crowdtime-cli 0.17.1__tar.gz → 0.19.0__tar.gz

{crowdtime_cli-0.17.1 → crowdtime_cli-0.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crowdtime-cli
-Version: 0.17.1
+Version: 0.19.0
 Summary: AI-powered time tracking CLI — a modern, developer-friendly alternative to Harvest
 Project-URL: Homepage, https://crowdtime.lat
 Project-URL: Documentation, https://crowdtime.lat/docs
@@ -56,10 +56,19 @@ Track time, manage projects, log expenses, generate reports, submit timesheets,
 ## Installation
 
 ```bash
-pip install crowdtime-cli
+pipx install crowdtime-cli
 ```
 
-Requires Python 3.11+
+Requires Python 3.11+. [pipx](https://pipx.pypa.io/) installs the CLI in its own isolated environment and puts `crowdtime` and `ct` on your PATH. On Debian, Ubuntu and other systems where the system Python is "externally managed", plain `pip install` into the system Python is blocked, so use pipx (or `uv tool install crowdtime-cli`).
+
+Prefer pip? Install into a virtualenv:
+
+```bash
+python3 -m venv ~/.venvs/crowdtime
+~/.venvs/crowdtime/bin/pip install crowdtime-cli
+```
+
+To upgrade later: `pipx upgrade crowdtime-cli` (or `pip install -U crowdtime-cli` in the virtualenv).
 
 ## Quick Start
 

{crowdtime_cli-0.17.1 → crowdtime_cli-0.19.0}/README.md

@@ -21,10 +21,19 @@ Track time, manage projects, log expenses, generate reports, submit timesheets,
 ## Installation
 
 ```bash
-pip install crowdtime-cli
+pipx install crowdtime-cli
 ```
 
-Requires Python 3.11+
+Requires Python 3.11+. [pipx](https://pipx.pypa.io/) installs the CLI in its own isolated environment and puts `crowdtime` and `ct` on your PATH. On Debian, Ubuntu and other systems where the system Python is "externally managed", plain `pip install` into the system Python is blocked, so use pipx (or `uv tool install crowdtime-cli`).
+
+Prefer pip? Install into a virtualenv:
+
+```bash
+python3 -m venv ~/.venvs/crowdtime
+~/.venvs/crowdtime/bin/pip install crowdtime-cli
+```
+
+To upgrade later: `pipx upgrade crowdtime-cli` (or `pip install -U crowdtime-cli` in the virtualenv).
 
 ## Quick Start
 

{crowdtime_cli-0.17.1 → crowdtime_cli-0.19.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "crowdtime-cli"
-version = "0.17.1"
+version = "0.19.0"
 description = "AI-powered time tracking CLI — a modern, developer-friendly alternative to Harvest"
 readme = "README.md"
 license = {text = "Proprietary"}

{crowdtime_cli-0.17.1 → crowdtime_cli-0.19.0}/src/crowdtime_cli/__init__.py

@@ -1,3 +1,3 @@
 """CrowdTime CLI - AI-powered time tracking from the command line."""
 
-__version__ = "0.17.1"
+__version__ = "0.19.0"

{crowdtime_cli-0.17.1 → crowdtime_cli-0.19.0}/src/crowdtime_cli/auth.py

@@ -5,6 +5,8 @@ Stores API tokens in the system keyring, with file-based fallback.
 
 from __future__ import annotations
 
+import os
+import sys
 from pathlib import Path
 
 from .config import CONFIG_DIR
@@ -51,8 +53,23 @@ def clear_token() -> None:
 def _save_token_file(token: str) -> None:
     """File-based fallback for token storage."""
     CONFIG_DIR.mkdir(parents=True, exist_ok=True)
-    CREDENTIALS_FILE.write_text(token)
-    CREDENTIALS_FILE.chmod(0o600)
+    # Created owner-only from the start — writing first and tightening the
+    # mode afterwards leaves the token world-readable in between.
+    fd = os.open(CREDENTIALS_FILE, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    try:
+        # The mode above only applies to a new file; an existing one keeps
+        # whatever it had, so tighten it before the token goes in.
+        if hasattr(os, "fchmod"):
+            os.fchmod(fd, 0o600)
+    except OSError:
+        pass
+    with os.fdopen(fd, "w") as f:
+        f.write(token)
+    print(
+        "Warning: no system keyring available — the API token was stored in "
+        f"plain text at {CREDENTIALS_FILE} (readable only by you).",
+        file=sys.stderr,
+    )
 
 
 def _get_token_file() -> str | None:

