atomadic-forge 0.3.3__tar.gz → 0.3.4__tar.gz

{atomadic_forge-0.3.3 → atomadic_forge-0.3.4}/CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## 0.3.4 — `forge whoami` for agents and humans
+
+Adds the agent-empowerment QOL win that 0.3.3 was missing: when the
+MCP gate refuses with `subscription required`, agents (and humans)
+need a cheap way to ask **"who is the gate seeing me as, and from
+which source?"** without burning a real tool call. `forge whoami` is
+that command.
+
+### Added
+
+- **`forge whoami`** new top-level CLI verb (and `--json` for scripted
+  consumers). Returns:
+  ```json
+  {
+    "ok": true,
+    "source": "credentials_file" | "env" | "missing",
+    "key_prefix": "fk_live_b3502…",
+    "email": "tom@example.com",
+    "plan": "pro",
+    "verify_ok": true,
+    "verify_reason": "",
+    "credentials_path": "~/.atomadic-forge/credentials.toml",
+    "env_var": "FORGE_API_KEY"
+  }
+  ```
+  Resolution order matches the MCP gate exactly (env → credentials.toml).
+  `--no-verify` skips the network roundtrip for offline triage.
+- **6 new unit tests** for whoami covering missing-key, env-key,
+  credentials-file-key, env-wins-over-file, --no-verify, and
+  verify-rejection.
+
+### Why this matters for agents
+
+Before 0.3.4, an agent that hit `MCP error -32001: Forge subscription
+required` had two options: ask the human to restart the MCP, or fail.
+With 0.3.4 the agent can call `forge whoami --json` (via Bash) and
+get a structured answer it can act on:
+
+  * `source == "missing"` → tell the user to run `forge login`
+  * `source == "credentials_file"` + `verify_ok == false` → key is
+    revoked or stale; `forge login` again
+  * `source == "env"` + `verify_ok == false` → CI env var is wrong
+  * everything green → restart the MCP host (the running subprocess
+    needs a respawn to see the new env)
+
+This closes the loop for the auth experience — the agent can diagnose
+its own failure mode.
+
+### Tests
+
+902 passing, 2 skipped. `forge wire src/atomadic_forge` PASS,
+`forge certify .` holds at **100/100**.
+
+---
+
 ## 0.3.3 — MCP gate reads credentials.toml + actionable error message
 
 Hot-fix release. Closes the gap where `forge login` writes a key to

{atomadic_forge-0.3.3 → atomadic_forge-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: atomadic-forge
-Version: 0.3.3
+Version: 0.3.4
 Summary: Atomadic Forge — absorb, enforce, emerge. Polyglot (Python + JavaScript/TypeScript) architecture guardian for AI-generated code.
 Author: Atomadic
 License-Expression: BUSL-1.1

{atomadic_forge-0.3.3 → atomadic_forge-0.3.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "atomadic-forge"
-version = "0.3.3"
+version = "0.3.4"
 description = "Atomadic Forge — absorb, enforce, emerge. Polyglot (Python + JavaScript/TypeScript) architecture guardian for AI-generated code."
 readme = "README.md"
 requires-python = ">=3.10"

{atomadic_forge-0.3.3 → atomadic_forge-0.3.4}/src/atomadic_forge/__init__.py

@@ -9,4 +9,4 @@ Public version surface only — every symbol lives in its tier package and
 is re-exported lazily by the CLI.
 """
 
-__version__ = "0.3.3"
+__version__ = "0.3.4"

{atomadic_forge-0.3.3 → atomadic_forge-0.3.4}/src/atomadic_forge/a4_sy_orchestration/cli.py

@@ -65,6 +65,7 @@ from ..a3_og_features.forge_pipeline import (
 from ..a3_og_features.forge_plan_apply import apply_all_applyable, apply_card
 from ..a3_og_features.mcp_server import serve_stdio as mcp_serve_stdio
 from .login_cmd import app as _login_app
+from .whoami_cmd import app as _whoami_app
 
 # Suppress SyntaxWarnings from third-party code in seed/forged directories.
 warnings.filterwarnings("ignore", category=SyntaxWarning)
@@ -1153,6 +1154,12 @@ app.add_typer(mcp_app, name="mcp",
 app.add_typer(_login_app, name="login",
                help="Capture a Forge subscription key (required by `forge mcp serve`).")
 
