apiwells 0.1.0__tar.gz

apiwells-0.1.0/CHANGELOG.md

@@ -0,0 +1,6 @@
+# Changelog
+
+## 0.1.0
+- Add a single-request models endpoint check and opt-in text chat smoke check.
+- Add HTTP/network failure categories, response shape checks and sanitized JSON.
+- Disable redirects, retries and implicit environment proxy use.

apiwells-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ApiWells contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

apiwells-0.1.0/MANIFEST.in

@@ -0,0 +1,3 @@
+include LICENSE README.md CHANGELOG.md
+recursive-include tests *.py
+recursive-include docs *.md

apiwells-0.1.0/PKG-INFO

@@ -0,0 +1,118 @@
+Metadata-Version: 2.4
+Name: apiwells
+Version: 0.1.0
+Summary: Endpoint Doctor for OpenAI-compatible model APIs
+License-Expression: MIT
+Keywords: api,diagnostics,llm,endpoint
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# ApiWells Endpoint Doctor
+
+A small, dependency-free CLI that checks an OpenAI-compatible model API from
+your machine. Useful when onboarding a gateway customer or checking a deployment.
+Python 3.10+. Initial alpha release; not a full SDK or a service monitor.
+
+## Install
+
+After the release is published to PyPI:
+
+```sh
+python -m pip install apiwells
+apiwells --version
+```
+
+For an unpublished local checkout: `python -m pip install .`
+
+## Check a model API
+
+Set `APIWELLS_API_KEY` in your environment using your shell's secret-input
+mechanism. Do not put a real key in a command, screenshot, issue or repository.
+
+```sh
+apiwells doctor --base-url https://YOUR-API-HOST/v1
+apiwells doctor --base-url https://YOUR-API-HOST/v1 --json
+```
+
+Replace the host with your actual API base. `/v1` is **not** added automatically.
+For a gateway using `/openai/v1`, supply that exact prefix. Do not supply the
+full `/models` or `/chat/completions` URL. This command sends one GET to
+`BASE/models`; it checks JSON `data` entries for nonempty string model IDs.
+An empty model list passes the shape check and reports `model_count: 0`.
+A model list does not prove that inference works or is available to this key.
+
+For one potentially billable inference request, opt in explicitly:
+
+```sh
+apiwells doctor --base-url https://YOUR-API-HOST/v1 --chat --model YOUR-MODEL-ID
+```
+
+This sends `Reply OK.` to `BASE/chat/completions`, with `stream: false` and
+`max_tokens: 8`. A pass means a nonempty assistant text response was returned;
+it does not require exactly `OK`. Some reasoning models require a different
+parameter or larger output budget; this release does not support those variants.
+`--max-tokens 32` increases the budget, not a guaranteed cost ceiling.
+There are no automatic retries or fallback models.
+
+For a local unauthenticated development server:
+
+```sh
+apiwells doctor --base-url http://127.0.0.1:3000/v1 --anonymous
+```
+
+Use `--api-key-env NAME` to select another environment variable.
+`--timeout 15` is a socket-operation timeout, not an overall deadline; DNS or
+slow continuous delivery may make total runtime longer. `elapsed_ms` measures
+this client's request/response time, not server inference time or streaming TTFT.
+
+## Results
+
+Exit codes: `0` minimal check passed, `1` endpoint check failed, `2` local usage
+or configuration error. `--json` writes one JSON object to stdout for completed
+checks; usage errors go to stderr and do not produce a JSON report.
+
+HTTP categories include authentication (401), forbidden (403), not_found (404),
+rate_or_quota (429), server_error (5xx), and redirect (3xx). These are diagnostic
+hints, not definitive root-cause identification. Transport categories include
+network, DNS, TLS and timeout. HTTP 200 with HTML, malformed JSON or an invalid
+response shape fails. Response reading is capped at 2 MiB plus one sentinel byte.
+
+## Security and limitations
+
+- Keys are sent only to the supplied endpoint. Verify the host before running.
+- HTTPS certificate verification stays enabled. Remote HTTP requires `--allow-http`;
+  literal loopback addresses and localhost are allowed for development.
+- Redirects are blocked, including same-host redirects.
+- No telemetry, files, raw response bodies, model IDs, URL or keys in reports.
+- Proxy settings are ignored unless `--use-env-proxy` is explicitly supplied.
+- This is a local CLI for endpoints you may test. Do not expose it as an unrestricted
+  server-side URL-fetching service: private/local destinations are intentionally allowed.
+- No streaming, embeddings, images, tool calling, Responses API, native Anthropic
+  or native Gemini protocol coverage in this version.
+- No live provider integration has been certified by the bundled local tests.
+
+## Development
+
+```sh
+python -m venv .venv
+# macOS/Linux: source .venv/bin/activate
+# Windows PowerShell: .\.venv\Scripts\Activate.ps1
+python -m pip install -e .
+python -m unittest discover -s tests -v
+python -m pip install build twine
+python -m build
+python -m twine check --strict dist/*
+```
+
+See `docs/PUBLISH_ZH.md` for the release walkthrough, sources and maintenance
+plan. License: MIT. Public source URL and maintainer contact can be added to
+project metadata once their real identities are confirmed; no fictitious links
+or authors are included.

