arccos-api 0.5.0__tar.gz → 0.5.2__tar.gz

{arccos_api-0.5.0 → arccos_api-0.5.2}/MANIFEST.in

@@ -1,5 +1,6 @@
 include LICENSE
 include README.md
 include pyproject.toml
+recursive-include tests/fixtures *.json
 recursive-exclude __pycache__ *
 global-exclude *.pyc *.pyo

{arccos_api-0.5.0/arccos_api.egg-info → arccos_api-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arccos-api
-Version: 0.5.0
+Version: 0.5.2
 Summary: Unofficial Python CLI and client library for the Arccos Golf API
 Author: Paul Frederiksen
 License-Expression: MIT
@@ -25,13 +25,16 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: requests<3,>=2.31
 Requires-Dist: click<9,>=8.1
-Requires-Dist: rich<15,>=13.0
+Requires-Dist: rich<16,>=13.0
+Provides-Extra: keyring
+Requires-Dist: keyring<27,>=25; extra == "keyring"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-cov; extra == "dev"
 Requires-Dist: ruff; extra == "dev"
 Requires-Dist: mypy; extra == "dev"
 Requires-Dist: types-requests; extra == "dev"
+Requires-Dist: openapi-spec-validator<0.8,>=0.7; extra == "dev"
 Requires-Dist: build>=0.10.0; extra == "dev"
 Requires-Dist: twine>=4.0.0; extra == "dev"
 Dynamic: license-file
@@ -91,7 +94,7 @@ arccos clubs       # smart club distances
 
 | Command | Description |
 |---------|-------------|
-| `arccos login` | Authenticate and cache credentials to `~/.arccos_creds.json` |
+| `arccos login` | Authenticate and securely cache credentials |
 | `arccos rounds` | List recent rounds with date, score, +/-, course name |
 | `arccos round <id>` | Hole-by-hole detail (score, putts, FIR, GIR) with totals |
 | `arccos handicap` | Handicap breakdown by category (overall, driving, approach, etc.) |
@@ -113,6 +116,7 @@ arccos clubs       # smart club distances
 | `arccos export` | Export rounds to JSON, CSV, or NDJSON (`--detail` for hole data) |
 | `arccos completions <shell>` | Generate bash/zsh/fish completion script |
 | `arccos logout` | Clear cached credentials |
+| `arccos doctor` | Check configuration, credentials, and API connectivity |
 
 Every command supports `--json` for raw JSON output and `--help` for usage info.
 
@@ -260,6 +264,8 @@ Other environment variables:
 ```bash
 export ARCCOS_TIMEOUT=30       # request timeout in seconds (default: 15)
 export ARCCOS_LOG_LEVEL=DEBUG  # enable debug logging (DEBUG, INFO, WARNING)
+export ARCCOS_PROFILE=work     # select a named credential profile
+export ARCCOS_KEYRING=true     # use the operating-system keyring
 ```
 
 > **Security note:** Environment variables may be visible in process listings (`ps`) and shell history. Prefer `arccos login` for interactive use.
@@ -270,7 +276,7 @@ export ARCCOS_LOG_LEVEL=DEBUG  # enable debug logging (DEBUG, INFO, WARNING)
 from arccos import ArccosClient
 
 client = ArccosClient(email="you@example.com", password="your_password")
-# Credentials cached in ~/.arccos_creds.json. Auto-refreshes silently.
+# Credentials are cached in the platform config directory and refresh silently.
 
 # Rounds
 rounds = client.rounds.list(limit=10)
@@ -432,18 +438,21 @@ python3 -m venv .venv
 source .venv/bin/activate
 pip install -e ".[dev]"
 
