assertion-cli 0.5.16__tar.gz → 0.5.18__tar.gz

{assertion_cli-0.5.16 → assertion_cli-0.5.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: assertion-cli
-Version: 0.5.16
+Version: 0.5.18
 Summary: CLI for the Assertion API
 Requires-Python: >=3.13
 Description-Content-Type: text/markdown
@@ -54,23 +54,28 @@ asrt verify-status                     # one-shot poll; loop with your own sleep
 ## Authentication
 
 `asrt login` stores your API token in a global, user-level file —
-`~/.assertion/credentials.json` (mode `0600`) — keyed by the repo's path:
+`~/.assertion/credentials.json` (mode `0600`) — with an inverted repo index:
 
 ```json
-{ "version": 1, "repos": { "/abs/path/to/repo": "alk_..." } }
+{
+  "version": 2,
+  "tokens": { "alk_...": ["acme/mvp", "acme/docs"] },
+  "repo_index": { "acme/mvp": "alk_...", "acme/docs": "alk_..." }
+}
 ```
 
 Run it from inside the repo it should authenticate. It validates the token and
 confirms the repo's `origin` remote is connected to a stack in the token's
-workspace before saving, so each repo can target a different workspace. Because
-entries are keyed by path, moving or renaming the repo folder means logging in
-again (which adds a new entry). `asrt logout` removes the current repo's entry;
-`asrt whoami` shows which token is in effect.
+workspace before saving the token against that workspace's stack repos, so each
+repo can target a different workspace while moved folders and fresh clones keep
+working. `asrt logout` removes the current repo's saved auth; `asrt whoami`
+shows which token is in effect.
 
 Token resolution at call time, in order:
 
-1. the entry for the current repo path in `~/.assertion/credentials.json`;
-2. the `ASSERTION_API_TOKEN` environment variable (a backup for CI, or repos
+1. the token in `repo_index` for the current repo's GitHub `owner/repo`;
+2. a legacy entry for the current repo path in `~/.assertion/credentials.json`;
+3. the `ASSERTION_API_TOKEN` environment variable (a backup for CI, or repos
    with no remote that `asrt login` won't store);
 
 with a clear "run `asrt login`" error when neither is present. The API base URL

{assertion_cli-0.5.16 → assertion_cli-0.5.18}/README.md

@@ -41,23 +41,28 @@ asrt verify-status                     # one-shot poll; loop with your own sleep
 ## Authentication
 
 `asrt login` stores your API token in a global, user-level file —
-`~/.assertion/credentials.json` (mode `0600`) — keyed by the repo's path:
+`~/.assertion/credentials.json` (mode `0600`) — with an inverted repo index:
 
 ```json
-{ "version": 1, "repos": { "/abs/path/to/repo": "alk_..." } }
+{
+  "version": 2,
+  "tokens": { "alk_...": ["acme/mvp", "acme/docs"] },
+  "repo_index": { "acme/mvp": "alk_...", "acme/docs": "alk_..." }
+}
 ```
 
 Run it from inside the repo it should authenticate. It validates the token and
 confirms the repo's `origin` remote is connected to a stack in the token's
-workspace before saving, so each repo can target a different workspace. Because
-entries are keyed by path, moving or renaming the repo folder means logging in
-again (which adds a new entry). `asrt logout` removes the current repo's entry;
-`asrt whoami` shows which token is in effect.
+workspace before saving the token against that workspace's stack repos, so each
+repo can target a different workspace while moved folders and fresh clones keep
+working. `asrt logout` removes the current repo's saved auth; `asrt whoami`
+shows which token is in effect.
 
 Token resolution at call time, in order:
 
-1. the entry for the current repo path in `~/.assertion/credentials.json`;
-2. the `ASSERTION_API_TOKEN` environment variable (a backup for CI, or repos
+1. the token in `repo_index` for the current repo's GitHub `owner/repo`;
+2. a legacy entry for the current repo path in `~/.assertion/credentials.json`;
+3. the `ASSERTION_API_TOKEN` environment variable (a backup for CI, or repos
    with no remote that `asrt login` won't store);
 
 with a clear "run `asrt login`" error when neither is present. The API base URL

{assertion_cli-0.5.16 → assertion_cli-0.5.18}/api.py

@@ -9,7 +9,7 @@ import typer
 from pydantic import BaseModel, ValidationError
 
 from credentials import API_TOKEN_ENV, resolve_token
-from git import find_git_root_or_none
+from git import current_repo_full_name, find_git_root_or_none
 from models import (
     CheckpointResponse,
     DecisionResponse,
@@ -35,11 +35,15 @@ def _base_url() -> str:
 def _resolve_token() -> str | None:
     """Token for the current repo, else the shell env-var backup, else None.
 