{crowdtime_cli-0.17.1 → crowdtime_cli-0.19.0}/src/crowdtime_cli/client.py

@@ -7,16 +7,39 @@ and friendly error handling.
 from __future__ import annotations
 
 import os
+import sys
 from typing import Any
 
 import httpx
 from rich.console import Console
+from rich.markup import escape
 
 from .auth import get_token
-from .config import get_config
+from .config import INSECURE_SERVER_URL_WARNING, get_config, is_insecure_server_url
 
 console = Console(stderr=True)
 _DEBUG = os.environ.get("CROWDTIME_DEBUG", "").lower() in ("1", "true", "yes")
+# One warning per invocation, however many clients a command creates.
+_warned_insecure_url = False
+
+
+def _error_message(detail: Any) -> str:
+    """Turn an API error body into one readable line.
+
+    Validation errors arrive as ``{"field": ["message", ...]}``; printing the
+    dict verbatim buries the reason the server gave.
+    """
+    if isinstance(detail, dict):
+        if isinstance(detail.get("detail"), str):
+            return detail["detail"]
+        parts = []
+        for field, value in detail.items():
+            text = "; ".join(str(v) for v in value) if isinstance(value, (list, tuple)) else str(value)
+            parts.append(text if field in ("non_field_errors", "detail") else f"{field}: {text}")
+        return " | ".join(parts) if parts else str(detail)
+    if isinstance(detail, list):
+        return "; ".join(str(item) for item in detail)
+    return str(detail)
 
 
 class APIError(Exception):
@@ -37,6 +60,14 @@ class CrowdTimeClient:
         self.base_url = self.config.server_url
         self.token = get_token()
         self.org_slug = self.config.organization
+        # Extra line a command can set before a call, shown if the server
+        # answers 403 — for pointing at the command that would work instead.
+        self.forbidden_hint: str | None = None
+
+        global _warned_insecure_url
+        if not _warned_insecure_url and is_insecure_server_url(self.base_url):
+            _warned_insecure_url = True
+            print(INSECURE_SERVER_URL_WARNING.format(url=self.base_url), file=sys.stderr)
 
         if require_auth and not self.token:
             console.print(
@@ -102,6 +133,25 @@ class CrowdTimeClient:
         response = self._request("DELETE", url)
         return response
 
+    def current_user_id(self) -> str | None:
+        """The authenticated user's id, cached in the config after the first lookup.
+
+        ``ct auth login`` refreshes the cache and ``ct auth logout`` clears it,
+        so the cached id always belongs to the stored token.
+        """
+        cached = self.config.get("user.id")
+        if cached:
+            return str(cached)
+        try:
+            me = self.get("/auth/me/", org_scoped=False)
+        except APIError:
+            return None
+        user_id = me.get("id") if isinstance(me, dict) else None
+        if not user_id:
+            return None
+        self.config.set("user.id", str(user_id))
+        return str(user_id)
+
     def _request(self, method: str, url: str, **kwargs: Any) -> Any:
         """Execute an HTTP request with error handling."""
         if _DEBUG:
@@ -138,7 +188,20 @@ class CrowdTimeClient:
             raise SystemExit(1)
 
         if response.status_code == 403:
-            console.print("[red]Permission denied.[/red] You don't have access to this resource.")
+            # The server says why (not your entry, already invoiced, no
+            # approval authority, read-only token…) — pass that on instead of
+            # a generic refusal.
+            reason = "You don't have access to this resource."
+            try:
+                body = response.json()
+                if isinstance(body, dict) and isinstance(body.get("detail"), str) and body["detail"]:
+                    reason = body["detail"]
+            except Exception:
+                pass
+            console.print(f"[red]Permission denied.[/red] {escape(reason)}")
+            hint = getattr(self, "forbidden_hint", None)
+            if hint:
+                console.print(f"[dim]{escape(hint)}[/dim]")
             raise SystemExit(1)
 