apiwells-0.1.0/README.md

@@ -0,0 +1,101 @@
+# ApiWells Endpoint Doctor
+
+A small, dependency-free CLI that checks an OpenAI-compatible model API from
+your machine. Useful when onboarding a gateway customer or checking a deployment.
+Python 3.10+. Initial alpha release; not a full SDK or a service monitor.
+
+## Install
+
+After the release is published to PyPI:
+
+```sh
+python -m pip install apiwells
+apiwells --version
+```
+
+For an unpublished local checkout: `python -m pip install .`
+
+## Check a model API
+
+Set `APIWELLS_API_KEY` in your environment using your shell's secret-input
+mechanism. Do not put a real key in a command, screenshot, issue or repository.
+
+```sh
+apiwells doctor --base-url https://YOUR-API-HOST/v1
+apiwells doctor --base-url https://YOUR-API-HOST/v1 --json
+```
+
+Replace the host with your actual API base. `/v1` is **not** added automatically.
+For a gateway using `/openai/v1`, supply that exact prefix. Do not supply the
+full `/models` or `/chat/completions` URL. This command sends one GET to
+`BASE/models`; it checks JSON `data` entries for nonempty string model IDs.
+An empty model list passes the shape check and reports `model_count: 0`.
+A model list does not prove that inference works or is available to this key.
+
+For one potentially billable inference request, opt in explicitly:
+
+```sh
+apiwells doctor --base-url https://YOUR-API-HOST/v1 --chat --model YOUR-MODEL-ID
+```
+
+This sends `Reply OK.` to `BASE/chat/completions`, with `stream: false` and
+`max_tokens: 8`. A pass means a nonempty assistant text response was returned;
+it does not require exactly `OK`. Some reasoning models require a different
+parameter or larger output budget; this release does not support those variants.
+`--max-tokens 32` increases the budget, not a guaranteed cost ceiling.
+There are no automatic retries or fallback models.
+
+For a local unauthenticated development server:
+
+```sh
+apiwells doctor --base-url http://127.0.0.1:3000/v1 --anonymous
+```
+
+Use `--api-key-env NAME` to select another environment variable.
+`--timeout 15` is a socket-operation timeout, not an overall deadline; DNS or
+slow continuous delivery may make total runtime longer. `elapsed_ms` measures
+this client's request/response time, not server inference time or streaming TTFT.
+
+## Results
+
+Exit codes: `0` minimal check passed, `1` endpoint check failed, `2` local usage
+or configuration error. `--json` writes one JSON object to stdout for completed
+checks; usage errors go to stderr and do not produce a JSON report.
+
+HTTP categories include authentication (401), forbidden (403), not_found (404),
+rate_or_quota (429), server_error (5xx), and redirect (3xx). These are diagnostic
+hints, not definitive root-cause identification. Transport categories include
+network, DNS, TLS and timeout. HTTP 200 with HTML, malformed JSON or an invalid
+response shape fails. Response reading is capped at 2 MiB plus one sentinel byte.
+
+## Security and limitations
+
+- Keys are sent only to the supplied endpoint. Verify the host before running.
+- HTTPS certificate verification stays enabled. Remote HTTP requires `--allow-http`;
+  literal loopback addresses and localhost are allowed for development.
+- Redirects are blocked, including same-host redirects.
+- No telemetry, files, raw response bodies, model IDs, URL or keys in reports.
+- Proxy settings are ignored unless `--use-env-proxy` is explicitly supplied.
+- This is a local CLI for endpoints you may test. Do not expose it as an unrestricted
+  server-side URL-fetching service: private/local destinations are intentionally allowed.
+- No streaming, embeddings, images, tool calling, Responses API, native Anthropic
+  or native Gemini protocol coverage in this version.
+- No live provider integration has been certified by the bundled local tests.
+
+## Development
+
+```sh
+python -m venv .venv
+# macOS/Linux: source .venv/bin/activate
+# Windows PowerShell: .\.venv\Scripts\Activate.ps1
+python -m pip install -e .
+python -m unittest discover -s tests -v
+python -m pip install build twine
+python -m build
+python -m twine check --strict dist/*
+```
+
+See `docs/PUBLISH_ZH.md` for the release walkthrough, sources and maintenance
+plan. License: MIT. Public source URL and maintainer contact can be added to
+project metadata once their real identities are confirmed; no fictitious links
+or authors are included.