-    The stored credential (keyed by the exact current git root) is primary; a
-    real `export ASSERTION_API_TOKEN` only fills in when no entry matches — e.g.
-    in CI, or a repo that was moved/renamed and never re-authenticated.
+    Stored credentials are primarily keyed by the current repo's GitHub
+    ``owner/repo`` identity, with the legacy exact git-root path as fallback. A
+    real `export ASSERTION_API_TOKEN` only fills in when no stored entry matches.
     """
-    token = resolve_token(find_git_root_or_none(Path.cwd()))
+    repo_root = find_git_root_or_none(Path.cwd())
+    repo_full_name = (
+        current_repo_full_name(repo_root) if repo_root is not None else None
+    )
+    token = resolve_token(repo_root, repo_full_name)
     if token:
         return token
     env_token = (os.environ.get(API_TOKEN_ENV) or "").strip()
@@ -53,7 +57,7 @@ def _auth_headers() -> dict[str, str]:
         where = f" for {repo_root}" if repo_root else ""
         typer.echo(
             f"No saved Assertion token{where}. Run `asrt login` to authenticate "
-            "this repo (if you moved or renamed the folder, log in again).\n"
+            "this repo.\n"
             f"Alternatively, export {API_TOKEN_ENV} in your shell as a backup.",
             err=True,
         )

{assertion_cli-0.5.16 → assertion_cli-0.5.18}/assertion_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: assertion-cli
-Version: 0.5.16
+Version: 0.5.18
 Summary: CLI for the Assertion API
 Requires-Python: >=3.13
 Description-Content-Type: text/markdown
@@ -54,23 +54,28 @@ asrt verify-status                     # one-shot poll; loop with your own sleep
 ## Authentication
 
 `asrt login` stores your API token in a global, user-level file —
-`~/.assertion/credentials.json` (mode `0600`) — keyed by the repo's path:
+`~/.assertion/credentials.json` (mode `0600`) — with an inverted repo index:
 
 ```json
-{ "version": 1, "repos": { "/abs/path/to/repo": "alk_..." } }
+{
+  "version": 2,
+  "tokens": { "alk_...": ["acme/mvp", "acme/docs"] },
+  "repo_index": { "acme/mvp": "alk_...", "acme/docs": "alk_..." }
+}
 ```
 
 Run it from inside the repo it should authenticate. It validates the token and
 confirms the repo's `origin` remote is connected to a stack in the token's
-workspace before saving, so each repo can target a different workspace. Because
-entries are keyed by path, moving or renaming the repo folder means logging in
-again (which adds a new entry). `asrt logout` removes the current repo's entry;
-`asrt whoami` shows which token is in effect.
+workspace before saving the token against that workspace's stack repos, so each
+repo can target a different workspace while moved folders and fresh clones keep
+working. `asrt logout` removes the current repo's saved auth; `asrt whoami`
+shows which token is in effect.
 
 Token resolution at call time, in order:
 
-1. the entry for the current repo path in `~/.assertion/credentials.json`;
-2. the `ASSERTION_API_TOKEN` environment variable (a backup for CI, or repos
+1. the token in `repo_index` for the current repo's GitHub `owner/repo`;
+2. a legacy entry for the current repo path in `~/.assertion/credentials.json`;
+3. the `ASSERTION_API_TOKEN` environment variable (a backup for CI, or repos
    with no remote that `asrt login` won't store);
 
