deepcell-cli 0.6.1__tar.gz → 0.6.3__tar.gz

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepcell-cli
-Version: 0.6.1
+Version: 0.6.3
 Summary: Build and revise .deepcell documents from a terminal — the reasoning, the calculations, the document and the deck, with the links between them
 Author-email: DeepCell <hello@deepcell.net>
 License-Expression: MIT
@@ -36,12 +36,12 @@ Command-line interface for **DeepCell** — a versionable `.deepcell` document t
 
 ```bash
 # macOS / Linux
-curl -LsSf https://beta.deepcell.net/install.sh | sh
+curl -LsSf https://deepcell.net/install.sh | sh
 ```
 
 ```powershell
 # Windows (PowerShell)
-irm https://beta.deepcell.net/install.ps1 | iex
+irm https://deepcell.net/install.ps1 | iex
 ```
 
 ```bash
@@ -166,8 +166,8 @@ deepcell defs apply model.deepcell --ops ops.json     # many ops, atomically
 | Document surface | `doc` — outline, blocks, body, links, lint |
 | Deck surface | `deck` — slides, ordering, binding, branding |
 | Change review | `changes list / diff / revert`, `impact` |
-| Version control | `log`, `diff`, `restore` |
-| Sync | `clone`, `status`, `pull`, `push`, `commit`, `merge` |
+| Version control | `log`, `diff`, `restore`, `commit` |
+| Sync (people, not agents) | `clone`, `status`, `pull`, `push`, `merge` |
 | Import / export | `import`, `ingest`, `to-excel`, `to-docx`, `to-pptx`, `to-pdf` |
 | Reasoning | `reasoning`, `reasoning-diff`, `claim`, `assumption` |
 | Delivery | `viewer`, `share create / list / revoke` |
@@ -218,7 +218,9 @@ deepcell push -m "Updated assumptions"   # upload
 deepcell pull                            # fetch cloud changes
 ```
 
-A `.deepcell/` metadata directory tracks the project link and sync state. `push` refuses to clobber cloud changes — it asks you to `pull` first. See `deepcell guide revise/history`.
+A `.deepcell/` metadata directory tracks the project link and sync state. `push` refuses to clobber cloud changes — it asks you to `pull` first. See `deepcell help clone`.
+
+Sync moves *bytes*, not the commands that read them: `query`, `describe --lint`, `cat` and every other read address the project on the server, so inside a clone they answer from the cloud's HEAD and not from the file you just edited. `push` first, then read back. Sync is a human workflow for this reason and is unavailable over MCP.
 
 ## Import & export
 
@@ -249,7 +251,7 @@ Interactive and sync commands (`login`, `clone`, `push`, …) are blocked inside
 
 | Variable | Purpose | Default |
 |----------|---------|---------|
-| `DEEPCELL_API_URL` | API endpoint | `https://beta.deepcell.net/api/jingwei` |
+| `DEEPCELL_API_URL` | API endpoint | `https://deepcell.net/api/jingwei` |
 | `DEEPCELL_PROJECT` | Override active project | _(none)_ |
 | `DEEPCELL_ACCESS_TOKEN` | Auth token for CI/headless use | _(none)_ |
 | `DEEPCELL_CONFIG` | Alternate `config.json` path (session-scoped) | `~/.deepcell/config.json` |

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/README.md

@@ -4,12 +4,12 @@ Command-line interface for **DeepCell** — a versionable `.deepcell` document t
 
 ```bash
 # macOS / Linux
-curl -LsSf https://beta.deepcell.net/install.sh | sh
+curl -LsSf https://deepcell.net/install.sh | sh
 ```
 
 ```powershell
 # Windows (PowerShell)
-irm https://beta.deepcell.net/install.ps1 | iex
+irm https://deepcell.net/install.ps1 | iex
 ```
 
 ```bash
@@ -134,8 +134,8 @@ deepcell defs apply model.deepcell --ops ops.json     # many ops, atomically
 | Document surface | `doc` — outline, blocks, body, links, lint |
 | Deck surface | `deck` — slides, ordering, binding, branding |
 | Change review | `changes list / diff / revert`, `impact` |
-| Version control | `log`, `diff`, `restore` |
-| Sync | `clone`, `status`, `pull`, `push`, `commit`, `merge` |
+| Version control | `log`, `diff`, `restore`, `commit` |
+| Sync (people, not agents) | `clone`, `status`, `pull`, `push`, `merge` |
 | Import / export | `import`, `ingest`, `to-excel`, `to-docx`, `to-pptx`, `to-pdf` |
 | Reasoning | `reasoning`, `reasoning-diff`, `claim`, `assumption` |
 | Delivery | `viewer`, `share create / list / revoke` |
@@ -186,7 +186,9 @@ deepcell push -m "Updated assumptions"   # upload
 deepcell pull                            # fetch cloud changes
 ```
 