+# Lane C W6 — `forge whoami` resolves the current auth state without
+# burning a real tool call. Pairs with `forge login` so agents can
+# verify what the gate is reading and where it came from.
+app.add_typer(_whoami_app, name="whoami",
+               help="Show the current Forge auth state — email, plan, source.")
+
 
 def _check_optional_dep(module: str) -> str:
     try:

atomadic_forge-0.3.4/src/atomadic_forge/a4_sy_orchestration/whoami_cmd.py

@@ -0,0 +1,159 @@
+"""Tier a4 — `forge whoami` orchestration command.
+
+Resolves the current Forge authentication state and prints (or returns
+as JSON) the email, plan, source (env vs credentials.toml), and verify
+result. Pairs with `forge login`: after a successful login, `whoami`
+confirms the credential file is being read and the verify endpoint
+agrees with what's there.
+
+Why a dedicated verb (and MCP tool):
+  * Agents need to ASK "am I authenticated and what's my plan?" without
+    burning a real tool call. Today an agent that hits "subscription
+    required" has no cheap follow-up — `whoami` is that follow-up.
+  * Humans running into MCP gate failures need a one-liner that says
+    exactly which key the gate read and where it came from.
+  * `--json` makes it scriptable in CI / shell wrappers.
+"""
+
+from __future__ import annotations
+
+import json as _json
+import os
+from pathlib import Path
+from typing import Annotated
+
+import typer
+
+from ..a0_qk_constants.auth_constants import API_KEY_ENV
+from ..a1_at_functions.forge_auth import (
+    read_api_key_from_credentials_file,
+    read_api_key_from_env,
+)
+from ..a2_mo_composites.forge_auth_client import ForgeAuthClient
+
+CREDENTIALS_FILE = Path("~/.atomadic-forge/credentials.toml").expanduser()
+
+
+def _resolve_key(env: dict[str, str], creds_path: Path) -> tuple[str | None, str]:
+    """Return (api_key, source) using the same resolution order the MCP gate uses.
+
+    source ∈ {"env", "credentials_file", "missing"}.
+    """
+    env_key = read_api_key_from_env(env)
+    if env_key:
+        return env_key, "env"
+    file_key = read_api_key_from_credentials_file(creds_path)
+    if file_key:
+        return file_key, "credentials_file"
+    return None, "missing"
+
+
+app = typer.Typer(
+    no_args_is_help=False,
+    help="Show the current Forge authentication state — email, plan, source.",
+)
+
+
+@app.callback(invoke_without_command=True)
+def whoami_cmd(
+    json_out: Annotated[
+        bool,
+        typer.Option(
+            "--json",
+            help="Emit the result as JSON for scripted consumers.",
+        ),
+    ] = False,
+    no_verify: Annotated[
+        bool,
+        typer.Option(
+            "--no-verify",
+            help="Skip the network verify roundtrip; just report the key shape "
+                 "and source (useful when the verify endpoint is offline).",
+        ),
+    ] = False,
+) -> None:
+    """Resolve and print the current Forge auth state."""
+    env_dict = dict(os.environ)
+    api_key, source = _resolve_key(env_dict, CREDENTIALS_FILE)
+
+    if api_key is None:
+        result: dict = {
+            "ok": False,
+            "source": "missing",
+            "email": "",
+            "plan": "",
+            "reason": (
+                "No Forge subscription key configured. Run "
+                "`forge login` to capture one, or export "
+                f"{API_KEY_ENV}=fk_live_… in the environment."
+            ),
+            "credentials_path": str(CREDENTIALS_FILE),
+        }
+        if json_out:
+            typer.echo(_json.dumps(result, indent=2))
+        else:
+            typer.echo("")
+            typer.secho("  ✗ Not logged in.", fg="red")
+            typer.echo("")
+            typer.echo("    Run `forge login` to capture a key, or export")
+            typer.echo(f"    {API_KEY_ENV}=fk_live_…")
+            typer.echo(f"    Credentials path: {CREDENTIALS_FILE}")
+        raise typer.Exit(code=1)
+
+    # We have a key. Mask it for display (show first 11 chars of fk_live_xxx).
+    masked = api_key[:11] + ("…" if len(api_key) > 11 else "")
+
+    email = ""
+    plan = ""
+    verify_ok = False
+    verify_reason = "(verification skipped via --no-verify)"
+
+    if not no_verify:
+        client = ForgeAuthClient()
+        try:
+            verify = client.verify(api_key)
+            verify_ok = bool(verify.get("ok"))
+            email = str(verify.get("email", "") or "")
+            plan = str(verify.get("plan", "") or "")
+            verify_reason = str(verify.get("reason", "") or "")
+        except Exception as exc:  # noqa: BLE001 — show offline status to the user
+            verify_reason = f"verify endpoint unreachable: {exc!r}"
+
+    result = {
+        "ok": verify_ok or no_verify,
+        "source": source,
+        "key_prefix": masked,
+        "email": email,
+        "plan": plan,
+        "verify_ok": verify_ok,
+        "verify_reason": verify_reason,
+        "credentials_path": str(CREDENTIALS_FILE),
+        "env_var": API_KEY_ENV,
+    }
+
+    if json_out:
+        typer.echo(_json.dumps(result, indent=2))
+        if not result["ok"]:
+            raise typer.Exit(code=1)
+        return
+
+    typer.echo("")
+    if result["ok"]:
+        typer.secho(
+            f"  ✓ Logged in as {email or '(unknown email)'}"
+            f"{f' · plan: {plan}' if plan else ''}",
+            fg="green",
+        )
+    else:
+        typer.secho(f"  ✗ Auth failed: {verify_reason}", fg="red")
+
+    typer.echo(f"    key:    {masked}")
+    typer.echo(f"    source: {source}")
+    if source == "credentials_file":
+        typer.echo(f"    file:   {CREDENTIALS_FILE}")
+    elif source == "env":
+        typer.echo(f"    env:    {API_KEY_ENV}")
+    typer.echo("")
+
+    if not result["ok"]:
+        raise typer.Exit(code=1)

