claude-acc-manager 1.1.0__tar.gz

claude_acc_manager-1.1.0/.agents/skills/next-task/SKILL.md

@@ -0,0 +1,77 @@
+---
+name: next-task
+description: Orient on the repo docs and execute the next milestone task — strict TDD, per-commit gate
+allowed-tools:
+  - read
+  - grep
+  - glob
+permissions:
+  allow:
+    - Exec(git status)
+    - Exec(git log)
+    - Exec(git diff)
+triggers:
+  - user
+---
+
+# Execution session
+
+You are starting a clean session with no memory of earlier ones. The repo's docs and git history are your memory. Follow these steps in order.
+
+## 1. Orient — grep first, read only what you need
+
+- Run `git log --oneline -15` and `git status --short`. Uncommitted or untracked work means an earlier session stopped partway through — understand it before starting anything new.
+- Open `maintainer/backlog.md`. Its "Finding things" table lists the greps. Find the next milestone: `grep -n "open ← next" maintainer/backlog.md`.
+- If that milestone has a PRD, it is `maintainer/slices/SL-NNN-*.md` — find its first unchecked task with `grep -n "\[ \]" maintainer/slices/SL-NNN-*.md`. If it has none, you write it first (§3).
+- For a decision, grep the ADR id (`grep -rn "ADR-0009" docs/`) and read only that ADR. For porting evidence, `grep -rn "GAP-" maintainer/research/`.
+- Follow `AGENTS.md`. Do the searches yourself; spawn agents only if I ask.
+
+## 2. Scope
+
+- Work the current milestone's next task; a milestone lands as a series of green commits. If a step is too big, split it in the PRD first, then do the first piece.
+- Finish what was started. No new milestone while an earlier one is `open` or `partial`.
+- Pre-visibility order (temporary): M15 and M16 land before the repo goes public; the visibility flip then unblocks M14's closeout (public-run validation + ruleset) and M17's Pages deploy; M18 ships last.
+
+## 3. If the milestone has no PRD, write it first
+
+Copy `maintainer/slices/_TEMPLATE.md` to `maintainer/slices/SL-NNN-<slug>.md`. A PRD exists so the executing session never guesses and never assumes. It is not ready without:
+
+- **Who else implements this** — a row per reference repo (`claude-swap`, `ai-usagebar`, plus claude-code itself where we interoperate with its behavior), including those lacking the feature. A capability present in none is an invention and must be justified.
+- **Implementation inventory** — per repo that has it, the actual files to open grouped by concern (domain, ports, use case, adapter, CLI entry, persistence, edge cases). Paths, not summaries. Where two repos disagree, the disagreement is the decision the milestone must make — name it.
+- **Gap analysis** — our code against the references, file against file: absent, unreachable, partial, or complete.
+
+Verify every `research_repos/` path with `test -e` in the session that writes the PRD. Symbol greps find candidates; open the files before counting them. Cite `path` (add a `~N` line hint only if checked today).
+
+## 4. Build — strict TDD, evidence over assumption
+
+- **Before writing code, analyze the source and docs of the reference repos** named in the PRD and take the best of them (`research_repos/`, read-only — never install, import, link, vendor, or commit it).
+- Test-driven development strictly: RED → GREEN → REFACTOR. Each unit is one conventional commit (`type(scope): imperative` — scope = component or concern).
+- Act on measurement and reading, never on assumption. **No workarounds, no band-aids, no over-engineering, no dead code.** Minimum code that solves the problem; refactor carefully when needed.
+- A defect you introduce is yours to fix before you stop, whether or not it was planned — with a regression test.
+- You may `curl` and web-search to double-check facts when the references and official docs don't settle one.
+- Tests are hermetic (injected paths/clocks/transports), Triple-A, named fakes in `test/support/`, tree mirrors `src/`.
+
+## 5. Close the step
+
+- The gate is the commit: `uv run pre-commit run --all-files` (actionlint, pyright strict, deptry, bandit, vulture, xenon, import-linter, pytest ≥95% branch, mutmut — see `docs/adr/0011-strict-tdd-per-commit-gate-coverage-and-mutation.md`). No `--no-verify`, ever.
+- Gate and milestone-exit measurements go in the **commit body**, never in a doc.
+- Update the PRD checkboxes and the backlog row by **editing** — one line per milestone, no dated blocks.
+- When a milestone ships: record the exit-gate numbers in the closing commit body, mark the row `shipped`, delete its slice PRD — durable residue goes into an ADR or a code comment first.
+- Stop, and report what shipped, what you measured, and what the next task is.
+
+## Release (M18)
+
+- Versions, `CHANGELOG.md`, `v*` tags, and PyPI uploads are **CI artifacts** — semantic-release derives them from conventional commits. Never bump `version` in `pyproject.toml`, hand-edit `CHANGELOG.md`, create or push a tag, or publish a dist inside a session.
+- Commit messages are the release input — keep them conventional (`feat`/`fix`/`docs`/`chore`/`refactor`/`test`/`perf`, `!` or `BREAKING CHANGE` for majors) so the version bump parses correctly.
+- A session fixes code; the release workflow cuts it. If a release itself misbehaves, that's the defect to fix (in the workflow or tool config), never a manual release.
+- CI is supply-chain surface: actions pin by SHA, and every scanner M14 installs (`zizmor`, `gitleaks`, `pip-audit`, CodeQL, Scorecard) must stay green — a new finding is a defect to fix, never suppress or exclude-rule around it.
+
+## Reference repositories — `research_repos/`, read-only and untracked
+
+| Repo | Read it for |
+| --- | --- |
+| `claude-swap` (v0.27.0b1, Python) | switch transaction + rollback, claude-code mkdir locks, autoswitch loop, poll policy, usage store/backoff, identity oracle |
+| `ai-usagebar` (v1.14.0, Rust) | `CLAUDE_CONFIG_DIR` account model, `account switch` (dry-run, outgoing capture), flat 429 backoff, usage response parsing |
+| `toad` (v0.6.20, Python) | textual-8.x idioms (`getters`, `@work`/`@on`, `data_bind`, `AUTO_FOCUS`), UX affordances (help panel, throbber, terminal title, breakpoints, key-accelerated menus, schema-driven settings screen), `Visual`/`Strip` renderers, rich CLI output |
+
+Structural conventions live in `docs/adr/0010-package-by-component-import-linter-contracts.md` (package-by-component + import-linter) and `AGENTS.md` — no external exemplar.

