code-mower 0.6.0b1__tar.gz → 0.6.0b2__tar.gz

{code_mower-0.6.0b1 → code_mower-0.6.0b2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.6.0b1
+Version: 0.6.0b2
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -117,7 +117,7 @@ observable.
 | C. Builder experiment | You want to compare authoring loops before trusting them broadly. | Use a work order or experiment spec, run `code-mower builder-experiment run` around an explicit command, then review the source-free `authoringRun` artifact and normal audit evidence. | [Builder Experiments](docs/builder-experiments.md) |
 
 The v0.6 beta announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v0.6.0-beta.1/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v0.6.0-beta.2/docs/try-in-10-minutes.md)
 guide.
 
 ## What Calibration Does And Does Not Prove
@@ -147,7 +147,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v0.6.0-beta.1` / `code-mower==0.6.0b1`. The
+the package-index procedure for `v0.6.0-beta.2` / `code-mower==0.6.0b2`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 
 ## Optional: Plan Before Coding
@@ -272,6 +272,12 @@ code-mower cloud setup \
   --out ~/.config/code-mower/tokens/your-laptop.env
 ```
 
+`cloud setup` stores a private `0600` token env file and records it as the
+current local cloud profile. Future `cloud doctor`, `cloud upload`, `cloud
+dogfood`, `cloud reviewer-runs`, and `cloud repo-sync` commands can load that
+profile automatically; pass `--install-id` or `--token-file` when a machine has
+multiple stored profiles.
+
 Cloud sharing details, historical catch-up, and repo-sync commands live in
 [docs/cloud-sharing.md](docs/cloud-sharing.md).
 
@@ -322,8 +328,8 @@ measurement work.
 
 ## Installation Status
 
-The current public beta baseline is `v0.6.0-beta.1`, with pinned package-index
-install spec `code-mower==0.6.0b1`. Release evidence is recorded on the GitHub
+The current public beta baseline is `v0.6.0-beta.2`, with pinned package-index
+install spec `code-mower==0.6.0b2`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and

{code_mower-0.6.0b1 → code_mower-0.6.0b2}/README.md

@@ -102,7 +102,7 @@ observable.
 | C. Builder experiment | You want to compare authoring loops before trusting them broadly. | Use a work order or experiment spec, run `code-mower builder-experiment run` around an explicit command, then review the source-free `authoringRun` artifact and normal audit evidence. | [Builder Experiments](docs/builder-experiments.md) |
 
 The v0.6 beta announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v0.6.0-beta.1/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v0.6.0-beta.2/docs/try-in-10-minutes.md)
 guide.
 
 ## What Calibration Does And Does Not Prove
@@ -132,7 +132,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v0.6.0-beta.1` / `code-mower==0.6.0b1`. The
+the package-index procedure for `v0.6.0-beta.2` / `code-mower==0.6.0b2`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 
 ## Optional: Plan Before Coding
@@ -257,6 +257,12 @@ code-mower cloud setup \
   --out ~/.config/code-mower/tokens/your-laptop.env
 ```
 
+`cloud setup` stores a private `0600` token env file and records it as the
+current local cloud profile. Future `cloud doctor`, `cloud upload`, `cloud
+dogfood`, `cloud reviewer-runs`, and `cloud repo-sync` commands can load that
+profile automatically; pass `--install-id` or `--token-file` when a machine has
+multiple stored profiles.
+
 Cloud sharing details, historical catch-up, and repo-sync commands live in
 [docs/cloud-sharing.md](docs/cloud-sharing.md).
 
@@ -307,8 +313,8 @@ measurement work.
 
