class TestVerifyPin:
         assert json.loads(seen[0].content) == {"pin": "4821"}
         await client.close()
 
+    @pytest.mark.asyncio
+    async def test_change_pin_sends_the_current_one(self) -> None:
+        client, seen = _recording_client(200, '{"status": "pin_changed"}')
+        assert await client.set_pin("4821", current_pin="1111") == {"status": "pin_changed"}
+        assert json.loads(seen[0].content) == {"pin": "4821", "current_pin": "1111"}
+        await client.close()
+
     @pytest.mark.asyncio
     async def test_remove_pin(self) -> None:
         client, seen = _recording_client(200, '{"status": "pin_removed"}')
-        assert await client.remove_pin() == {"status": "pin_removed"}
+        assert await client.remove_pin("1111") == {"status": "pin_removed"}
         assert (seen[0].method, seen[0].url.path) == ("DELETE", "/v1/account/pin")
+        assert json.loads(seen[0].content) == {"current_pin": "1111"}
         await client.close()
 
 
@@ -162,6 +170,23 @@ class TestWebhook:
         }
         await client.close()
 
+    @pytest.mark.asyncio
+    async def test_set_with_pin(self) -> None:
+        client, seen = _recording_client(200, '{"status": "registered", "owner_notified": true}')
+        await client.set_webhook("https://hook.example", pin="4821")
+        assert json.loads(seen[0].content) == {"url": "https://hook.example", "pin": "4821"}
+        await client.close()
+
+    @pytest.mark.asyncio
+    async def test_pin_required_is_an_error(self) -> None:
+        client, _ = _recording_client(
+            403, '{"error": {"code": "pin_required", "message": "This account has a security PIN"}}'
+        )
+        with pytest.raises(TextarooError) as exc_info:
+            await client.set_webhook("https://hook.example")
+        assert exc_info.value.code == "pin_required"
+        await client.close()
+
     @pytest.mark.asyncio
     async def test_remove(self) -> None:
         client, seen = _recording_client(200, '{"status": "removed"}')