-A `.deepcell/` metadata directory tracks the project link and sync state. `push` refuses to clobber cloud changes — it asks you to `pull` first. See `deepcell guide revise/history`.
+A `.deepcell/` metadata directory tracks the project link and sync state. `push` refuses to clobber cloud changes — it asks you to `pull` first. See `deepcell help clone`.
+
+Sync moves *bytes*, not the commands that read them: `query`, `describe --lint`, `cat` and every other read address the project on the server, so inside a clone they answer from the cloud's HEAD and not from the file you just edited. `push` first, then read back. Sync is a human workflow for this reason and is unavailable over MCP.
 
 ## Import & export
 
@@ -217,7 +219,7 @@ Interactive and sync commands (`login`, `clone`, `push`, …) are blocked inside
 
 | Variable | Purpose | Default |
 |----------|---------|---------|
-| `DEEPCELL_API_URL` | API endpoint | `https://beta.deepcell.net/api/jingwei` |
+| `DEEPCELL_API_URL` | API endpoint | `https://deepcell.net/api/jingwei` |
 | `DEEPCELL_PROJECT` | Override active project | _(none)_ |
 | `DEEPCELL_ACCESS_TOKEN` | Auth token for CI/headless use | _(none)_ |
 | `DEEPCELL_CONFIG` | Alternate `config.json` path (session-scoped) | `~/.deepcell/config.json` |

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "deepcell-cli"
-version = "0.6.1"
+version = "0.6.3"
 description = "Build and revise .deepcell documents from a terminal — the reasoning, the calculations, the document and the deck, with the links between them"
 readme = "README.md"
 license = "MIT"
@@ -42,12 +42,10 @@ deepcell-mcp = "deepcell_cli.mcp_server:main"
 # deliberately no Repository or Issues entry: the CLI is developed in a private
 # repository, and a link to one nobody can open is worse than no link.
 #
-# deepcell.net is the canonical host the site is moving to shortly; it does not
-# resolve yet, so these two links go live when the domain does. That is a
-# deliberate trade for not stamping the outgoing beta host into the metadata of
-# a release that cannot be re-uploaded. The installer URLs are NOT part of it —
-# they stay on beta.deepcell.net, because a curl that 404s is a broken install
-# today rather than a link that is briefly grey.
+# deepcell.net is the canonical origin and serves the site. beta.deepcell.net
+# answers the same deployment and is deliberately left un-redirected, because
+# every CLI already installed has it baked in as its API default — but it is
+# not what anything new should hand out.
 [project.urls]
 Homepage = "https://deepcell.net"
 Documentation = "https://deepcell.net/product/cli"

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/src/deepcell_cli/__init__.py

@@ -9,4 +9,4 @@ same thing, and a third is stamped into ``docs/cli-surface.json`` by
 reports a version it is not, and skipping the regen lands a red build.
 """
 
-__version__ = "0.6.1"
+__version__ = "0.6.3"

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/src/deepcell_cli/capabilities.py

@@ -33,6 +33,7 @@ MCP_ALLOWED_COMMANDS = frozenset(
         "cell-meta",
         "changes",
         "claim",
+        "commit",
         "deck",
         "defs",
         "describe",
@@ -61,13 +62,23 @@ MCP_ALLOWED_COMMANDS = frozenset(
         "rm",
         "rules",
         "share",
-        "variant",
         "viewer",
         "whoami",
+        # `workspace` is the pre-rename spelling of `project` — a hidden alias
+        # of the same Group. Hidden is not unreachable: `_parse_command`
+        # dispatches through Click, which runs a hidden command like any other,
+        # so the alias needs a policy of its own or it is reachable with none
+        # declared. It carries `project`'s policy because it IS `project`.
+        "workspace",
         "write",
     }
 )
 
