brindle 0.0.4__tar.gz → 0.0.6__tar.gz

{brindle-0.0.4 → brindle-0.0.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brindle
-Version: 0.0.4
+Version: 0.0.6
 Summary: Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges
 Project-URL: Homepage, https://pawdelta.com/brindle/
 Project-URL: Documentation, https://pawdelta.com/brindle/docs/recommended-use
@@ -89,7 +89,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.0.4`). A session started before an upgrade keeps
+session shows it too (`brindle 0.0.6`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -148,7 +148,15 @@ a dim ◇ instead, because the supervisor reviews it.
 
 **Copying chat text.** Drag with the mouse in the chat: the selection stays inside
 that pane and is copied to the system clipboard (`pbcopy`, `wl-copy` or `xclip`;
-`brindle doctor` shows which). `h` in the sidebar hides it without quitting brindle
+`brindle doctor` shows which); a double or triple click copies the word or line.
+tmux keeps the mouse in the chat even though Claude Code asks to track it, so a
+click only focuses the pane (and can't park Claude Code's focus in a dialog where
+Esc stops working); the wheel still scrolls the chat. If Claude Code's Settings
+dialog (`/usage`, `/config`) ever ignores Esc, its filter box has the focus: press
+Esc up to three times (clear, leave the box, close), or `↓` then Esc. Don't reach
+for Ctrl-C twice, which quits Claude Code and pauses the session.
+
+**Hiding the sidebar.** `h` in the sidebar hides it without quitting brindle
 (the chat zooms; `Ctrl-b S` brings it back), and `Ctrl-b z` zooms the chat by hand.
 If the sidebar got left behind in another tmux session, `Ctrl-b S` in a window
 without one pulls it here, as does `brindle sidebar` (it restarts a sidebar that was closed).
@@ -820,7 +828,12 @@ workflows call these commands:
   checkout of the repository. For Claude it asks whether to use an API key
   (the `ANTHROPIC_API_KEY` secret) or Anthropic
   [workload identity federation](https://platform.claude.com/docs/en/manage-claude/wif-reference)
-  (`--credential key|federation` answers without asking).
+  (`--credential key|federation` answers without asking). It also creates the
+  `brindle` issue label (label an issue with it to hand it to brindle CI), and
+  commits the workflows on a `brindle/ci-setup` branch, then puts you back on
+  the branch you started on and deletes the local setup branch, so `git pull`
+  after merging the setup pull request is clean (commit or stash your changes
+  first: it refuses to start with uncommitted work).
 - `brindle ci doctor`: which provider CLIs and credential names a runner has, and
   which providers CI may use on this repository.
 - `brindle ci start`: start a run for an issue, a goal text or a dispatched run,
@@ -832,6 +845,16 @@ workflows call these commands:
 Credential names are reported, never values. On a repository owned by a GitHub
 organization, a provider signed in only with a personal subscription is not used.
 
+Fix builds only fix the default branch's *required* status checks, and a new
+repository has none. When the default branch requires none, `brindle ci init`
+warns and, for each job in your workflows, asks whether to make it required
+(`--required-check NAME` picks one without asking, `--no-required-check` only
+warns; run without a terminal, init only makes a check required when
+`--required-check` names it). It adds the check to the branch's existing protection, or protects the
+branch with just that check. GitHub only allows branch protection on a private
+repository with a paid plan; when it refuses, init says how to require the
+check yourself (Settings > Branches, "Require status checks to pass").
+
 An Anthropic API key is either a workspace key (scoped to one workspace) or an
 organization-level key (not scoped to a workspace). An organization-level key
 needs the workspace in every request, so after the key `brindle ci init` asks for
@@ -848,20 +871,40 @@ organization repositories), and gives the job `ANTHROPIC_AUTH_TOKEN`. `brindle
 ci init` stores the rule, organization, service account and optional workspace
 IDs as the Actions variables `ANTHROPIC_FEDERATION_RULE_ID`,
 `ANTHROPIC_ORGANIZATION_ID`, `ANTHROPIC_SERVICE_ACCOUNT_ID` and
-`ANTHROPIC_WORKSPACE_ID`. Create the federation rule in the Claude Console with
+`ANTHROPIC_WORKSPACE_ID`, from `--rule-id`, `--organization-id`,
+`--service-account-id` and `--workspace-id` or else asked (defaulting to those
+environment variables). Without a terminal on stdin, init asks nothing and
+takes the options and the environment, so it can run unattended; a missing or
+malformed ID (rule `fdrl_...`, organization a UUID, service account
+`svac_...`, workspace `wrkspc_...`) stops it before it creates the CI token.
+The ID options imply `--credential federation` and can't be combined with
+`--credential key`. Create the federation rule in the Claude Console with
 subject prefix `repo:<owner>/<name>:*`, the condition
 
 ```text
 claims.repository == "<owner>/<name>" && claims.workflow_ref.startsWith("<owner>/<name>/.github/workflows/brindle-ci-")
 ```
 
