chatenv 0.2.4__tar.gz → 0.2.6__tar.gz

{chatenv-0.2.4/src/chatenv.egg-info → chatenv-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chatenv
-Version: 0.2.4
+Version: 0.2.6
 Summary: ChatArch typed environment profile manager
 Author-email: rexwzh <1073853456@qq.com>
 License-Expression: MIT

{chatenv-0.2.4 → chatenv-0.2.6}/src/chatenv/__init__.py

@@ -3,6 +3,7 @@
 from .fields import BaseEnvConfig, EnvField
 from .paths import ChatArchPaths, get_paths
 from .store import EnvStore
+from .tokens import TokenStore
 from .configs import FeishuConfig, OpenAIConfig
 from .discovery import get_provider_configs, get_provider_errors, load_config_providers
 
@@ -13,6 +14,7 @@ __all__ = [
     "EnvStore",
     "FeishuConfig",
     "OpenAIConfig",
+    "TokenStore",
     "get_provider_configs",
     "get_provider_errors",
     "get_paths",
@@ -20,4 +22,4 @@ __all__ = [
     "__version__",
 ]
 
-__version__ = "0.2.4"
+__version__ = "0.2.6"

{chatenv-0.2.4 → chatenv-0.2.6}/src/chatenv/cli.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import json
 import sys
 import os
 from pathlib import Path
@@ -26,6 +27,7 @@ from .paste import iter_fields_for_values, parse_pasted_env_text
 from .paths import get_paths
 from .registry import resolve_config_types
 from .store import EnvStore
+from .tokens import TokenStore
 from .utils import mask_secret
 
 
@@ -106,6 +108,7 @@ COMMAND_ORDER = [
     "use",
     "list",
     "status",
+    "token",
     "cat",
     "get",
     "set",
@@ -116,13 +119,19 @@ COMMAND_ORDER = [
 
 
 class OrderedGroup(click.Group):
+    command_order = COMMAND_ORDER
+
     def list_commands(self, ctx: click.Context) -> list[str]:
         commands = set(self.commands)
-        ordered = [name for name in COMMAND_ORDER if name in commands]
+        ordered = [name for name in self.command_order if name in commands]
         ordered.extend(sorted(commands.difference(ordered)))
         return ordered
 
 
+class TokenCommandGroup(OrderedGroup):
+    command_order = ["status", "refresh", "list", "clear"]
+
+
 def _format_metavar(name: str) -> str:
     return name.replace("_", "-").upper()
 
@@ -234,7 +243,11 @@ def cli(ctx: click.Context, home: Path | None):
     """Manage typed env profiles under $CHATARCH_HOME/envs."""
     load_config_providers()
     paths = get_paths(home)
-    ctx.obj = {"paths": paths, "store": EnvStore(paths.envs_dir)}
+    ctx.obj = {
+        "paths": paths,
+        "store": EnvStore(paths.envs_dir),
+        "token_store": TokenStore(tokens_dir=paths.tokens_dir),
+    }
 
 
 def _store(ctx: click.Context) -> EnvStore:
@@ -245,6 +258,14 @@ def _envs_dir(ctx: click.Context) -> Path:
     return ctx.obj["paths"].envs_dir
 
 
+def _token_store(ctx: click.Context) -> TokenStore:
+    return ctx.obj["token_store"]
+
+
+def _tokens_dir(ctx: click.Context) -> Path:
+    return ctx.obj["paths"].tokens_dir
+
+
 def _matched_or_all(config_types: tuple[str, ...]) -> list[type[BaseEnvConfig]]:
     return _ordered_config_classes(resolve_config_types(config_types)) if config_types else _ordered_config_classes()
 
@@ -556,6 +577,168 @@ def status_env(ctx: click.Context, config_types: tuple[str, ...], detail: bool):
             click.echo(f"- {provider}: {exc}")
 