{atomadic_forge-0.3.3 → atomadic_forge-0.3.4}/src/atomadic_forge.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: atomadic-forge
-Version: 0.3.3
+Version: 0.3.4
 Summary: Atomadic Forge — absorb, enforce, emerge. Polyglot (Python + JavaScript/TypeScript) architecture guardian for AI-generated code.
 Author: Atomadic
 License-Expression: BUSL-1.1

{atomadic_forge-0.3.3 → atomadic_forge-0.3.4}/src/atomadic_forge.egg-info/SOURCES.txt

@@ -186,6 +186,7 @@ src/atomadic_forge/a3_og_features/demo_packages/mixed_py_js/tests/test_mixed.py
 src/atomadic_forge/a4_sy_orchestration/__init__.py
 src/atomadic_forge/a4_sy_orchestration/cli.py
 src/atomadic_forge/a4_sy_orchestration/login_cmd.py
+src/atomadic_forge/a4_sy_orchestration/whoami_cmd.py
 src/atomadic_forge/commands/__init__.py
 src/atomadic_forge/commands/_registry.py
 src/atomadic_forge/commands/audit.py
@@ -263,5 +264,6 @@ tests/test_synergy.py
 tests/test_test_runner.py
 tests/test_tier_init_rebuild.py
 tests/test_vscode_extension_manifest.py
+tests/test_whoami_cmd.py
 tests/test_wire_certify.py
 tests/test_wire_suggest_repairs.py