 with a clear "run `asrt login`" error when neither is present. The API base URL

assertion_cli-0.5.18/credentials.py

@@ -0,0 +1,253 @@
+"""Global, user-level token store at ``~/.assertion/credentials.json``.
+
+The current store keeps plaintext tokens plus an inverted GitHub repo index, so
+reclones or moved folders keep resolving as long as their ``origin`` still
+points at a connected repo:
+
+    {
+      "version": 2,
+      "tokens": {"alk_...": ["acme/mvp"]},
+      "repo_index": {"acme/mvp": "alk_..."}
+    }
+
+The legacy v1 ``repos`` path map is still read as a fallback:
+
+    {"version": 1, "repos": {"/abs/path/to/repo": "alk_..."}}
+
+This module is deliberately git-free and pure stdlib — callers pass in the repo
+root / repo full name (resolved via ``git.py``) and handle their own error
+reporting. Token resolution precedence (repo entry first, then the env-var
+backup) lives in ``api.py``; this module only owns on-disk reads and writes.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+
+API_TOKEN_ENV = "ASSERTION_API_TOKEN"
+
+CREDENTIALS_FILE_NAME = "credentials.json"
+CREDENTIALS_VERSION = 2
+
+
+def assertion_home() -> Path:
+    """Directory holding global Assertion credentials (``~/.assertion``)."""
+    return Path.home() / ".assertion"
+
+
+def credentials_path() -> Path:
+    return assertion_home() / CREDENTIALS_FILE_NAME
+
+
+def _empty_store() -> dict:
+    return {
+        "version": CREDENTIALS_VERSION,
+        "tokens": {},
+        "repo_index": {},
+        "repos": {},
+    }
+
+
+def load_store() -> dict:
+    """Return the credentials store, tolerating a missing or corrupt file.
+
+    A malformed file is treated as empty rather than crashing every command —
+    the user can re-run ``asrt login`` to repair it.
+    """
+    path = credentials_path()
+    if not path.exists():
+        return _empty_store()
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, OSError, ValueError):
+        return _empty_store()
+    if not isinstance(data, dict):
+        return _empty_store()
+    data.setdefault("version", CREDENTIALS_VERSION)
+    if not isinstance(data.get("tokens"), dict):
+        data["tokens"] = {}
+    if not isinstance(data.get("repo_index"), dict):
+        data["repo_index"] = _repo_index_from_tokens(data["tokens"])
+    if not isinstance(data.get("repos"), dict):
+        data["repos"] = {}
+    return data
+
+
+def _repo_key(repo_root: Path) -> str:
+    """Canonical store key for a repo root (absolute, symlinks resolved)."""
+    return str(repo_root.resolve())
+
+
+def _repo_name_key(repo_full_name: str) -> str:
+    return repo_full_name.strip().lower()
+
+
+def _normalize_repo_names(repo_full_names: list[str]) -> list[str]:
+    seen: set[str] = set()
+    normalized: list[str] = []
+    for repo in repo_full_names:
+        key = _repo_name_key(repo)
+        if not key or key in seen:
+            continue
+        seen.add(key)
+        normalized.append(key)
+    return normalized
+
+
+def _repo_index_from_tokens(tokens: dict) -> dict[str, str]:
+    index: dict[str, str] = {}
+    for token, repos in tokens.items():
+        if not isinstance(token, str) or not isinstance(repos, list):
+            continue
+        for repo in repos:
+            key = _repo_name_key(str(repo))
+            if key:
+                index[key] = token
+    return index
+
+
+def _write_store(store: dict) -> Path:
+    home = assertion_home()
+    home.mkdir(parents=True, exist_ok=True)
+    try:
+        home.chmod(0o700)
+    except OSError:
+        pass
+    path = credentials_path()
+    path.write_text(json.dumps(store, indent=2) + "\n", encoding="utf-8")
+    try:
+        path.chmod(0o600)
+    except OSError:
+        pass
+    return path
+
+
+def save_token(
+    token: str, *, repo_root: Path, repo_full_names: list[str] | None = None
+) -> Path:
+    """Persist ``token`` and return the credentials file path.
+
+    ``repo_full_names`` are canonical GitHub ``owner/repo`` names visible to the
+    token. The legacy path entry is still written so older CLIs can read the
+    file during a rolling upgrade.
+    """
+    store = load_store()
+    if repo_full_names is not None:
+        normalized = _normalize_repo_names(repo_full_names)
+        normalized_set = set(normalized)
+        repo_index = store["repo_index"]
+        for repo, indexed_token in list(repo_index.items()):
+            if indexed_token == token or repo in normalized_set:
+                del repo_index[repo]
+        for saved_token, repos in list(store["tokens"].items()):
+            if saved_token == token or not isinstance(repos, list):
+                continue
+            filtered = [
+                _repo_name_key(str(repo))
+                for repo in repos
+                if _repo_name_key(str(repo)) not in normalized_set
+            ]
+            if filtered:
+                store["tokens"][saved_token] = filtered
+            else:
+                del store["tokens"][saved_token]
+            for repo in normalized:
+                if repo_index.get(repo) == saved_token:
+                    del repo_index[repo]
+        store["tokens"][token] = normalized
+        for repo in normalized:
+            repo_index[repo] = token
+    store["repos"][_repo_key(repo_root)] = token
+    return _write_store(store)
+
+
+def remove_token(*, repo_root: Path, repo_full_name: str | None = None) -> bool:
+    """Delete this repo's saved credential. Return ``True`` if one was removed."""
+    store = load_store()
+    key = _repo_key(repo_root)
+    token = store["repos"].pop(key, None)
+    removed = token is not None
+    if repo_full_name is not None:
+        repo_key = _repo_name_key(repo_full_name)
+        indexed_token = store["repo_index"].pop(repo_key, None)
+        target_token = token or indexed_token
+        for saved_token, repos in list(store["tokens"].items()):
+            if target_token is not None and saved_token != target_token:
+                continue
+            if not isinstance(repos, list):
+                continue
+            filtered = [
+                str(repo).strip().lower()
+                for repo in repos
+                if _repo_name_key(str(repo)) != repo_key
+            ]
+            if len(filtered) != len(repos):
+                removed = True
+                if filtered:
+                    store["tokens"][saved_token] = filtered
+                else:
+                    del store["tokens"][saved_token]
+            if saved_token == target_token:
+                break
+        removed = removed or indexed_token is not None
+    if token:
+        repo_refs = 0
+        for saved in store["repos"].values():
+            if saved == token:
+                repo_refs += 1
+        indexed_refs = [
+            indexed_token
+            for indexed_token in store["repo_index"].values()
+            if indexed_token == token
+        ]
+        if (
+            repo_refs == 0
+            and not indexed_refs
+            and token in store["tokens"]
+            and repo_full_name is None
+        ):
+            del store["tokens"][token]
+    if removed:
+        _write_store(store)
+    return removed
+
+
+def resolve_token(
+    repo_root: Path | None, repo_full_name: str | None = None
+) -> str | None:
+    """Return the stored token for ``repo_full_name`` / ``repo_root``.
+
+    Repo-name matching is primary and survives reclones/moved folders. The
+    legacy exact path match is retained so existing credentials keep working.
+    """
+    store = load_store()
+    if repo_full_name is not None:
+        local = _repo_name_key(repo_full_name)
+        token = store["repo_index"].get(local)
+        if token:
+            return token
+    if repo_root is None:
+        return None
+    token = store["repos"].get(_repo_key(repo_root))
+    return token or None
+
+
+def describe_source(
+    repo_root: Path | None, repo_full_name: str | None = None
+) -> str | None:
+    """Describe where the active token comes from, in resolution order.
+
+    Returns a human phrase for ``whoami``, or ``None`` when nothing resolves.
+    """
+    if (
+        repo_full_name is not None
+        and resolve_token(repo_root, repo_full_name) is not None
+    ):
+        return f"the saved token for {repo_full_name.strip().lower()}"
+    if repo_root is not None and resolve_token(repo_root) is not None:
+        return f"the saved token for {_repo_key(repo_root)}"
+    if (os.environ.get(API_TOKEN_ENV) or "").strip():
+        return f"the {API_TOKEN_ENV} environment variable"
+    return None