apiwells-0.1.0/docs/PUBLISH_ZH.md

@@ -0,0 +1,290 @@
+# ApiWells 0.1.0：从本地验证到 PyPI 正式发布
+
+核查日期：2026-09-07。适用对象：第一次发布 Python 工具的维护者。
+
+## 1. 本次交付和完成边界
+
+交付是真实的 Endpoint Doctor：源码、测试、说明书、MIT 许可证、wheel 安装包和 sdist 源码包。
+本次已经完成的检查以压缩包根目录 VALIDATION.md 和验证日志为准。
+尚未完成：你的电脑测试、真实上游带密钥测试、TestPyPI 上传、正式 PyPI 上传。
+没有访问你的 PyPI 账户，也没有代替你创建或使用发布凭据。
+
+这是 OpenAI 兼容协议的基础诊断工具，不依赖 ApiWells 平台已上线。
+不包含 New API 的代码；不是 New API 的分发版本。
+可将它用于客户接入、网关部署验收和支持排障，已有独立用途。
+
+## 2. 名称与规则：事实、判断和边界
+
+事实：PEP 541 将无功能或空包式名称占用列为无效项目；同时还有垃圾信息、侵权、滥用等其他移除依据。
+事实：本次直接查询 https://pypi.org/pypi/apiwells/json 得到 HTTP 404。
+判断：目前未查到该名称的公开项目，可以尝试上传；但保留名、禁止名或之后发生的注册都可能阻止上传。
+边界：工具有功能并不等于 PyPI 事前认可，也不保证永久拥有名称。以首次正式上传成功且项目归属于你的账户为验收条件。
+来源：[PEP 541](https://peps.python.org/pep-0541/)。
+
+PyPI 用户名、Python 项目名、导入名和终端命令分别是不同概念：
+
+| 项目 | 本次值 | 如何产生 |
+|---|---|---|
+| PyPI 账户 | 你的实际账号 | 注册并验证邮箱，不要求叫 apiwells |
+| 发行项目名 | apiwells | pyproject.toml 中的 name，首次成功上传创建 |
+| Python 导入名 | apiwells | src/apiwells 目录 |
+| 终端命令 | apiwells | project.scripts 显式配置，安装时生成 |
+
+因此 CLI 并非仅靠 PyPI 名称自动获得，交付件已写好入口配置。它只在安装该包的环境中出现，不构成跨软件全局唯一命令权利。
+
+## 3. 下载和准备目录（约 10 分钟）
+
+下载 apiwells-release-kit-0.1.0.zip，解压。目录包含：
+
+- apiwells/：项目源码。后面的构建命令都在该目录运行。
+- apiwells/dist/：已验证的 .whl 和 .tar.gz 文件。
+- VALIDATION.md、validation-*.txt：本次验证记录。
+- SHA256SUMS.txt：压缩包内部交付文件的校验值。
+
+不要直接在压缩包预览窗口运行代码。先完整解压。
+使用 Python 3.10 或以上；本次实测版本是 Python 3.12.13，其他版本/系统未实机验证。
+
+macOS：打开“终端”，输入 `cd `（末尾有空格），把解压后的 apiwells 文件夹拖入终端，再回车。
+Windows：在 apiwells 文件夹的空白处右键，选择“在终端中打开”。
+
+macOS/Linux：
+
+```sh
+python3 --version
+python3 -m venv .venv
+source .venv/bin/activate
+```
+
+Windows PowerShell：
+
+```powershell
+py --version
+py -m venv .venv
+.\.venv\Scripts\Activate.ps1
+```
+
+若 PowerShell 禁止运行激活脚本，不必修改全局策略：后文所有 `python` 改为 `.\.venv\Scripts\python.exe`，`apiwells` 改为 `.\.venv\Scripts\apiwells.exe`。
+激活后的命令均使用 `python`，以确保 pip、测试和构建使用同一个环境。
+虚拟环境把该项目的工具与系统 Python 隔离开。
+
+## 4. 先安装交付的成品，验证确实能用（约 5 分钟）
+
+```sh
+python -m pip install --no-deps ./dist/apiwells-0.1.0-py3-none-any.whl
+python -m apiwells --version
+python -m apiwells doctor --help
+python -m unittest discover -s tests -v
+```
+
+预期版本：`apiwells 0.1.0`；测试结尾应为 `OK`。
+测试会启动临时本地 HTTP 服务并自动关闭；无需真实密钥，也不会调用付费模型。
+这里安装的是 wheel，不是开发目录，因此能发现“源码正常、打包漏文件”的问题。
+`--no-deps` 可用，因为首版无第三方运行依赖；构建和发布工具仍需要安装。
+
+## 5. 真实端点验收（约 10 分钟）
+
+准备两个信息：上游/你自己的网关的完整 API Base URL，以及在该平台创建的 API Key。
+不要把管理后台网址当 API Base；按对方文档确定 `/v1` 或其他路径。
+不要在这里填写未经确认的 apiwells 品牌域名。
+
+macOS 默认 zsh 安全输入密钥（输入时不显示字符）：
+
+```sh
+read -s 'APIWELLS_API_KEY?API Key: '
+export APIWELLS_API_KEY
+```
+
+bash 用户使用：
+
+```sh
+read -r -s -p 'API Key: ' APIWELLS_API_KEY
+export APIWELLS_API_KEY
+```
+
+Windows PowerShell：
+
+```powershell
+$endpointSecret = Read-Host 'API Key' -AsSecureString
+$env:APIWELLS_API_KEY = [System.Net.NetworkCredential]::new('', $endpointSecret).Password
+Remove-Variable endpointSecret
+```
+
+用真实地址替换下面的 YOUR-API-HOST：
+
+```sh
+python -m apiwells doctor --base-url https://YOUR-API-HOST/v1
+python -m apiwells doctor --base-url https://YOUR-API-HOST/v1 --json
+```
+
+预期：PASS、HTTP=200、model_count 为平台返回的数量。空数组也会通过结构检查，但没有可见模型。