 ## Installation Status
 
-The current public beta baseline is `v0.6.0-beta.1`, with pinned package-index
-install spec `code-mower==0.6.0b1`. Release evidence is recorded on the GitHub
+The current public beta baseline is `v0.6.0-beta.2`, with pinned package-index
+install spec `code-mower==0.6.0b2`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and

{code_mower-0.6.0b1 → code_mower-0.6.0b2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "0.6.0b1"
+version = "0.6.0b2"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.11"
 readme = "README.md"

{code_mower-0.6.0b1 → code_mower-0.6.0b2}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "0.6.0b1"
+__version__ = "0.6.0b2"

{code_mower-0.6.0b1 → code_mower-0.6.0b2}/src/code_mower/cloud.py

@@ -42,6 +42,9 @@ if __package__ in {None, ""}:
         read_token_file as _read_token_file,
         render_bundle_readme,
         render_cloud_doctor_text,
+        require_upload_token,
+        resolve_cloud_endpoint,
+        resolve_cloud_token,
         render_setup_env,
         repo_slug_from_remote as _repo_slug_from_remote,
         repo_sync_output_name as _repo_sync_output_name,
@@ -92,6 +95,9 @@ else:  # pragma: no cover - exercised after package extraction.
         read_token_file as _read_token_file,
         render_bundle_readme,
         render_cloud_doctor_text,
+        require_upload_token,
+        resolve_cloud_endpoint,
+        resolve_cloud_token,
         render_setup_env,
         repo_slug_from_remote as _repo_slug_from_remote,
         repo_sync_output_name as _repo_sync_output_name,
@@ -137,8 +143,11 @@ __all__ = [
     "build_cloud_bundle",
     "build_upload_payload",
     "post_upload_payload",
+    "require_upload_token",
     "render_bundle_readme",
     "render_setup_env",
+    "resolve_cloud_endpoint",
+    "resolve_cloud_token",
     "run_cloud_doctor",
     "run_cloud_setup",
     "validate_metadata_payload",
@@ -290,6 +299,23 @@ def main(argv: list[str] | None = None) -> int:
         default=os.environ.get("CODE_MOWER_CLOUD_ENDPOINT", DEFAULT_UPLOAD_ENDPOINT),
     )
     upload.add_argument("--token-env", default=DEFAULT_TOKEN_ENV)
+    upload.add_argument(
+        "--token-file",
+        type=Path,
+        default=None,
+        help="token env file or raw token file to use when token env is not set",
+    )
+    upload.add_argument(
+        "--token-dir",
+        type=Path,
+        default=None,
+        help="directory with Code Mower Cloud token profiles",
+    )
+    upload.add_argument(
+        "--install-id",
+        default="",
+        help="stored token profile name to use when token env is not set",
+    )
     upload.add_argument("--include-reports", action="store_true")
     upload.add_argument("--dry-run", action="store_true")
     upload.add_argument(
@@ -312,6 +338,23 @@ def main(argv: list[str] | None = None) -> int:
         default=os.environ.get("CODE_MOWER_CLOUD_ENDPOINT", DEFAULT_UPLOAD_ENDPOINT),
     )
     doctor.add_argument("--token-env", default=DEFAULT_TOKEN_ENV)
+    doctor.add_argument(
+        "--token-file",
+        type=Path,
+        default=None,
+        help="token env file or raw token file to check when token env is not set",
+    )
+    doctor.add_argument(
+        "--token-dir",
+        type=Path,
+        default=None,
+        help="directory with Code Mower Cloud token profiles",
+    )
+    doctor.add_argument(
+        "--install-id",
+        default="",
+        help="stored token profile name to check when token env is not set",
+    )
     doctor.add_argument(
         "--probe-service",
         action="store_true",
@@ -354,6 +397,18 @@ def main(argv: list[str] | None = None) -> int:
         default=os.environ.get("CODE_MOWER_CLOUD_ENDPOINT", DEFAULT_UPLOAD_ENDPOINT),
     )
     dogfood.add_argument("--token-env", default=DEFAULT_TOKEN_ENV)
+    dogfood.add_argument(
+        "--token-file",
+        type=Path,
+        default=None,
+        help="token env file or raw token file to use when token env is not set",
+    )
+    dogfood.add_argument(
+        "--token-dir",
+        type=Path,
+        default=None,
+        help="directory with Code Mower Cloud token profiles",
+    )
     dogfood.add_argument("--include-reports", action="store_true")
     dogfood.add_argument(
         "--yes",
@@ -389,6 +444,18 @@ def main(argv: list[str] | None = None) -> int:
         default=os.environ.get("CODE_MOWER_CLOUD_ENDPOINT", DEFAULT_UPLOAD_ENDPOINT),
     )
     catch_up.add_argument("--token-env", default=DEFAULT_TOKEN_ENV)
+    catch_up.add_argument(
+        "--token-file",
+        type=Path,
+        default=None,
+        help="token env file or raw token file to use when token env is not set",
+    )
+    catch_up.add_argument(
+        "--token-dir",
+        type=Path,
+        default=None,
+        help="directory with Code Mower Cloud token profiles",
+    )
     catch_up.add_argument(
         "--yes",
         action="store_true",
@@ -451,6 +518,18 @@ def main(argv: list[str] | None = None) -> int:
         default=os.environ.get("CODE_MOWER_CLOUD_ENDPOINT", DEFAULT_UPLOAD_ENDPOINT),
     )
     reviewer_runs.add_argument("--token-env", default=DEFAULT_TOKEN_ENV)
+    reviewer_runs.add_argument(
+        "--token-file",
+        type=Path,
+        default=None,
+        help="token env file or raw token file to use when token env is not set",
