cortexdb-cli 0.5.4__py3-none-any.whl → 0.6.0__py3-none-any.whl

cortexdb_cli/__init__.py

@@ -1,3 +1,3 @@
-"""CortexDB CLI - command-line interface for the v1 memory API."""
-
-__version__ = "0.5.4"
+"""CortexDB CLI - command-line interface for the v1 memory API."""
+
+__version__ = "0.6.0"

cortexdb_cli/commands/__init__.py

@@ -1 +1 @@
-"""CortexDB CLI command modules."""
+"""CortexDB CLI command modules."""

cortexdb_cli/commands/auth.py

@@ -83,11 +83,29 @@ def auth_signup(ctx: click.Context, endpoint: str, save_state_flag: bool) -> Non
     show_default=True,
     help="Token lifetime in seconds (server enforces a tenant ceiling).",
 )
-@click.option("--scope", "scopes", multiple=True, help="`scopes` claim - repeat for multiple.")
+@click.option(
+    "--scope",
+    "scope",
+    default=None,
+    help="Scope path where YOUR auth.mint is checked (omit for a deployment-wide "
+    "check). Does not confine the minted token - use --confine.",
+)
+@click.option(
+    "--confine",
+    "confine",
+    multiple=True,
+    metavar="CAP:PREFIX",
+    help="Confine a capability (or capability prefix) to a scope subtree, e.g. "
+    "scope.read:org:acme/team:b/* - repeat for multiple. Sent as the `scopes` claim.",
+)
 @click.pass_context
 @handle_errors
 def auth_tokens(
-    ctx: click.Context, subject: str, ttl_seconds: int, scopes: tuple[str, ...]
+    ctx: click.Context,
+    subject: str,
+    ttl_seconds: int,
+    scope: str | None,
+    confine: tuple[str, ...],
 ) -> None:
     """POST /v1/auth/tokens - mint a service-account token.
 
@@ -95,12 +113,27 @@ def auth_tokens(
     have it - you must hold an IdP-issued token (or a token previously
     minted by an account that does).
 
-        cortexdb auth tokens --subject user:alice --ttl 3600 --scope org:acme/user:alice
+    --scope only says where your auth.mint is evaluated. The token is
+    confined only by --confine entries (CAP:PREFIX); the server rejects an
+    entry whose capability part names no capability.
+
+        cortexdb auth tokens --subject agent:b --confine scope.read:org:acme/team:b/*
     """
+    # Before --confine existed, --scope carried `scopes` entries. A value
+    # that starts with a capability (dots before the first ':') is one of
+    # those, not a scope path; point at the right flag instead of letting
+    # the server 422 on the scope grammar.
+    if scope is not None and "." in scope.split(":", 1)[0]:
+        raise click.UsageError(
+            f"--scope {scope!r} looks like a CAP:PREFIX confinement entry; "
+            "pass it with --confine"
+        )
     cfg = ctx.obj
     body: dict[str, object] = {"subject": subject, "ttl_seconds": ttl_seconds}
-    if scopes:
-        body["scopes"] = list(scopes)
+    if scope is not None:
+        body["scope"] = scope
+    if confine:
+        body["scopes"] = list(confine)
     with get_client(cfg) as client:
         if not is_json_mode(cfg):
             with spinner("Minting..."):