+默认只做 GET /models。它不主动产生推理 Token，但是否对请求收费仍由服务商决定。
+如果平台不支持模型列表，这项检查可能失败，但对话接口仍可能正常。
+
+在平台文档或控制台找到你有权限的完整模型 ID，再执行一次：
+
+```sh
+python -m apiwells doctor --base-url https://YOUR-API-HOST/v1 --chat --model YOUR-MODEL-ID
+```
+
+这会发送一次真实、可能收费的对话请求。成功标准是收到非空 assistant 文本。
+默认 max_tokens=8，适合基础文本模型；不保证所有推理模型支持。若返回400，检查模型与参数，而非立刻断定平台故障。
+本版不测流式、工具调用、多模态、Responses API，也不证明模型身份或生成质量。
+
+macOS/Linux 结束后：`unset APIWELLS_API_KEY`。
+PowerShell 结束后：`Remove-Item Env:APIWELLS_API_KEY`。
+密钥不会写入报告，但环境变量仍应按凭据保护。
+
+## 6. 发布前检查项目身份和许可证（约 5 分钟）
+
+打开 pyproject.toml，确认 name=apiwells、version=0.1.0。
+本交付默认采用 MIT：允许其他人使用、修改和再分发这份小工具。若这不是你希望的代码授权方式，先更改许可证和元数据，再重新构建。
+品牌名称使用权与代码许可不是同一件事。
+
+没有填写虚构作者邮箱或 GitHub 地址；这些字段不是本包构建所必需的。
+建议在你拥有的 GitHub 账户下建立 apiwells 仓库，上传源码，建立真实问题反馈渠道后，再补充项目链接。
+只添加真实且你控制的信息，不必为了首次发布填写不存在的网址。
+
+如果源码/README/元数据有任何改动，应重新测试和构建；不能继续发布旧 dist 文件。
+若未改动，可以直接上传本次验证的两个成品。
+
+## 7. 如需自行重新构建（约 5–10 分钟）
+
+安装构建工具。build 负责生成分发文件；twine 负责校验元数据和上传。
+
+```sh
+python -m pip install --upgrade build twine
+python -m unittest discover -s tests -v
+python -m build
+python -m twine check --strict dist/apiwells-0.1.0-py3-none-any.whl dist/apiwells-0.1.0.tar.gz
+```
+
+build 默认先构建源码包，再从源码包生成 wheel。检查两项 PASSED。
+如果测试源代码发生变化，应先 `python -m pip install -e .` 再运行测试，随后重新构建，并在另一个新虚拟环境安装新 wheel 复核。
+不要把 PASSED 理解成安全审计：twine check 主要检查元数据和说明文档。
+来源：[PyPA 打包教程](https://packaging.python.org/en/latest/tutorials/packaging-projects/)。
+
+## 8. 创建两个发布账户（约 10–20 分钟）
+
+在 [TestPyPI](https://test.pypi.org/account/register/) 和 [PyPI](https://pypi.org/account/register/) 分别注册、验证邮箱，设置双因素认证并保存恢复码。
+这两个站点的账户和 Token 分开管理，不能混用。
+
+在对应站点 Account settings → API tokens → Add API token，生成首次发布所用 Token。
+首次发布新项目时项目尚不存在，手工 Token 路线使用该账户范围的 Token；上传完成后换成仅 apiwells 项目的 Token，并撤销首次用的广范围 Token。
+
+Token 在终端密码提示中粘贴，不要发给任何聊天助手，不写入源码、命令历史或提交到 Git。
+发布身份固定使用 `__token__`，密码是完整的 `pypi-...` Token。
+来源：[PyPI 账户、2FA 与 Token 帮助](https://pypi.org/help/)。
+
+## 9. 先上传 TestPyPI（约 5–10 分钟）
+
+在已激活虚拟环境、且位于 apiwells 源码目录时：
+
+```sh
+python -m twine upload --repository testpypi --username __token__ dist/apiwells-0.1.0-py3-none-any.whl dist/apiwells-0.1.0.tar.gz
+```
+
+提示密码时粘贴 TestPyPI Token；终端不显示字符是正常现象。
+若你已有本机凭据管理配置，Twine 可能直接取已保存凭据；务必核对目标站点。
+上传成功后打开 https://test.pypi.org/project/apiwells/0.1.0/，检查简介和文件。
+
+用新环境验证下载，macOS/Linux：
+
+```sh
+python -m venv ../apiwells-test-install
+../apiwells-test-install/bin/python -m pip install --index-url https://test.pypi.org/simple/ --no-deps apiwells==0.1.0
+../apiwells-test-install/bin/python -m apiwells --version
+```
+
+Windows PowerShell：
+
+```powershell
+python -m venv ..\apiwells-test-install
+..\apiwells-test-install\Scripts\python.exe -m pip install --index-url https://test.pypi.org/simple/ --no-deps apiwells==0.1.0
+..\apiwells-test-install\Scripts\python.exe -m apiwells --version
+```
+
+TestPyPI 的成功不会占有正式 PyPI 名称；测试站数据也可能被清理。
+如果测试站 apiwells 已被别人使用，不表示正式站也被使用，不要声称该项目属于你；可以依靠已完成的本地 wheel 安装验收再走正式发布。
+本项目无运行依赖，因此无需混用测试/生产两个下载索引。
+来源：[TestPyPI 官方指南](https://packaging.python.org/en/latest/guides/using-testpypi/)。
+社区实践参考：[Python 打包社区对全新环境 wheel 测试的讨论](https://discuss.python.org/t/update-packaging-tutorial-to-allow-installing-dependencies-when-testing-installation/47999)。这是实践建议，不是上传规则。