+    )
+    reviewer_runs.add_argument(
+        "--token-dir",
+        type=Path,
+        default=None,
+        help="directory with Code Mower Cloud token profiles",
+    )
     reviewer_runs.add_argument(
         "--yes",
         action="store_true",
@@ -498,6 +577,18 @@ def main(argv: list[str] | None = None) -> int:
         default=os.environ.get("CODE_MOWER_CLOUD_ENDPOINT", DEFAULT_UPLOAD_ENDPOINT),
     )
     repo_sync.add_argument("--token-env", default=DEFAULT_TOKEN_ENV)
+    repo_sync.add_argument(
+        "--token-file",
+        type=Path,
+        default=None,
+        help="token env file or raw token file to use when token env is not set",
+    )
+    repo_sync.add_argument(
+        "--token-dir",
+        type=Path,
+        default=None,
+        help="directory with Code Mower Cloud token profiles",
+    )
     repo_sync.add_argument("--include-reports", action="store_true")
     repo_sync.add_argument(
         "--yes",
@@ -535,6 +626,7 @@ def main(argv: list[str] | None = None) -> int:
                 print(f"Token: {result['token_prefix']}")
                 if result["status"] == "written":
                     print(f"Load it with: {result['shell']}")
+                    print(f"Current profile: {result['current_profile']}")
             return 0
         if args.command == "export":
             events = [
@@ -569,11 +661,18 @@ def main(argv: list[str] | None = None) -> int:
                 bundle_dir=args.bundle_dir,
                 include_reports=args.include_reports,
             )
+            token_resolution = resolve_cloud_token(
+                token_env=args.token_env,
+                token_file=args.token_file,
+                token_dir=args.token_dir,
+                install_id=args.install_id,
+            )
+            resolved_endpoint = resolve_cloud_endpoint(args.endpoint, token_resolution)
             dry_run = args.dry_run or not args.yes
             if dry_run:
                 preview = {
                     "mode": "cloud-upload-dry-run",
-                    "endpoint": args.endpoint,
+                    "endpoint": resolved_endpoint,
                     "would_upload": False,
                     "requires_yes": not args.yes,
                     "upload_mode": payload["upload_mode"],
@@ -592,14 +691,14 @@ def main(argv: list[str] | None = None) -> int:
                     print(f"Events: {preview['event_count']}")
                     print("Network: skipped (pass --yes to upload)")
                 return 0
-            token = os.environ.get(args.token_env, "")
-            if not token and not _is_local_http_endpoint(args.endpoint):
-                raise CloudBundleError(
-                    f"{args.token_env} is not set; refusing non-local upload without a token"
-                )
+            token = require_upload_token(
+                endpoint=resolved_endpoint,
+                resolution=token_resolution,
+                local_endpoint=_is_local_http_endpoint(resolved_endpoint),
+            )
             result = post_upload_payload(
                 payload=payload,
-                endpoint=args.endpoint,
+                endpoint=resolved_endpoint,
                 token=token,
                 timeout=args.timeout,
             )
@@ -615,6 +714,9 @@ def main(argv: list[str] | None = None) -> int:
                 bundle_dir=args.bundle_dir,
                 endpoint=args.endpoint,
                 token_env=args.token_env,
+                token_file=args.token_file,
+                token_dir=args.token_dir,
+                install_id=args.install_id,
                 probe_service=args.probe_service,
                 timeout=args.timeout,
             )
@@ -636,6 +738,8 @@ def main(argv: list[str] | None = None) -> int:
                 source=args.source,
                 endpoint=args.endpoint,
                 token_env=args.token_env,
+                token_file=args.token_file,
+                token_dir=args.token_dir,
                 include_reports=args.include_reports,
                 yes=args.yes,
                 timeout=args.timeout,
@@ -664,6 +768,8 @@ def main(argv: list[str] | None = None) -> int:
                 limit=args.limit,
                 endpoint=args.endpoint,
                 token_env=args.token_env,
+                token_file=args.token_file,
+                token_dir=args.token_dir,
                 yes=args.yes,
                 timeout=args.timeout,
                 include_git_ref=args.include_git_ref,
@@ -700,6 +806,8 @@ def main(argv: list[str] | None = None) -> int:
                 offset=args.offset,
                 endpoint=args.endpoint,
                 token_env=args.token_env,
+                token_file=args.token_file,
+                token_dir=args.token_dir,
                 yes=args.yes,
                 timeout=args.timeout,
                 include_git_ref=args.include_git_ref,
@@ -733,6 +841,8 @@ def main(argv: list[str] | None = None) -> int:
                 limit=args.limit,
                 endpoint=args.endpoint,
                 token_env=args.token_env,
+                token_file=args.token_file,
+                token_dir=args.token_dir,
                 include_reports=args.include_reports,
                 include_git_ref=args.include_git_ref,
                 yes=args.yes,

