conduct-cli 0.9.7__tar.gz → 0.9.9__tar.gz

{conduct_cli-0.9.7 → conduct_cli-0.9.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.9.7
+Version: 0.9.9
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.9.7 → conduct_cli-0.9.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.9.7"
+version = "0.9.9"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.9.7 → conduct_cli-0.9.9}/src/conduct_cli/main.py

@@ -552,6 +552,10 @@ def cmd_login(args):
     api_url = (getattr(args, "server", None) or _load_config().get("api_url", _DEFAULT_API_URL)).rstrip("/")
     web_url = _DEFAULT_WEB_URL
 
+    # Capture the workspace the user was on BEFORE login — so we can restore
+    # it after the login flow (which always returns the account's default).
+    prior_ws = _load_config().get("workspace_id") or _load_config().get("workspace") or ""
+
     # --token escape hatch: paste agent_token directly (no browser)
     manual_token = getattr(args, "token", None)
     if manual_token:
@@ -576,6 +580,28 @@ def cmd_login(args):
     cfg.pop("api_key", None)
     _atomic_write(CONFIG_PATH, cfg)
 
+    # Restore prior workspace if login returned a different default. Otherwise
+    # every `conduct login` silently blows away the last `conduct switch`.
+    if prior_ws and str(prior_ws) != str(result["workspace_id"]):
+        try:
+            _hdrs_restore = {"Authorization": f"Bearer {result['agent_token']}", "Content-Type": "application/json"}
+            _r = api.req("POST", f"{api_url}/auth/switch-workspace", _hdrs_restore, {"workspace_id": prior_ws})
+            if _r and _r.get("agent_token"):
+                cfg["agent_token"] = _r["agent_token"]
+                if _r.get("refresh_token"):
+                    cfg["refresh_token"] = _r["refresh_token"]
+                cfg["workspace"]    = prior_ws
+                cfg["workspace_id"] = prior_ws
+                cfg["token_expires_at"] = (_dt.datetime.now(_dt.timezone.utc) + _dt.timedelta(seconds=int(_r.get("expires_in", 28800)))).isoformat()
+                _atomic_write(CONFIG_PATH, cfg)
+                # Update `result` so subsequent code (name display, sync) targets prior workspace
+                result["workspace_id"] = prior_ws
+                result["agent_token"] = cfg["agent_token"]
+        except SystemExit:
+            pass  # not a member of prior workspace anymore, or endpoint missing — keep server default
+        except Exception:
+            pass
+
     # Fetch workspaces so we can display the current one by name and nudge
     # the user if their account has more than one (cross-surface switch drift).
     try:
@@ -1438,10 +1464,33 @@ def cmd_switch(args):
     new_id   = str(chosen["id"])
     new_name = chosen["name"]
 
+    # Re-mint agent token bound to the new workspace so server-side attribution
+    # follows the switch. Without this, POSTs (discover, audit, heartbeats)
+    # keep hitting the workspace the token was originally minted for.
+    try:
+        _r = api.req("POST", f"{server}/auth/switch-workspace", hdrs, {"workspace_id": new_id})
+        if _r and _r.get("agent_token"):
+            cfg["agent_token"]      = _r["agent_token"]
+            if _r.get("refresh_token"):
+                cfg["refresh_token"] = _r["refresh_token"]
+            import datetime as _dt
+            cfg["token_expires_at"] = (_dt.datetime.now(_dt.timezone.utc) + _dt.timedelta(seconds=int(_r.get("expires_in", 28800)))).isoformat()
+    except SystemExit:
+        print(f"  {YELLOW}⚠ Could not re-mint token for new workspace — falling back to config-only switch{RESET}")
+    except Exception as e:
+        print(f"  {YELLOW}⚠ Token re-mint failed ({e}) — falling back to config-only switch{RESET}")
+
     # Update ~/.conduct/config.json atomically
     cfg["workspace"] = new_id; cfg["workspace_id"] = new_id
     _atomic_write(CONFIG_PATH, cfg)
 
+    # Fire coverage POST so the new workspace's "developer connected" widget
+    # populates immediately. Without this the switch works but the widget
+    # stays empty until the next `conduct login`.
+    try:
+        _report_tool_coverage()
+    except Exception:
+        pass
 
     # Re-sync Guard policies for the new workspace
     try:

{conduct_cli-0.9.7 → conduct_cli-0.9.9}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.9.7
+Version: 0.9.9
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.9.7 → conduct_cli-0.9.9}/tests/test_switch.py