+
+## 10. 正式发布（约 5 分钟）
+
+确保真实端点验收达到你的要求，且确认 MIT 和公开文件内容。
+再次打开 https://pypi.org/project/apiwells/ 检查名称状态。404 仍不保证可注册。
+在构建环境执行下列命令；这一步会把工具公开到正式 PyPI：
+
+```sh
+python -m twine upload --repository-url https://upload.pypi.org/legacy/ --username __token__ dist/apiwells-0.1.0-py3-none-any.whl dist/apiwells-0.1.0.tar.gz
+```
+
+密码提示中使用正式 PyPI Token。
+上传结束后，打开 https://pypi.org/project/apiwells/0.1.0/，并在登录后的 Your projects 确认该项目由你管理。
+只看到公网项目页面不足以证明你是所有者。
+
+如果 wheel 成功而 sdist 失败，只重传失败的那个文件，不要删除整个项目。
+若看到已用文件名错误，先查站点是否已经收到了文件。
+已上传文件不能用同名文件覆盖，删除后也不能重用；需要修复代码时升到 0.1.1 并重建。
+不要用 `--skip-existing` 掩盖第一次发布的异常。来源：[PyPI 文件名不可重用说明](https://pypi.org/help/#file-name-reuse)。
+
+## 11. 从正式 PyPI 验证“pip install apiwells”
+
+必须用另一个新环境，以免本地已装版本造成假成功。
+macOS/Linux：
+
+```sh
+python -m venv ../apiwells-prod-install
+../apiwells-prod-install/bin/python -m pip install --index-url https://pypi.org/simple/ --no-cache-dir apiwells==0.1.0
+../apiwells-prod-install/bin/apiwells --version
+../apiwells-prod-install/bin/python -m unittest discover -s tests -v
+```
+
+Windows PowerShell：
+
+```powershell
+python -m venv ..\apiwells-prod-install
+..\apiwells-prod-install\Scripts\python.exe -m pip install --index-url https://pypi.org/simple/ --no-cache-dir apiwells==0.1.0
+..\apiwells-prod-install\Scripts\apiwells.exe --version
+..\apiwells-prod-install\Scripts\python.exe -m unittest discover -s tests -v
+```
+
+随后使用这个环境里的 Python 重做第5节真实端点测试。
+最终客户在支持的 Python 环境、且 pip 指向正式 PyPI 时，可以使用 `pip install apiwells`。
+文档推荐 `python -m pip install apiwells`，以减少多 Python 环境装错位置的问题。
+如果国内镜像尚未同步，先用上面的正式索引验证，不能立即判断发布失败。
+
+## 12. 排错表
+
+| 现象 | 先查什么 | 处理动作 |
+|---|---|---|
+| doctor 缺少密钥 | 当前终端是否设置变量 | 重新输入变量，或仅对无鉴权端点加 --anonymous |
+| 401 | 密钥、平台、过期状态 | 到对应平台核对，不反复盲试 |
+| 403 | 权限、IP、WAF | 查平台访问策略及日志 |
+| 404 | /v1 前缀、端点、模型ID | 使用官方 Base URL，区分 models 与 chat 支持 |
+| 429 | 速率、余额、配额 | 查账户与限额；不是自动认定某一个原因 |
+| TLS/network | 证书、DNS、代理 | 修复证书/网络；需要系统代理时明确加 --use-env-proxy |
+| timeout | 上游响应、网络 | 先查状态；必要时提高 --timeout，不自动重试收费请求 |
+| twine 认证失败 | 是否用了错误站点 Token | __token__ + 对应站点完整 Token |
+| 名称不可用/无权限 | 保留名、已有项目、Token范围 | 看服务端错误；不要声明名称已经锁定 |
+| command not found | 虚拟环境/命令PATH | 用 python -m apiwells，或执行该环境的绝对路径 |
+
+## 13. 长期维护与可证伪目标
+
+判断：这个工具适合作为接入支持资产；仅凭它不能推断未来 MaaS 的获客或盈利能力。
+建议第一周实际诊断至少3个你有权限的端点组合，保留脱敏的成功/失败类别，并记录一次实际排障用途。
+基准情况：安装可复现，至少一个真实模型列表和一个对话检查通过，能用于客户接入说明。
+最佳情况：客户能用报告自行定位常见接入错误，减少你重复支持时间。
+失败情况：目标客户主要用不兼容协议，或工具经常把可用端点判为失败；先修正覆盖范围/提示，不为了版本活动随意发包。
+验证指标：安装成功率、真实已知故障分类是否正确、误报数量、客户独立完成检查比例。
+首周失败条件：无法完成真实端点调用或出现密钥泄漏；在修复前不对客户宣传已通过验收。
+
+建议每季度实际检查一次安装、核心功能和反馈渠道；发现缺陷时发布修复并写 CHANGELOG。
+PEP 541 的“被遗弃”并非只看12个月没发版，而是还要求不可联系等条件同时满足。不要机械发空更新；保持真实维护和邮箱可达。
+未来有稳定 GitHub 发布流程后，可升级为 [Trusted Publishing](https://docs.pypi.org/trusted-publishers/)，使用短期身份凭据，减少长期 Token 管理。
+
+## 14. 设计依据
+
+- [Python urllib.request 官方文档](https://docs.python.org/3/library/urllib.request.html)：HTTP、TLS、代理和重定向的实现基础。
+- [HTTPie 官方 CLI 文档](https://httpie.io/docs/cli/HEAD)：状态码影响退出码、显式超时和重定向控制的成熟 CLI 实践。本工具并非复制 HTTPie 功能，退出码也不同。
+- 本项目使用标准库以降低首版安装成本；这是本次工程判断，不是 PyPI 对项目大小或依赖数量的要求。

