conduct-cli 0.9.6__tar.gz → 0.9.8__tar.gz

{conduct_cli-0.9.6 → conduct_cli-0.9.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.9.6
+Version: 0.9.8
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.9.6 → conduct_cli-0.9.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.9.6"
+version = "0.9.8"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.9.6 → conduct_cli-0.9.8}/src/conduct_cli/main.py

@@ -576,7 +576,19 @@ def cmd_login(args):
     cfg.pop("api_key", None)
     _atomic_write(CONFIG_PATH, cfg)
 
-    print(f"{GREEN}✓ Logged in{RESET} — workspace {GRAY}{result['workspace_id']}{RESET}")
+    # Fetch workspaces so we can display the current one by name and nudge
+    # the user if their account has more than one (cross-surface switch drift).
+    try:
+        _hdrs = {"Authorization": f"Bearer {result['agent_token']}", "Content-Type": "application/json"}
+        _workspaces = api.req("GET", f"{api_url}/projects", _hdrs) or []
+    except Exception:
+        _workspaces = []
+    _current = next((w for w in _workspaces if str(w.get("id")) == str(result["workspace_id"])), None)
+    _name = (_current or {}).get("name") or ""
+    if _name:
+        print(f"{GREEN}✓ Logged in{RESET} — workspace {BOLD}{_name}{RESET} {GRAY}({str(result['workspace_id'])[:8]}…){RESET}")
+    else:
+        print(f"{GREEN}✓ Logged in{RESET} — workspace {GRAY}{result['workspace_id']}{RESET}")
 
     # Auto-sync: register hooks + pull policy
     try:
@@ -588,6 +600,15 @@ def cmd_login(args):
     except Exception:
         pass
 
+    # Nudge if the account has multiple workspaces — the web UI and CLI hold
+    # workspace context independently, so users routinely forget which one
+    # the CLI is now targeting.
+    if len(_workspaces) > 1:
+        _others = [w.get("name","") for w in _workspaces if str(w.get("id")) != str(result["workspace_id"])]
+        _preview = ", ".join(o for o in _others[:3] if o)
+        print(f"\n  {GRAY}You have {len(_workspaces)} workspaces. This CLI now targets:{RESET} {BOLD}{_name or result['workspace_id']}{RESET}")
+        print(f"  {GRAY}Switch with:{RESET} {CYAN}conduct switch \"<name>\"{RESET}  {GRAY}(others: {_preview}){RESET}")
+
 
 def cmd_agents(args):
     server, workspace_id, token = _require_auth(args)
@@ -1417,6 +1438,22 @@ def cmd_switch(args):
     new_id   = str(chosen["id"])
     new_name = chosen["name"]
 
+    # Re-mint agent token bound to the new workspace so server-side attribution
+    # follows the switch. Without this, POSTs (discover, audit, heartbeats)
+    # keep hitting the workspace the token was originally minted for.
+    try:
+        _r = api.req("POST", f"{server}/auth/switch-workspace", hdrs, {"workspace_id": new_id})
+        if _r and _r.get("agent_token"):
+            cfg["agent_token"]      = _r["agent_token"]
+            if _r.get("refresh_token"):
+                cfg["refresh_token"] = _r["refresh_token"]
+            import datetime as _dt
+            cfg["token_expires_at"] = (_dt.datetime.now(_dt.timezone.utc) + _dt.timedelta(seconds=int(_r.get("expires_in", 28800)))).isoformat()
+    except SystemExit:
+        print(f"  {YELLOW}⚠ Could not re-mint token for new workspace — falling back to config-only switch{RESET}")
+    except Exception as e:
+        print(f"  {YELLOW}⚠ Token re-mint failed ({e}) — falling back to config-only switch{RESET}")
+
     # Update ~/.conduct/config.json atomically
     cfg["workspace"] = new_id; cfg["workspace_id"] = new_id
     _atomic_write(CONFIG_PATH, cfg)

{conduct_cli-0.9.6 → conduct_cli-0.9.8}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.9.6
+Version: 0.9.8
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.9.6 → conduct_cli-0.9.8}/tests/test_switch.py