@@ -288,3 +288,185 @@ def test_login_omits_nudge_when_single_workspace(tmp_path, capsys):
     out = capsys.readouterr().out
     assert "Only" in out
     assert "conduct switch" not in out
+
+
+# ---------------------------------------------------------------------------
+# Fix A regression: cmd_switch must re-mint the agent token by calling
+# POST /auth/switch-workspace so server-side attribution follows the local
+# workspace flip. Without this, POSTs after switch keep hitting the
+# original workspace.
+# ---------------------------------------------------------------------------
+
+def test_switch_remints_agent_token_via_endpoint(tmp_path, monkeypatch, capsys):
+    from conduct_cli import main as m
+    from conduct_cli import guard as g
+
+    cfg_path = tmp_path / "conduct" / "config.json"
+    cfg_path.parent.mkdir(parents=True)
+    cfg_path.write_text(json.dumps({
+        "api_url":     "https://api.conductai.ai",
+        "agent_token": "cond_agt_ORIGINAL_engineering",
+        "workspace":   "ef0a7e36-0000-0000-0000-000000000001",
+    }))
+
+    args = _make_args(workspace="Marketing")
+    remint_response = {
+        "agent_token":   "cond_agt_NEW_marketing_scoped",
+        "refresh_token": "cond_ref_new_refresh",
+        "expires_in":    28800,
+        "workspace_id":  "ab1b2c3d-0000-0000-0000-000000000002",
+        "user_id":       "user_test",
+    }
+
+    def _api_req(method, url, hdrs, body=None, timeout=30):
+        if method == "GET" and url.endswith("/projects"):
+            return _fake_workspaces()
+        if method == "POST" and url.endswith("/auth/switch-workspace"):
+            assert body == {"workspace_id": "ab1b2c3d-0000-0000-0000-000000000002"}
+            return remint_response
+        raise AssertionError(f"unexpected call {method} {url}")
+
+    with (
+        patch.object(m, "CONFIG_PATH", cfg_path),
+        patch("pathlib.Path.home", return_value=tmp_path),
+        patch.object(m.api, "req", side_effect=_api_req),
+        patch.object(g, "_req", return_value={"version": "1", "rules": []}),
+        patch.object(g, "_save_policy"),
+    ):
+        m.cmd_switch(args)
+
+    updated_cfg = json.loads(cfg_path.read_text())
+    assert updated_cfg["agent_token"]  == "cond_agt_NEW_marketing_scoped"
+    assert updated_cfg["refresh_token"] == "cond_ref_new_refresh"
+    assert updated_cfg["workspace_id"] == "ab1b2c3d-0000-0000-0000-000000000002"
+    assert "token_expires_at" in updated_cfg
+
+
+def test_switch_falls_back_gracefully_when_remint_fails(tmp_path, monkeypatch, capsys):
+    """If the switch-workspace endpoint 401s (older server), config-only switch still applies."""
+    from conduct_cli import main as m
+    from conduct_cli import guard as g
+
+    cfg_path = tmp_path / "conduct" / "config.json"
+    cfg_path.parent.mkdir(parents=True)
+    cfg_path.write_text(json.dumps({
+        "api_url":     "https://api.conductai.ai",
+        "agent_token": "cond_agt_ORIGINAL",
+        "workspace":   "ef0a7e36-0000-0000-0000-000000000001",
+    }))
+    args = _make_args(workspace="Marketing")
+
+    def _api_req(method, url, hdrs, body=None, timeout=30):
+        if method == "GET" and url.endswith("/projects"):
+            return _fake_workspaces()
+        # Endpoint failure — mimic api.req's SystemExit on HTTP error
+        raise SystemExit(1)
+
+    with (
+        patch.object(m, "CONFIG_PATH", cfg_path),
+        patch("pathlib.Path.home", return_value=tmp_path),
+        patch.object(m.api, "req", side_effect=_api_req),
+        patch.object(g, "_req", return_value={"version": "1", "rules": []}),
+        patch.object(g, "_save_policy"),
+    ):
+        m.cmd_switch(args)
+
+    updated_cfg = json.loads(cfg_path.read_text())
+    # Token unchanged (fallback preserves the original) but workspace_id updated
+    assert updated_cfg["agent_token"] == "cond_agt_ORIGINAL"
+    assert updated_cfg["workspace_id"] == "ab1b2c3d-0000-0000-0000-000000000002"
+    out = capsys.readouterr().out
+    assert "falling back to config-only switch" in out
+
+