-pytest                  # tests with coverage (87%+, 173 tests)
+pytest                  # tests with coverage (87%+, 203 tests)
 ruff check .            # lint
 mypy arccos/            # type check
+openapi-spec-validator docs/openapi.yaml
 ```
 
 Coverage report: `htmlcov/index.html`. Minimum threshold: 80% (configured in `pyproject.toml`).
-Current suite: 173 tests.
+The suite includes sanitized response-contract fixtures so upstream schema drift
+is caught without making live API calls.
 
 ## Security
 
 - Data access is read-only: the client only sends `GET` requests to `api.arccosgolf.com`. The only `POST` requests are the required login/token-refresh calls to `authentication.arccosgolf.com`; no golf data is created, changed, or deleted.
-- Credentials are cached in `~/.arccos_creds.json` (mode `0600` — owner-only read/write). The file contains your access key (~180-day validity) and JWT token. Keep it safe.
+- Credentials are cached in the platform configuration directory (mode `0600` — owner-only read/write). Existing `~/.arccos_creds.json` files migrate automatically. Named profiles are available through `ARCCOS_PROFILE` or `--profile`.
+- Optional OS-keyring storage is available with `pip install 'arccos-api[keyring]'` and `ARCCOS_KEYRING=true` (or `--keyring` for login/logout/doctor).
 - All API communication uses HTTPS with TLS certificate verification.
 - `arccos logout` removes the local credential file but does **not** revoke server-side tokens. If you suspect your credentials were compromised, change your Arccos password.
 - The export command restricts output paths to your home directory or current working directory.

{arccos_api-0.5.0 → arccos_api-0.5.2}/README.md

@@ -53,7 +53,7 @@ arccos clubs       # smart club distances
 
 | Command | Description |
 |---------|-------------|
-| `arccos login` | Authenticate and cache credentials to `~/.arccos_creds.json` |
+| `arccos login` | Authenticate and securely cache credentials |
 | `arccos rounds` | List recent rounds with date, score, +/-, course name |
 | `arccos round <id>` | Hole-by-hole detail (score, putts, FIR, GIR) with totals |
 | `arccos handicap` | Handicap breakdown by category (overall, driving, approach, etc.) |
@@ -75,6 +75,7 @@ arccos clubs       # smart club distances
 | `arccos export` | Export rounds to JSON, CSV, or NDJSON (`--detail` for hole data) |
 | `arccos completions <shell>` | Generate bash/zsh/fish completion script |
 | `arccos logout` | Clear cached credentials |
+| `arccos doctor` | Check configuration, credentials, and API connectivity |
 
 Every command supports `--json` for raw JSON output and `--help` for usage info.
 
@@ -222,6 +223,8 @@ Other environment variables:
 ```bash
 export ARCCOS_TIMEOUT=30       # request timeout in seconds (default: 15)
 export ARCCOS_LOG_LEVEL=DEBUG  # enable debug logging (DEBUG, INFO, WARNING)
+export ARCCOS_PROFILE=work     # select a named credential profile
+export ARCCOS_KEYRING=true     # use the operating-system keyring
 ```
 
 > **Security note:** Environment variables may be visible in process listings (`ps`) and shell history. Prefer `arccos login` for interactive use.
@@ -232,7 +235,7 @@ export ARCCOS_LOG_LEVEL=DEBUG  # enable debug logging (DEBUG, INFO, WARNING)
 from arccos import ArccosClient
 
 client = ArccosClient(email="you@example.com", password="your_password")
-# Credentials cached in ~/.arccos_creds.json. Auto-refreshes silently.
+# Credentials are cached in the platform config directory and refresh silently.
 
 # Rounds
 rounds = client.rounds.list(limit=10)
@@ -394,18 +397,21 @@ python3 -m venv .venv
 source .venv/bin/activate
 pip install -e ".[dev]"
 
-pytest                  # tests with coverage (87%+, 173 tests)
+pytest                  # tests with coverage (87%+, 203 tests)
 ruff check .            # lint
 mypy arccos/            # type check
+openapi-spec-validator docs/openapi.yaml
 ```
 
 Coverage report: `htmlcov/index.html`. Minimum threshold: 80% (configured in `pyproject.toml`).
-Current suite: 173 tests.
+The suite includes sanitized response-contract fixtures so upstream schema drift
+is caught without making live API calls.
 
 ## Security
 
 - Data access is read-only: the client only sends `GET` requests to `api.arccosgolf.com`. The only `POST` requests are the required login/token-refresh calls to `authentication.arccosgolf.com`; no golf data is created, changed, or deleted.
-- Credentials are cached in `~/.arccos_creds.json` (mode `0600` — owner-only read/write). The file contains your access key (~180-day validity) and JWT token. Keep it safe.
+- Credentials are cached in the platform configuration directory (mode `0600` — owner-only read/write). Existing `~/.arccos_creds.json` files migrate automatically. Named profiles are available through `ARCCOS_PROFILE` or `--profile`.
+- Optional OS-keyring storage is available with `pip install 'arccos-api[keyring]'` and `ARCCOS_KEYRING=true` (or `--keyring` for login/logout/doctor).
 - All API communication uses HTTPS with TLS certificate verification.
 - `arccos logout` removes the local credential file but does **not** revoke server-side tokens. If you suspect your credentials were compromised, change your Arccos password.
 - The export command restricts output paths to your home directory or current working directory.