cortexdb_cli/commands/config_cmd.py

@@ -1,50 +1,50 @@
-"""cortexdb config -- View and edit configuration."""
-
-from __future__ import annotations
-
-import click
-
-from cortexdb_cli.config import config_path, load_config, save_config
-from cortexdb_cli.output import console, print_json, is_json_mode
-
-
-@click.group("config")
-def config_group() -> None:
-    """View and manage CLI configuration."""
-
-
-@config_group.command("show")
-@click.pass_context
-def config_show(ctx: click.Context) -> None:
-    """Show current configuration."""
-    cfg = load_config()
-    if is_json_mode(ctx.obj):
-        # Redact API key in JSON output
-        safe = dict(cfg)
-        if "api_key" in safe:
-            key = safe["api_key"]
-            safe["api_key"] = key[:8] + "..." + key[-4:] if len(key) > 12 else "***"
-        print_json(safe)
-    else:
-        console.print(f"[dim]Config file: {config_path()}[/dim]\n")
-        for k, v in cfg.items():
-            if k == "api_key" and v:
-                v = v[:8] + "..." + v[-4:] if len(v) > 12 else "***"
-            console.print(f"  [bold]{k}[/bold] = {v}")
-        console.print()
-
-
-@config_group.command("set")
-@click.argument("key")
-@click.argument("value")
-def config_set(key: str, value: str) -> None:
-    """Set a configuration value.
-
-        cortexdb config set api_key cx_live_...
-
-        cortexdb config set endpoint https://api-v1.cortexdb.ai
-    """
-    cfg = load_config()
-    cfg[key] = value
-    save_config("default", cfg)
-    console.print(f"[success]Set {key}[/success]")
+"""cortexdb config -- View and edit configuration."""
+
+from __future__ import annotations
+
+import click
+
+from cortexdb_cli.config import config_path, load_config, save_config
+from cortexdb_cli.output import console, print_json, is_json_mode
+
+
+@click.group("config")
+def config_group() -> None:
+    """View and manage CLI configuration."""
+
+
+@config_group.command("show")
+@click.pass_context
+def config_show(ctx: click.Context) -> None:
+    """Show current configuration."""
+    cfg = load_config()
+    if is_json_mode(ctx.obj):
+        # Redact API key in JSON output
+        safe = dict(cfg)
+        if "api_key" in safe:
+            key = safe["api_key"]
+            safe["api_key"] = key[:8] + "..." + key[-4:] if len(key) > 12 else "***"
+        print_json(safe)
+    else:
+        console.print(f"[dim]Config file: {config_path()}[/dim]\n")
+        for k, v in cfg.items():
+            if k == "api_key" and v:
+                v = v[:8] + "..." + v[-4:] if len(v) > 12 else "***"
+            console.print(f"  [bold]{k}[/bold] = {v}")
+        console.print()
+
+
+@config_group.command("set")
+@click.argument("key")
+@click.argument("value")
+def config_set(key: str, value: str) -> None:
+    """Set a configuration value.
+
+        cortexdb config set api_key cx_live_...
+
+        cortexdb config set endpoint https://api-v1.cortexdb.ai
+    """
+    cfg = load_config()
+    cfg[key] = value
+    save_config("default", cfg)
+    console.print(f"[success]Set {key}[/success]")