-audience `https://api.anthropic.com`, and a token lifetime of at least 7200
+audience `https://api.anthropic.com`, and a token lifetime of at least 600
 seconds. The condition lets only brindle's workflows mint tokens. On pull
 requests the pull request's own copy of the validate workflow runs, so give
 write access only to people you trust (forks never get a token). Leave the `ANTHROPIC_API_KEY` secret
 unset: a key takes precedence (brindle drops an empty one before Claude Code
 starts).
 
+A federated token lives at most about ten minutes, however long the rule
+allows: Anthropic caps it at twice what remains of GitHub's OIDC token. So
+the run job doesn't rely on the workflow's one exchange: `brindle ci run`
+fetches a fresh OIDC token and exchanges it again at 70% of each token's
+life, and lends the current token to the agents through a proxy on the
+runner's loopback interface. The agents get `ANTHROPIC_BASE_URL` pointing at
+it and a random per-run secret as `ANTHROPIC_AUTH_TOKEN`; the Anthropic token
+itself stays in the `brindle ci run` process, and the GitHub token endpoint
+(`ACTIONS_ID_TOKEN_REQUEST_URL` and its token) is scrubbed before any agent or
+check starts. If the first exchange fails, the run goes on with the
+workflow's token as before; `BRINDLE_CI_FEDERATION_REFRESH=0` in the job's
+environment turns the refresh off.
+
 **Closing and cleaning up.** Press `x` on an agent in the sidebar (twice for one
 that's still running) or run `brindle close <id>` to stop it and hide it. Stopping means
 every process of the agent, not just its window: Claude Code can host a session in its

{brindle-0.0.4 → brindle-0.0.6}/README.md

@@ -59,7 +59,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.0.4`). A session started before an upgrade keeps
+session shows it too (`brindle 0.0.6`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -118,7 +118,15 @@ a dim ◇ instead, because the supervisor reviews it.
 
 **Copying chat text.** Drag with the mouse in the chat: the selection stays inside
 that pane and is copied to the system clipboard (`pbcopy`, `wl-copy` or `xclip`;
-`brindle doctor` shows which). `h` in the sidebar hides it without quitting brindle
+`brindle doctor` shows which); a double or triple click copies the word or line.
+tmux keeps the mouse in the chat even though Claude Code asks to track it, so a
+click only focuses the pane (and can't park Claude Code's focus in a dialog where
+Esc stops working); the wheel still scrolls the chat. If Claude Code's Settings
+dialog (`/usage`, `/config`) ever ignores Esc, its filter box has the focus: press
+Esc up to three times (clear, leave the box, close), or `↓` then Esc. Don't reach
+for Ctrl-C twice, which quits Claude Code and pauses the session.
+
+**Hiding the sidebar.** `h` in the sidebar hides it without quitting brindle
 (the chat zooms; `Ctrl-b S` brings it back), and `Ctrl-b z` zooms the chat by hand.
 If the sidebar got left behind in another tmux session, `Ctrl-b S` in a window
 without one pulls it here, as does `brindle sidebar` (it restarts a sidebar that was closed).
@@ -790,7 +798,12 @@ workflows call these commands:
   checkout of the repository. For Claude it asks whether to use an API key
   (the `ANTHROPIC_API_KEY` secret) or Anthropic
   [workload identity federation](https://platform.claude.com/docs/en/manage-claude/wif-reference)
-  (`--credential key|federation` answers without asking).
+  (`--credential key|federation` answers without asking). It also creates the
+  `brindle` issue label (label an issue with it to hand it to brindle CI), and
+  commits the workflows on a `brindle/ci-setup` branch, then puts you back on
+  the branch you started on and deletes the local setup branch, so `git pull`
+  after merging the setup pull request is clean (commit or stash your changes
+  first: it refuses to start with uncommitted work).
 - `brindle ci doctor`: which provider CLIs and credential names a runner has, and
   which providers CI may use on this repository.
 - `brindle ci start`: start a run for an issue, a goal text or a dispatched run,
@@ -802,6 +815,16 @@ workflows call these commands:
 Credential names are reported, never values. On a repository owned by a GitHub
 organization, a provider signed in only with a personal subscription is not used.
 