+#: Allowed spellings that are aliases of another allowed command. They need an
+#: MCP policy (they run) but must NOT reach the tool catalog: documenting a
+#: second spelling of `project` would put back the row the alias is hidden from.
+MCP_ALIAS_COMMANDS = frozenset({"workspace"})
+
 # Reason codes are stable data rendered into help, guide, MCP errors, and the
 # for-agent page.  The detail is for maintainers and structured clients; user
 # prose remains translated at its own surface.
@@ -80,10 +91,6 @@ MCP_BLOCKED_COMMANDS: dict[str, dict[str, str]] = {
         "reason": "local_checkout",
         "detail": "creates and updates a local Git working copy",
     },
-    "commit": {
-        "reason": "local_checkout",
-        "detail": "reads local sync state and commits a working copy",
-    },
     "login": {
         "reason": "interactive_auth",
         "detail": "opens or polls an interactive browser authentication flow",
@@ -132,6 +139,15 @@ MCP_BLOCKED_COMMANDS: dict[str, dict[str, str]] = {
         "reason": "shared_host_install",
         "detail": "would inspect or replace the CLI installed on the MCP host",
     },
+    "variant": {
+        "reason": "local_checkout",
+        "detail": (
+            "branches the whole file set, and only a working copy can use one: "
+            "`checkout` resets a local tree, and no write command takes a "
+            "`--variant`, so a caller with no clone cannot put anything on a "
+            "branch for `diff` or `merge` to act on"
+        ),
+    },
     "verify-email": {
         "reason": "interactive_auth",
         "detail": "prompts for a verification token sent out of band",

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/src/deepcell_cli/capability-contract.json

@@ -427,9 +427,9 @@
           "reason": "not_dispatched"
         },
         "mcp": {
-          "available": false,
-          "detail": "reads local sync state and commits a working copy",
-          "reason": "local_checkout"
+          "available": true,
+          "detail": null,
+          "reason": null
         }
       }
     },
@@ -5817,9 +5817,9 @@
           "reason": "not_dispatched"
         },
         "mcp": {
-          "available": true,
-          "detail": null,
-          "reason": null
+          "available": false,
+          "detail": "branches the whole file set, and only a working copy can use one: `checkout` resets a local tree, and no write command takes a `--variant`, so a caller with no clone cannot put anything on a branch for `diff` or `merge` to act on",
+          "reason": "local_checkout"
         }
       }
     },
@@ -5848,9 +5848,9 @@
           "reason": "not_dispatched"
         },
         "mcp": {
-          "available": true,
-          "detail": null,
-          "reason": null
+          "available": false,
+          "detail": "branches the whole file set, and only a working copy can use one: `checkout` resets a local tree, and no write command takes a `--variant`, so a caller with no clone cannot put anything on a branch for `diff` or `merge` to act on",
+          "reason": "local_checkout"
         }
       }
     },
@@ -5879,9 +5879,9 @@
           "reason": "not_dispatched"
         },
         "mcp": {
-          "available": true,
-          "detail": null,
-          "reason": null
+          "available": false,
+          "detail": "branches the whole file set, and only a working copy can use one: `checkout` resets a local tree, and no write command takes a `--variant`, so a caller with no clone cannot put anything on a branch for `diff` or `merge` to act on",
+          "reason": "local_checkout"
         }
       }
     },
@@ -5910,9 +5910,9 @@
           "reason": "not_dispatched"
         },
         "mcp": {
-          "available": true,
-          "detail": null,
-          "reason": null
+          "available": false,
+          "detail": "branches the whole file set, and only a working copy can use one: `checkout` resets a local tree, and no write command takes a `--variant`, so a caller with no clone cannot put anything on a branch for `diff` or `merge` to act on",
+          "reason": "local_checkout"
         }
       }
     },
@@ -5941,9 +5941,9 @@
           "reason": "not_dispatched"
         },
         "mcp": {
-          "available": true,
-          "detail": null,
-          "reason": null
+          "available": false,
+          "detail": "branches the whole file set, and only a working copy can use one: `checkout` resets a local tree, and no write command takes a `--variant`, so a caller with no clone cannot put anything on a branch for `diff` or `merge` to act on",
+          "reason": "local_checkout"
         }
       }
     },

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/src/deepcell_cli/client.py

@@ -111,7 +111,16 @@ class DeepCellClient:
         # which build their own per-request headers and would otherwise be the
         # two calls a new user makes before anything else. httpx merges these
         # with per-request headers rather than replacing them.
-        self._http = httpx.Client(timeout=_TIMEOUT, headers=client_headers())
+        # `follow_redirects` because httpx defaults it to False, and an installed
+        # CLI outlives the hostname it was built against: every copy already in
+        # the wild has `https://beta.deepcell.net/api/jingwei` baked in as its
+        # default. The day that host answers a 301 instead of serving, a client
+        # that does not follow redirects reports the 3xx as a hard failure and
+        # every one of those installs breaks at once — which is why beta is kept
+        # serving rather than redirected. This makes the next move survivable.
+        self._http = httpx.Client(
+            timeout=_TIMEOUT, headers=client_headers(), follow_redirects=True
+        )
 
     # ── Helpers ─────────────────────────────────────────────
 

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/src/deepcell_cli/commands/help_cmd.py