claude_acc_manager-1.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,51 @@
+name: Bug report
+description: Something in cam isn't working right
+labels: [bug]
+body:
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: What did you do, what did you see, and what did you expect instead?
+      placeholder: Ran `cam switch`, got ... — expected ...
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: cam version and install method
+      description: Output of `cam --version`, and whether you installed with pipx, uv, or from source.
+      placeholder: cam 1.2.3, installed with pipx
+    validations:
+      required: true
+  - type: input
+    id: claude-version
+    attributes:
+      label: claude version
+      description: Output of `claude --version` — mutating operations only run inside a verified version band, so this matters.
+      placeholder: "claude 2.1.150"
+    validations:
+      required: true
+  - type: input
+    id: distro
+    attributes:
+      label: Linux distribution
+      placeholder: "Ubuntu 24.04, Fedora 42, …"
+    validations:
+      required: false
+  - type: textarea
+    id: doctor
+    attributes:
+      label: cam doctor output
+      description: Paste the output of `cam doctor` — it reports the interop setup (paths, locks, env, contract band). Review before pasting and remove anything you don't want public.
+      render: shell
+    validations:
+      required: false
+  - type: textarea
+    id: logs
+    attributes:
+      label: Command output
+      description: Paste the failing command's output — `--json` output is fine too. Never paste access/refresh tokens, API keys, or credential-file contents — cam never prints them, and neither should you.
+      render: shell
+    validations:
+      required: false

claude_acc_manager-1.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Architecture and design decisions
+    url: https://github.com/dmenezesgabriel/claude-acc-manager/blob/main/docs/architecture.md
+    about: How cam interoperates with Claude Code — locks, credential files, the usage endpoint, and the verified version band.
+  - name: Security concerns
+    url: https://github.com/dmenezesgabriel/claude-acc-manager/blob/main/SECURITY.md
+    about: Credential-store bugs are reported privately, never as public issues.