apiwells-0.1.0/pyproject.toml

@@ -0,0 +1,27 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "apiwells"
+version = "0.1.0"
+description = "Endpoint Doctor for OpenAI-compatible model APIs"
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+keywords = ["api", "diagnostics", "llm", "endpoint"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Environment :: Console",
+  "Intended Audience :: Developers",
+  "Programming Language :: Python :: 3",
+  "Operating System :: OS Independent",
+  "Topic :: Software Development :: Testing",
+]
+
+[project.scripts]
+apiwells = "apiwells.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

apiwells-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

apiwells-0.1.0/src/apiwells/__init__.py

@@ -0,0 +1,2 @@
+"""Small diagnostics for OpenAI-compatible endpoints."""
+__version__ = "0.1.0"

apiwells-0.1.0/src/apiwells/__main__.py

@@ -0,0 +1,2 @@
+from .cli import main
+raise SystemExit(main())

apiwells-0.1.0/src/apiwells/cli.py

@@ -0,0 +1,178 @@
+"""Dependency-free, single-request endpoint diagnostics."""
+import argparse
+import http.client
+import ipaddress
+import json
+import math
+import os
+import socket
+import ssl
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+
+from . import __version__
+
+LIMIT = 2 * 1024 * 1024
+
+
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+def endpoint(base, allow_http=False):
+    if not base or any(ord(c) <= 32 or ord(c) == 127 for c in base):
+        raise ValueError("Base URL must not contain whitespace/control characters.")
+    p = urllib.parse.urlsplit(base)
+    if p.scheme not in ("http", "https") or not p.hostname:
+        raise ValueError("Use an absolute http(s) API base URL ending in /v1 if required.")
+    if p.username is not None or p.password is not None or p.query or p.fragment:
+        raise ValueError("Do not put credentials, query strings or fragments in the base URL.")
+    try:
+        p.port
+        local = ipaddress.ip_address(p.hostname).is_loopback
+    except ValueError:
+        local = p.hostname == "localhost"
+        # Validate malformed ports separately from non-IP hostnames.
+        p.port
+    if p.scheme == "http" and not local and not allow_http:
+        raise ValueError("Remote HTTP is unencrypted; use HTTPS or explicitly --allow-http.")
+    path = p.path.rstrip("/")
+    if path.endswith(("/models", "/chat/completions")):
+        raise ValueError("Supply the API base, not the /models or /chat/completions endpoint.")
+    return urllib.parse.urlunsplit((p.scheme, p.netloc, path, "", ""))
+
+
+def hint(status):
+    if 300 <= status < 400:
+        return "redirect", "Redirect blocked. Verify the final API base URL."
+    return {
+        400: ("bad_request", "Check model support and request parameters."),
+        401: ("authentication", "Check API key validity and the intended endpoint."),
+        403: ("forbidden", "Check permissions, IP policy and gateway/WAF rules."),
+        404: ("not_found", "Check base path and model name; this does not prove the service is offline."),
+        405: ("method_not_allowed", "Check route and protocol compatibility."),
+        429: ("rate_or_quota", "Check rate limits, quota and account balance; status alone cannot distinguish them."),
+    }.get(status, ("server_error" if status >= 500 else "http_error", "Inspect gateway/upstream logs for this request."))
+
+
+def diagnose(base_url, key="", model=None, timeout=15.0, max_tokens=8,
+             allow_http=False, use_env_proxy=False):
+    """Return a sanitized report. Raises ValueError for invalid local configuration."""
+    base = endpoint(base_url, allow_http)
+    if not math.isfinite(timeout) or timeout <= 0 or timeout > 300:
+        raise ValueError("Timeout must be finite and in (0, 300] seconds.")
+    if not isinstance(max_tokens, int) or not 1 <= max_tokens <= 4096:
+        raise ValueError("max-tokens must be an integer from 1 to 4096.")
+    if any(ord(c) < 33 or ord(c) > 126 for c in key):
+        raise ValueError("API key must contain printable ASCII without spaces.")
+    if model is not None and (not isinstance(model, str) or not model.strip()):
+        raise ValueError("A nonempty model is required for a chat check.")
+    kind = "chat" if model is not None else "models"
+    route = "/chat/completions" if model is not None else "/models"
+    headers = {"Accept": "application/json", "User-Agent": "apiwells/" + __version__}
+    if key:
+        headers["Authorization"] = "Bearer " + key
+    body = None
+    if model is not None:
+        headers["Content-Type"] = "application/json"
+        body = json.dumps({"model": model, "messages": [{"role": "user", "content": "Reply OK."}],
+                           "max_tokens": max_tokens, "stream": False}).encode()
+    req = urllib.request.Request(base + route, data=body, headers=headers)
+    # No redirects, .netrc authentication, retries or implicit environment proxy.
+    opener = urllib.request.build_opener(NoRedirect(), urllib.request.ProxyHandler(
+        None if use_env_proxy else {}))
+    report = {"schema_version": 1, "version": __version__, "check": kind,
+              "ok": False, "http_status": None, "category": "network", "elapsed_ms": 0}
+    start = time.monotonic()
+    try:
+        try:
+            response = opener.open(req, timeout=timeout)
+        except urllib.error.HTTPError as exc:
+            response = exc
+        with response:
+            report["http_status"] = response.code
+            if not 200 <= response.code < 300:
+                report["category"], report["hint"] = hint(response.code)
+                return report
+            raw = response.read(LIMIT + 1)
+        if len(raw) > LIMIT:
+            report.update(category="response_too_large", hint="Response exceeded the 2 MiB limit.")
+            return report
+        try:
+            data = json.loads(raw)
+        except (ValueError, UnicodeError, RecursionError):
+            report.update(category="invalid_json", hint="Expected JSON; check for an HTML login or proxy page.")
+            return report
+        valid = False
+        if isinstance(data, dict) and "error" not in data:
+            if kind == "models":
+                items = data.get("data")
+                valid = isinstance(items, list) and all(
+                    isinstance(x, dict) and isinstance(x.get("id"), str) and bool(x["id"])
+                    for x in items)
+                if valid:
+                    report["model_count"] = len(items)
+            else:
+                choices = data.get("choices")
+                if isinstance(choices, list) and choices and isinstance(choices[0], dict):
+                    message = choices[0].get("message")
+                    valid = (isinstance(message, dict) and message.get("role") == "assistant"
+                             and isinstance(message.get("content"), str) and bool(message["content"].strip()))
+        report.update(ok=valid, category="ok" if valid else "unexpected_schema",
+                      hint=("Minimal response check passed; this is not a full compatibility or quality certification."
+                            if valid else "Expected models data or nonempty assistant text. Inspect upstream protocol/model support."))
+        return report
+    except (urllib.error.URLError, OSError, http.client.HTTPException) as exc:
+        reason = exc.reason if isinstance(exc, urllib.error.URLError) else exc
+        category = "network"
+        if isinstance(reason, (TimeoutError, socket.timeout)):
+            category = "timeout"
+        elif isinstance(reason, ssl.SSLError):
+            category = "tls"
+        elif isinstance(reason, socket.gaierror):
+            category = "dns"
+        report.update(category=category, hint="Check DNS, certificate trust, connectivity and timeout. Raw errors are omitted to protect credentials.")
+        return report
+    finally:
+        report["elapsed_ms"] = round((time.monotonic() - start) * 1000, 2)
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description="ApiWells Endpoint Doctor: one diagnostic request, no retries.")
+    parser.add_argument("--version", action="version", version="apiwells " + __version__)
+    sub = parser.add_subparsers(dest="command", required=True)
+    p = sub.add_parser("doctor", help="Check an OpenAI-compatible API base")
+    p.add_argument("--base-url", required=True, help="Exact API base, e.g. https://host.example/v1; no automatic /v1")
+    p.add_argument("--api-key-env", default="APIWELLS_API_KEY", help="Environment variable containing the key")
+    p.add_argument("--anonymous", action="store_true", help="Send no authentication header")
+    p.add_argument("--chat", action="store_true", help="Opt into one potentially billable chat request")
+    p.add_argument("--model", help="Exact model ID; required with --chat")
+    p.add_argument("--max-tokens", type=int, default=8)
+    p.add_argument("--timeout", type=float, default=15, help="Socket operation timeout in seconds, not total wall-clock deadline")
+    p.add_argument("--allow-http", action="store_true", help="Explicitly allow unencrypted remote HTTP")
+    p.add_argument("--use-env-proxy", action="store_true", help="Opt into system/environment proxy settings")
+    p.add_argument("--json", action="store_true", help="Print sanitized JSON to stdout")
+    args = parser.parse_args(argv)
+    if args.chat != (args.model is not None):
+        p.error("Use --chat and --model together.")
+    key = "" if args.anonymous else os.environ.get(args.api_key_env, "")
+    if not args.anonymous and not key:
+        p.error("API key environment variable is missing/empty; set it or use --anonymous.")
+    try:
+        result = diagnose(args.base_url, key, args.model, args.timeout, args.max_tokens,
+                          args.allow_http, args.use_env_proxy)
+    except (ValueError, UnicodeError):
+        p.error("Invalid configuration. Check URL, port, HTTPS, key characters, model, timeout and token limit.")
+    if args.json:
+        print(json.dumps(result, ensure_ascii=True, allow_nan=False))
+    else:
+        print("{} {} HTTP={} {:.2f}ms [{}]".format(
+            "PASS" if result["ok"] else "FAIL", result["check"],
+            result["http_status"], result["elapsed_ms"], result["category"]))
+        print(result["hint"])
+        if "model_count" in result:
+            print("Models returned:", result["model_count"])
+    return 0 if result["ok"] else 1