+Fix builds only fix the default branch's *required* status checks, and a new
+repository has none. When the default branch requires none, `brindle ci init`
+warns and, for each job in your workflows, asks whether to make it required
+(`--required-check NAME` picks one without asking, `--no-required-check` only
+warns; run without a terminal, init only makes a check required when
+`--required-check` names it). It adds the check to the branch's existing protection, or protects the
+branch with just that check. GitHub only allows branch protection on a private
+repository with a paid plan; when it refuses, init says how to require the
+check yourself (Settings > Branches, "Require status checks to pass").
+
 An Anthropic API key is either a workspace key (scoped to one workspace) or an
 organization-level key (not scoped to a workspace). An organization-level key
 needs the workspace in every request, so after the key `brindle ci init` asks for
@@ -818,20 +841,40 @@ organization repositories), and gives the job `ANTHROPIC_AUTH_TOKEN`. `brindle
 ci init` stores the rule, organization, service account and optional workspace
 IDs as the Actions variables `ANTHROPIC_FEDERATION_RULE_ID`,
 `ANTHROPIC_ORGANIZATION_ID`, `ANTHROPIC_SERVICE_ACCOUNT_ID` and
-`ANTHROPIC_WORKSPACE_ID`. Create the federation rule in the Claude Console with
+`ANTHROPIC_WORKSPACE_ID`, from `--rule-id`, `--organization-id`,
+`--service-account-id` and `--workspace-id` or else asked (defaulting to those
+environment variables). Without a terminal on stdin, init asks nothing and
+takes the options and the environment, so it can run unattended; a missing or
+malformed ID (rule `fdrl_...`, organization a UUID, service account
+`svac_...`, workspace `wrkspc_...`) stops it before it creates the CI token.
+The ID options imply `--credential federation` and can't be combined with
+`--credential key`. Create the federation rule in the Claude Console with
 subject prefix `repo:<owner>/<name>:*`, the condition
 
 ```text
 claims.repository == "<owner>/<name>" && claims.workflow_ref.startsWith("<owner>/<name>/.github/workflows/brindle-ci-")
 ```
 
-audience `https://api.anthropic.com`, and a token lifetime of at least 7200
+audience `https://api.anthropic.com`, and a token lifetime of at least 600
 seconds. The condition lets only brindle's workflows mint tokens. On pull
 requests the pull request's own copy of the validate workflow runs, so give
 write access only to people you trust (forks never get a token). Leave the `ANTHROPIC_API_KEY` secret
 unset: a key takes precedence (brindle drops an empty one before Claude Code
 starts).
 
+A federated token lives at most about ten minutes, however long the rule
+allows: Anthropic caps it at twice what remains of GitHub's OIDC token. So
+the run job doesn't rely on the workflow's one exchange: `brindle ci run`
+fetches a fresh OIDC token and exchanges it again at 70% of each token's
+life, and lends the current token to the agents through a proxy on the
+runner's loopback interface. The agents get `ANTHROPIC_BASE_URL` pointing at
+it and a random per-run secret as `ANTHROPIC_AUTH_TOKEN`; the Anthropic token
+itself stays in the `brindle ci run` process, and the GitHub token endpoint
+(`ACTIONS_ID_TOKEN_REQUEST_URL` and its token) is scrubbed before any agent or
+check starts. If the first exchange fails, the run goes on with the
+workflow's token as before; `BRINDLE_CI_FEDERATION_REFRESH=0` in the job's
+environment turns the refresh off.
+
 **Closing and cleaning up.** Press `x` on an agent in the sidebar (twice for one
 that's still running) or run `brindle close <id>` to stop it and hide it. Stopping means
 every process of the agent, not just its window: Claude Code can host a session in its

{brindle-0.0.4 → brindle-0.0.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brindle"
-version = "0.0.4"
+version = "0.0.6"
 description = "Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges"
 readme = "README.md"
 requires-python = ">=3.11"

{brindle-0.0.4 → brindle-0.0.6}/src/brindle/ci_adapters.py

@@ -11,7 +11,8 @@ An adapter answers four questions and does three things:
   endpoint without a key, or a personal subscription (``CLAUDE_CODE_OAUTH_TOKEN``;
   a ChatGPT login for Codex). Anthropic workload identity federation reaches
   here as an API key: the workflow exchanges GitHub's OIDC token once and
-  gives the job ``ANTHROPIC_AUTH_TOKEN``.
+  gives the job ``ANTHROPIC_AUTH_TOKEN``; during the run that variable holds
+  the secret of brindle's own credential proxy (:mod:`brindle.ci_federation`).
 * ``available(env)``: installed and holding some credential.
 * ``launch``: start a brindle autopilot supervisor with the plan's instructions.
 * ``review``: ask the model one question (the plan's instructions) and return