{arccos_api-0.5.0 → arccos_api-0.5.2}/arccos/__init__.py

@@ -18,10 +18,12 @@ from .auth import ArccosAuth
 from .client import ArccosClient
 from .exceptions import (
     ArccosAuthError,
+    ArccosConnectionError,
     ArccosError,
     ArccosForbiddenError,
     ArccosNotFoundError,
     ArccosRateLimitError,
+    ArccosResponseError,
 )
 
 
@@ -70,7 +72,9 @@ __all__ = [
     "ArccosAuth",
     "ArccosError",
     "ArccosAuthError",
+    "ArccosConnectionError",
     "ArccosForbiddenError",
     "ArccosNotFoundError",
     "ArccosRateLimitError",
+    "ArccosResponseError",
 ]

{arccos_api-0.5.0 → arccos_api-0.5.2}/arccos/_http.py

@@ -11,12 +11,18 @@ import contextlib
 import logging
 import os
 import time
+from datetime import UTC, datetime
+from email.utils import parsedate_to_datetime
 from typing import Any
 
 import requests
 
 from .auth import ArccosAuth, Credentials
-from .exceptions import raise_for_status
+from .exceptions import (
+    ArccosConnectionError,
+    ArccosResponseError,
+    raise_for_status,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -24,6 +30,7 @@ API_BASE = "https://api.arccosgolf.com"
 DEFAULT_TIMEOUT = 15
 MAX_RETRIES = 3
 RETRY_BACKOFF = 1.0  # seconds; doubles each retry
+MAX_RETRY_DELAY = 60.0
 
 
 class HttpClient:
@@ -38,10 +45,15 @@ class HttpClient:
     - Raises typed :mod:`arccos.exceptions` for non-2xx responses
     """
 
-    def __init__(self, auth: ArccosAuth, creds: Credentials):
+    def __init__(
+        self,
+        auth: ArccosAuth,
+        creds: Credentials,
+        session: requests.Session | None = None,
+    ):
         self._auth = auth
         self._creds = creds
-        self._session = requests.Session()
+        self._session = session or requests.Session()
         self._session.headers.update({
             "Content-Type": "application/json",
             "Accept":       "application/json",
@@ -74,19 +86,29 @@ class HttpClient:
         """
         return self._request(path, params=params)
 
+    def close(self) -> None:
+        """Close the underlying HTTP session."""
+        self._session.close()
+
+    def __enter__(self) -> HttpClient:
+        return self
+
+    def __exit__(self, *exc_info: object) -> None:
+        self.close()
+
     # ------------------------------------------------------------------
     # Private
     # ------------------------------------------------------------------
 
     def _request(self, path: str, **kwargs) -> Any:
         self._creds = self._auth.ensure_fresh(self._creds)
-        headers = {"Authorization": self._auth.auth_header(self._creds)}
-
         url = f"{API_BASE}{path}"
         logger.debug("GET %s", url)
 
         last_exc: Exception | None = None
+        retried_auth = False
         for attempt in range(MAX_RETRIES):
+            headers = {"Authorization": self._auth.auth_header(self._creds)}
             try:
                 # Deliberately call Session.get rather than the generic request
                 # method so this client cannot issue mutating data-API requests.
@@ -96,32 +118,54 @@ class HttpClient:
                 )
             except requests.exceptions.Timeout as exc:
                 last_exc = exc
-                self._backoff(attempt)
+                if attempt < MAX_RETRIES - 1:
+                    self._backoff(attempt)
                 continue
             except requests.exceptions.ConnectionError as exc:
                 last_exc = exc
-                self._backoff(attempt)
+                if attempt < MAX_RETRIES - 1:
+                    self._backoff(attempt)
                 continue
 
             if resp.ok:
                 if resp.content:
-                    return resp.json()
+                    try:
+                        return resp.json()
+                    except (requests.exceptions.JSONDecodeError, ValueError) as exc:
+                        raise ArccosResponseError(
+                            f"Arccos returned invalid JSON for GET {path}.",
+                            status_code=resp.status_code,
+                        ) from exc
                 return {}
 
+            # A JWT can be rejected before its local expiry time. Refresh once
+            # and retry with a newly constructed Authorization header.
+            if resp.status_code == 401 and not retried_auth:
+                self._creds = self._auth.refresh(self._creds)
+                retried_auth = True
+                continue
+
             # Retry on 429 and 5xx; raise immediately on other errors
             if resp.status_code == 429 or resp.status_code >= 500:
                 try:
                     raise_for_status(resp)
                 except Exception as exc:
                     last_exc = exc
-                    self._backoff(attempt, resp)
+                    if attempt < MAX_RETRIES - 1:
+                        self._backoff(attempt, resp)
                     continue
 