 
+@cli.group(name="token", cls=TokenCommandGroup)
+def token_group():
+    """Manage generic runtime token profiles."""
+    pass
+
+
+def _echo_json(payload: object) -> None:
+    click.echo(json.dumps(payload, ensure_ascii=False, indent=2, sort_keys=True))
+
+
+def _parse_summary(items: tuple[str, ...]) -> dict[str, str]:
+    summary: dict[str, str] = {}
+    for item in items:
+        if "=" not in item:
+            raise click.ClickException("--summary values must use KEY=VALUE format.")
+        key, value = item.split("=", 1)
+        key = key.strip()
+        if not key:
+            raise click.ClickException("--summary key cannot be blank.")
+        summary[key] = value.strip()
+    return summary
+
+
+def _render_token_status(payload: dict[str, object]) -> None:
+    for key in (
+        "service",
+        "profile",
+        "token_type",
+        "token_file",
+        "token_file_exists",
+        "token_present",
+        "created_at",
+        "updated_at",
+        "expires_at",
+        "source",
+    ):
+        value = payload.get(key)
+        if value not in (None, ""):
+            click.echo(f"{key}={value}")
+    summary = payload.get("summary")
+    if isinstance(summary, dict) and summary:
+        click.echo("summary:")
+        for key in sorted(summary):
+            click.echo(f"- {key}={summary[key]}")
+
+
+def _read_token_values(*, read_stdin: bool, value_file: Path | None) -> dict[str, object]:
+    if read_stdin == bool(value_file):
+        raise click.ClickException("token refresh requires exactly one of --stdin or --file.")
+    text = sys.stdin.read() if read_stdin else value_file.read_text(encoding="utf-8")  # type: ignore[union-attr]
+    try:
+        payload = json.loads(text)
+    except json.JSONDecodeError as exc:
+        raise click.ClickException(f"token payload must be a JSON object: {exc}") from exc
+    if not isinstance(payload, dict) or not payload:
+        raise click.ClickException("token payload must be a non-empty JSON object.")
+    return payload
+
+
+@token_group.command(name="refresh")
+@click.argument("service")
+@click.argument("profile", required=False, default="default")
+@click.option("--stdin", "read_stdin", is_flag=True, help="Read token JSON object from stdin.")
+@click.option("--file", "value_file", type=click.Path(dir_okay=False, path_type=Path), help="Read token JSON object from a file.")
+@click.option("--token-type", default="runtime", show_default=True, help="Caller-defined token/session type.")
+@click.option("--summary", multiple=True, help="Safe status field in KEY=VALUE form. Values are printed by status/list.")
+@click.option("--expires-at", default="", help="Optional caller-provided expiry timestamp.")
+@click.option("--format", "output_format", type=click.Choice(["text", "json"]), default="text", show_default=True)
+@click.pass_context
+def token_refresh(
+    ctx: click.Context,
+    service: str,
+    profile: str,
+    read_stdin: bool,
+    value_file: Path | None,
+    token_type: str,
+    summary: tuple[str, ...],
+    expires_at: str,
+    output_format: str,
+):
+    """Write refreshed generic runtime token JSON for SERVICE/PROFILE."""
+    values = _read_token_values(read_stdin=read_stdin, value_file=value_file)