claude_acc_manager-1.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,22 @@
+name: Feature request
+description: Suggest an improvement or new capability
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem would this solve?
+      description: Describe the situation where you miss this feature — the workflow matters more than the mechanism.
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: What would you like to happen?
+      description: A rough sketch is fine — commands, flags, behavior.
+    validations:
+      required: false
+  - type: markdown
+    attributes:
+      value: |
+        Worth knowing before you propose: the project is intentionally narrow — Linux only, OAuth subscription accounts only, no API-key or setup-token accounts, no daemon/systemd unit. The explicit non-goals are listed in `docs/architecture.md` §1.

claude_acc_manager-1.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+<!--
+Thanks for the contribution. The checklist below is what review would
+otherwise ask for — see CONTRIBUTING.md for the reasoning behind each.
+-->
+
+## What this changes
+
+
+
+## Checklist
+
+- [ ] `uv run pre-commit run --all-files` is green — the same gate the commit hooks run (ruff, pyright strict, deptry, bandit, vulture, xenon, import-linter, pytest ≥95% branch, mutmut)
+- [ ] Commit messages are conventional — `type(scope): imperative`
+- [ ] Bug fixes include a test that fails on `main` and passes here — say so below
+- [ ] Tests are hermetic — no real `$HOME`/`$XDG`, no network; `-m integration` is opt-in only
+- [ ] Docs updated where they mention what changed (`README.md`, `docs/`)
+
+## Testing
+
+<!-- What you ran, and on which distribution. -->

claude_acc_manager-1.1.0/.github/actionlint.yaml

@@ -0,0 +1,9 @@
+# actionlint 1.7.12 predates GitHub's `$/` self-repository syntax — the
+# dedicated form for referencing actions/workflows in the same repo at the
+# triggering commit, which zizmor's self-repository audit prefers over
+# `./`. Until upstream supports it (rhysd/actionlint), the false positive
+# is ignored here via the same mechanism ruff uses for cache-mode.
+paths:
+  ".github/workflows/*.yml":
+    ignore:
+      - 'specifying action "\$/[^"]*" in invalid format because ref is missing'

claude_acc_manager-1.1.0/.github/actions/setup-env/action.yml

@@ -0,0 +1,31 @@
+name: setup-env
+
+# The env block every env-consuming job used to paste: pin the uv binary
+# (SHA-pinned action + version/checksum-pinned tool, cached) and
+# `uv sync --locked`. `checkout` deliberately stays a job step — a
+# composite-internal checkout would make this action own the
+# `persist-credentials` decision, which belongs to each job.
+description: Install the pinned uv toolchain and sync the locked project env
+
+inputs:
+  python-version:
+    description: >-
+      Interpreter setup-uv provisions. Empty falls back to
+      `.python-version` (setup-uv treats "" as unset); `test` passes the
+      matrix value.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      with:
+        version: "0.11.8"
+        checksum: "56dd1b66701ecb62fe896abb919444e4b83c5e8645cca953e6ddd496ff8a0feb"
+        enable-cache: true
+        python-version: ${{ inputs.python-version }}
+
+    - name: Install dependencies
+      run: uv sync --locked
+      shell: bash

claude_acc_manager-1.1.0/.github/dependabot.yml

@@ -0,0 +1,20 @@
+version: 2
+
+# github-actions keeps every `# vX.Y.Z`-commented SHA pin fresh — that is what
+# makes SHA pinning sustainable. uv keeps pyproject + uv.lock current.
+# cooldown defers any release younger than 7 days — freshly-published
+# versions are the window most supply-chain attacks are caught inside.
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7