             # Non-retryable error (4xx other than 429)
             raise_for_status(resp)
 
         # Exhausted retries
-        raise last_exc  # type: ignore[misc]
+        if isinstance(last_exc, requests.exceptions.RequestException):
+            raise ArccosConnectionError(
+                f"Unable to reach Arccos after {MAX_RETRIES} attempts."
+            ) from last_exc
+        if last_exc is not None:
+            raise last_exc
+        raise ArccosConnectionError("Arccos request failed without a response.")
 
     @staticmethod
     def _backoff(attempt: int, resp: requests.Response | None = None) -> None:
@@ -131,6 +175,18 @@ class HttpClient:
             retry_after = resp.headers.get("Retry-After")
             if retry_after:
                 with contextlib.suppress(ValueError, TypeError):
-                    delay = max(float(retry_after), delay)
+                    delay = max(HttpClient._retry_after_seconds(retry_after), delay)
+        delay = min(delay, MAX_RETRY_DELAY)
         logger.warning("Retrying in %.1fs (attempt %d/%d)", delay, attempt + 1, MAX_RETRIES)
         time.sleep(delay)
+
+    @staticmethod
+    def _retry_after_seconds(value: str) -> float:
+        """Parse Retry-After seconds or an HTTP date."""
+        try:
+            return max(float(value), 0.0)
+        except ValueError:
+            parsed = parsedate_to_datetime(value)
+            if parsed.tzinfo is None:
+                parsed = parsed.replace(tzinfo=UTC)
+            return max((parsed - datetime.now(UTC)).total_seconds(), 0.0)

arccos_api-0.5.2/arccos/_validation.py

@@ -0,0 +1,36 @@
+"""Shared validation for public resource arguments."""
+
+from __future__ import annotations
+
+from datetime import date
+
+
+def positive(value: int | float, name: str, *, allow_zero: bool = False) -> None:
+    """Require a positive numeric value (or zero when explicitly allowed)."""
+    minimum = 0 if allow_zero else 1
+    if value < minimum:
+        qualifier = "non-negative" if allow_zero else "positive"
+        raise ValueError(f"{name} must be {qualifier}.")
+
+
+def iso_date(value: str | None, name: str) -> None:
+    """Require an ISO 8601 calendar date when a value is supplied."""
+    if value is None:
+        return
+    try:
+        date.fromisoformat(value)
+    except ValueError as exc:
+        raise ValueError(f"{name} must use YYYY-MM-DD format.") from exc
+
+
+def choice(value: str | None, name: str, choices: set[str]) -> None:
+    """Require a value to belong to a fixed set when supplied."""
+    if value is not None and value not in choices:
+        allowed = ", ".join(sorted(choices))
+        raise ValueError(f"{name} must be one of: {allowed}.")
+
+
+def nonempty(value: object, name: str) -> None:
+    """Reject empty identifiers and collections."""
+    if value is None or (hasattr(value, "__len__") and len(value) == 0):  # type: ignore[arg-type]
+        raise ValueError(f"{name} must not be empty.")

{arccos_api-0.5.0 → arccos_api-0.5.2}/arccos/auth.py

@@ -24,6 +24,8 @@ import contextlib
 import json
 import logging
 import os
+import re
+import sys
 import tempfile
 from dataclasses import dataclass
 from datetime import UTC, datetime
@@ -37,7 +39,31 @@ logger = logging.getLogger(__name__)
 
 AUTH_BASE = "https://authentication.arccosgolf.com"
 
-DEFAULT_CREDS_PATH = Path.home() / ".arccos_creds.json"
+LEGACY_CREDS_PATH = Path.home() / ".arccos_creds.json"
+KEYRING_SERVICE = "arccos-api"
+
+
+def config_dir() -> Path:
+    """Return the platform-appropriate per-user configuration directory."""
+    if os.name == "nt":
+        root = Path(os.environ.get("APPDATA", Path.home() / "AppData" / "Roaming"))
+    elif sys.platform == "darwin":
+        root = Path.home() / "Library" / "Application Support"
+    else:
+        root = Path(os.environ.get("XDG_CONFIG_HOME", Path.home() / ".config"))
+    return root / "arccos-api"
+
+
+DEFAULT_CREDS_PATH = config_dir() / "credentials.json"
+
+
+def credentials_path(profile: str = "default") -> Path:
+    """Resolve a profile name to its credential file without allowing traversal."""
+    if not re.fullmatch(r"[A-Za-z0-9_.-]+", profile):
+        raise ValueError("profile may contain only letters, numbers, '.', '_' and '-'.")
+    if profile == "default":
+        return DEFAULT_CREDS_PATH
+    return config_dir() / "profiles" / f"{profile}.json"
 