{code_mower-0.6.0b1 → code_mower-0.6.0b2}/src/code_mower/cloud_client/__init__.py

@@ -93,6 +93,19 @@ from .setup import (
     token_prefix,
     write_setup_env_file,
 )
+from .tokens import (
+    CURRENT_PROFILE_FILENAME,
+    DEFAULT_TOKEN_DIR,
+    CloudTokenResolution,
+    default_token_dir,
+    display_token_path,
+    read_token_profile,
+    require_upload_token,
+    resolve_cloud_endpoint,
+    resolve_cloud_identity,
+    resolve_cloud_token,
+    write_current_token_profile,
+)
 from .upload import (
     UPLOAD_SCHEMA,
     build_upload_payload,
@@ -113,10 +126,13 @@ __all__ = [
     "SAFE_REPORT_KINDS",
     "UPLOAD_SCHEMA",
     "CloudBundleError",
+    "CloudTokenResolution",
+    "CURRENT_PROFILE_FILENAME",
     "DEFAULT_INSTALL_ID_ENV",
     "DEFAULT_SETUP_INSTALL_ID",
     "DEFAULT_TEAM_ID_ENV",
     "DEFAULT_TOKEN_ENV",
+    "DEFAULT_TOKEN_DIR",
     "DEFAULT_UPLOAD_ENDPOINT",
     "DogfoodPlan",
     "EVENT_SCHEMA",
@@ -132,7 +148,9 @@ __all__ = [
     "catch_up_upload",
     "dashboard_url_for_endpoint",
     "default_setup_path",
+    "default_token_dir",
     "detect_repo_slug",
+    "display_token_path",
     "default_dogfood_reports",
     "dogfood_upload",
     "event_id_from_github_run",
@@ -150,6 +168,7 @@ __all__ = [
     "post_upload_payload",
     "probe_cloud_service",
     "read_token_file",
+    "read_token_profile",
     "render_bundle_readme",
     "render_cloud_doctor_text",
     "render_setup_env",
@@ -157,6 +176,10 @@ __all__ = [
     "repo_sync_output_name",
     "repo_sync_upload",
     "report_path_from_manifest",
+    "require_upload_token",
+    "resolve_cloud_endpoint",
+    "resolve_cloud_identity",
+    "resolve_cloud_token",
     "resolve_setup_token",
     "reviewer_runs_upload",
     "run_cloud_doctor",
@@ -176,4 +199,5 @@ __all__ = [
     "validate_metadata_payload",
     "validate_upload_endpoint",
     "write_setup_env_file",
+    "write_current_token_profile",
 ]