claude_acc_manager-1.1.0/.github/workflows/ci.yml

@@ -0,0 +1,109 @@
+name: CI
+
+# The required merge gate. `gate` runs `pre-commit run --all-files`
+# verbatim so CI can never pass what a commit cannot; `test` re-runs the
+# suite across the advertised requires-python range. The duplication is
+# intentional — gate proves the whole-repo gate at the pinned version,
+# the matrix proves the version surface. The scanner battery lives in
+# security.yml, which also owns the weekly drift cron.
+#
+# Job `name:` values are the required-check API — the default-branch
+# ruleset binds these names. Renaming one requires updating the ruleset
+# in the same commit.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+# Default-deny: a job inherits {} unless it re-declares scopes. Every job
+# needs at least `contents: read` — a zero-scope GITHUB_TOKEN cannot even
+# clone the repo (checkout 404s on private, and reads stay token-scoped).
+permissions: {}
+
+# Sha-keyed so consecutive main pushes never cancel each other — a ref-keyed
+# group would kill the in-flight main run and lose its coverage signal and
+# mutmut cache banking. PR pushes share the pull_request.number key, so a
+# fresh push still cancels a stale PR run.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+env:
+  # Every uv invocation must verify the lockfile, never silently relock.
+  UV_LOCKED: "1"
+
+jobs:
+  gate:
+    name: gate
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: $/.github/actions/setup-env
+
+      # mutants/ is mutmut's workdir: it doubles as the incremental cache,
+      # and a cold ~9k-mutant pass already exceeded a 60-min timeout once.
+      # Split restore/save so even a killed run banks progress — plain
+      # actions/cache only saves on success and the cache would never warm.
+      # The key partitions on the TEST tree: mutmut re-runs mutants when
+      # their source function changes but trusts verdicts across test edits,
+      # so a restore matching a different test/ would replay stale
+      # survived/killed results verbatim (observed: 0 mutants re-tested).
+      # The hash is `git rev-parse HEAD:test`, computed ONCE here:
+      # hashFiles() evaluates lazily per step, and pytest/mutmut drop
+      # __pycache__/ under test/ mid-job — a hashFiles save key therefore
+      # never matched the restore prefix (observed: 5 saves, 0 hits).
+      - name: Compute test-tree hash for the mutants cache key
+        id: testhash
+        run: echo "hash=$(git rev-parse HEAD:test)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: mutants/
+          key: mutants-t${{ steps.testhash.outputs.hash }}-${{ github.run_id }}
+          # Deliberately no loose fallback prefix: pre-fix entries were keyed
+          # on a pyc-mutated tree that maps to no real commit — restoring one
+          # would replay exactly the stale verdicts the partition exists to
+          # prevent. The cache rewarms from this commit forward.
+          restore-keys: mutants-t${{ steps.testhash.outputs.hash }}-
+
+      - name: Full local gate (lint, types, contracts, tests ≥95% branch, mutants)
+        run: uv run pre-commit run --all-files
+
+      - if: always()
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: mutants/
+          key: mutants-t${{ steps.testhash.outputs.hash }}-${{ github.run_id }}
+
+  test:
+    name: test (${{ matrix.python-version }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    env:
+      # `.python-version` pins 3.12 — the env override is what makes the
+      # matrix real; both `uv sync` and `uv run` honor it.
+      UV_PYTHON: ${{ matrix.python-version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: $/.github/actions/setup-env
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Run tests
+        run: uv run pytest