atomadic_forge-0.3.4/tests/test_whoami_cmd.py

@@ -0,0 +1,126 @@
+"""Tests for `forge whoami` (Tier a4).
+
+Covers the four states: missing-key, env-key, credentials-file-key,
+and verify-failure. Uses CliRunner so the test mirrors what an agent
+or shell user would see, not just internal state.
+"""
+
+from __future__ import annotations
+
+import json
+
+import pytest
+from typer.testing import CliRunner
+
+from atomadic_forge.a4_sy_orchestration import whoami_cmd
+
+
+@pytest.fixture()
+def runner():
+    return CliRunner()
+
+
+@pytest.fixture()
+def fake_creds(tmp_path, monkeypatch):
+    """Point CREDENTIALS_FILE at a tmp path and ensure env is empty."""
+    creds = tmp_path / "credentials.toml"
+    monkeypatch.setattr(whoami_cmd, "CREDENTIALS_FILE", creds)
+    monkeypatch.delenv("FORGE_API_KEY", raising=False)
+    return creds
+
+
+class _StubClient:
+    """Stand-in for ForgeAuthClient — returns whatever `verify` is patched to."""
+
+    def __init__(self, result: dict):
+        self._result = result
+
+    def verify(self, _api_key: str) -> dict:
+        return self._result
+
+
+def test_whoami_missing_key_exits_1(runner, fake_creds):
+    out = runner.invoke(whoami_cmd.app, [])
+    assert out.exit_code == 1
+    assert "Not logged in" in out.output
+    assert "forge login" in out.output
+
+
+def test_whoami_missing_key_json(runner, fake_creds):
+    out = runner.invoke(whoami_cmd.app, ["--json"])
+    assert out.exit_code == 1
+    body = json.loads(out.output)
+    assert body["ok"] is False
+    assert body["source"] == "missing"
+
+
+def test_whoami_reads_credentials_file_when_no_env(
+    runner, fake_creds, monkeypatch,
+):
+    fake_creds.write_text(
+        '[forge_auth]\napi_key = "fk_live_abcdef123"\n', encoding="utf-8",
+    )
+    monkeypatch.setattr(
+        whoami_cmd, "ForgeAuthClient",
+        lambda: _StubClient({"ok": True, "email": "tom@example.com", "plan": "pro"}),
+    )
+    out = runner.invoke(whoami_cmd.app, ["--json"])
+    assert out.exit_code == 0
+    body = json.loads(out.output)
+    assert body["ok"] is True
+    assert body["source"] == "credentials_file"
+    assert body["email"] == "tom@example.com"
+    assert body["plan"] == "pro"
+    assert body["key_prefix"].startswith("fk_live_")
+
+
+def test_whoami_prefers_env_over_credentials_file(
+    runner, fake_creds, monkeypatch,
+):
+    """Env wins over credentials file (CI / explicit override behavior)."""
+    fake_creds.write_text(
+        '[forge_auth]\napi_key = "fk_live_FILEKEY999"\n', encoding="utf-8",
+    )
+    monkeypatch.setenv("FORGE_API_KEY", "fk_live_ENVKEY777")
+    monkeypatch.setattr(
+        whoami_cmd, "ForgeAuthClient",
+        lambda: _StubClient({"ok": True, "email": "ci@example.com", "plan": "ci"}),
+    )
+    out = runner.invoke(whoami_cmd.app, ["--json"])
+    assert out.exit_code == 0
+    body = json.loads(out.output)
+    assert body["source"] == "env"
+    assert body["key_prefix"].startswith("fk_live_ENV")
+
+
+def test_whoami_no_verify_skips_network(runner, fake_creds, monkeypatch):
+    fake_creds.write_text(
+        '[forge_auth]\napi_key = "fk_live_offline"\n', encoding="utf-8",
+    )
+    # If verify were called, this would explode. --no-verify must skip it.
+    monkeypatch.setattr(
+        whoami_cmd, "ForgeAuthClient",
+        lambda: (_ for _ in ()).throw(RuntimeError("verify must not be called")),
+    )
+    out = runner.invoke(whoami_cmd.app, ["--no-verify", "--json"])
+    assert out.exit_code == 0
+    body = json.loads(out.output)
+    assert body["ok"] is True
+    assert body["verify_ok"] is False
+    assert "skipped" in body["verify_reason"]
+
+
+def test_whoami_verify_rejection_exits_1(runner, fake_creds, monkeypatch):
+    fake_creds.write_text(
+        '[forge_auth]\napi_key = "fk_live_revoked"\n', encoding="utf-8",
+    )
+    monkeypatch.setattr(
+        whoami_cmd, "ForgeAuthClient",
+        lambda: _StubClient({"ok": False, "reason": "key revoked", "email": "", "plan": ""}),
+    )
+    out = runner.invoke(whoami_cmd.app, ["--json"])
+    assert out.exit_code == 1
+    body = json.loads(out.output)
+    assert body["ok"] is False
+    assert body["verify_ok"] is False
+    assert "revoked" in body["verify_reason"]