cortexdb_cli/errors.py

@@ -1,96 +1,96 @@
-"""Error handling for CortexDB CLI commands."""
-
-from __future__ import annotations
-
-import functools
-import sys
-from typing import Any, Callable
-
-import click
-import httpx
-
-from cortexdb_cli.output import err_console
-
-
-def escape_safe(s: Any) -> str:
-    """Rich-safe escape used in the error decorator (avoids circular imports)."""
-    from rich.markup import escape
-
-    return escape(str(s))
-
-
-def handle_errors(fn: Callable[..., Any]) -> Callable[..., Any]:
-    """Decorator that catches common errors and prints friendly messages."""
-
-    @functools.wraps(fn)
-    def wrapper(*args: Any, **kwargs: Any) -> Any:
-        try:
-            return fn(*args, **kwargs)
-        except httpx.HTTPStatusError as exc:
-            status = exc.response.status_code
-            body: dict[str, Any] = {}
-            try:
-                body = exc.response.json()
-            except Exception:
-                body = {}
-            code = body.get("error_code") or body.get("code") or ""
-            msg = body.get("message") or body.get("error") or exc.response.text[:200]
-
-            if status == 401:
-                if code in ("TOKEN_EXPIRED", "INVALID_TOKEN_SIGNATURE", "MISSING_TOKEN"):
-                    err_console.print(
-                        f"[error]Token rejected ({code}).[/error] "
-                        "Run [bold]cortexdb init[/bold] to mint a fresh one."
-                    )
-                elif code == "actor_mismatch":
-                    err_console.print(
-                        "[error]Actor mismatch.[/error] The X-Cortex-Actor header "
-                        "doesn't match the token's subject. Re-run "
-                        "[bold]cortexdb init[/bold] to re-bind."
-                    )
-                else:
-                    err_console.print(
-                        f"[error]Authentication failed:[/error] {msg}\n"
-                        "Run [bold]cortexdb init[/bold] to set up credentials."
-                    )
-            elif status == 403:
-                # The v1 surface always cites the missing capability.
-                details = body.get("details") or {}
-                cap = details.get("capability") or ""
-                tier = details.get("decided_by_tier") or ""
-                if cap:
-                    err_console.print(
-                        f"[error]Denied by {escape_safe(tier)}:[/error] "
-                        f"missing capability [bold]{escape_safe(cap)}[/bold]."
-                    )
-                    if cap == "diagnostics.read":
-                        err_console.print(
-                            "[dim]Hint: pass [bold]--diagnostics none[/bold] (free tier).[/dim]"
-                        )
-                else:
-                    err_console.print(f"[error]Forbidden:[/error] {msg}")
-            elif status == 429:
-                retry = exc.response.headers.get("Retry-After", "?")
-                err_console.print(f"[error]Rate limited.[/error] Retry after {retry}s.")
-            elif status == 402:
-                err_console.print(f"[warning]Feature not available on your tier.[/warning] {msg}")
-            else:
-                err_console.print(f"[error]API error (HTTP {status}, {code}):[/error] {msg}")
-            sys.exit(1)
-        except httpx.ConnectError:
-            err_console.print(
-                "[error]Cannot connect to CortexDB.[/error] "
-                "Check your endpoint and network."
-            )
-            sys.exit(2)
-        except httpx.TimeoutException:
-            err_console.print("[error]Request timed out.[/error]")
-            sys.exit(2)
-        except click.Abort:
-            err_console.print("\n[dim]Aborted.[/dim]")
-            sys.exit(130)
-        except KeyboardInterrupt:
-            err_console.print("\n[dim]Interrupted.[/dim]")
-            sys.exit(130)
-