+    try:
+        payload = _token_store(ctx).write(
+            service,
+            profile,
+            values=values,
+            token_type=token_type,
+            summary=_parse_summary(summary),
+            expires_at=expires_at,
+            source="refresh",
+        )
+    except ValueError as exc:
+        raise click.ClickException(str(exc)) from exc
+    if output_format == "json":
+        _echo_json(payload)
+    else:
+        _render_token_status(payload)
+
+
+@token_group.command(name="status")
+@click.argument("service")
+@click.argument("profile", required=False, default="default")
+@click.option("--format", "output_format", type=click.Choice(["text", "json"]), default="text", show_default=True)
+@click.pass_context
+def token_status(ctx: click.Context, service: str, profile: str, output_format: str):
+    """Show safe runtime token metadata for SERVICE/PROFILE."""
+    try:
+        payload = _token_store(ctx).status(service, profile)
+    except ValueError as exc:
+        raise click.ClickException(str(exc)) from exc
+    if output_format == "json":
+        _echo_json(payload)
+    else:
+        _render_token_status(payload)
+
+
+@token_group.command(name="list")
+@click.argument("service", required=False)
+@click.option("--format", "output_format", type=click.Choice(["text", "json"]), default="text", show_default=True)
+@click.pass_context
+def token_list(ctx: click.Context, service: str | None, output_format: str):
+    """List runtime token profiles grouped by service."""
+    payload = _token_store(ctx).list_tokens(service)
+    if output_format == "json":
+        _echo_json(payload)
+        return
+    if not payload:
+        click.echo(f"No tokens found under {_tokens_dir(ctx)}")
+        return
+    current_service = None
+    for item in payload:
+        service_name = str(item["service"])
+        if service_name != current_service:
+            if current_service is not None:
+                click.echo("")
+            click.echo(f"[{service_name}]")
+            current_service = service_name
+        suffix = " [present]" if item.get("token_present") else ""
+        click.echo(f"- {item['profile']}.json{suffix}")
+
+
+@token_group.command(name="clear")
+@click.argument("service")
+@click.argument("profile", required=False, default="default")
+@click.option("--execute", is_flag=True, help="Actually delete the token file. Omit for a dry run.")
+@click.option("--format", "output_format", type=click.Choice(["text", "json"]), default="text", show_default=True)
+@click.pass_context
+def token_clear(ctx: click.Context, service: str, profile: str, execute: bool, output_format: str):
+    """Clear a generic runtime token file for SERVICE/PROFILE."""
+    try:
+        payload = _token_store(ctx).clear(service, profile, execute=execute)
+    except ValueError as exc:
+        raise click.ClickException(str(exc)) from exc
+    if output_format == "json":
+        _echo_json(payload)
+    else:
+        for key, value in payload.items():
+            if value not in (None, ""):
+                click.echo(f"{key}={value}")
+
+
 @cli.command(name="cat")
 @click.argument("name", required=False)
 @click.option("--no-mask", is_flag=True, help="Show sensitive values in plain text.")