{assertion_cli-0.5.16 → assertion_cli-0.5.18}/main.py

@@ -125,8 +125,9 @@ def login(
     """Authenticate this repo and save its token under ~/.assertion/.
 
     Generate a token at Settings → Authentication in the dashboard, then run
-    this from inside the repo it should be used for. The token is stored keyed
-    by the repo's path, so each repo can target a different workspace.
+    this from inside any repo it can access. The token is stored with the
+    workspace's stack repos, so moved folders and fresh clones keep working when
+    their `origin` remote matches.
 
     Only repos whose `origin` remote matches a stack in the token's workspace
     are stored; a repo with no remote can't be verified, so use the
@@ -173,7 +174,9 @@ def login(
             "the dashboard, then re-run `asrt login`."
         )
 
-    path = save_token(token, repo_root=repo_root)
+    path = save_token(
+        token, repo_root=repo_root, repo_full_names=[s.repo for s in stack_list]
+    )
     names = ", ".join(f"'{s.name}'" for s in matched)
     typer.echo(f"✓ {local} is connected to stack(s): {names}")
     typer.echo(f"Saved token for {repo_root} to {path}")
@@ -186,7 +189,8 @@ def logout() -> None:
     if repo_root is None:
         exit_with_error("Not inside a git repository.")
 