 
 @dataclass
@@ -81,6 +107,7 @@ class Credentials:
         prevents partially-written credential files.
         """
         path = Path(path)
+        path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
         fd, temp_name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
         try:
             os.fchmod(fd, 0o600)
@@ -154,8 +181,12 @@ class ArccosAuth:
         self,
         creds_path: Path = DEFAULT_CREDS_PATH,
         session: requests.Session | None = None,
+        profile: str = "default",
+        use_keyring: bool = False,
     ):
         self._creds_path = creds_path
+        self._profile = profile
+        self._use_keyring = use_keyring
         self._session = session or requests.Session()
         self._session.headers.update({"Content-Type": "application/json"})
 
@@ -182,11 +213,9 @@ class ArccosAuth:
         logger.debug("Logging in as %s", email)
 
         # Step 1: email + password → accessKey
-        resp = self._session.post(
+        resp = self._post(
             f"{AUTH_BASE}/accessKeys",
-            json={"email": email, "password": password, "signedInByFacebook": "F"},
-            timeout=15,
-            verify=True,
+            {"email": email, "password": password, "signedInByFacebook": "F"},
         )
         if resp.status_code == 401:
             raise ArccosAuthError(
@@ -194,7 +223,7 @@ class ArccosAuth:
                 status_code=resp.status_code,
             )
         raise_for_status(resp)
-        data = resp.json()
+        data = self._response_json(resp)
 
         try:
             access_key = data["accessKey"]
@@ -216,7 +245,7 @@ class ArccosAuth:
             token=token,
             secret=secret,
         )
-        creds.save(self._creds_path)
+        self._save(creds)
         logger.info("Logged in successfully as %s (userId=%s)", email, user_id)
         return creds
 
@@ -238,7 +267,7 @@ class ArccosAuth:
         """
         logger.debug("Refreshing token for userId=%s", creds.user_id)
         creds.token = self._fetch_token(creds.user_id, creds.access_key)
-        creds.save(self._creds_path)
+        self._save(creds)
         return creds
 
     def ensure_fresh(self, creds: Credentials) -> Credentials:
@@ -271,7 +300,7 @@ class ArccosAuth:
         Returns:
             Valid :class:`Credentials`.
         """
-        creds = Credentials.load(self._creds_path)
+        creds = self.load_cached()
         if creds and creds.email == email:
             return self.ensure_fresh(creds)
         return self.login(email, password)
@@ -281,17 +310,77 @@ class ArccosAuth:
         """Return the ``Authorization`` header value for API requests."""
         return f"Bearer {creds.token}"
 
+    def load_cached(self) -> Credentials | None:
+        """Load cached credentials from the selected backend."""
+        if not self._use_keyring:
+            creds = Credentials.load(self._creds_path)
+            if (
+                creds is None
+                and self._profile == "default"
+                and self._creds_path == DEFAULT_CREDS_PATH
+                and LEGACY_CREDS_PATH.exists()
+            ):
+                creds = Credentials.load(LEGACY_CREDS_PATH)
+                if creds is not None:
+                    creds.save(self._creds_path)
+                    LEGACY_CREDS_PATH.unlink()
+                    logger.info("Migrated credentials to %s", self._creds_path)
+            return creds
+        try:
+            import keyring
+        except ImportError as exc:
+            raise ArccosAuthError(
+                "Keyring storage requires: pip install 'arccos-api[keyring]'"
+            ) from exc
+        value = keyring.get_password(KEYRING_SERVICE, self._profile)
+        if value is None:
+            return None
+        try:
+            return Credentials.from_dict(json.loads(value))
+        except (KeyError, TypeError, json.JSONDecodeError) as exc:
+            raise ArccosAuthError("Stored keyring credentials are invalid.") from exc
+
+    def clear_cached(self) -> bool:
+        """Remove cached credentials and report whether anything was removed."""
+        if not self._use_keyring:
+            if not self._creds_path.exists():
+                return False
+            self._creds_path.unlink()
+            return True
+        try:
+            import keyring
+            from keyring.errors import PasswordDeleteError
+        except ImportError as exc:
+            raise ArccosAuthError(
+                "Keyring storage requires: pip install 'arccos-api[keyring]'"
+            ) from exc
+        try:
+            keyring.delete_password(KEYRING_SERVICE, self._profile)
+        except PasswordDeleteError:
+            return False
+        return True
+
     # ------------------------------------------------------------------
     # Private helpers
     # ------------------------------------------------------------------
 