-    return wrapper
+"""Error handling for CortexDB CLI commands."""
+
+from __future__ import annotations
+
+import functools
+import sys
+from typing import Any, Callable
+
+import click
+import httpx
+
+from cortexdb_cli.output import err_console
+
+
+def escape_safe(s: Any) -> str:
+    """Rich-safe escape used in the error decorator (avoids circular imports)."""
+    from rich.markup import escape
+
+    return escape(str(s))
+
+
+def handle_errors(fn: Callable[..., Any]) -> Callable[..., Any]:
+    """Decorator that catches common errors and prints friendly messages."""
+
+    @functools.wraps(fn)
+    def wrapper(*args: Any, **kwargs: Any) -> Any:
+        try:
+            return fn(*args, **kwargs)
+        except httpx.HTTPStatusError as exc:
+            status = exc.response.status_code
+            body: dict[str, Any] = {}
+            try:
+                body = exc.response.json()
+            except Exception:
+                body = {}
+            code = body.get("error_code") or body.get("code") or ""
+            msg = body.get("message") or body.get("error") or exc.response.text[:200]
+
+            if status == 401:
+                if code in ("TOKEN_EXPIRED", "INVALID_TOKEN_SIGNATURE", "MISSING_TOKEN"):
+                    err_console.print(
+                        f"[error]Token rejected ({code}).[/error] "
+                        "Run [bold]cortexdb init[/bold] to mint a fresh one."
+                    )
+                elif code == "actor_mismatch":
+                    err_console.print(
+                        "[error]Actor mismatch.[/error] The X-Cortex-Actor header "
+                        "doesn't match the token's subject. Re-run "
+                        "[bold]cortexdb init[/bold] to re-bind."
+                    )
+                else:
+                    err_console.print(
+                        f"[error]Authentication failed:[/error] {msg}\n"
+                        "Run [bold]cortexdb init[/bold] to set up credentials."
+                    )
+            elif status == 403:
+                # The v1 surface always cites the missing capability.
+                details = body.get("details") or {}
+                cap = details.get("capability") or ""
+                tier = details.get("decided_by_tier") or ""
+                if cap:
+                    err_console.print(
+                        f"[error]Denied by {escape_safe(tier)}:[/error] "
+                        f"missing capability [bold]{escape_safe(cap)}[/bold]."
+                    )
+                    if cap == "diagnostics.read":
+                        err_console.print(
+                            "[dim]Hint: pass [bold]--diagnostics none[/bold] (free tier).[/dim]"
+                        )
+                else:
+                    err_console.print(f"[error]Forbidden:[/error] {msg}")
+            elif status == 429:
+                retry = exc.response.headers.get("Retry-After", "?")
+                err_console.print(f"[error]Rate limited.[/error] Retry after {retry}s.")
+            elif status == 402:
+                err_console.print(f"[warning]Feature not available on your tier.[/warning] {msg}")
+            else:
+                err_console.print(f"[error]API error (HTTP {status}, {code}):[/error] {msg}")
+            sys.exit(1)
+        except httpx.ConnectError:
+            err_console.print(
+                "[error]Cannot connect to CortexDB.[/error] "
+                "Check your endpoint and network."
+            )
+            sys.exit(2)
+        except httpx.TimeoutException:
+            err_console.print("[error]Request timed out.[/error]")
+            sys.exit(2)
+        except click.Abort:
+            err_console.print("\n[dim]Aborted.[/dim]")
+            sys.exit(130)
+        except KeyboardInterrupt:
+            err_console.print("\n[dim]Interrupted.[/dim]")
+            sys.exit(130)
+
+    return wrapper