{chatenv-0.2.4 → chatenv-0.2.6}/src/chatenv/paths.py

@@ -13,6 +13,10 @@ class ChatArchPaths:
     def envs_dir(self) -> Path:
         return self.home_dir / "envs"
 
+    @property
+    def tokens_dir(self) -> Path:
+        return self.home_dir / "tokens"
+
 
 def _expand_path(value: str | Path) -> Path:
     return Path(value).expanduser().resolve()

chatenv-0.2.6/src/chatenv/tokens.py

@@ -0,0 +1,211 @@
+"""Generic runtime token store for ChatArch tools.
+
+ChatEnv owns only the generic management substrate. It stores one runtime
+state document per service/profile under ``$CHATARCH_HOME/tokens`` and never
+interprets service-specific token semantics.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import tempfile
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+from .paths import get_paths
+
+TOKEN_SCHEMA_VERSION = 1
+DEFAULT_PROFILE = "default"
+DEFAULT_TOKEN_TYPE = "runtime"
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _iso(value: datetime) -> str:
+    return value.astimezone(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
+
+
+def _safe_segment(value: str, *, default: str) -> str:
+    cleaned = re.sub(r"[^A-Za-z0-9_.-]+", "-", str(value or "").strip())
+    cleaned = cleaned.strip(".-")
+    return cleaned or default
+
+
+def _strict_token_profile_segment(value: str | None) -> str:
+    if value is None:
+        return DEFAULT_PROFILE
+    raw = str(value)
+    stripped = raw.strip()
+    if not stripped:
+        raise ValueError("token profile must not be empty")
+    if stripped != raw:
+        raise ValueError("token profile must not contain leading or trailing whitespace")
+    if stripped in {".", ".."}:
+        raise ValueError("token profile must not be '.' or '..'")
+    if "/" in stripped or "\\" in stripped:
+        raise ValueError("token profile must be a single path segment")
+    if re.search(r"[^A-Za-z0-9_.-]", stripped):
+        raise ValueError("token profile may contain only letters, numbers, dot, underscore, and hyphen")
+    if stripped.strip(".-") != stripped:
+        raise ValueError("token profile must not start or end with dot or hyphen")
+    return stripped
+
+
+def normalize_service_name(value: str) -> str:
+    return _safe_segment(value, default="Service")
+
+
+def normalize_token_profile(value: str | None) -> str:
+    return _strict_token_profile_segment(value)
+
+
+def _coerce_mapping(value: dict[str, Any] | None) -> dict[str, Any]:
+    return dict(value) if isinstance(value, dict) else {}
+
+
+class TokenStore:
+    """Generic JSON token store keyed by service/profile.
+
+    The ``values`` object is opaque and may contain secrets. ``status`` and
+    ``list_tokens`` intentionally expose only safe metadata and caller-supplied
+    summary fields.
+    """
+
+    def __init__(self, *, home: str | Path | None = None, tokens_dir: str | Path | None = None):
+        self.tokens_dir = Path(tokens_dir) if tokens_dir is not None else get_paths(home).tokens_dir
+
+    def token_path(self, service: str, profile: str | None = None) -> Path:
+        service_name = normalize_service_name(service)
+        profile_name = normalize_token_profile(profile)
+        return self.tokens_dir / service_name / f"{profile_name}.json"
+
+    def read(self, service: str, profile: str | None = None) -> dict[str, Any]:
+        path = self.token_path(service, profile)
+        try:
+            payload = json.loads(path.read_text(encoding="utf-8"))
+        except FileNotFoundError:
+            return {}
+        except (OSError, json.JSONDecodeError):
+            return {}
+        return payload if isinstance(payload, dict) else {}
+
+    def write(
+        self,
+        service: str,
+        profile: str | None = None,
+        *,
+        values: dict[str, Any],
+        token_type: str = DEFAULT_TOKEN_TYPE,
+        summary: dict[str, Any] | None = None,
+        expires_at: str | None = None,
+        source: str = "refresh",
+    ) -> dict[str, Any]:
+        if not isinstance(values, dict) or not values:
+            raise ValueError("values must be a non-empty JSON object")
+        service_name = normalize_service_name(service)
