avr-cli 0.4.0__tar.gz → 0.5.0__tar.gz

{avr_cli-0.4.0 → avr_cli-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: avr-cli
-Version: 0.4.0
+Version: 0.5.0
 Summary: Avrea command-line client
 Author-email: Avrea <support@avrea.com>
 License-Expression: Apache-2.0
@@ -15,6 +15,7 @@ Requires-Python: >=3.14
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: anyio>=4.14.2
+Requires-Dist: certifi>=2026.10.19
 Requires-Dist: click>=8.3.1
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: platformdirs>=4.0
@@ -117,6 +118,61 @@ Auto-detection means most commands "just work" without `--repo`. Outside a git t
 
 ## Common workflows
 
+**Clone from a nearby Git mirror**
+
+```sh
+avr repo clone foo/faa
+avr repo clone foo/faa my-checkout --depth 1 --branch main
+avr repo clone foo/faa --placement https://git.fi.a.avrea.io
+```
+
+Avrea discovers the repository's placements and picks the first mirror that
+responds successfully from your machine. `--placement` accepts an advertised
+mirror URL or hostname to select one explicitly. Give the `owner/repository` name
+or an Avrea repository ID (`rep-...`).
+The repository must already have Git mirroring enabled and a usable placement.
+
+`origin` stays on the selected read-only mirror. The clone installs a
+repository-local credential helper so ordinary `git fetch` and `git pull`
+obtain fresh Git tokens through your Avrea login. Push changes to the source
+repository using a separate remote, for example:
+
+```sh
+git remote add upstream git@github.com:foo/faa.git
+git push upstream HEAD
+```
+
+Tokens normally last one hour; scoped API keys are limited to ten minutes or
+their remaining lifetime. Git tokens are never saved in the remote URL or
+repository configuration. Keep `avr` installed and logged in for later Git
+operations; the helper continues to use the API host used for the clone.
+
+**Create a mirror at a location**
+
+```sh
+avr repo mirror locations
+avr repo mirror create foo/faa --location gsc-fi
+avr repo mirror create group/subgroup/project --source gitlab --location gsc-fi
+avr repo mirror status --repo group/subgroup/project --source gitlab
+```
+
+`--source` defaults to `github`; `gitlab` supports nested group names. The
+repository must already be connected to your Avrea organization. Use `--org`
+to select an organization. Mirror management requires the organization's
+Git-mirror feature and an admin role.
+
+`--location` accepts a cluster ID, datacenter ID, or unique name from `locations`.
+The command enables mirroring and adds the placement, preserving existing
+placements. Sync runs asynchronously; use `status` to check it. Repeating
+`create` is safe, including when enabling succeeded but placement failed.
+`locations` and `create` also support `--json` and `--jq`.
+
+GitLab repositories cannot be mirrored until GitLab mirroring is enabled
+for your organization. `--source gitlab` is available for deployments that
+support it, including repositories in nested groups. If a GitLab repository
+returns “not found,” check its connection to Avrea, your access, and whether
+GitLab mirroring is enabled.
+
 **Watch a run live**
 
 ```sh
@@ -239,11 +295,32 @@ case $? in
 esac
 ```
 
