cli-login 0.1.0__tar.gz

cli_login-0.1.0/.claude/settings.json

@@ -0,0 +1,10 @@
+{
+  "permissions": {
+    "deny": [
+      "Read(./project/issues/**)",
+      "Edit(./project/issues/**)",
+      "Read(./project/events/**)",
+      "Edit(./project/events/**)"
+    ]
+  }
+}

cli_login-0.1.0/.cursorignore

@@ -0,0 +1,2 @@
+project/issues/
+project/events/

cli_login-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,66 @@
+name: release
+
+# Git Flow: develop is promoted to main by pull request; only main releases.
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  release:
+    # The version bump commit carries [skip ci], and a push made with the default workflow token never starts
+    # another run; this guard is a third safeguard against an endless loop.
+    if: "!contains(github.event.head_commit.message, 'chore(release):')"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      released: ${{ steps.version.outputs.released }}
+      tag: ${{ steps.version.outputs.tag }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - run: python -m pip install "python-semantic-release==9.21.1"
+      - name: Version, tag and GitHub release from conventional commits
+        id: version
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          before="$(git rev-parse HEAD)"
+          semantic-release version --no-changelog
+          after="$(git rev-parse HEAD)"
+          if [ "$before" = "$after" ]; then
+            echo "released=false" >> "$GITHUB_OUTPUT"
+            echo "No feat:, fix: or breaking commit since the last release."
+          else
+            echo "released=true" >> "$GITHUB_OUTPUT"
+            echo "tag=$(git describe --tags --abbrev=0)" >> "$GITHUB_OUTPUT"
+          fi
+
+  pypi:
+    needs: release
+    if: needs.release.outputs.released == 'true'
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write # OIDC trusted publishing; there is no API token or secret.
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.release.outputs.tag }}
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - run: python -m pip install build
+      - run: python -m build
+      - uses: pypa/gh-action-pypi-publish@release/v1

cli_login-0.1.0/.github/workflows/tests.yml

@@ -0,0 +1,72 @@
+name: tests
+
+on:
+  push:
+    branches: [develop, main]
+  pull_request:
+
+jobs:
+  python:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python: ["3.10", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - run: python -m pip install -e ".[dev]"
+      - name: Linux extras and a real Secret Service keyring
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gnome-keyring dbus-x11 libsecret-1-0
+          python -m pip install -e ".[dev,linux]"
+      - run: python -m ruff check .
+      - name: Specs and Gherkin features
+        if: runner.os != 'Linux'
+        shell: bash
+        run: |
+          python -m pytest -q -rs
+          python -m behave features
+      - name: Specs and Gherkin features, with a real Secret Service and kernel keyring
+        if: runner.os == 'Linux'
+        env:
+          # A skipped real backend fails the run instead of passing silently.
+          ANTHUS_REQUIRE_REAL: secret-service,kernel-keyring
+        run: |
+          dbus-run-session -- bash -c '
+            set -e
+            echo -n "ci-test-password" | gnome-keyring-daemon --unlock --components=secrets > /dev/null
+            python -m pytest -q -rs
+            python -m behave features
+          '
+
+  wheel:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - run: python -m pip install build
+      - run: python -m build
+      - name: The wheel holds no specs and no plaintext test store
+        run: |
+          python - <<'PY'
+          import glob, zipfile
+          (wheel,) = glob.glob("dist/*.whl")
+          names = zipfile.ZipFile(wheel).namelist()
+          bad = [n for n in names if n.endswith("_test.py") or n.endswith("testing_processes.py")]
+          assert not bad, f"test files shipped in the wheel: {bad}"
+          assert any(n.endswith("cli_login/__init__.py") for n in names), names
+          print("wheel ok:", len(names), "files")
+          PY
+      - name: The installed wheel imports
+        run: |
+          python -m venv /tmp/wheel-venv
+          /tmp/wheel-venv/bin/pip install dist/*.whl
+          cd /tmp && /tmp/wheel-venv/bin/python -c "import cli_login; print(cli_login.__file__)"

cli_login-0.1.0/.gitignore

@@ -0,0 +1,6 @@
+project/.overlay/
+.venv/
+__pycache__/
+*.egg-info/
+dist/
+*.zip

cli_login-0.1.0/.kanbus.yml

@@ -0,0 +1,185 @@
+project_directory: project
+virtual_projects: {}
+new_issue_project: null
+ignore_paths: []
+console_port: null
+project_key: cli-login
+project_id: d3c92a99-f33d-4d98-a79d-450199042276
+project_management_template: null
+hierarchy:
+- initiative
+- epic
+- task
+- sub-task
+types:
+- bug
+- story
+- chore
+workflows:
+  default:
+    backlog:
+    - open
+    - closed
+    blocked:
+    - in_progress
+    - closed
+    closed:
+    - open
+    in_progress:
+    - open
+    - blocked
+    - closed
+    open:
+    - in_progress
+    - closed
+    - backlog
+  epic:
+    closed:
+    - open
+    in_progress:
+    - open
+    - closed
+    open:
+    - in_progress
+    - closed
+transition_labels:
+  default:
+    backlog:
+      closed: Drop
+      open: Start discovery
+    blocked:
+      closed: Drop
+      in_progress: Unblock
+    closed:
+      open: Reopen
+    in_progress:
+      blocked: Block
+      closed: Complete
+      open: Pause
+    open:
+      backlog: Back to backlog
+      closed: Drop
+      in_progress: Start work
+  epic:
+    closed:
+      open: Reopen
+    in_progress:
+      closed: Complete
+      open: Pause
+    open:
+      closed: Complete
+      in_progress: Start
+initial_status: open
+priorities:
+  0:
+    name: critical
+    color: red
+  1:
+    name: high
+    color: bright_red
+  2:
+    name: medium
+    color: yellow
+  3:
+    name: low
+    color: blue
+  4:
+    name: trivial
+    color: white
+default_priority: 2
+assignee: null
+time_zone: null
+statuses:
+- key: backlog
+  name: Backlog
+  category: To do
+  semantic_category: todo
+  color: null
+  collapsed: true
+- key: open
+  name: Discovery
+  category: To do
+  semantic_category: todo
+  color: null
+  collapsed: false
+- key: in_progress
+  name: In Progress
+  category: In progress
+  semantic_category: in_progress
+  color: null
+  collapsed: false
+- key: blocked
+  name: Blocked
+  category: In progress
+  semantic_category: in_progress
+  color: null
+  collapsed: true
+- key: closed
+  name: Done
+  category: Done
+  semantic_category: done
+  color: null
+  collapsed: true
+categories:
+- name: To do
+  color: grey
+- name: In progress
+  color: blue
+- name: Done
+  color: green
+sort_order: {}
+type_colors:
+  bug: red
+  chore: green
+  epic: magenta
+  event: bright_blue
+  initiative: bright_blue
+  story: yellow
+  sub-task: bright_cyan
+  task: blue
+beads_compatibility: false
+events: true
+wiki_directory: null
+ai:
+  provider: litellm
+  model: gpt-5.6-luna
+right_now:
+  enabled: true
+  default_tree_expanded: false
+  max_length: 120
+  model: gpt-5.6-luna
+standup:
+  window: rolling
+  lookback: 24h
+  skip_weekends: false
+  timezone: null
+jira: null
+snyk: null
+realtime:
+  transport: auto
+  broker: auto
+  autostart: false
+  keepalive: false
+  uds_socket_path: null
+  mqtt_custom_authorizer_name: null
+  mqtt_api_token: null
+  topics:
+    project_events: projects/{project}/events
+overlay:
+  enabled: true
+  ttl_s: 86400
+hooks:
+  enabled: true
+  run_in_beads_mode: true
+  default_timeout_ms: 5000
+  before: {}
+  after: {}
+github_security: null
+coordination:
+  providers:
+  - git
+  contention_window: 5s
+  default_lease_ttl: 300s
+  mutex_api:
+    endpoint: null
+    bearer_token: null

cli_login-0.1.0/.vscode/settings.json

@@ -0,0 +1,14 @@
+{
+  "files.exclude": {
+    "**/project/issues/**": true,
+    "**/project/events/**": true
+  },
+  "files.watcherExclude": {
+    "**/project/issues/**": true,
+    "**/project/events/**": true
+  },
+  "search.exclude": {
+    "**/project/issues/**": true,
+    "**/project/events/**": true
+  }
+}

cli_login-0.1.0/AGENTS.md

@@ -0,0 +1,51 @@
+# Agent Instructions
+
+## Project management with Kanbus
+
+Use Kanbus for task management.
+Why: Kanbus task management is MANDATORY here; every task must live in Kanbus.
+When: Create/update the Kanbus task before coding; close it only after the change lands.
+How: See CONTRIBUTING_AGENT.md for the Kanbus workflow, hierarchy, status rules, priorities, command examples, and the mistakes to avoid. Never inspect project/ or issue JSON directly (including with cat or jq); use Kanbus commands only.
+Performance: Prefer kbs (Rust) when available; kanbus (Python) is equivalent but slower.
+Warning: Editing project/ directly violates The Way. Do not read or write anything in project/; work only through Kanbus.
+Git / PR policy: Rules for product-code commits, branch names, pull requests, and human approval live in this repository's AGENTS.md (outside this Kanbus section). CONTRIBUTING_AGENT.md covers Kanbus board mechanics such as `kbs commit`; follow AGENTS.md for product code and git workflow.
+
+
+## What this project is
+
+`cli-login` is the one CLI login shared by Anthus products (Cyclotron, Papyrus, Auritus, and later Chatticus). It
+holds three parts: a Python library for the CLI side, a broker deployed once per product deployment, and a
+language-neutral protocol with conformance specs. Read [docs/design.md](docs/design.md) first.
+
+## Rules that matter here
+
+- **This repository is public.** Never commit account ids, user pool ids, client ids, product domains, tokens,
+  secrets or real email addresses. Each product supplies its own values through its discovery data. Examples use
+  placeholders such as `https://app.example.test`.
+- **Products stay separate.** Every stored key carries the product namespace, and a store refuses a key outside
+  the namespace it was opened with. One product never reads, refreshes or revokes another product's credentials.
+- **Fail closed.** No plaintext fallback for any secret, ever. A missing, locked or unusable store is an error with
+  recovery guidance.
+- **Never replay an uncertain mutation.** Only token operations are retried.
+- **Specs first.** Every behaviour change ships with Gherkin specs and unit specs beside the module. Specs use fake
+  providers, stores and brokers; no network or credentials in specs. Live proof is recorded separately.
+- **Protocol changes are versioned.** A change to the broker protocol bumps the major version, and the broker's
+  answers carry it.
+- **Do not print, log or commit secrets.** Status and errors redact every token.
+
+## Git workflow
+
+Git Flow: branch from `develop`, open a pull request to `develop`, merge with a merge commit once CI is green.
+Promotion to `main` is a pull request from `develop`. Kanbus board changes are committed on `develop` with
+`kbs commit` and pushed, with no pull request. Conventional commits (`feat:`, `fix:`, `docs:`, `chore:`, `test:`).
+
+## Commands
+
+```bash
+python -m pip install -e ".[dev]"
+python -m ruff check .
+python -m pytest -q          # unit specs beside each module
+python -m behave features    # Gherkin specs
+```
+
+CI runs these on Linux, macOS and Windows, because the stores and locks differ by platform.