{cortexdb_cli-0.5.4.dist-info → cortexdb_cli-0.6.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cortexdb-cli
-Version: 0.5.4
+Version: 0.6.0
 Summary: Command-line interface for CortexDB — the long-term memory layer for AI.
 Project-URL: Homepage, https://cortexdb.ai
 Project-URL: Documentation, https://cortexdb.ai/docs

{cortexdb_cli-0.5.4.dist-info → cortexdb_cli-0.6.0.dist-info}/RECORD

@@ -1,22 +1,22 @@
-cortexdb_cli/__init__.py,sha256=R-3t2jLxSGdc1xNb9pu6tbckqSCXYYrp2zCV8lOqSsE,93
+cortexdb_cli/__init__.py,sha256=T_HhRfBox9rKO8_8r9aytlz_MMBHnWF-LimTRVTQFss,90
 cortexdb_cli/client.py,sha256=Abgv8CLbhNYKG0QqHjsdGFXWZuVhke4Zuc4TAOuGjG4,3086
 cortexdb_cli/config.py,sha256=ee1qmOfqMwilL81ujaqjf6TjjlrFG7WZAHRIgeyif9U,5690
-cortexdb_cli/errors.py,sha256=xwxAWYY7KtNa-e7dyLQECnsKcciVcKC41CXFFF_-0VU,3924
+cortexdb_cli/errors.py,sha256=yk6J6Gm-lBVsIPVl10ezECqG0Wds3vDOCUqKx7ct7z4,3828
 cortexdb_cli/harness_packs_data.py,sha256=38oyPX47a_S3BRgiNxml37auhIUyWafeJ_MtApX9tWE,10693
 cortexdb_cli/main.py,sha256=xnsAgPQMvZOuRxgxREsEN1QM8wE9DSUN2Cd0kxSAU3A,10014
 cortexdb_cli/onboarding.py,sha256=kjCxhMOY2nReNyEfGGGsmHO6_j4CXS5o2LIwzpFzIok,17527
 cortexdb_cli/output.py,sha256=9NvXhX3ncCIgP9BMzt7c9VReQc0O1FUbQTwj2vUQ2JI,13611
 cortexdb_cli/state.py,sha256=pfslyJ9xuZno4n13-maJ0qKmD7nxWkFznjrVvItYK4I,1527
-cortexdb_cli/commands/__init__.py,sha256=TeF4ieMQkbgBr9Fco9VAiIZvKQ4vdg4yhkz4fvwfToc,37
+cortexdb_cli/commands/__init__.py,sha256=Uqz-6IAeIxrSS94FHI6Q0iqDf_2MQeHKY0LaHgEC4HU,36
 cortexdb_cli/commands/admin.py,sha256=KzCiRSLeDkVHGa_V1AYwk4--KVkC2GI9giZc0LDN8pY,21633
 cortexdb_cli/commands/answer.py,sha256=41Yl9pjfODyRnWzYL68nRA7GPDb73Cccj0Kq-8sLv9k,3343
 cortexdb_cli/commands/audit.py,sha256=br9ksMeR4dHBkfvNvGG4mjYdhh7E1IRxJ1FOX1klckQ,2620
-cortexdb_cli/commands/auth.py,sha256=6YoKl5mZcyep2FRMrnXRv_EKvblC6H2vKfVOBzDXgpo,4505
+cortexdb_cli/commands/auth.py,sha256=SE9nUfE6C9ix8IgBi4efDI_o1GfE_ezSk40LzzOZKAE,5655
 cortexdb_cli/commands/beliefs.py,sha256=akjOg2drLqQKlrGVL-Z6oLdP6TY-4YHe3yg9lJpQPH4,6180
 cortexdb_cli/commands/claims.py,sha256=NApq0i8NXX0j7uwnHdHtendnblMBnHh0OXlwQwB-tCQ,3720
 cortexdb_cli/commands/code.py,sha256=QMlE9RwNFEQsRqQrUvqlKA2c0v7sKLU2vcyQiW1uZ10,10719
 cortexdb_cli/commands/compose.py,sha256=i9fEugN818mt1t8nWsAxvv9h0nNLvBAf-WZZIl64xiw,3853
-cortexdb_cli/commands/config_cmd.py,sha256=MCb5XoulnGLkeOzYY54R_hFnTxGWAboLARSe8zAEhXA,1522
+cortexdb_cli/commands/config_cmd.py,sha256=i-LICYVUrFVqFICeS-ddwI-aX7pxzxdxL2I8hc3tW3A,1472
 cortexdb_cli/commands/conflicts.py,sha256=s4sp3BtPzPEy3T73inx68vhmucvjh-zQRnWYsJ_ADQQ,10506
 cortexdb_cli/commands/entities.py,sha256=aPnyVnK6LlKkc7t_aEuplqnX5K4DH6jToWTVCAG_GM8,6055
 cortexdb_cli/commands/episodes.py,sha256=bMnGOT4Kzz6b5o3JVhcCEsOmEzqoVrxUFPhKCn70TC8,4131
@@ -34,7 +34,7 @@ cortexdb_cli/commands/scopes.py,sha256=Cx_zV-zyIrnDxwp_I4AX_Teh7UFu4EdvDOYe9hTEF
 cortexdb_cli/commands/search.py,sha256=4wsgNU47deb0x5o7xC9eWlhwdIIbz56q7ne8GIiCmYo,1953
 cortexdb_cli/commands/understanding.py,sha256=BktqOn-GloOzSSGJGK9xh5kGCpxcrwkNogtXhjj4pBI,5371
 cortexdb_cli/commands/wire.py,sha256=M3UUHScmvr_MDrX_RaMBg-YLTcHKUq9woNkT4KHJKfs,8131
-cortexdb_cli-0.5.4.dist-info/METADATA,sha256=wNeADaguuwEJjnQgsLpwnOnMKaWGSZMfnKfgXARS2JU,5234
-cortexdb_cli-0.5.4.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-cortexdb_cli-0.5.4.dist-info/entry_points.txt,sha256=h3sEbdqqvtv8LBbRLUgybYPo9N2lpU85fQUSh5ToEvs,51
-cortexdb_cli-0.5.4.dist-info/RECORD,,
+cortexdb_cli-0.6.0.dist-info/METADATA,sha256=2-OQEQC65mQW-q4Y9hbYpMvbF0rkExxH-qAAj3UOb6M,5234
+cortexdb_cli-0.6.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+cortexdb_cli-0.6.0.dist-info/entry_points.txt,sha256=h3sEbdqqvtv8LBbRLUgybYPo9N2lpU85fQUSh5ToEvs,51
+cortexdb_cli-0.6.0.dist-info/RECORD,,

{cortexdb_cli-0.5.4.dist-info → cortexdb_cli-0.6.0.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.32.0
+Generator: hatchling 1.32.4
 Root-Is-Purelib: true
 Tag: py3-none-any