+        profile_name = normalize_token_profile(profile)
+        path = self.token_path(service_name, profile_name)
+        existing = self.read(service_name, profile_name)
+        now = _iso(_now())
+        payload = {
+            "schema_version": TOKEN_SCHEMA_VERSION,
+            "service": service_name,
+            "profile": profile_name,
+            "token_type": token_type or DEFAULT_TOKEN_TYPE,
+            "created_at": existing.get("created_at") or now,
+            "updated_at": now,
+            "expires_at": expires_at or "",
+            "source": source,
+            "summary": _coerce_mapping(summary),
+            "values": values,
+        }
+        path.parent.mkdir(parents=True, exist_ok=True)
+        fd, tmp_name = tempfile.mkstemp(prefix=f".{path.name}.", suffix=".tmp", dir=str(path.parent), text=True)
+        try:
+            with os.fdopen(fd, "w", encoding="utf-8") as handle:
+                json.dump(payload, handle, ensure_ascii=False, indent=2, sort_keys=True)
+                handle.write("\n")
+            os.replace(tmp_name, path)
+        finally:
+            if os.path.exists(tmp_name):
+                os.unlink(tmp_name)
+        return self.status(service_name, profile_name)
+
+    def status(self, service: str, profile: str | None = None) -> dict[str, Any]:
+        service_name = normalize_service_name(service)
+        profile_name = normalize_token_profile(profile)
+        path = self.token_path(service_name, profile_name)
+        payload = self.read(service_name, profile_name)
+        values = payload.get("values") if isinstance(payload, dict) else None
+        token_present = isinstance(values, dict) and bool(values)
+        summary = payload.get("summary") if isinstance(payload.get("summary"), dict) else {}
+        return {
+            "ok": True,
+            "service": service_name,
+            "profile": profile_name,
+            "token_type": payload.get("token_type") or DEFAULT_TOKEN_TYPE,
+            "token_file": str(path),
+            "token_file_exists": path.exists(),
+            "token_present": token_present,
+            "created_at": payload.get("created_at") or "",
+            "updated_at": payload.get("updated_at") or "",
+            "expires_at": payload.get("expires_at") or "",
+            "source": payload.get("source") or "",
+            "summary": summary,
+        }
+
+    def list_tokens(self, service: str | None = None) -> list[dict[str, Any]]:
+        roots: list[Path]
+        if service:
+            roots = [self.tokens_dir / normalize_service_name(service)]
+        elif self.tokens_dir.exists():
+            roots = sorted(path for path in self.tokens_dir.iterdir() if path.is_dir())
+        else:
+            roots = []
+        items: list[dict[str, Any]] = []
+        for root in roots:
+            for path in sorted(root.glob("*.json")):
+                items.append(self.status(root.name, path.stem))
+        return sorted(items, key=lambda item: (str(item["service"]), str(item["profile"])))
+
+    def clear(self, service: str, profile: str | None = None, *, execute: bool = False) -> dict[str, Any]:
+        service_name = normalize_service_name(service)
+        profile_name = normalize_token_profile(profile)
+        path = self.token_path(service_name, profile_name)
+        exists = path.exists()
+        if not execute:
+            return {
+                "ok": True,
+                "mutated": False,
+                "service": service_name,
+                "profile": profile_name,
+                "token_file": str(path),
+                "token_file_exists": exists,
+                "would_delete": str(path),
+            }
+        if exists:
+            path.unlink()
+        return {
+            "ok": True,
+            "mutated": exists,
+            "service": service_name,
+            "profile": profile_name,
+            "token_file": str(path),
+            "token_file_exists": False,
+            "deleted": exists,
+        }
+
+
+__all__ = [
+    "DEFAULT_PROFILE",
+    "DEFAULT_TOKEN_TYPE",
+    "TOKEN_SCHEMA_VERSION",
+    "TokenStore",
+    "normalize_service_name",
+    "normalize_token_profile",
+]