-Exit code `4` is reserved for "auth required". `1` is general failure; `2` is a usage error.
+Exit code `4` is reserved for "auth required". `1` is general failure; `2` is a usage error. `130` means Ctrl-C
+ended the command, including a watch, a log follow or a tunnel that is stopped that way.
+
+**Scoped tokens for scripts and agents**
+
+```sh
+avr token create --name ci-read --org <org-id> --repo acme/api --ttl 8h  # prints the credential once
+avr token create --name agent --org <org-id> --vm <vm-id> --allow-vm-create --vm-create-limit 3
+avr token list
+avr token view <token-id>
+avr token revoke <token-id>
+```
+
+A scoped token is a short-lived credential (60 seconds to 7 days, 8 hours by default) bound to one organization. Repository grants are read-only and VM grants are admin: it reads only the repositories it names, has admin access to only the VMs it names, and cannot create further tokens. `create` prints the `export AVR_TOKEN=...` and `export AVR_ORG=...` lines for whatever will use the token. Scoped tokens require the `org-...` ID in `AVR_ORG` or `--org`; they ignore the login's stored organization and cannot resolve a slug. `avr auth status` reports this configuration without checking whether the token is still live. A 403 or 404 comes with a reminder that the token reaches only what it names.
+
+`avr repo clone acme/api` uses the `owner/repository` name directly.
+
+With a scoped token, a repository name (`--repo acme/api`, `AVR_REPO` or the checkout's remote) is matched against the repositories the token reaches; a `rep-...` ID works as well. For runs, use the run ID rather than an Avrea console URL, whose organization slug cannot be resolved with a scoped token. Token IDs for `view` and `revoke` are `key-` followed by 32 lowercase hexadecimal characters.
+
+Creation returns the credential only once. If `--jq` fails or removes it, the command falls back to the requested JSON without filtering and exits nonzero. Save the credential from that JSON. Output failures also report a revoke command on stderr without exposing the credential there. If the creation request is interrupted, its response is lost, or the answer is a server error (5xx), a token may already exist: check `avr token list` before retrying. Only a 503 that carries the API's own reason means that no token was created.
+
+If `avr token create` returns a 404, check the API's reason, the organization and the API host. If scoped-token access is unavailable, contact support@avrea.com to request it. VM grants and `--allow-vm-create` also require customer VMs to be enabled for the organization. `list`, `view` and `revoke` remain available when token creation is disabled.
 
 **Pipe-aware output**
 
-When stdout isn't a TTY, list commands switch to tab-separated rows (no color, no truncation, ISO timestamps), so `avr run list | awk` works without flags. `avr run watch | jq -c .` automatically switches to NDJSON event mode.
+When stdout isn't a TTY, list commands switch to tab-separated rows (no color, no truncation, ISO timestamps), so `avr run list | awk` works without flags. Control characters, Unicode line separators and bidirectional controls inside cells are escaped (`\t`, `\x1b`, `\u2028`), keeping each item on one row with stable columns. The escaping is not reversible: a literal backslash is left as it is, so a cell that reads `a\tb` may hold either a tab or a backslash and a `t`. Use `--json` when the exact value matters; JSON retains the original values. `avr run watch | jq -c .` automatically switches to NDJSON event mode.
 
 ## Configuration
 
@@ -252,8 +329,8 @@ When stdout isn't a TTY, list commands switch to tab-separated rows (no color, n
 | Variable         | Purpose                                                                                          |
 | ---------------- | ------------------------------------------------------------------------------------------------ |
 | `AVR_HOST`       | Avrea API URL. Defaults to the active host in `hosts.json`, then `https://api.avrea.com`.        |
-| `AVR_TOKEN`      | API key. Overrides whatever's stored for the active host.                                         |
-| `AVR_ORG`        | Default organization ID. Overrides the stored default.                                           |
+| `AVR_TOKEN`      | API key or scoped token. Overrides whatever's stored for the active host.                         |
+| `AVR_ORG`        | Default organization ID. Overrides the stored default. A scoped token needs it, or `--org`, except for `repo clone`. |
 | `AVR_REPO`       | Default repository (`org/name` or `rep-xxx`). Overrides git auto-detect.                          |
 | `AVR_BROWSER`    | Browser to launch for `--web` and OAuth login. Falls back to `BROWSER`, then system default.      |
 | `AVR_PAGER`      | Pager for long output. Overrides `PAGER`. Set to empty string to disable paging.                  |

{avr_cli-0.4.0 → avr_cli-0.5.0}/README.md

@@ -85,6 +85,61 @@ Auto-detection means most commands "just work" without `--repo`. Outside a git t
 