         if response.status_code == 402:
@@ -179,8 +242,7 @@ class CrowdTimeClient:
                 detail = response.json()
             except Exception:
                 detail = response.text
-            msg = detail.get("detail", str(detail)) if isinstance(detail, dict) else str(detail)
-            raise APIError(msg, status_code=response.status_code, detail=detail)
+            raise APIError(_error_message(detail), status_code=response.status_code, detail=detail)
 
         if not response.content:
             return None

{crowdtime_cli-0.17.1 → crowdtime_cli-0.19.0}/src/crowdtime_cli/commands/auth_cmd.py

@@ -59,6 +59,7 @@ def _login_with_token(token: str, output_json: bool) -> None:
         client = CrowdTimeClient(require_auth=True, require_org=False)
         data = client.get("/api/v1/auth/me/", org_scoped=False)
         user = User(**data)
+        get_config().set("user.id", user.id)  # read back by current_user_id()
 
         if output_json:
             print_json(user)
@@ -81,7 +82,14 @@ def _login_with_browser(output_json: bool) -> None:
     console.print(f"[dim]Server: {server_url}[/dim]")
     console.print(f"[dim]Waiting for authentication (up to 2 minutes)...[/dim]\n")
 
-    result = run_oauth_flow(server_url)
+    def _show_code(code: str) -> None:
+        console.print(f"Verification code: [bold]{code}[/bold]")
+        console.print(
+            "[dim]The browser will ask you to authorize this login. "
+            "Only approve it if it shows the same code.[/dim]\n"
+        )
+
+    result = run_oauth_flow(server_url, on_verification_code=_show_code)
 
     if result is None:
         console.print()
@@ -111,6 +119,7 @@ def _login_with_browser(output_json: bool) -> None:
         client = CrowdTimeClient(require_auth=True, require_org=False)
         data = client.get("/api/v1/auth/me/", org_scoped=False)
         user = User(**data)
+        config.set("user.id", user.id)  # read back by current_user_id()
 
         if output_json:
             print_json(user)
@@ -133,6 +142,7 @@ def logout() -> None:
         return
 
     clear_token()
+    get_config().set("user.id", "")
     format_success("Logged out. Token removed.")
 
 

{crowdtime_cli-0.17.1 → crowdtime_cli-0.19.0}/src/crowdtime_cli/commands/clients_cmd.py

@@ -84,7 +84,9 @@ def list_clients(
             for c in clients_list:
                 client_id = str(c.get("id", ""))
                 name = c.get("name", "")
-                contact = c.get("contact_name", "") or "-"
+                # The primary contact record; contact_name is a legacy field (CRO-83).
+                primary = c.get("primary_contact") or {}
+                contact = primary.get("name") or c.get("contact_name", "") or "-"
                 project_count = str(c.get("project_count", 0))
                 is_archived = c.get("is_archived", False)
                 status = "[red]Archived[/red]" if is_archived else "[green]Active[/green]"
@@ -117,11 +119,30 @@ def show(
             console.print(f"\n[bold]{data.get('name')}[/bold]")
             console.print(f"  ID:       {data.get('id')}")
             console.print(f"  Currency: {data.get('currency', '-')}")
-            console.print(f"  Contact:  {data.get('contact_name', '-')}")
-            if data.get("contact_email"):
-                console.print(f"  Email:    {data['contact_email']}")
-            if data.get("contact_phone"):
-                console.print(f"  Phone:    {data['contact_phone']}")
+            contacts = data.get("contacts") or []
+            if contacts:
+                for contact in contacts:
+                    line = f"  Contact:  {contact.get('name', '')}"
+                    if contact.get("email"):
+                        line += f" <{contact['email']}>"
+                    if contact.get("phone"):
+                        line += f" {contact['phone']}"
+                    if contact.get("role"):
+                        line += f" — {contact['role']}"
+                    flags = [
+                        label for key, label in (("is_primary", "primary"), ("receives_invoices", "invoices"))
+                        if contact.get(key)
+                    ]
+                    if flags:
+                        line += f" [dim]({', '.join(flags)})[/dim]"
+                    console.print(line)
+            else:
+                # Legacy contact fields, only on clients that never got a contact record.
+                console.print(f"  Contact:  {data.get('contact_name') or '-'}")
+                if data.get("contact_email"):
+                    console.print(f"  Email:    {data['contact_email']}")
+                if data.get("contact_phone"):
+                    console.print(f"  Phone:    {data['contact_phone']}")
             if data.get("address"):
                 console.print(f"  Address:  {data['address']}")
             status = "Archived" if data.get("is_archived") else "Active"
@@ -149,7 +170,7 @@ def create(
     country: Optional[str] = typer.Option(None, "--country", help="Country."),
     output_json: bool = typer.Option(False, "--json", help="Output as JSON."),
 ) -> None:
-    """Create a new client.
+    """Create a new client. --contact/--email add its primary contact.
 