{chatenv-0.2.4 → chatenv-0.2.6/src/chatenv.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chatenv
-Version: 0.2.4
+Version: 0.2.6
 Summary: ChatArch typed environment profile manager
 Author-email: rexwzh <1073853456@qq.com>
 License-Expression: MIT

{chatenv-0.2.4 → chatenv-0.2.6}/src/chatenv.egg-info/SOURCES.txt

@@ -11,6 +11,7 @@ src/chatenv/paths.py
 src/chatenv/registry.py
 src/chatenv/source_chain.py
 src/chatenv/store.py
+src/chatenv/tokens.py
 src/chatenv/utils.py
 src/chatenv.egg-info/PKG-INFO
 src/chatenv.egg-info/SOURCES.txt

{chatenv-0.2.4 → chatenv-0.2.6}/tests/test_chatenv_core.py

@@ -1,6 +1,8 @@
+import json
 from pathlib import Path
 from types import SimpleNamespace
 
+import pytest
 from click.testing import CliRunner
 import chatenv.discovery as discovery_module
 import chatenv.cli as cli_module
@@ -240,6 +242,99 @@ def test_paths_only_use_chatarch_home(monkeypatch, tmp_path):
     paths = get_paths()
     assert paths.home_dir == (tmp_path / "arch").resolve()
     assert paths.envs_dir == (tmp_path / "arch" / "envs").resolve()
+    assert paths.tokens_dir == (tmp_path / "arch" / "tokens").resolve()
+
+
+def test_token_store_roundtrip_keeps_profile_parallel_to_env_without_exposing_values(tmp_path):
+    from chatenv.tokens import TokenStore
+
+    home = tmp_path / "arch"
+    store = TokenStore(home=home)
+
+    saved = store.write(
+        "CRS",
+        "admin",
+        values={"access_token": "opaque-value-a", "cookie": "opaque-value-b"},
+        token_type="admin_session",
+        summary={"base_url": "https://crs.example.test", "username": "operator"},
+    )
+
+    assert saved["service"] == "CRS"
+    assert saved["profile"] == "admin"
+    assert saved["token_present"] is True
+    assert saved["token_file"] == str(home / "tokens" / "CRS" / "admin.json")
+    assert "opaque-value-a" not in json.dumps(saved)
+
+    assert store.read("CRS", "admin")["values"] == {
+        "access_token": "opaque-value-a",
+        "cookie": "opaque-value-b",
+    }
+    status = store.status("CRS", "admin")
+    assert status["summary"] == {"base_url": "https://crs.example.test", "username": "operator"}
+    assert "opaque-value-a" not in json.dumps(status)
+    assert "opaque-value-b" not in json.dumps(status)
+
+
+def test_token_store_list_and_clear_are_generic(tmp_path):
+    from chatenv.tokens import TokenStore
+
+    store = TokenStore(home=tmp_path / "arch")
+    store.write("PyPI", "RexWzh", values={"session": "opaque-value-a"}, token_type="web_session")
+    store.write("CRS", "admin", values={"access_token": "opaque-value-b"}, token_type="admin_session")
+
+    all_tokens = store.list_tokens()
+    assert [(item["service"], item["profile"]) for item in all_tokens] == [("CRS", "admin"), ("PyPI", "RexWzh")]
+    assert store.list_tokens("PyPI")[0]["profile"] == "RexWzh"
+
+    dry_run = store.clear("PyPI", "RexWzh", execute=False)
+    assert dry_run["would_delete"].endswith("tokens/PyPI/RexWzh.json")
+    assert store.status("PyPI", "RexWzh")["token_present"] is True
+
+    removed = store.clear("PyPI", "RexWzh", execute=True)
+    assert removed["deleted"] is True
+    assert store.status("PyPI", "RexWzh")["token_present"] is False
+
+
+def test_token_store_rejects_aliasing_profile_segments(tmp_path):
+    from chatenv.tokens import TokenStore, normalize_token_profile
+
+    store = TokenStore(home=tmp_path / "arch")
+    store.write("PyPI", "RexWzh", values={"session": "opaque-value"}, token_type="web_session")
+
+    invalid_profiles = [
+        "",
+        " ",
+        ".",
+        "..",
+        "../RexWzh",
+        "RexWzh/other",
+        "RexWzh\\other",
+        " RexWzh",
+        "RexWzh ",
+        ".RexWzh",
+        "RexWzh.",
+        "Rex Wzh",
+    ]
+    for profile in invalid_profiles:
+        with pytest.raises(ValueError):
+            normalize_token_profile(profile)
+        with pytest.raises(ValueError):
+            store.status("PyPI", profile)
+
+    assert store.status("PyPI", "RexWzh")["token_present"] is True
+    assert store.status("PyPI", None)["profile"] == "default"
+
+
+def test_token_cli_reports_invalid_profile_without_aliasing(tmp_path):
+    runner = CliRunner()
+    result = runner.invoke(
+        cli,
+        ["--home", str(tmp_path / "arch"), "token", "status", "PyPI", "../RexWzh", "--format", "json"],
+    )
+
+    assert result.exit_code != 0
+    assert "single path segment" in result.output
+    assert "Traceback" not in result.output
 
 
 def test_store_profile_roundtrip(tmp_path):
@@ -606,6 +701,69 @@ def test_cli_new_bad_type_shows_available_types_outside_interactive(tmp_path):
     assert "Unit (unit)" in result.output
 