 ## Common workflows
 
+**Clone from a nearby Git mirror**
+
+```sh
+avr repo clone foo/faa
+avr repo clone foo/faa my-checkout --depth 1 --branch main
+avr repo clone foo/faa --placement https://git.fi.a.avrea.io
+```
+
+Avrea discovers the repository's placements and picks the first mirror that
+responds successfully from your machine. `--placement` accepts an advertised
+mirror URL or hostname to select one explicitly. Give the `owner/repository` name
+or an Avrea repository ID (`rep-...`).
+The repository must already have Git mirroring enabled and a usable placement.
+
+`origin` stays on the selected read-only mirror. The clone installs a
+repository-local credential helper so ordinary `git fetch` and `git pull`
+obtain fresh Git tokens through your Avrea login. Push changes to the source
+repository using a separate remote, for example:
+
+```sh
+git remote add upstream git@github.com:foo/faa.git
+git push upstream HEAD
+```
+
+Tokens normally last one hour; scoped API keys are limited to ten minutes or
+their remaining lifetime. Git tokens are never saved in the remote URL or
+repository configuration. Keep `avr` installed and logged in for later Git
+operations; the helper continues to use the API host used for the clone.
+
+**Create a mirror at a location**
+
+```sh
+avr repo mirror locations
+avr repo mirror create foo/faa --location gsc-fi
+avr repo mirror create group/subgroup/project --source gitlab --location gsc-fi
+avr repo mirror status --repo group/subgroup/project --source gitlab
+```
+
+`--source` defaults to `github`; `gitlab` supports nested group names. The
+repository must already be connected to your Avrea organization. Use `--org`
+to select an organization. Mirror management requires the organization's
+Git-mirror feature and an admin role.
+
+`--location` accepts a cluster ID, datacenter ID, or unique name from `locations`.
+The command enables mirroring and adds the placement, preserving existing
+placements. Sync runs asynchronously; use `status` to check it. Repeating
+`create` is safe, including when enabling succeeded but placement failed.
+`locations` and `create` also support `--json` and `--jq`.
+
+GitLab repositories cannot be mirrored until GitLab mirroring is enabled
+for your organization. `--source gitlab` is available for deployments that
+support it, including repositories in nested groups. If a GitLab repository
+returns “not found,” check its connection to Avrea, your access, and whether
+GitLab mirroring is enabled.
+
 **Watch a run live**
 
 ```sh
@@ -207,11 +262,32 @@ case $? in
 esac
 ```
 
-Exit code `4` is reserved for "auth required". `1` is general failure; `2` is a usage error.
+Exit code `4` is reserved for "auth required". `1` is general failure; `2` is a usage error. `130` means Ctrl-C
+ended the command, including a watch, a log follow or a tunnel that is stopped that way.
+
+**Scoped tokens for scripts and agents**
+
+```sh
+avr token create --name ci-read --org <org-id> --repo acme/api --ttl 8h  # prints the credential once
+avr token create --name agent --org <org-id> --vm <vm-id> --allow-vm-create --vm-create-limit 3
+avr token list
+avr token view <token-id>
+avr token revoke <token-id>
+```
+
+A scoped token is a short-lived credential (60 seconds to 7 days, 8 hours by default) bound to one organization. Repository grants are read-only and VM grants are admin: it reads only the repositories it names, has admin access to only the VMs it names, and cannot create further tokens. `create` prints the `export AVR_TOKEN=...` and `export AVR_ORG=...` lines for whatever will use the token. Scoped tokens require the `org-...` ID in `AVR_ORG` or `--org`; they ignore the login's stored organization and cannot resolve a slug. `avr auth status` reports this configuration without checking whether the token is still live. A 403 or 404 comes with a reminder that the token reaches only what it names.
+
+`avr repo clone acme/api` uses the `owner/repository` name directly.
+
+With a scoped token, a repository name (`--repo acme/api`, `AVR_REPO` or the checkout's remote) is matched against the repositories the token reaches; a `rep-...` ID works as well. For runs, use the run ID rather than an Avrea console URL, whose organization slug cannot be resolved with a scoped token. Token IDs for `view` and `revoke` are `key-` followed by 32 lowercase hexadecimal characters.
+
+Creation returns the credential only once. If `--jq` fails or removes it, the command falls back to the requested JSON without filtering and exits nonzero. Save the credential from that JSON. Output failures also report a revoke command on stderr without exposing the credential there. If the creation request is interrupted, its response is lost, or the answer is a server error (5xx), a token may already exist: check `avr token list` before retrying. Only a 503 that carries the API's own reason means that no token was created.
+
+If `avr token create` returns a 404, check the API's reason, the organization and the API host. If scoped-token access is unavailable, contact support@avrea.com to request it. VM grants and `--allow-vm-create` also require customer VMs to be enabled for the organization. `list`, `view` and `revoke` remain available when token creation is disabled.
 