+    def _save(self, creds: Credentials) -> None:
+        if not self._use_keyring:
+            creds.save(self._creds_path)
+            return
+        try:
+            import keyring
+        except ImportError as exc:
+            raise ArccosAuthError(
+                "Keyring storage requires: pip install 'arccos-api[keyring]'"
+            ) from exc
+        keyring.set_password(KEYRING_SERVICE, self._profile, json.dumps(creds.to_dict()))
+
     def _fetch_token(self, user_id: str, access_key: str) -> str:
         """POST /tokens and return the JWT string."""
-        resp = self._session.post(
+        resp = self._post(
             f"{AUTH_BASE}/tokens",
-            json={"userId": user_id, "accessKey": access_key},
-            timeout=15,
-            verify=True,
+            {"userId": user_id, "accessKey": access_key},
         )
         if resp.status_code == 401:
             raise ArccosAuthError(
@@ -299,4 +388,35 @@ class ArccosAuth:
                 status_code=resp.status_code,
             )
         raise_for_status(resp)
-        return resp.json()["token"]
+        data = self._response_json(resp)
+        token = data.get("token")
+        if not isinstance(token, str) or not token:
+            raise ArccosAuthError(
+                "Unexpected response from authentication server.",
+                status_code=resp.status_code,
+            )
+        return token
+
+    @staticmethod
+    def _response_json(resp: requests.Response) -> dict:
+        """Decode an authentication response or raise a stable public error."""
+        try:
+            data = resp.json()
+        except (requests.exceptions.JSONDecodeError, ValueError) as exc:
+            raise ArccosAuthError(
+                "Authentication server returned invalid JSON.",
+                status_code=resp.status_code,
+            ) from exc
+        if not isinstance(data, dict):
+            raise ArccosAuthError(
+                "Unexpected response from authentication server.",
+                status_code=resp.status_code,
+            )
+        return data
+
+    def _post(self, url: str, payload: dict) -> requests.Response:
+        """Send an auth request and normalize transport failures."""
+        try:
+            return self._session.post(url, json=payload, timeout=15, verify=True)
+        except requests.exceptions.RequestException as exc:
+            raise ArccosAuthError("Unable to reach the authentication server.") from exc

{arccos_api-0.5.0 → arccos_api-0.5.2}/arccos/cli/__init__.py

@@ -50,6 +50,7 @@ class RichGroup(click.Group):
             ("export", "Export rounds to JSON/CSV/NDJSON"),
             ("completions", "Generate shell completion script"),
             ("logout", "Clear cached credentials"),
+            ("doctor", "Check credentials and API connectivity"),
         ]
         for cmd, desc in cmds:
             table.add_row(f"arccos {cmd}", desc)
@@ -57,7 +58,7 @@ class RichGroup(click.Group):
         _console.print(table)
         _console.print(
             "\n[dim]All commands support [bold]--json[/bold] and [bold]--help[/bold]. "
-            "Credentials cached in ~/.arccos_creds.json.[/dim]\n"
+            "Named profiles and optional OS-keyring storage are supported.[/dim]\n"
         )
 
 

{arccos_api-0.5.0 → arccos_api-0.5.2}/arccos/cli/_helpers.py

@@ -20,9 +20,16 @@ def _get_client():
 
     email    = os.environ.get("ARCCOS_EMAIL")
     password = os.environ.get("ARCCOS_PASSWORD")
+    profile = os.environ.get("ARCCOS_PROFILE", "default")
+    use_keyring = os.environ.get("ARCCOS_KEYRING", "").lower() in {"1", "true", "yes"}
 
     try:
-        return ArccosClient(email=email, password=password)
+        return ArccosClient(
+            email=email,
+            password=password,
+            profile=profile,
+            use_keyring=use_keyring,
+        )
     except ArccosAuthError as e:
         err_console.print(f"[red]Auth failed:[/red] {e}")
         err_console.print("Run [bold]arccos login[/bold] or set ARCCOS_EMAIL and ARCCOS_PASSWORD.")