apiwells-0.1.0/src/apiwells.egg-info/PKG-INFO

@@ -0,0 +1,118 @@
+Metadata-Version: 2.4
+Name: apiwells
+Version: 0.1.0
+Summary: Endpoint Doctor for OpenAI-compatible model APIs
+License-Expression: MIT
+Keywords: api,diagnostics,llm,endpoint
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# ApiWells Endpoint Doctor
+
+A small, dependency-free CLI that checks an OpenAI-compatible model API from
+your machine. Useful when onboarding a gateway customer or checking a deployment.
+Python 3.10+. Initial alpha release; not a full SDK or a service monitor.
+
+## Install
+
+After the release is published to PyPI:
+
+```sh
+python -m pip install apiwells
+apiwells --version
+```
+
+For an unpublished local checkout: `python -m pip install .`
+
+## Check a model API
+
+Set `APIWELLS_API_KEY` in your environment using your shell's secret-input
+mechanism. Do not put a real key in a command, screenshot, issue or repository.
+
+```sh
+apiwells doctor --base-url https://YOUR-API-HOST/v1
+apiwells doctor --base-url https://YOUR-API-HOST/v1 --json
+```
+
+Replace the host with your actual API base. `/v1` is **not** added automatically.
+For a gateway using `/openai/v1`, supply that exact prefix. Do not supply the
+full `/models` or `/chat/completions` URL. This command sends one GET to
+`BASE/models`; it checks JSON `data` entries for nonempty string model IDs.
+An empty model list passes the shape check and reports `model_count: 0`.
+A model list does not prove that inference works or is available to this key.
+
+For one potentially billable inference request, opt in explicitly:
+
+```sh
+apiwells doctor --base-url https://YOUR-API-HOST/v1 --chat --model YOUR-MODEL-ID
+```
+
+This sends `Reply OK.` to `BASE/chat/completions`, with `stream: false` and
+`max_tokens: 8`. A pass means a nonempty assistant text response was returned;
+it does not require exactly `OK`. Some reasoning models require a different
+parameter or larger output budget; this release does not support those variants.
+`--max-tokens 32` increases the budget, not a guaranteed cost ceiling.
+There are no automatic retries or fallback models.
+
+For a local unauthenticated development server:
+
+```sh
+apiwells doctor --base-url http://127.0.0.1:3000/v1 --anonymous
+```
+
+Use `--api-key-env NAME` to select another environment variable.
+`--timeout 15` is a socket-operation timeout, not an overall deadline; DNS or
+slow continuous delivery may make total runtime longer. `elapsed_ms` measures
+this client's request/response time, not server inference time or streaming TTFT.
+
+## Results
+
+Exit codes: `0` minimal check passed, `1` endpoint check failed, `2` local usage
+or configuration error. `--json` writes one JSON object to stdout for completed
+checks; usage errors go to stderr and do not produce a JSON report.
+
+HTTP categories include authentication (401), forbidden (403), not_found (404),
+rate_or_quota (429), server_error (5xx), and redirect (3xx). These are diagnostic
+hints, not definitive root-cause identification. Transport categories include
+network, DNS, TLS and timeout. HTTP 200 with HTML, malformed JSON or an invalid
+response shape fails. Response reading is capped at 2 MiB plus one sentinel byte.
+
+## Security and limitations
+
+- Keys are sent only to the supplied endpoint. Verify the host before running.
+- HTTPS certificate verification stays enabled. Remote HTTP requires `--allow-http`;
+  literal loopback addresses and localhost are allowed for development.
+- Redirects are blocked, including same-host redirects.
+- No telemetry, files, raw response bodies, model IDs, URL or keys in reports.
+- Proxy settings are ignored unless `--use-env-proxy` is explicitly supplied.
+- This is a local CLI for endpoints you may test. Do not expose it as an unrestricted
+  server-side URL-fetching service: private/local destinations are intentionally allowed.
+- No streaming, embeddings, images, tool calling, Responses API, native Anthropic
+  or native Gemini protocol coverage in this version.
+- No live provider integration has been certified by the bundled local tests.
+
+## Development
+
+```sh
+python -m venv .venv
+# macOS/Linux: source .venv/bin/activate
+# Windows PowerShell: .\.venv\Scripts\Activate.ps1
+python -m pip install -e .
+python -m unittest discover -s tests -v
+python -m pip install build twine
+python -m build
+python -m twine check --strict dist/*
+```
+
+See `docs/PUBLISH_ZH.md` for the release walkthrough, sources and maintenance
+plan. License: MIT. Public source URL and maintainer contact can be added to
+project metadata once their real identities are confirmed; no fictitious links
+or authors are included.

apiwells-0.1.0/src/apiwells.egg-info/SOURCES.txt

@@ -0,0 +1,15 @@
+CHANGELOG.md
+LICENSE
+MANIFEST.in
+README.md
+pyproject.toml
+docs/PUBLISH_ZH.md
+src/apiwells/__init__.py
+src/apiwells/__main__.py
+src/apiwells/cli.py
+src/apiwells.egg-info/PKG-INFO
+src/apiwells.egg-info/SOURCES.txt
+src/apiwells.egg-info/dependency_links.txt
+src/apiwells.egg-info/entry_points.txt
+src/apiwells.egg-info/top_level.txt
+tests/test_doctor.py

apiwells-0.1.0/src/apiwells.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

apiwells-0.1.0/src/apiwells.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+apiwells = apiwells.cli:main