 **Pipe-aware output**
 
-When stdout isn't a TTY, list commands switch to tab-separated rows (no color, no truncation, ISO timestamps), so `avr run list | awk` works without flags. `avr run watch | jq -c .` automatically switches to NDJSON event mode.
+When stdout isn't a TTY, list commands switch to tab-separated rows (no color, no truncation, ISO timestamps), so `avr run list | awk` works without flags. Control characters, Unicode line separators and bidirectional controls inside cells are escaped (`\t`, `\x1b`, `\u2028`), keeping each item on one row with stable columns. The escaping is not reversible: a literal backslash is left as it is, so a cell that reads `a\tb` may hold either a tab or a backslash and a `t`. Use `--json` when the exact value matters; JSON retains the original values. `avr run watch | jq -c .` automatically switches to NDJSON event mode.
 
 ## Configuration
 
@@ -220,8 +296,8 @@ When stdout isn't a TTY, list commands switch to tab-separated rows (no color, n
 | Variable         | Purpose                                                                                          |
 | ---------------- | ------------------------------------------------------------------------------------------------ |
 | `AVR_HOST`       | Avrea API URL. Defaults to the active host in `hosts.json`, then `https://api.avrea.com`.        |
-| `AVR_TOKEN`      | API key. Overrides whatever's stored for the active host.                                         |
-| `AVR_ORG`        | Default organization ID. Overrides the stored default.                                           |
+| `AVR_TOKEN`      | API key or scoped token. Overrides whatever's stored for the active host.                         |
+| `AVR_ORG`        | Default organization ID. Overrides the stored default. A scoped token needs it, or `--org`, except for `repo clone`. |
 | `AVR_REPO`       | Default repository (`org/name` or `rep-xxx`). Overrides git auto-detect.                          |
 | `AVR_BROWSER`    | Browser to launch for `--web` and OAuth login. Falls back to `BROWSER`, then system default.      |
 | `AVR_PAGER`      | Pager for long output. Overrides `PAGER`. Set to empty string to disable paging.                  |

{avr_cli-0.4.0 → avr_cli-0.5.0}/avr_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: avr-cli
-Version: 0.4.0
+Version: 0.5.0
 Summary: Avrea command-line client
 Author-email: Avrea <support@avrea.com>
 License-Expression: Apache-2.0
@@ -15,6 +15,7 @@ Requires-Python: >=3.14
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: anyio>=4.14.2
+Requires-Dist: certifi>=2026.10.19
 Requires-Dist: click>=8.3.1
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: platformdirs>=4.0
@@ -117,6 +118,61 @@ Auto-detection means most commands "just work" without `--repo`. Outside a git t
 