-    if remove_token(repo_root=repo_root):
+    local = current_repo_full_name(repo_root)
+    if remove_token(repo_root=repo_root, repo_full_name=local):
         typer.echo(f"Removed saved token for {repo_root}.")
     else:
         typer.echo(f"No saved token for {repo_root}.")
@@ -196,7 +200,8 @@ def logout() -> None:
 def whoami() -> None:
     """Show which token would be used here and confirm it works."""
     repo_root = find_git_root_or_none(Path.cwd())
-    source = describe_source(repo_root)
+    local = current_repo_full_name(repo_root) if repo_root is not None else None
+    source = describe_source(repo_root, local)
     if source is None:
         exit_with_error(
             "Not authenticated. Run `asrt login` to save a token for this repo."
@@ -694,22 +699,36 @@ def _build_verify_bundle(
     return bundle_bytes, review_diff_text, compute_review_diff_hash(review_diff_text)
 
 
-def _try_reuse_successful_verify(
+def _compute_review_diff_fingerprint(ctx) -> tuple[str, str]:
+    """Return (review_diff_text, review_diff_hash) without bundle side effects."""
+    verify_base = read_init_verify_base_sha(ctx.assertion_dir)
+    review_diff_text = get_full_diff(ctx.repo_root, verify_base)
+    return review_diff_text, compute_review_diff_hash(review_diff_text)
+
+
+def _try_reuse_verify(
     assertion_dir: Path,
     *,
     review_diff_hash: str,
     json_output: bool,
 ) -> bool:
-    """Reuse the prior verification when the review diff is unchanged.
+    """Reuse a prior verification when the review diff is unchanged.
 
-    Returns True when a prior succeeded verification is reused (no new submission).
+    Returns True when an existing session is reused (no new submission). Covers
+    both terminal ``succeeded`` runs and in-flight ``created``/``running`` runs
+    so a repeated ``asrt verify`` does not submit twice for the same diff.
     """
     stored_hash = read_review_diff_hash(assertion_dir)
     if stored_hash != review_diff_hash:
         return False
 
     last_status = read_verify_last_status(assertion_dir)
-    if last_status != SessionStatus.SUCCEEDED.value:
+    reusable_statuses = {
+        SessionStatus.SUCCEEDED.value,
+        SessionStatus.CREATED.value,
+        SessionStatus.RUNNING.value,
+    }
+    if last_status not in reusable_statuses:
         return False
 
     session_id = _read_optional_verify_session_id(assertion_dir)
@@ -726,12 +745,12 @@ def _try_reuse_successful_verify(
                 {
                     "session_id": session_id,
                     "url": session_url,
-                    "status": SessionStatus.SUCCEEDED.value,
+                    "status": last_status,
                     "reused": True,
                 }
             )
         )
-    else:
+    elif last_status == SessionStatus.SUCCEEDED.value:
         typer.echo(
             "Review diff unchanged since the last successful verification — "
             f"reusing session {session_id}."
@@ -740,6 +759,13 @@ def _try_reuse_successful_verify(
         typer.echo(
             "Embed `asrt get-link` in the PR body if the branch name may differ."
         )
+    else:
+        typer.echo(
+            "Review diff unchanged since the last verification submission — "
+            f"session {session_id} is still {last_status}."
+        )
+        typer.echo(f"URL: {session_url}")
+        typer.echo("Poll `asrt verify-status` instead of submitting again.")
     return True
 
 
@@ -763,24 +789,25 @@ def verify(
     this command only submits — poll `asrt verify-status` (one-shot) on whatever
     interval your harness prefers to learn the outcome.
 