{code_mower-0.6.0b1 → code_mower-0.6.0b2}/src/code_mower/cloud_client/doctor.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import os
 import shlex
 from pathlib import Path
 from typing import Any
@@ -18,6 +17,10 @@ from .endpoints import (
     validate_upload_endpoint,
 )
 from .errors import CloudBundleError
+from .tokens import (
+    resolve_cloud_endpoint,
+    resolve_cloud_token,
+)
 from .upload import build_upload_payload
 
 
@@ -84,12 +87,22 @@ def run_cloud_doctor(
     bundle_dir: Path,
     endpoint: str,
     token_env: str,
+    token_file: Path | None = None,
+    token_dir: Path | None = None,
+    install_id: str = "",
     require_token: bool = True,
     probe_service: bool = False,
     timeout: float = 5.0,
 ) -> dict[str, Any]:
     checks: list[dict[str, Any]] = []
     endpoint_is_valid = False
+    token_resolution = resolve_cloud_token(
+        token_env=token_env,
+        token_file=token_file,
+        token_dir=token_dir,
+        install_id=install_id,
+    )
+    endpoint = resolve_cloud_endpoint(endpoint, token_resolution)
 
     try:
         _validate_upload_endpoint(endpoint)
@@ -122,13 +135,13 @@ def run_cloud_doctor(
             }
         )
 
-    token_present = bool(os.environ.get(token_env, ""))
-    if token_present:
+    if token_resolution.has_token:
         checks.append(
             {
                 "name": "token",
                 "status": "pass",
-                "message": f"{token_env} is set",
+                "message": token_resolution.message,
+                "detail": token_resolution.safe_detail(),
             }
         )
     elif is_local_http_endpoint(endpoint):
@@ -137,8 +150,9 @@ def run_cloud_doctor(
                 "name": "token",
                 "status": "warn",
                 "message": (
-                    f"{token_env} is not set; local configless ingest may still work"
+                    f"{token_resolution.message}; local configless ingest may still work"
                 ),
+                "detail": token_resolution.safe_detail(),
             }
         )
     elif not require_token:
@@ -146,11 +160,9 @@ def run_cloud_doctor(
             {
                 "name": "token",
                 "status": "warn",
-                "message": f"{token_env} is not set; upload will remain disabled",
-                "remediation": (
-                    "Run `code-mower cloud setup --token-stdin` or export "
-                    f"{token_env} before using --yes."
-                ),
+                "message": f"{token_resolution.message}; upload will remain disabled",
+                "detail": token_resolution.safe_detail(),
+                "remediation": token_resolution.remediation,
             }
         )
     else:
@@ -158,11 +170,9 @@ def run_cloud_doctor(
             {
                 "name": "token",
                 "status": "fail",
-                "message": f"{token_env} is not set",
-                "remediation": (
-                    "Set CODE_MOWER_CLOUD_TOKEN to a team ingest token before "
-                    "running cloud upload --yes."
-                ),
+                "message": token_resolution.message,
+                "detail": token_resolution.safe_detail(),
+                "remediation": token_resolution.remediation,
             }
         )