 ## Common workflows
 
+**Clone from a nearby Git mirror**
+
+```sh
+avr repo clone foo/faa
+avr repo clone foo/faa my-checkout --depth 1 --branch main
+avr repo clone foo/faa --placement https://git.fi.a.avrea.io
+```
+
+Avrea discovers the repository's placements and picks the first mirror that
+responds successfully from your machine. `--placement` accepts an advertised
+mirror URL or hostname to select one explicitly. Give the `owner/repository` name
+or an Avrea repository ID (`rep-...`).
+The repository must already have Git mirroring enabled and a usable placement.
+
+`origin` stays on the selected read-only mirror. The clone installs a
+repository-local credential helper so ordinary `git fetch` and `git pull`
+obtain fresh Git tokens through your Avrea login. Push changes to the source
+repository using a separate remote, for example:
+
+```sh
+git remote add upstream git@github.com:foo/faa.git
+git push upstream HEAD
+```
+
+Tokens normally last one hour; scoped API keys are limited to ten minutes or
+their remaining lifetime. Git tokens are never saved in the remote URL or
+repository configuration. Keep `avr` installed and logged in for later Git
+operations; the helper continues to use the API host used for the clone.
+
+**Create a mirror at a location**
+
+```sh
+avr repo mirror locations
+avr repo mirror create foo/faa --location gsc-fi
+avr repo mirror create group/subgroup/project --source gitlab --location gsc-fi
+avr repo mirror status --repo group/subgroup/project --source gitlab
+```
+
+`--source` defaults to `github`; `gitlab` supports nested group names. The
+repository must already be connected to your Avrea organization. Use `--org`
+to select an organization. Mirror management requires the organization's
+Git-mirror feature and an admin role.
+
+`--location` accepts a cluster ID, datacenter ID, or unique name from `locations`.
+The command enables mirroring and adds the placement, preserving existing
+placements. Sync runs asynchronously; use `status` to check it. Repeating
+`create` is safe, including when enabling succeeded but placement failed.
+`locations` and `create` also support `--json` and `--jq`.
+
+GitLab repositories cannot be mirrored until GitLab mirroring is enabled
+for your organization. `--source gitlab` is available for deployments that
+support it, including repositories in nested groups. If a GitLab repository
+returns “not found,” check its connection to Avrea, your access, and whether
+GitLab mirroring is enabled.
+
 **Watch a run live**
 
 ```sh
@@ -239,11 +295,32 @@ case $? in
 esac
 ```
 
-Exit code `4` is reserved for "auth required". `1` is general failure; `2` is a usage error.
+Exit code `4` is reserved for "auth required". `1` is general failure; `2` is a usage error. `130` means Ctrl-C
+ended the command, including a watch, a log follow or a tunnel that is stopped that way.
+
+**Scoped tokens for scripts and agents**
+
+```sh
+avr token create --name ci-read --org <org-id> --repo acme/api --ttl 8h  # prints the credential once
+avr token create --name agent --org <org-id> --vm <vm-id> --allow-vm-create --vm-create-limit 3
+avr token list
+avr token view <token-id>
+avr token revoke <token-id>
+```
+
+A scoped token is a short-lived credential (60 seconds to 7 days, 8 hours by default) bound to one organization. Repository grants are read-only and VM grants are admin: it reads only the repositories it names, has admin access to only the VMs it names, and cannot create further tokens. `create` prints the `export AVR_TOKEN=...` and `export AVR_ORG=...` lines for whatever will use the token. Scoped tokens require the `org-...` ID in `AVR_ORG` or `--org`; they ignore the login's stored organization and cannot resolve a slug. `avr auth status` reports this configuration without checking whether the token is still live. A 403 or 404 comes with a reminder that the token reaches only what it names.
+
+`avr repo clone acme/api` uses the `owner/repository` name directly.
+
+With a scoped token, a repository name (`--repo acme/api`, `AVR_REPO` or the checkout's remote) is matched against the repositories the token reaches; a `rep-...` ID works as well. For runs, use the run ID rather than an Avrea console URL, whose organization slug cannot be resolved with a scoped token. Token IDs for `view` and `revoke` are `key-` followed by 32 lowercase hexadecimal characters.
+
+Creation returns the credential only once. If `--jq` fails or removes it, the command falls back to the requested JSON without filtering and exits nonzero. Save the credential from that JSON. Output failures also report a revoke command on stderr without exposing the credential there. If the creation request is interrupted, its response is lost, or the answer is a server error (5xx), a token may already exist: check `avr token list` before retrying. Only a 503 that carries the API's own reason means that no token was created.
+
+If `avr token create` returns a 404, check the API's reason, the organization and the API host. If scoped-token access is unavailable, contact support@avrea.com to request it. VM grants and `--allow-vm-create` also require customer VMs to be enabled for the organization. `list`, `view` and `revoke` remain available when token creation is disabled.
 
 **Pipe-aware output**
 
-When stdout isn't a TTY, list commands switch to tab-separated rows (no color, no truncation, ISO timestamps), so `avr run list | awk` works without flags. `avr run watch | jq -c .` automatically switches to NDJSON event mode.
+When stdout isn't a TTY, list commands switch to tab-separated rows (no color, no truncation, ISO timestamps), so `avr run list | awk` works without flags. Control characters, Unicode line separators and bidirectional controls inside cells are escaped (`\t`, `\x1b`, `\u2028`), keeping each item on one row with stable columns. The escaping is not reversible: a literal backslash is left as it is, so a cell that reads `a\tb` may hold either a tab or a backslash and a `t`. Use `--json` when the exact value matters; JSON retains the original values. `avr run watch | jq -c .` automatically switches to NDJSON event mode.
 