-    When the review-scope diff is unchanged since the last *succeeded*
-    verification, the CLI reuses that result instead of submitting again.
-    Pass ``--force`` to always submit.
+    When the review-scope diff is unchanged since the last verification
+    submission, the CLI reuses that session instead of submitting again —
+    including while a prior run is still ``running``. Pass ``--force`` to always
+    submit.
     """
     ctx, metadata = load_existing_session(Path.cwd())
     stack_id = metadata.stack_id
     assert stack_id is not None
-    bundle_bytes, review_diff_text, review_diff_hash = _build_verify_bundle(
-        ctx, metadata
-    )
+    _, review_diff_hash = _compute_review_diff_fingerprint(ctx)
 
-    if not force and _try_reuse_successful_verify(
+    if not force and _try_reuse_verify(
         ctx.assertion_dir,
         review_diff_hash=review_diff_hash,
         json_output=json_output,
     ):
         return
 
+    bundle_bytes, _, review_diff_hash = _build_verify_bundle(ctx, metadata)
+
     client = AssertionClient()
     resp = client.verify(
         stack_id=stack_id,

{assertion_cli-0.5.16 → assertion_cli-0.5.18}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "assertion-cli"
-version = "0.5.16"
+version = "0.5.18"
 description = "CLI for the Assertion API"
 readme = "README.md"
 requires-python = ">=3.13"

{assertion_cli-0.5.16 → assertion_cli-0.5.18}/templates/SKILL.md

@@ -21,7 +21,7 @@ Before any `asrt` call:
 
 - You are inside a git repository.
 - `asrt install` has been run once in this repo. It installs the skill files you are reading right now (plus the `AGENTS.md` / `CLAUDE.md` pointer and `.gitignore` rules). This is an onboarding step, not a per-run one.
-- `asrt login` has been run once to authenticate this repo. It stores the API token in `~/.assertion/credentials.json` (keyed by repo path) — not in a repo `.env`. If an `asrt` call fails with "No saved Assertion token … run `asrt login`", the user needs to run `asrt login` (or export `ASSERTION_API_TOKEN`); surface that to them rather than retrying.
+- `asrt login` has been run once to authenticate this repo. It stores the API token in `~/.assertion/credentials.json` (keyed by GitHub `owner/repo`) — not in a repo `.env`. If an `asrt` call fails with "No saved Assertion token … run `asrt login`", the user needs to run `asrt login` (or export `ASSERTION_API_TOKEN`); surface that to them rather than retrying.
 - `asrt session start` has been run for this work session. It resets `.assertion/` (except `.assertion/seed.py`) and records the verification base — the merge-base with the upstream tracking branch by default, or an explicit `--from <ref>`. If `asrt checkpoint` or `asrt verify` errors with "No verification base recorded", run `asrt session start` and retry.
 
 **First command sequence for a new work session:**
@@ -144,7 +144,7 @@ Do not call `verify` mid-task. It is not a substitute for checkpoints; it is the
 
 `verify` is **non-blocking**: it submits the verification and returns immediately with the session id and URL. The verification itself can take several minutes — you poll `asrt verify-status` on your own cadence to learn the outcome. This avoids tripping any shell-timeout in the harness.
 
-When the review diff is unchanged since the last **succeeded** verification, `asrt verify` reuses that session instead of submitting again. Use `asrt verify --force` to submit anyway. After a new git branch, run `asrt session start` only when the verification base should change — check the scope line it prints, or pass `--from <ref>` if the default is wrong.
+When the review diff is unchanged since the last verification submission, `asrt verify` reuses that session instead of submitting again — including while a prior run is still `running` (poll `asrt verify-status` instead). After a **succeeded** run, reuse skips a redundant submission. Use `asrt verify --force` to submit anyway. After a new git branch, run `asrt session start` only when the verification base should change — check the scope line it prints, or pass `--from <ref>` if the default is wrong.
 
 ```
 asrt verify                                # submit; prints session id + URL, exits 0

{assertion_cli-0.5.16 → assertion_cli-0.5.18}/tests/test_auth.py

@@ -43,7 +43,9 @@ def repo(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
 
 @respx.mock
 def test_login_saves_when_repo_matches_stack(repo: Path) -> None:
-    route = respx.get(STACKS_URL).mock(return_value=_stacks_response("acme/mvp"))
+    route = respx.get(STACKS_URL).mock(
+        return_value=_stacks_response("acme/mvp", "acme/docs")
+    )
 
     result = runner.invoke(main.app, ["login", "--token", "alk_new"])
 
@@ -51,6 +53,8 @@ def test_login_saves_when_repo_matches_stack(repo: Path) -> None:
     assert "connected to stack" in result.output.lower()
     assert route.called
     assert credentials.resolve_token(repo) == "alk_new"
+    assert credentials.resolve_token(None, "acme/mvp") == "alk_new"
+    assert credentials.resolve_token(None, "acme/docs") == "alk_new"
 
 
 @respx.mock