+# ---------------------------------------------------------------------------
+# 0.9.9 — cmd_switch must fire _report_tool_coverage so the new workspace's
+# "developer connected" widget populates immediately (not just after next login)
+# ---------------------------------------------------------------------------
+
+def test_switch_fires_tool_coverage(tmp_path, monkeypatch, capsys):
+    from conduct_cli import main as m
+    from conduct_cli import guard as g
+
+    cfg_path = tmp_path / "conduct" / "config.json"
+    cfg_path.parent.mkdir(parents=True)
+    cfg_path.write_text(json.dumps({
+        "api_url":     "https://api.conductai.ai",
+        "agent_token": "cond_agt_test",
+        "workspace":   "ef0a7e36-0000-0000-0000-000000000001",
+    }))
+    args = _make_args(workspace="Marketing")
+
+    def _api_req(method, url, hdrs, body=None, timeout=30):
+        if method == "GET" and url.endswith("/projects"):
+            return _fake_workspaces()
+        if method == "POST" and url.endswith("/auth/switch-workspace"):
+            return {"agent_token": "cond_agt_new", "expires_in": 28800, "workspace_id": body["workspace_id"], "user_id": "u1"}
+        raise AssertionError(f"unexpected call {method} {url}")
+
+    with (
+        patch.object(m, "CONFIG_PATH", cfg_path),
+        patch("pathlib.Path.home", return_value=tmp_path),
+        patch.object(m.api, "req", side_effect=_api_req),
+        patch.object(g, "_req", return_value={"version": "1", "rules": []}),
+        patch.object(g, "_save_policy"),
+        patch.object(m, "_report_tool_coverage") as coverage,
+    ):
+        m.cmd_switch(args)
+
+    coverage.assert_called_once()
+
+
+# ---------------------------------------------------------------------------
+# 0.9.9 — cmd_login must preserve the prior workspace_id if it differs from
+# the server-returned default. Otherwise every re-login blows away the user's
+# last `conduct switch`.
+# ---------------------------------------------------------------------------
+
+def test_login_preserves_prior_workspace(tmp_path, capsys):
+    from conduct_cli import main as m
+
+    cfg_path = tmp_path / "config.json"
+    # Prior state: user was on Marketing (via a previous switch)
+    cfg_path.write_text(json.dumps({
+        "api_url":     "https://api.conductai.ai",
+        "agent_token": "cond_agt_old",
+        "workspace":   "ab1b2c3d-0000-0000-0000-000000000002",
+        "workspace_id": "ab1b2c3d-0000-0000-0000-000000000002",
+    }))
+    args = _make_args(server=None, token=None)
+
+    # Login returns Engineering (server default) — but prior was Marketing
+    fake_login_result = {
+        "agent_token": "cond_agt_from_login_engineering",
+        "workspace_id": "ef0a7e36-0000-0000-0000-000000000001",
+    }
+    remint_response = {
+        "agent_token": "cond_agt_reminted_for_marketing",
+        "refresh_token": "cond_ref_reminted",
+        "expires_in": 28800,
+        "workspace_id": "ab1b2c3d-0000-0000-0000-000000000002",
+        "user_id": "u1",
+    }
+
+    def _api_req(method, url, hdrs, body=None, timeout=30):
+        if method == "POST" and url.endswith("/auth/switch-workspace"):
+            # Should be called with prior_ws (Marketing UUID)
+            assert body == {"workspace_id": "ab1b2c3d-0000-0000-0000-000000000002"}
+            return remint_response
+        if method == "GET" and url.endswith("/projects"):
+            return _fake_workspaces()
+        raise AssertionError(f"unexpected call {method} {url}")
+
+    with (
+        patch.object(m, "CONFIG_PATH", cfg_path),
+        patch.object(m, "_web_login_flow", return_value=fake_login_result),
+        patch.object(m.api, "req", side_effect=_api_req),
+        patch("conduct_cli.guard.cmd_guard_sync", return_value=None),
+    ):
+        m.cmd_login(args)
+
+    updated_cfg = json.loads(cfg_path.read_text())
+    assert updated_cfg["workspace_id"] == "ab1b2c3d-0000-0000-0000-000000000002"
+    assert updated_cfg["agent_token"] == "cond_agt_reminted_for_marketing"
+    assert updated_cfg["refresh_token"] == "cond_ref_reminted"