bt-cli 0.4.69__tar.gz → 0.4.70__tar.gz

{bt_cli-0.4.69 → bt_cli-0.4.70}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.69**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.70**
 
 ## Setup
 

{bt_cli-0.4.69 → bt_cli-0.4.70}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bt-cli
-Version: 0.4.69
+Version: 0.4.70
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT

{bt_cli-0.4.69 → bt_cli-0.4.70}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.69"
+version = "0.4.70"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"

{bt_cli-0.4.69 → bt_cli-0.4.70}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.69"
+__version__ = "0.4.70"

{bt_cli-0.4.69 → bt_cli-0.4.70}/src/bt_cli/data/skills/session-analysis/SKILL.md

@@ -24,7 +24,7 @@ bt pws sessions analyze <id> --model opus   # or --model sonnet for a cheaper es
 
 `analyze` writes `analysis.json` into the folder and prints:
 - **Who / what / when:** `user` (the initiator's real name + username, resolved from `UserID` via `/Users/{id}`), `user_email`, `account`@`system`, `start_time`. **Always name the human in the summary** — "UserID 219" is not an answer; "Amy Miller (amiller)" is.
-- **RDP:** the **keyframes** to read. Each is tagged with a **reason** — `screen-change` (the picture moved) and/or `after-typing` (it renders the result of something the user typed). `after-typing` frames also carry the exact `typed` text.
+- **RDP:** the **keyframes** to read, plus a **cull ratio** (`keyframes_kept_pct`, e.g. "37/59 · 63% kept — busy session"). High kept-% = busy session, reading all keyframes is mandatory; low kept-% = a handful covers it. Either way, read them all — the ratio sets your expectation, it does not license sampling. Each keyframe is tagged with a **reason** — `screen-change` (the picture moved) and/or `after-typing` (it renders the result of something the user typed). `after-typing` frames also carry the exact `typed` text.
 - **SSH:** a pointer to the transcript (analyze it instead of frames).
 - **`typed_bursts`** — typed input grouped into phrases with recording-relative offsets (`@14.9s "powershell"`), already anchored to the keyframes above.
 - A **cost estimate**: `focused` (keyframes only) vs `all frames`.

{bt_cli-0.4.69 → bt_cli-0.4.70}/src/bt_cli/pws/commands/sessions.py

@@ -762,6 +762,23 @@ def _build_keyframes(
     return keyframes
 
 
+def _cull_label(n_keyframes: int, n_frames: int) -> tuple:
+    """Classify how aggressively the keyframe selection culled the recording, so
+    the reader knows up front whether reading every keyframe is a cent or a busy
+    session. Returns (kept_pct, label). Reinforces the rule: read ALL keyframes
+    the CLI lists — the lever for cost is --threshold, not sub-sampling."""
+    if n_frames <= 0:
+        return 0, "no frames"
+    pct = round(n_keyframes / n_frames * 100)
+    if pct >= 50:
+        note = "busy session, budget to read all keyframes"
+    elif pct >= 20:
+        note = "moderate, read all keyframes"
+    else:
+        note = "a handful covers it"
+    return pct, note
+
+
 def _user_label(user: dict) -> str:
     """Human label for a /Users record: 'First Last (username)' or best available."""
     if not user:
@@ -883,6 +900,7 @@ def session_analyze(
         "frame_dims": [w, h],
         "frame_count": len(frames),
         "keyframe_count": len(keyframes),
+        "keyframes_kept_pct": _cull_label(len(keyframes), len(frames))[0] if protocol.upper() != "SSH" else None,
         "keyframes": keyframes,
         "keystroke_count": len(decoded_ks),
         "keystrokes": decoded_ks,
@@ -909,7 +927,9 @@ def session_analyze(
     else:
         anchored = sum(1 for k in keyframes if "after-typing" in k.get("reasons", []))
         hint = f" ([cyan]{anchored}[/cyan] anchored to typed input)" if anchored else ""
-        console.print(f"  [green]{len(keyframes)} keyframes[/green] (of {len(frames)}) — read these, not every frame{hint}:")
+        kept_pct, cull_note = _cull_label(len(keyframes), len(frames))
+        console.print(f"  [green]{len(keyframes)} keyframes[/green] (of {len(frames)} · {kept_pct}% kept — {cull_note}){hint}")
+        console.print("  [dim]Read every one — the CLI already culled; don't sub-sample.[/dim]")
         for k in keyframes:
             typed_here = "  [yellow]⌨ " + rich_escape(" ".join(k["typed"])) + "[/yellow]" if k.get("typed") else ""
             reasons = ",".join(k.get("reasons", [])) or "screen-change"