apiwells-0.1.0/src/apiwells.egg-info/top_level.txt

@@ -0,0 +1 @@
+apiwells

apiwells-0.1.0/tests/test_doctor.py

@@ -0,0 +1,126 @@
+import contextlib
+import io
+import json
+import os
+import threading
+import time
+import unittest
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from unittest.mock import patch
+from apiwells.cli import diagnose, main, endpoint
+
+
+class Handler(BaseHTTPRequestHandler):
+    calls = []
+    def log_message(self, *args):
+        pass
+    def do_GET(self):
+        self.handle_check()
+    def do_POST(self):
+        self.handle_check()
+    def handle_check(self):
+        body = self.rfile.read(int(self.headers.get('Content-Length', 0)))
+        Handler.calls.append((self.path, self.headers.get('Authorization'), body))
+        prefix = self.path.split('/')[1]
+        code = int(prefix) if prefix.isdigit() else 200
+        self.send_response(code)
+        if code == 302:
+            self.send_header('Location', '/v1/models')
+        self.end_headers()
+        if prefix == 'slow':
+            time.sleep(.15)
+        if prefix == 'invalid':
+            raw = b'<html>login</html>'
+        elif prefix == 'large':
+            raw = b'x' * (2 * 1024 * 1024 + 1)
+        elif prefix == 'schema':
+            raw = b'{"data":[{}]}'
+        elif prefix == 'error':
+            raw = b'{"error":{"message":"secret-test-key"}}'
+        elif self.path.endswith('/chat/completions'):
+            raw = b'{"choices":[{"message":{"role":"assistant","content":"OK"}}]}'
+        else:
+            raw = b'{"data":[{"id":"secret-test-key"}]}'
+        try:
+            self.wfile.write(raw)
+        except (BrokenPipeError, ConnectionResetError):
+            pass
+
+
+class DoctorTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.server = ThreadingHTTPServer(('127.0.0.1', 0), Handler)
+        cls.thread = threading.Thread(target=cls.server.serve_forever, daemon=True)
+        cls.thread.start()
+        cls.base = 'http://127.0.0.1:' + str(cls.server.server_port)
+    @classmethod
+    def tearDownClass(cls):
+        cls.server.shutdown()
+        cls.server.server_close()
+        cls.thread.join()
+    def test_models_and_redaction(self):
+        r = diagnose(self.base + '/v1/', 'secret-test-key')
+        self.assertTrue(r['ok'])
+        self.assertEqual(r['model_count'], 1)
+        self.assertNotIn('secret-test-key', json.dumps(r))
+        self.assertEqual(Handler.calls[-1][:2], ('/v1/models', 'Bearer secret-test-key'))
+    def test_chat_payload(self):
+        r = diagnose(self.base + '/v1', 'key', model='demo')
+        self.assertTrue(r['ok'])
+        body = json.loads(Handler.calls[-1][2])
+        self.assertEqual(body['model'], 'demo')
+        self.assertEqual(body['max_tokens'], 8)
+        self.assertFalse(body['stream'])
+    def test_http_failures_no_retry(self):
+        for status, cat in [(400,'bad_request'), (401,'authentication'), (403,'forbidden'),
+                            (404,'not_found'), (405,'method_not_allowed'), (429,'rate_or_quota'), (500,'server_error')]:
+            with self.subTest(status=status):
+                n = len(Handler.calls)
+                r = diagnose(self.base + '/' + str(status))
+                self.assertEqual(r['category'], cat)
+                self.assertEqual(len(Handler.calls), n + 1)
+    def test_redirect_not_followed(self):
+        n = len(Handler.calls)
+        self.assertEqual(diagnose(self.base + '/302', 'key')['category'], 'redirect')
+        self.assertEqual(len(Handler.calls), n + 1)
+    def test_response_validation(self):
+        for path, cat in [('invalid', 'invalid_json'), ('schema', 'unexpected_schema'),
+                          ('error','unexpected_schema'), ('large', 'response_too_large')]:
+            self.assertEqual(diagnose(self.base + '/' + path)['category'], cat)
+    def test_timeout(self):
+        self.assertEqual(diagnose(self.base + '/slow', timeout=.03)['category'], 'timeout')
+    def test_invalid_config(self):
+        for url in ['ftp://example.com', 'https://u:p@example.com', 'https://example.com?key=x',
+                    'https://example.com#x', 'https://example.com:bad', 'http://example.com',
+                    'https://example.com/v1/models', 'https://exam\nple.com']:
+            with self.subTest(url=url), self.assertRaises(ValueError):
+                endpoint(url)
+        for timeout in [0, -1, float('nan'), float('inf'), 301]:
+            with self.assertRaises(ValueError):
+                diagnose(self.base, timeout=timeout)
+        with self.assertRaises(ValueError):
+            diagnose(self.base, 'key\r\nInjected: x')
+    def test_proxy_ignored_by_default(self):
+        with patch.dict(os.environ, {'http_proxy':'http://127.0.0.1:1', 'HTTP_PROXY':'http://127.0.0.1:1', 'no_proxy':'', 'NO_PROXY':''}):
+            self.assertTrue(diagnose(self.base + '/v1')['ok'])
+    def test_cli_json_exit_codes(self):
+        for path, expected in [('v1', 0), ('401', 1)]:
+            out = io.StringIO()
+            with contextlib.redirect_stdout(out):
+                code = main(['doctor','--base-url',self.base+'/'+path,'--anonymous','--json'])
+            self.assertEqual(code, expected)
+            self.assertEqual(json.loads(out.getvalue())['ok'], expected == 0)
+    def test_cli_usage_error(self):
+        for extra in [['--chat'], ['--model','demo'], ['--timeout','nan']]:
+            with contextlib.redirect_stderr(io.StringIO()), self.assertRaises(SystemExit) as e:
+                main(['doctor','--base-url',self.base,'--anonymous'] + extra)
+            self.assertEqual(e.exception.code, 2)
+    def test_missing_key(self):
+        with patch.dict(os.environ, {}, clear=True), contextlib.redirect_stderr(io.StringIO()), self.assertRaises(SystemExit) as e:
+            main(['doctor','--base-url',self.base])
+        self.assertEqual(e.exception.code, 2)
+
+
+if __name__ == '__main__':
+    unittest.main()