@@ -227,3 +227,153 @@ def test_switch_accepts_api_url_key(tmp_path, capsys):
     out = capsys.readouterr().out
     assert "Not logged in" not in out
     assert "Engineering" in out
+
+
+# ---------------------------------------------------------------------------
+# Regression: `conduct login` prints workspace name (not just UUID) and a
+# switch-hint when the account has more than one workspace. Cross-surface
+# workspace drift (web-UI-switched, CLI still on old) was invisible before.
+# ---------------------------------------------------------------------------
+
+def test_login_shows_name_and_nudges_when_multiple_workspaces(tmp_path, capsys):
+    from conduct_cli import main as m
+
+    cfg_path = tmp_path / "config.json"
+    cfg_path.write_text(json.dumps({}))
+    args = _make_args(server=None, token=None)
+
+    fake_result = {
+        "agent_token": "cond_agt_testkey",
+        "workspace_id": "ef0a7e36-0000-0000-0000-000000000001",
+    }
+
+    with (
+        patch.object(m, "CONFIG_PATH", cfg_path),
+        patch.object(m, "_web_login_flow", return_value=fake_result),
+        patch.object(m.api, "req", return_value=_fake_workspaces()),
+        patch("conduct_cli.guard.cmd_guard_sync", return_value=None),
+    ):
+        m.cmd_login(args)
+
+    out = capsys.readouterr().out
+    # Current workspace displayed by name (not just UUID)
+    assert "Engineering" in out
+    # Nudge appears because account has >1 workspace
+    assert "conduct switch" in out
+    # Other workspace names surfaced in the preview
+    assert "Marketing" in out or "Eng Backup" in out
+
+
+def test_login_omits_nudge_when_single_workspace(tmp_path, capsys):
+    from conduct_cli import main as m
+
+    cfg_path = tmp_path / "config.json"
+    cfg_path.write_text(json.dumps({}))
+    args = _make_args(server=None, token=None)
+
+    fake_result = {
+        "agent_token": "cond_agt_testkey",
+        "workspace_id": "ef0a7e36-0000-0000-0000-000000000001",
+    }
+    single_ws = [{"id": "ef0a7e36-0000-0000-0000-000000000001", "name": "Only", "owner_id": "u1", "workflow_count": 0}]
+
+    with (
+        patch.object(m, "CONFIG_PATH", cfg_path),
+        patch.object(m, "_web_login_flow", return_value=fake_result),
+        patch.object(m.api, "req", return_value=single_ws),
+        patch("conduct_cli.guard.cmd_guard_sync", return_value=None),
+    ):
+        m.cmd_login(args)
+
+    out = capsys.readouterr().out
+    assert "Only" in out
+    assert "conduct switch" not in out
+
+
+# ---------------------------------------------------------------------------
+# Fix A regression: cmd_switch must re-mint the agent token by calling
+# POST /auth/switch-workspace so server-side attribution follows the local
+# workspace flip. Without this, POSTs after switch keep hitting the
+# original workspace.
+# ---------------------------------------------------------------------------
+
+def test_switch_remints_agent_token_via_endpoint(tmp_path, monkeypatch, capsys):
+    from conduct_cli import main as m
+    from conduct_cli import guard as g
+
+    cfg_path = tmp_path / "conduct" / "config.json"
+    cfg_path.parent.mkdir(parents=True)
+    cfg_path.write_text(json.dumps({
+        "api_url":     "https://api.conductai.ai",
+        "agent_token": "cond_agt_ORIGINAL_engineering",
+        "workspace":   "ef0a7e36-0000-0000-0000-000000000001",
+    }))
+
+    args = _make_args(workspace="Marketing")
+    remint_response = {
+        "agent_token":   "cond_agt_NEW_marketing_scoped",
+        "refresh_token": "cond_ref_new_refresh",
+        "expires_in":    28800,
+        "workspace_id":  "ab1b2c3d-0000-0000-0000-000000000002",
+        "user_id":       "user_test",
+    }
+
+    def _api_req(method, url, hdrs, body=None, timeout=30):
+        if method == "GET" and url.endswith("/projects"):
+            return _fake_workspaces()
+        if method == "POST" and url.endswith("/auth/switch-workspace"):
+            assert body == {"workspace_id": "ab1b2c3d-0000-0000-0000-000000000002"}
+            return remint_response
+        raise AssertionError(f"unexpected call {method} {url}")
+
+    with (
+        patch.object(m, "CONFIG_PATH", cfg_path),
+        patch("pathlib.Path.home", return_value=tmp_path),
+        patch.object(m.api, "req", side_effect=_api_req),
+        patch.object(g, "_req", return_value={"version": "1", "rules": []}),
+        patch.object(g, "_save_policy"),
+    ):
+        m.cmd_switch(args)
+
+    updated_cfg = json.loads(cfg_path.read_text())
+    assert updated_cfg["agent_token"]  == "cond_agt_NEW_marketing_scoped"
+    assert updated_cfg["refresh_token"] == "cond_ref_new_refresh"
+    assert updated_cfg["workspace_id"] == "ab1b2c3d-0000-0000-0000-000000000002"
+    assert "token_expires_at" in updated_cfg
+
+
+def test_switch_falls_back_gracefully_when_remint_fails(tmp_path, monkeypatch, capsys):
+    """If the switch-workspace endpoint 401s (older server), config-only switch still applies."""
+    from conduct_cli import main as m
+    from conduct_cli import guard as g
+
+    cfg_path = tmp_path / "conduct" / "config.json"
+    cfg_path.parent.mkdir(parents=True)
+    cfg_path.write_text(json.dumps({
+        "api_url":     "https://api.conductai.ai",
+        "agent_token": "cond_agt_ORIGINAL",
+        "workspace":   "ef0a7e36-0000-0000-0000-000000000001",
+    }))
+    args = _make_args(workspace="Marketing")
+
+    def _api_req(method, url, hdrs, body=None, timeout=30):
+        if method == "GET" and url.endswith("/projects"):
+            return _fake_workspaces()
+        # Endpoint failure — mimic api.req's SystemExit on HTTP error
+        raise SystemExit(1)
+
+    with (
+        patch.object(m, "CONFIG_PATH", cfg_path),
+        patch("pathlib.Path.home", return_value=tmp_path),
+        patch.object(m.api, "req", side_effect=_api_req),
+        patch.object(g, "_req", return_value={"version": "1", "rules": []}),
+        patch.object(g, "_save_policy"),
+    ):
+        m.cmd_switch(args)
+
+    updated_cfg = json.loads(cfg_path.read_text())
+    # Token unchanged (fallback preserves the original) but workspace_id updated
+    assert updated_cfg["agent_token"] == "cond_agt_ORIGINAL"
+    assert updated_cfg["workspace_id"] == "ab1b2c3d-0000-0000-0000-000000000002"
+    out = capsys.readouterr().out
+    assert "falling back to config-only switch" in out