 
+def test_cli_token_refresh_status_list_and_clear_hide_values(tmp_path):
+    runner = CliRunner()
+    home = tmp_path / "arch"
+    token_json = json.dumps({"access_token": "opaque-value-a", "cookie": "opaque-value-b"})
+
+    refreshed = runner.invoke(
+        cli,
+        [
+            "--home",
+            str(home),
+            "token",
+            "refresh",
+            "PyPI",
+            "RexWzh",
+            "--token-type",
+            "web_session",
+            "--summary",
+            "username=RexWzh",
+            "--summary",
+            "base_url=https://pypi.org",
+            "--stdin",
+            "--format",
+            "json",
+        ],
+        input=token_json,
+    )
+
+    assert refreshed.exit_code == 0, refreshed.output
+    assert '"token_present": true' in refreshed.output
+    assert '"token_file"' in refreshed.output
+    assert "opaque-value-a" not in refreshed.output
+    assert "opaque-value-b" not in refreshed.output
+    assert (home / "tokens" / "PyPI" / "RexWzh.json").exists()
+
+    status = runner.invoke(
+        cli,
+        ["--home", str(home), "token", "status", "PyPI", "RexWzh", "--format", "json"],
+    )
+    assert status.exit_code == 0, status.output
+    assert '"profile": "RexWzh"' in status.output
+    assert '"username": "RexWzh"' in status.output
+    assert "opaque-value-a" not in status.output
+
+    listed = runner.invoke(cli, ["--home", str(home), "token", "list", "PyPI"])
+    assert listed.exit_code == 0, listed.output
+    assert "[PyPI]" in listed.output
+    assert "- RexWzh.json" in listed.output
+    assert "opaque-value-a" not in listed.output
+
+    dry_run = runner.invoke(cli, ["--home", str(home), "token", "clear", "PyPI", "RexWzh"])
+    assert dry_run.exit_code == 0, dry_run.output
+    assert "would_delete=" in dry_run.output
+    assert (home / "tokens" / "PyPI" / "RexWzh.json").exists()
+
+    cleared = runner.invoke(
+        cli,
+        ["--home", str(home), "token", "clear", "PyPI", "RexWzh", "--execute", "--format", "json"],
+    )
+    assert cleared.exit_code == 0, cleared.output
+    assert '"deleted": true' in cleared.output
+    assert not (home / "tokens" / "PyPI" / "RexWzh.json").exists()
+
+
 def test_cli_init_prompts_for_config_type_when_type_missing(
     tmp_path, monkeypatch
 ):
@@ -658,6 +816,7 @@ def test_cli_help_uses_stable_command_order():
         "use",
         "list",
         "status",
+        "token",
         "cat",
         "get",
         "set",

{chatenv-0.2.4 → chatenv-0.2.6}/tests/test_version.py

@@ -4,7 +4,7 @@ from click.testing import CliRunner
 
 
 def test_version_present():
-    assert __version__ == "0.2.4"
+    assert __version__ == "0.2.6"
 
 
 def test_cli_version_option():
@@ -35,6 +35,11 @@ def test_tree_option_renders_registered_command_surface():
     assert "├── use [NAME]" in result.output
     assert "├── list" in result.output
     assert "├── status" in result.output
+    assert "├── token" in result.output
+    assert "│   ├── refresh" in result.output
+    assert "│   ├── status" in result.output
+    assert "│   ├── list" in result.output
+    assert "│   └── clear" in result.output
     assert "├── cat [NAME]" in result.output
     assert "├── get [KEY]" in result.output
     assert "├── set [KEY-VALUE]" in result.output