     Examples:
         ct clients create "Acme Corp"
@@ -157,13 +178,13 @@ def create(
     """
     api_client = CrowdTimeClient(require_auth=True, require_org=True)
 
+    if contact_email and not contact_name:
+        format_error("--email needs --contact (the contact's name).")
+        raise typer.Exit(1)
+
     payload: dict = {"name": name}
     if currency:
         payload["currency"] = currency
-    if contact_name:
-        payload["contact_name"] = contact_name
-    if contact_email:
-        payload["contact_email"] = contact_email
     if address_line1:
         payload["address_line1"] = address_line1
     if address_line2:
@@ -180,10 +201,22 @@ def create(
     try:
         data = api_client.post("/clients/", data=payload)
 
+        # Contacts are records of their own, shown on the client page and used
+        # for invoicing — not the legacy contact_* fields on the client (CRO-83).
+        if contact_name:
+            contact = api_client.post(f"/clients/{data.get('id')}/contacts/", data={
+                "name": contact_name,
+                "email": contact_email or "",
+                "is_primary": True,
+            })
+            data["contacts"] = [contact]
+
         if output_json:
             print_json(data)
         else:
             format_success(f"Client '{data.get('name')}' created (ID: {data.get('id')})")
+            if contact_name:
+                console.print(f"  Primary contact: {contact_name}" + (f" <{contact_email}>" if contact_email else ""))
     except APIError as e:
         format_error(e.message)
         raise typer.Exit(1)
@@ -203,7 +236,7 @@ def edit(
     country: Optional[str] = typer.Option(None, "--country", help="Country."),
     output_json: bool = typer.Option(False, "--json", help="Output as JSON."),
 ) -> None:
-    """Edit an existing client.
+    """Edit an existing client. --contact/--email update its primary contact.
 
     Examples:
         ct clients edit <client-id> --name "New Name"
@@ -216,10 +249,6 @@ def edit(
         payload["name"] = name
     if currency is not None:
         payload["currency"] = currency
-    if contact_name is not None:
-        payload["contact_name"] = contact_name
-    if contact_email is not None:
-        payload["contact_email"] = contact_email
     if address_line1 is not None:
         payload["address_line1"] = address_line1
     if city is not None:
@@ -231,12 +260,35 @@ def edit(
     if country is not None:
         payload["country"] = country
 
-    if not payload:
+    contact_payload: dict = {}
+    if contact_name is not None:
+        contact_payload["name"] = contact_name
+    if contact_email is not None:
+        contact_payload["email"] = contact_email
+
+    if not payload and not contact_payload:
         format_error("No changes specified. Use --name, --currency, --contact, etc.")
         raise typer.Exit(1)
 
     try:
-        data = api_client.patch(f"/clients/{client_id}/", data=payload)
+        if payload:
+            data = api_client.patch(f"/clients/{client_id}/", data=payload)
+        else:
+            data = api_client.get(f"/clients/{client_id}/")
+
+        # Contacts are records of their own, shown on the client page and used
+        # for invoicing (CRO-83): update the primary one, or create it.
+        if contact_payload:
+            contacts = extract_results(api_client.get(f"/clients/{client_id}/contacts/"))
+            primary = next((c for c in contacts if c.get("is_primary")), contacts[0] if contacts else None)
+            if primary:
+                api_client.patch(f"/clients/{client_id}/contacts/{primary['id']}/", data=contact_payload)
+            elif contact_payload.get("name"):
+                api_client.post(f"/clients/{client_id}/contacts/", data={**contact_payload, "is_primary": True})
+            else:
+                format_error("This client has no contact yet — pass --contact (the contact's name) with --email.")
+                raise typer.Exit(1)
+            data = api_client.get(f"/clients/{client_id}/")
 
         if output_json:
             print_json(data)