claude_acc_manager-1.1.0/.github/workflows/docs.yml

@@ -0,0 +1,82 @@
+name: Docs
+
+# The user docs site (M17). `docs` is the merge-facing check — it runs the
+# same `mkdocs build --strict` the local pre-commit hook runs — and `deploy`
+# publishes the built site to GitHub Pages on main pushes once the repo is
+# public. The split is permission scoping, not ceremony: only `deploy` holds
+# `pages: write` + `id-token: write`; `docs` is contents:read end to end.
+# No paths: filter — a required check that path-skips on untouched PRs would
+# deadlock them.
+#
+# Job `name:` values are the required-check API — the default-branch
+# ruleset binds these names. Renaming one requires updating the ruleset
+# in the same commit.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+# Default-deny: a job inherits {} unless it re-declares scopes.
+permissions: {}
+
+# Sha-keyed like the sibling workflows — consecutive main pushes must both
+# deploy; a ref-keyed group would drop a deploy between pushes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+env:
+  # Every uv invocation must verify the lockfile, never silently relock.
+  UV_LOCKED: "1"
+  # Silences the vendor banner mkdocs-material prints to stderr on every
+  # invocation — it is upstream advocacy, not a build diagnostic (the
+  # package's own opt-out).
+  NO_MKDOCS_2_WARNING: "1"
+
+jobs:
+  docs:
+    name: docs
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: $/.github/actions/setup-env
+
+      # The gate's verbatim check: strict mode escalates the validation
+      # block (omitted files, broken links) to build errors.
+      - name: Build site (strict)
+        run: uv run --group docs mkdocs build --strict
+
+      # configure-pages is a near-noop once Pages source = "GitHub Actions"
+      # is set in repo settings — the maintainer flips that at go-public.
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+        if: github.event_name == 'push' && github.event.repository.visibility == 'public'
+
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        if: github.event_name == 'push' && github.event.repository.visibility == 'public'
+        with:
+          path: site/
+
+  deploy:
+    name: deploy
+    needs: docs
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    # Inert while private — Pages needs a public repo; the guard mirrors
+    # codeql/scorecard so the job activates the moment visibility flips.
+    if: github.event_name == 'push' && github.event.repository.visibility == 'public'
+    permissions:
+      pages: write # deploy to Pages
+      id-token: write # OIDC proof for deploy-pages
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