 ## Configuration
 
@@ -252,8 +329,8 @@ When stdout isn't a TTY, list commands switch to tab-separated rows (no color, n
 | Variable         | Purpose                                                                                          |
 | ---------------- | ------------------------------------------------------------------------------------------------ |
 | `AVR_HOST`       | Avrea API URL. Defaults to the active host in `hosts.json`, then `https://api.avrea.com`.        |
-| `AVR_TOKEN`      | API key. Overrides whatever's stored for the active host.                                         |
-| `AVR_ORG`        | Default organization ID. Overrides the stored default.                                           |
+| `AVR_TOKEN`      | API key or scoped token. Overrides whatever's stored for the active host.                         |
+| `AVR_ORG`        | Default organization ID. Overrides the stored default. A scoped token needs it, or `--org`, except for `repo clone`. |
 | `AVR_REPO`       | Default repository (`org/name` or `rep-xxx`). Overrides git auto-detect.                          |
 | `AVR_BROWSER`    | Browser to launch for `--web` and OAuth login. Falls back to `BROWSER`, then system default.      |
 | `AVR_PAGER`      | Pager for long output. Overrides `PAGER`. Set to empty string to disable paging.                  |

{avr_cli-0.4.0 → avr_cli-0.5.0}/avr_cli.egg-info/SOURCES.txt

@@ -18,6 +18,7 @@ avrea_cli/config.py
 avrea_cli/display.py
 avrea_cli/docs_gen.py
 avrea_cli/firewall.py
+avrea_cli/git_mirror.py
 avrea_cli/helpers.py
 avrea_cli/json_output.py
 avrea_cli/log_display.py
@@ -29,11 +30,13 @@ avrea_cli/repo_context.py
 avrea_cli/run_diagnostics.py
 avrea_cli/run_diagnostics_display.py
 avrea_cli/run_refs.py
+avrea_cli/spawn_script.py
 avrea_cli/transport.py
 avrea_cli/version.py
 avrea_cli/vm.py
 avrea_cli/assets/logo_mark.svg
 avrea_cli/commands/__init__.py
+avrea_cli/commands/artifact.py
 avrea_cli/commands/auth_cmd.py
 avrea_cli/commands/cache.py
 avrea_cli/commands/config_cmd.py
@@ -48,8 +51,10 @@ avrea_cli/commands/run.py
 avrea_cli/commands/sbom.py
 avrea_cli/commands/settings.py
 avrea_cli/commands/status.py
+avrea_cli/commands/token.py
 avrea_cli/commands/workflow.py
 tests/test_api_client.py
+tests/test_artifact.py
 tests/test_auth.py
 tests/test_auth_login.py
 tests/test_auth_sso.py
@@ -75,6 +80,7 @@ tests/test_output.py
 tests/test_piped_output.py
 tests/test_pr_list.py
 tests/test_public_mirrors.py
+tests/test_repo_clone.py
 tests/test_repo_context.py
 tests/test_repo_mirror.py
 tests/test_run_attempts.py
@@ -85,9 +91,13 @@ tests/test_run_logs.py
 tests/test_run_refs.py
 tests/test_run_view.py
 tests/test_sbom.py
+tests/test_scoped_token.py
 tests/test_settings.py
+tests/test_token.py
+tests/test_token_output.py
 tests/test_transport.py
 tests/test_vm.py
+tests/test_vm_spawn_script.py
 tests/test_web_flag.py
 tests/test_workflow_actions.py
 tests/test_workflow_run.py

{avr_cli-0.4.0 → avr_cli-0.5.0}/avr_cli.egg-info/requires.txt

@@ -1,4 +1,5 @@
 anyio>=4.14.2
+certifi>=2026.10.19
 click>=8.3.1
 httpx>=0.28.1
 platformdirs>=4.0