{crowdtime_cli-0.17.1 → crowdtime_cli-0.19.0}/src/crowdtime_cli/commands/config_cmd.py

@@ -8,7 +8,7 @@ import subprocess
 import typer
 from rich.console import Console
 
-from ..config import get_config
+from ..config import INSECURE_SERVER_URL_WARNING, get_config, is_insecure_server_url
 from ..formatters import format_error, format_success, print_json
 
 app = typer.Typer(name="config", help="Manage CLI configuration.")
@@ -23,11 +23,13 @@ def config_set(
     """Set a configuration value.
 
     Examples:
-        ct config set server.url https://api.crowdtime.io
+        ct config set server.url https://api.crowdtime.lat
         ct config set defaults.project myproject
         ct config set defaults.daily_target 7h
     """
     config = get_config()
+    if key == "server.url" and is_insecure_server_url(value):
+        typer.echo(INSECURE_SERVER_URL_WARNING.format(url=value), err=True)
     # Convert boolean strings
     if value.lower() in ("true", "yes", "1"):
         config.set(key, True)

{crowdtime_cli-0.17.1 → crowdtime_cli-0.19.0}/src/crowdtime_cli/commands/insights_cmd.py

@@ -571,7 +571,8 @@ def profitability_insights(
 
     Revenue is computed from billable time entries. Cost is derived from team
     compensation configs (hourly rate or prorated salary). Margin = Revenue - Cost.
-    Requires manager+ role. Cost data requires payroll compensation configs.
+    Requires manager+ role. Cost and margin are shown to admins and owners only
+    (they derive from payroll); account managers get revenue and hours.
 
     Examples:
         ct insights profitability
@@ -671,7 +672,8 @@ def profitability_insights(
 
         if not has_cost:
             console.print(
-                "[dim]ℹ Cost data unavailable — configure compensation in Payroll to see margins.[/dim]"
+                "[dim]ℹ Cost and margin are not shown. They derive from payroll, so they are "
+                "visible to admins and owners only, and need compensation configured in Payroll.[/dim]"
             )
 
         console.print()

{crowdtime_cli-0.17.1 → crowdtime_cli-0.19.0}/src/crowdtime_cli/commands/log_cmd.py

@@ -277,8 +277,15 @@ def bulk_delete(
         if skipped:
             for s in skipped:
                 console.print(f"  [yellow]Skipped[/yellow] {s['id']}: {s['reason']}")
+        # Entries that aren't yours are not reported at all — the server
+        # treats them as not found.
+        unmatched = len(set(ids)) - deleted_count - len(skipped)
         if not deleted_count and not skipped:
             console.print("[dim]No matching entries found.[/dim]")
+        elif unmatched > 0:
+            console.print(
+                f"  [dim]{unmatched} ID(s) not found (wrong ID, or not your entry).[/dim]"
+            )
     except APIError as e:
         format_error(e.message)
         raise typer.Exit(1)
@@ -374,11 +381,23 @@ def list_entries(
     task: Optional[str] = typer.Option(None, "--task", "-t", help="Filter by task name or ID."),
     billable: Optional[bool] = typer.Option(None, "--billable/--no-billable", "-b/-B",
                                             help="Filter by billable status."),
-    user: Optional[str] = typer.Option(None, "--user", "-u", help="Filter by user ID (manager+ only)."),
+    user: Optional[str] = typer.Option(
+        None, "--user", "-u",
+        help="Filter by user ID. Only people whose time you can see: yourself, your direct "
+             "reports (manager), and anyone on projects you manage (project manager).",
+    ),
+    mine: bool = typer.Option(
+        False, "--mine",
+        help="Only your own entries. Managers and project managers otherwise also see "
+             "the time of the people and projects they manage.",
+    ),
     format_output: str = typer.Option("table", "--format", help="Output format: table, json, csv."),
     output_json: bool = typer.Option(False, "--json", help="Output as JSON."),
 ) -> None:
-    """List time entries with optional filters."""
+    """List time entries with optional filters.
+
+    The table and CSV show a User column whenever an entry isn't yours.
+    """
     effective_date = date
     if today_flag:
         effective_date = "today"
@@ -395,6 +414,7 @@ def list_entries(
         task=task,
         billable=billable,
         user=user,
+        mine=mine,
         format_output=format_output,
         output_json=output_json,
     )
@@ -410,6 +430,7 @@ def _list_entries(
     task: str | None = None,
     billable: bool | None = None,
     user: str | None = None,
+    mine: bool = False,
     format_output: str = "table",
     output_json: bool = False,
 ) -> None:
@@ -418,6 +439,14 @@ def _list_entries(
 