claude_acc_manager-1.1.0/.github/workflows/release.yml

@@ -0,0 +1,176 @@
+name: Release
+
+# The PyPI release pipeline (M18, attrs model): CI never pushes to main —
+# the main-branch ruleset requires the nine checks on every commit, and a
+# fresh release commit can never have run them yet. Instead the maintainer
+# cuts the release locally (python-semantic-release does the version math
+# from conventional commits — the input format the commit-msg hook already
+# enforces) and the release commit rides a normal PR, so it passes the same
+# gate as everything else. Pushing the v{version} tag — not ruleset-
+# restricted; the ruleset targets ~DEFAULT_BRANCH only — then triggers this
+# workflow, which builds the dists from the tag and publishes them: GitHub
+# Release with dist assets, TestPyPI (ungated canary), PyPI (reviewer-gated
+# environment) — all via OIDC trusted publishing, no stored credentials.
+#
+# Maintainer flow per release (the release commit is chore(release), which
+# is not a bumping type, so the tag names the version it carries):
+#   git switch -c release/vX.Y.Z && git pull
+#   uvx --from python-semantic-release==10.7.0 semantic-release version \
+#     --no-tag --no-vcs-release
+#   gh pr create ... && gh pr merge --rebase   # nine checks run on it
+#   git switch main && git pull
+#   git tag "v$(uvx --from python-semantic-release==10.7.0 \
+#     semantic-release version --print)" && git push origin "v$(...)"
+#
+# Fork guard on every job (attrs' defense in depth): a fork's tag push must
+# never reach this repo's release machinery.
+on:
+  push:
+    tags: ["v*"]
+
+# Default-deny: a job inherits {} unless it re-declares scopes.
+permissions: {}
+
+# Publishes serialize per tag, never cancel: a mid-flight publish killed by
+# a cancel would strand the release halfway.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  # Every uv invocation must verify the lockfile, never silently relock.
+  UV_LOCKED: "1"
+
+jobs:
+  build:
+    name: build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    if: github.repository == 'dmenezesgabriel/claude-acc-manager'
+    permissions:
+      contents: read
+    steps:
+      # Tag ref by default on a tag push — build exactly what the tag names.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: $/.github/actions/setup-env
+
+      # ai-usagebar's verify-version lesson, cheapened: the maintainer's
+      # local PSR run derives the surfaces, so assert they agree before
+      # anything publishes.
+      - name: Version surfaces must agree (tag == pyproject == uv.lock)
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          version="${RELEASE_TAG#v}"
+          grep -Fqx "version = \"$version\"" pyproject.toml \
+            || { echo "::error::pyproject.toml version is not $version"; exit 1; }
+          grep -A1 -F 'name = "claude-acc-manager"' uv.lock | grep -Fqx "version = \"$version\"" \
+            || { echo "::error::uv.lock version is not $version"; exit 1; }
+
+      - name: Build dists
+        run: uv build
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dist
+          path: dist
+          if-no-files-found: error
+
+  # Separate job so the GH Release exists even if PyPI fails. The release
+  # notes are the tag's own CHANGELOG section (ai-usagebar's extraction) —
+  # PSR's publish-action is not used here: `semantic-release publish` refuses
+  # to run on a detached-HEAD tag checkout ("cannot match any release
+  # groups"), which is exactly what a tag-triggered job checks out.
+  release:
+    name: release (github.com)
+    needs: build
+    if: github.repository == 'dmenezesgabriel/claude-acc-manager'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write # create the GH Release, upload dist assets
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist
+
+      - name: Create or update the GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          version="${RELEASE_TAG#v}"
+          # PSR's changelog headers are "## vX.Y.Z (date)" — prefix-match the
+          # tag's section, stop at the next "## v" header (dots stay literal).
+          awk -v ver="$version" '
+            BEGIN { hdr = "## v" ver }
+            index($0, hdr) == 1 { flag = 1; next }
+            flag && index($0, "## v") == 1 { exit }
+            flag { print }
+          ' CHANGELOG.md > release-notes.md
+          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release upload "$RELEASE_TAG" dist/* --repo "$GITHUB_REPOSITORY" --clobber
+            gh release edit "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --notes-file release-notes.md
+          else
+            gh release create "$RELEASE_TAG" dist/* --repo "$GITHUB_REPOSITORY" \
+              --title "$RELEASE_TAG" --notes-file release-notes.md --latest
+          fi
+
+  # Ungated canary: every release lands on TestPyPI first so the artifact is
+  # installable before the human approves the real publish. Independent of
+  # `deploy` — a TestPyPI failure never blocks PyPI; the reviewer is the gate.
+  deploy-test:
+    name: deploy-test (test.pypi.org)
+    needs: build
+    if: github.repository == 'dmenezesgabriel/claude-acc-manager'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write # OIDC proof for trusted publishing
+    environment: pypi-test
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist
+
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: dist
+          print-hash: true
+
+  # The only reason this is a separate job: id-token: write lives here alone,
+  # and the pypi environment's required reviewer makes every real publish a
+  # human decision (PyPA guide recommendation).
+  deploy:
+    name: deploy (pypi.org)
+    needs: build
+    if: github.repository == 'dmenezesgabriel/claude-acc-manager'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write # OIDC proof for trusted publishing
+    environment: pypi
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist
+
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          packages-dir: dist
+          print-hash: true

claude_acc_manager-1.1.0/.github/workflows/scorecard.yml

@@ -0,0 +1,49 @@
+name: Scorecard
+
+# Separate file from ci.yml: different cadence (default-branch pushes +
+# weekly drift check, never PRs — pull_request is experimental upstream)
+# and a permission profile nothing in ci.yml shares.
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "30 6 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+# Sha-keyed so consecutive main pushes never cancel each other — a ref-keyed
+# group would kill an in-flight run mid-publish. (This file has no
+# pull_request trigger; the same expression is kept across workflows so the
+# rule is learned once.)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  scorecard:
+    name: scorecard
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    # Results publishing (id-token OIDC) + SARIF upload need the repo public;
+    # the guard keeps the job inert rather than failing if visibility flips
+    # back to private.
+    if: github.event.repository.visibility == 'public'
+    permissions:
+      contents: read # checkout
+      security-events: write # upload results.sarif to code scanning
+      id-token: write # OIDC for publish_results (scorecard.dev API)
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@55891bbd73f2425e97637d96e306fc9d491d0b21 # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - uses: github/codeql-action/upload-sarif@88585263c0627ee42c0e1c5143a112c8d6f4aa18 # v4.38.2
+        with:
+          sarif_file: results.sarif