{avr_cli-0.4.0 → avr_cli-0.5.0}/avrea_cli/_build_info.py

@@ -1,2 +1,2 @@
 # Auto-generated by .github/workflows/release.yml; do not edit.
-GIT_COMMIT = "5d74471e85fe9ce7a40209ef3daebaad435c38d8"
+GIT_COMMIT = "620a47d50c11e7e1905980829c01fe2d974fe837"

{avr_cli-0.4.0 → avr_cli-0.5.0}/avrea_cli/api_client.py

@@ -2,6 +2,7 @@
 
 from avrea_cli.config import CliConfig
 from avrea_cli.transport import CompressingTransport
+from collections.abc import Iterator
 from typing import Any
 import click
 import httpx
@@ -76,6 +77,32 @@ class ApiClient:
         response.raise_for_status()
         return response.content
 
+    def public_download(self, path: str) -> Iterator[bytes]:
+        """Stream an authenticated response without following credential redirects."""
+        url = f"{self.config.public_api_url}{path}"
+        with self._http.stream(
+            "GET",
+            url,
+            headers={**self.config.get_api_headers(), "Accept-Encoding": "identity"},
+            timeout=self.timeout,
+            follow_redirects=False,
+        ) as response:
+            self._log("GET", str(response.request.url), response.status_code)
+            if not response.is_success:
+                # Error formatting needs a buffered body, but a failed download
+                # must not buffer an arbitrarily large response.
+                body = bytearray()
+                for chunk in response.iter_bytes(chunk_size=4096):
+                    body.extend(chunk)
+                    if len(body) > 64 * 1024:
+                        body.clear()
+                        break
+                headers = {"Retry-After": response.headers["Retry-After"]} if "Retry-After" in response.headers else {}
+                httpx.Response(
+                    response.status_code, headers=headers, content=bytes(body), request=response.request
+                ).raise_for_status()
+            yield from response.iter_bytes(chunk_size=1024 * 1024)
+
     def public_post(
         self,
         path: str,

{avr_cli-0.4.0 → avr_cli-0.5.0}/avrea_cli/auth.py

@@ -42,6 +42,11 @@ _LOGO_SVG = (Path(__file__).parent / "assets" / "logo_mark.svg").read_text(encod
 HOSTS_FILE = PATHS.hosts_file
 
 
+def is_scoped_token(token: str | None) -> bool:
+    """Identify organization-bound credentials without making a request."""
+    return token is not None and token.startswith("avs_")
+
+
 def _read() -> dict[str, Any]:
     """Load the hosts file. Returns an empty wrapper if missing or malformed
     — callers treat absence as 'no credentials yet'."""

{avr_cli-0.4.0 → avr_cli-0.5.0}/avrea_cli/click_ext.py

@@ -6,6 +6,9 @@ import importlib
 
 SECTION_ORDER = ["Core Commands", "Setup & Config", "Additional Commands"]
 
+# 128 + SIGINT, the shell convention for a command ended by Ctrl-C.
+EXIT_INTERRUPTED = 130
+
 LEARN_MORE = 'Use "avr <command> <subcommand> --help" for more information about a command.\nRead the docs at https://docs.avrea.com/cli'
 
 
@@ -188,6 +191,24 @@ class AliasGroup(GhHelpMixin, LazyGroup):
         finally:
             self._current_section = prev
 
+    def invoke(self, ctx: click.Context):
+        """Exit 130 when Ctrl-C ends the command.
+
+        Click reports an interrupt as exit 1, the same as a general failure.
+        A prompt turns the interrupt into ``click.Abort`` before it gets here,
+        so that case is recognised by the exception it replaced. An ``Abort``
+        raised for any other reason, end of input included, keeps exit 1.
+        """
+        try:
+            return super().invoke(ctx)
+        except KeyboardInterrupt:
+            click.echo(err=True)
+        except click.Abort as exc:
+            if not isinstance(exc.__context__, KeyboardInterrupt):
+                raise
+        click.echo("Aborted!", err=True)
+        raise click.exceptions.Exit(EXIT_INTERRUPTED)
+
     def add_command(self, cmd, name=None):
         super().add_command(cmd, name)
         if self._current_section is not None: