cmpnd 0.62.0__tar.gz → 0.63.0__tar.gz

{cmpnd-0.62.0 → cmpnd-0.63.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cmpnd
-Version: 0.62.0
+Version: 0.63.0
 Summary: DSPy observability and deployment SDK for cmpnd
 Project-URL: Homepage, https://cmpnd.ai
 Author-email: cmpnd <hello@cmpnd.ai>

{cmpnd-0.62.0 → cmpnd-0.63.0}/cmpnd/cli/commands/org.py

@@ -29,17 +29,21 @@ adds one) and `switch` picks which stored key later commands use, the way the
 web app switches a session's active org. `list` reads
 /api/v1/auth/organizations and marks the orgs you hold a key for and the
 active one. `switch` needs no network call when the org's key is already
-stored. `cmpnd org leave` removes your own membership and drops that org's
-stored key.
+stored. When none is stored for an org you are an approved member of, it
+offers to mint one with the current key's scopes (`--mint` skips the
+question), stores it and switches to it. `cmpnd org leave` removes your own
+membership and drops that org's stored key.
 
 Always registered (no env gate); the server is the authority.
 """
 
 from __future__ import annotations
 
+import socket
 import sys
 import urllib.parse
 from argparse import ArgumentParser, _SubParsersAction
+from datetime import datetime, timezone
 from typing import Any
 
 from .. import api_client, credentials
@@ -91,6 +95,11 @@ def register(subparsers: _SubParsersAction[ArgumentParser]) -> None:
 
     switch = sub.add_parser("switch", help="Use the stored key for another of your organizations")
     switch.add_argument("org", help="Organization slug or id (from `org list`)")
+    switch.add_argument(
+        "--mint",
+        action="store_true",
+        help="When no key is stored for the org, mint one with the current key's scopes without asking",
+    )
     switch.set_defaults(func=handle_switch, _skip_resolve_config=True)
 
     leave = sub.add_parser("leave", help="Leave one of your organizations and drop its stored key")
@@ -214,12 +223,70 @@ def handle_switch(_unused_client: api_client.ApiClient | None, args: Any) -> Non
         api_key, _ = api_client.resolve_config(args)
     except api_client.CliError:
         raise _no_key_stored(f"'{target}'", endpoint, target) from None
-    for row in _memberships(api_client.ApiClient(api_key, endpoint)):
+    client = api_client.ApiClient(api_key, endpoint)
+    for row in _memberships(client):
         if target in (row.get("id"), row.get("slug")):
-            raise _no_key_stored(str(row.get("name") or target), endpoint, target)
+            _mint_and_switch(client, row, target, ask=not getattr(args, "mint", False))
+            return
     raise api_client.CliError(f"You are not a member of an organization '{target}' on {endpoint}.")
 
 
+def _mint_and_switch(client: api_client.ApiClient, row: dict[str, Any], target: str, *, ask: bool) -> None:
+    """Mint a key for a member org that has none stored, store it and switch.
+
+    The request names no scopes, so serve grants the calling key's own
+    non-admin scopes and the new key is never broader than the one in use.
+    serve refuses with 400 or 403 when the calling key cannot mint, and the
+    browser login is then the way to get the key.
+    """
+    endpoint = client._endpoint
+    label = str(row.get("name") or row.get("slug") or target)
+    if row.get("approved") is False:
+        raise api_client.CliError(
+            f"Your membership in {label} is not approved yet, so no key can be minted for it. "
+            "An owner of the org approves it."
+        )
+    if ask:
+        if not sys.stdin.isatty():
+            raise api_client.CliError(
+                f"No key is stored for {label} on {endpoint}. Run {top.hint_org_switch(target, mint=True)} "
+                f"to mint one with the current key's scopes, or {top.hint_login(target)}."
+            )
+        try:
+            answer = input(f"No key is stored for {label}. Mint one with the current key's scopes? [Y/n] ")
+        except EOFError:
+            # Ctrl-D at the prompt declines.
+            print(file=sys.stderr)
+            answer = "n"
+        if answer.strip().lower() not in ("", "y", "yes"):
+            raise _no_key_stored(label, endpoint, target)
+
+    hostname = socket.gethostname() or "unknown"
+    name = f"CLI: {hostname} {datetime.now(timezone.utc).strftime('%Y-%m-%d')}"
+    try:
+        created = client.post("/api/v1/org/keys", json={"name": name, "org_id": row.get("id") or target})
+    except api_client.CliError as exc:
+        if exc.status_code in (400, 403):
+            raise api_client.CliError(
+                f"The current key could not mint a key for {label}: {exc}. Run {top.hint_login(target)} to store one."
+            ) from exc
+        raise
+    token = created.get("token") if isinstance(created, dict) else None
+    org_id = created.get("org_id") if isinstance(created, dict) else None
+    if not isinstance(token, str) or not token or not isinstance(org_id, str) or not org_id:
+        raise api_client.CliError(f"The response did not include a key for {label}. Nothing was stored.")
+    name_out = created.get("org_name")
+    slug_out = created.get("org_slug")
+    credentials.save(
+        endpoint,
+        token,
+        org_id=org_id,
+        org_name=name_out if isinstance(name_out, str) else None,
+        org_slug=slug_out if isinstance(slug_out, str) else None,
+    )
+    print(f"Minted a key for {name_out or slug_out or org_id} ({org_id}) and switched to it on {endpoint}")
+
+
 def _say_active_moved(endpoint: str, moved_to: str | None) -> None:
     if moved_to:
         k = {k.org_id: k for k in credentials.stored_keys(endpoint)}.get(moved_to)

{cmpnd-0.62.0 → cmpnd-0.63.0}/cmpnd/cli/commands/top.py

@@ -180,8 +180,8 @@ def hint_login(org: str | None = None) -> str:
     return f"`{cmd}` in a terminal, then restart the shell" if _SHELL_MODE else f"`{cmd}`"
 
 
-def hint_org_switch(org: str) -> str:
-    cmd = f"cmpnd org switch {org}"
+def hint_org_switch(org: str, *, mint: bool = False) -> str:
+    cmd = f"cmpnd org switch {org}" + (" --mint" if mint else "")
     # Same reason as hint_login: the shell picks its key once, at startup.
     # Both are public, unlike the other hint helpers, because only org.py
     # calls them.

{cmpnd-0.62.0 → cmpnd-0.63.0}/docs/cli.md

@@ -438,9 +438,14 @@ mode 0600. An active pointer names the org whose key commands use.
   is stored, and `active` marks the org of the key in use. When `--api-key` or
   `CMPND_API_KEY` is set, `active` marks that key's org.
 - `cmpnd org switch <slug-or-id>` makes another org's stored key active, with
-  no network call. When no key is stored for that org, it says so and names
-  the `cmpnd login --org` command to run. It refuses while `--api-key` or
-  `CMPND_API_KEY` is set, because either one overrides the stored keys.
+  no network call. When no key is stored for an org where you are an approved
+  member, it asks whether to mint one with the current key's scopes, stores
+  it and switches to it. `--mint` mints without asking, and without a
+  terminal to ask in it mints only with `--mint`. The request names no
+  scopes, so serve grants the current key's non-admin scopes. When serve
+  refuses the mint, the error names the `cmpnd login --org` command to run.
+  `switch` refuses while `--api-key` or `CMPND_API_KEY` is set, because
+  either one overrides the stored keys.
 - `cmpnd org leave <slug-or-id>` removes your membership in that org and drops
   its stored key. If that key was active, the CLI switches to another stored
   key, preferring your new default org's, or clears the pointer, and says

{cmpnd-0.62.0 → cmpnd-0.63.0}/pyproject.toml

@@ -5,7 +5,7 @@ name = "cmpnd"
 # it's new) — no git tags. Bump with `uv version --bump {minor,patch}` or by
 # hand. Runtime `cmpnd.__version__` reads installed metadata, so it tracks
 # this automatically. See docs/plans/2026-07-02-sdk-pypi-tag-free-publish.md.
-version = "0.62.0"
+version = "0.63.0"
 description = "DSPy observability and deployment SDK for cmpnd"
 readme = "README.md"
 requires-python = ">=3.11"

{cmpnd-0.62.0 → cmpnd-0.63.0}/tests/test_cli/test_org.py

@@ -6,6 +6,7 @@ import json
 from argparse import Namespace
 from unittest import mock
 
+import httpx
 import pytest
 
 from cmpnd.cli import credentials
@@ -125,8 +126,8 @@ def _client_for(api_key: str):
     return client
 
 
-def _switch_args(target: str) -> Namespace:
-    return Namespace(org=target, endpoint=EP, api_key=None)
+def _switch_args(target: str, *, mint: bool = False) -> Namespace:
+    return Namespace(org=target, endpoint=EP, api_key=None, mint=mint)
 
 
 def _write_legacy(api_key: str) -> None:
@@ -396,14 +397,20 @@ class TestOrgSwitch:
             org.handle_switch(None, _switch_args("acme"))
         assert credentials.load(EP) == "cmpnd_acme"
 
-    def test_member_without_a_stored_key_is_told_how_to_log_in(self, config_dir):
+    def test_member_without_a_stored_key_is_told_how_to_get_one(self, config_dir, monkeypatch):
+        # With no terminal to ask in and no --mint, nothing is minted: the
+        # error names both ways to get the key.
+        monkeypatch.setattr(org.sys.stdin, "isatty", lambda: False)
         credentials.save(EP, "cmpnd_own", org_id="o_own", org_slug="own")
         client = _client_for("cmpnd_own")
         client.get.return_value = MEMBERSHIPS
         with mock.patch.object(org.api_client, "ApiClient", return_value=client):
-            with pytest.raises(CliError, match="cmpnd login --org beta"):
+            with pytest.raises(CliError) as err:
                 org.handle_switch(None, _switch_args("beta"))
+        assert "cmpnd login --org beta" in str(err.value)
+        assert "cmpnd org switch beta --mint" in str(err.value)
         client.get.assert_called_once_with("/api/v1/auth/organizations")
+        client.post.assert_not_called()
         assert credentials.load(EP) == "cmpnd_own"
 
     def test_non_member_is_refused(self, config_dir):
@@ -433,3 +440,152 @@ class TestOrgSwitch:
         legacy.get.assert_called_once_with("/api/v1/auth/me")
         assert credentials.load(EP) == "cmpnd_legacy"
         assert credentials.active_org(EP) == "o_own"
+
+
+MINTED_BETA = {
+    "id": "k_beta",
+    "name": "CLI: box 2026-10-29",
+    "token": "cmpnd_beta",
+    "scopes": ["traces:read"],
+    "org_id": "o_beta",
+    "org_name": "Beta",
+    "org_slug": "beta",
+}
+
+
+class TestOrgSwitchMintsAMissingKey:
+    """`org switch` to a member org with no stored key offers to mint one."""
+
+    @pytest.fixture
+    def own_key(self, config_dir):
+        credentials.save(EP, "cmpnd_own", org_id="o_own", org_slug="own")
+        client = _client_for("cmpnd_own")
+        client.get.return_value = MEMBERSHIPS
+        with mock.patch.object(org.api_client, "ApiClient", autospec=True) as ctor:
+            ctor.return_value = client
+            yield client, ctor
+
+    def test_mint_flag_mints_and_switches(self, own_key, capsys):
+        client, ctor = own_key
+        client.post.return_value = MINTED_BETA
+
+        org.handle_switch(None, _switch_args("beta", mint=True))
+
+        ctor.assert_called_once_with("cmpnd_own", EP)
+        client.post.assert_called_once()
+        assert credentials.load(EP) == "cmpnd_beta"
+        assert credentials.active_org(EP) == "o_beta"
+        # The key it switched from stays stored.
+        assert {k.org_id for k in credentials.stored_keys(EP)} == {"o_own", "o_beta"}
+        assert "Beta" in capsys.readouterr().out
+
+    def test_terminal_prompt_yes_mints(self, own_key, monkeypatch):
+        client, _ = own_key
+        client.post.return_value = MINTED_BETA
+        monkeypatch.setattr(org.sys.stdin, "isatty", lambda: True)
+        monkeypatch.setattr("builtins.input", lambda _prompt="": "")
+
+        org.handle_switch(None, _switch_args("beta"))
+
+        assert credentials.load(EP) == "cmpnd_beta"
+
+    def test_ctrl_d_at_the_prompt_declines(self, own_key, monkeypatch):
+        client, _ = own_key
+        monkeypatch.setattr(org.sys.stdin, "isatty", lambda: True)
+
+        def eof(_prompt=""):
+            raise EOFError
+
+        monkeypatch.setattr("builtins.input", eof)
+
+        with pytest.raises(CliError, match="cmpnd login --org beta"):
+            org.handle_switch(None, _switch_args("beta"))
+
+        client.post.assert_not_called()
+        assert credentials.load(EP) == "cmpnd_own"
+
+    def test_terminal_prompt_no_mints_nothing(self, own_key, monkeypatch):
+        client, _ = own_key
+        monkeypatch.setattr(org.sys.stdin, "isatty", lambda: True)
+        monkeypatch.setattr("builtins.input", lambda _prompt="": "n")
+
+        with pytest.raises(CliError, match="cmpnd login --org beta"):
+            org.handle_switch(None, _switch_args("beta"))
+
+        client.post.assert_not_called()
+        assert credentials.load(EP) == "cmpnd_own"
+
+    @pytest.mark.parametrize("status", [400, 403])
+    def test_a_refused_mint_falls_back_to_the_login_hint(self, own_key, status):
+        # A key without the scopes to mint, or a serve that refuses the
+        # request, leaves the browser login as the way to get the key.
+        client, _ = own_key
+        client.post.side_effect = CliError("the calling key holds no non-admin scopes to grant", status_code=status)
+
+        with pytest.raises(CliError) as err:
+            org.handle_switch(None, _switch_args("beta", mint=True))
+
+        assert "no non-admin scopes" in str(err.value)
+        assert "cmpnd login --org beta" in str(err.value)
+        assert credentials.load(EP) == "cmpnd_own"
+        assert {k.org_id for k in credentials.stored_keys(EP)} == {"o_own"}
+
+    def test_a_transport_failure_is_not_turned_into_a_login_hint(self, own_key):
+        client, _ = own_key
+        client.post.side_effect = CliError("could not connect")
+
+        with pytest.raises(CliError) as err:
+            org.handle_switch(None, _switch_args("beta", mint=True))
+
+        assert str(err.value) == "could not connect"
+        assert credentials.load(EP) == "cmpnd_own"
+
+    def test_pending_membership_is_not_offered_a_key(self, own_key):
+        client, _ = own_key
+        pending = {
+            "organizations": [
+                *MEMBERSHIPS["organizations"][:2],
+                {**MEMBERSHIPS["organizations"][2], "approved": False},
+            ],
+            "total": 3,
+        }
+        client.get.return_value = pending
+
+        with pytest.raises(CliError, match="not approved"):
+            org.handle_switch(None, _switch_args("beta", mint=True))
+
+        client.post.assert_not_called()
+        assert credentials.load(EP) == "cmpnd_own"
+
+
+class TestOrgSwitchMintOverTheWire:
+    """The mint request as a real ``httpx.Client`` sends it."""
+
+    def test_mint_request_names_no_scopes_and_authenticates_with_the_current_key(self, config_dir):
+        credentials.save(EP, "cmpnd_own", org_id="o_own", org_slug="own")
+        sent: list[httpx.Request] = []
+
+        def handle(request: httpx.Request) -> httpx.Response:
+            sent.append(request)
+            if request.method == "GET" and request.url.path == "/api/v1/auth/organizations":
+                return httpx.Response(200, json=MEMBERSHIPS)
+            if request.method == "POST" and request.url.path == "/api/v1/org/keys":
+                return httpx.Response(201, json=MINTED_BETA)
+            return httpx.Response(404, json={"error": "not found"})
+
+        real = httpx.Client
+        with mock.patch("httpx.Client", lambda **kwargs: real(**kwargs, transport=httpx.MockTransport(handle))):
+            org.handle_switch(None, _switch_args("beta", mint=True))
+
+        posts = [r for r in sent if r.method == "POST"]
+        assert len(posts) == 1
+        assert posts[0].url == httpx.URL(f"{EP}/api/v1/org/keys")
+        assert posts[0].headers["X-API-Key"] == "cmpnd_own"
+        body = json.loads(posts[0].content)
+        # No scopes in the body: serve grants the calling key's own non-admin
+        # scopes, so the minted key is never broader than the one in use.
+        assert set(body) == {"name", "org_id"}
+        assert body["org_id"] == "o_beta"
+        assert body["name"].startswith("CLI: ")
+        assert credentials.load(EP) == "cmpnd_beta"
+        assert credentials.active_org(EP) == "o_beta"

{cmpnd-0.62.0 → cmpnd-0.63.0}/uv.lock

@@ -505,7 +505,7 @@ wheels = [
 
 [[package]]
 name = "cmpnd"
-version = "0.62.0"
+version = "0.63.0"
 source = { editable = "." }
 default-groups = ["dspy-3-4-1"]
 dependencies = [