     client = CrowdTimeClient(require_auth=True, require_org=True)
 
+    # Known up front so other people's entries can be told apart (CRO-85).
+    me = client.current_user_id()
+    if mine:
+        if not me:
+            format_error("Could not resolve your user id. Run ct auth login again.")
+            raise typer.Exit(1)
+        user = me
+
     params: dict = {}
 
     if date_str:
@@ -477,7 +506,10 @@ def _list_entries(
         elif format_output == "csv":
             _print_csv(entries)
         else:
-            format_entries_table(entries, show_date=True)
+            # Someone else's entry with no owner column looks like your own;
+            # the column appears as soon as the list holds one (CRO-85).
+            foreign = any(e.user and e.user != me for e in entries)
+            format_entries_table(entries, show_date=True, show_user=bool(user) or foreign)
     except APIError as e:
         format_error(e.message)
         raise typer.Exit(1)
@@ -485,13 +517,14 @@ def _list_entries(
 
 def _print_csv(entries: list[TimeEntry]) -> None:
     """Print entries as CSV (plain output, safe for piping)."""
-    print("id,date,project,task,description,duration,billable,hourly_rate,billable_amount")
+    print("id,date,user,project,task,description,duration,billable,hourly_rate,billable_amount")
     for e in entries:
         desc = (e.description or "").replace('"', '""')
+        user_name = (e.user_name or "").replace('"', '""')
         rate = getattr(e, "hourly_rate", None) or ""
         amount = getattr(e, "billable_amount", None) or ""
         print(
-            f'{e.id},{e.date or ""},'
+            f'{e.id},{e.date or ""},"{user_name}",'
             f'{e.project_name or ""},{e.task_name or ""},'
             f'"{desc}",{e.duration or 0},'
             f'{"yes" if e.is_billable else "no"},'

{crowdtime_cli-0.17.1 → crowdtime_cli-0.19.0}/src/crowdtime_cli/commands/org_cmd.py

@@ -231,7 +231,10 @@ def update_member(
     capacity: Optional[float] = typer.Option(None, "--capacity", help="Weekly capacity hours."),
     output_json: bool = typer.Option(False, "--json", help="Output as JSON."),
 ) -> None:
-    """Update an organization member's role, rate, or capacity.
+    """Update an organization member's role, rate, or capacity (admin+).
+
+    You cannot grant a role above your own, and only the owner can change
+    the owner's membership. Ownership is not assignable here.
 
     Examples:
         ct org update-member <user-id> --role project_manager
@@ -363,7 +366,7 @@ def revoke_invite(
 def invitations(
     output_json: bool = typer.Option(False, "--json", help="Output as JSON."),
 ) -> None:
-    """List pending invitations for the current organization."""
+    """List pending invitations for the current organization (admin+)."""
     client = CrowdTimeClient(require_auth=True, require_org=True)
 
     try:

{crowdtime_cli-0.17.1 → crowdtime_cli-0.19.0}/src/crowdtime_cli/commands/report_cmd.py

@@ -649,7 +649,7 @@ def saved_delete(
     client = CrowdTimeClient(require_auth=True, require_org=True)
 
     if not force:
-        if not typer.confirm(f"Delete saved report {report_id[:8]}…?"):
+        if not typer.confirm(f"Delete saved report {report_id}?"):
             console.print("[dim]Cancelled.[/dim]")
             raise typer.Exit(0)