@@ -257,6 +257,19 @@ def help_cmd(
     if command:
         path = " ".join(command)
         entry = commands.get(path)
+        if entry is None:
+            # A HIDDEN command is absent from the listing on purpose but still
+            # runs, so asking for it by name must answer. `clone` is the case:
+            # `cli/README.md` points a person at `deepcell help clone`, and the
+            # listing it is hidden from is not the same question as the flags it
+            # takes. Only reached on an explicit name — the index, the stage
+            # filters and every generated surface still see the visible set.
+            hidden_entry = build_commands(include_hidden=True).get(path)
+            if hidden_entry is not None:
+                entry = {
+                    **hidden_entry,
+                    "capability": get_command_capability(path),
+                }
         if entry is None:
             # `build_commands()` keys leaf commands only, so a group path misses
             # the table. Asking what is under `defs` is a well-formed question
@@ -267,6 +280,16 @@ def help_cmd(
             children = sorted(
                 name for name in commands if name.startswith(f"{path} ")
             )
+            if not children:
+                # A hidden GROUP is keyed nowhere — `build_commands` keys leaves
+                # — so `deepcell help variant` has to find its children the same
+                # way, in the hidden-inclusive tree.
+                all_commands = build_commands(include_hidden=True)
+                children = sorted(
+                    name for name in all_commands if name.startswith(f"{path} ")
+                )
+                if children:
+                    commands = {**all_commands, **commands}
             if children:
                 if ctx.fmt == "json":
                     output({"group": path, "commands": children}, ctx.fmt)

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/src/deepcell_cli/commands/sync.py

@@ -1,6 +1,10 @@
-"""Sync commands: clone, pull, push, status, commit.
+"""Sync commands: clone, pull, push, status.
 
-Git-like sync between a local folder and a cloud DeepCell workspace.
+Git-like sync between a local folder and a cloud DeepCell workspace. Every
+command here genuinely reads or writes a local working copy — that is the
+membership rule, and `commit` failed it: it posts to
+`/workspaces/{slug}/versions/commit` and touches no local file, so it lives in
+`version.py` with the rest of the server-side history commands.
 """
 
 from __future__ import annotations
@@ -742,63 +746,3 @@ def push(ctx: Ctx, message: str) -> None:
             "push again"
         )
         raise click.exceptions.Exit(1)
-
-
-# -- commit (server-side pending) ---------------------------------------------
-
-
-@click.command()
-@click.option("-m", "--message", default=None, help="Commit message.")
-@pass_ctx
-def commit(ctx: Ctx, message: str | None) -> None:
-    """Commit changes staged on the server by something other than you.
-
-    You almost certainly do not need this. `defs`, `edit`, `write` and
-    `reasoning` each commit their own change with their own `-m` — there is no
-    staging area they queue into. This commits what a *different* actor left
-    pending on the server, such as files created by an agent session.
-
-    Nothing staged is a no-op, not an error.
-    """
-    root, state = _require_sync_root(ctx)
-    slug = state.workspace_slug
-
-    # `-m` is no longer `required=True`, so this reaches the server even when
-    # the caller gave no message. The server checks "is anything staged"
-    # first and answers the no-op; a commit that will actually write still
-    # 422s without a message, and that is re-raised below as a usage error.
-    #
-    # It used to be rejected by Click during parsing, so a worker whose defs
-    # ops had each already committed and who reasonably tried to finalize got
-    # "Missing option '-m' / '--message'" — an argument-syntax error for a
-    # command with nothing to do. That is what the 2026-08-02 CLI eval hit.
-    data = ctx.client.post(
-        f"/workspaces/{slug}/versions/commit",
-        json={"message": message or ""},
-    )
-
-    # A commit with nothing staged is a benign no-op (the endpoint answers
-    # 200 with committed=false, sha=null) — report it instead of slicing a
-    # null sha.
-    if isinstance(data, dict) and data.get("committed") is False:
-        echo_info(
-            "Nothing to commit — no pending changes. `defs`, `edit`, `write` "
-            "and `reasoning` each commit their own change, so there is "
-            "normally nothing here to finalize."
-        )
-        return
-
-    sha = (data.get("sha") or "")[:8] if isinstance(data, dict) else ""
-    # Staged content is committed either way (the server persists invalid
-    # .deepcell on purpose), so report the errors rather than letting a clean
-    # "Committed" line stand in for them — parity with write/push.
-    invalid = echo_validation_map(
-        data.get("validation") if isinstance(data, dict) else None
-    )
-    if invalid:
-        echo_warning(
-            f"Committed ({sha}), but {len(invalid)} file(s) have validation "
-            f"error(s): {', '.join(invalid)} — fix the errors above"
-        )
-        raise click.exceptions.Exit(1)
-    echo_success(f"Committed ({sha}): {message}")

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/src/deepcell_cli/commands/version.py

@@ -1,4 +1,4 @@
-"""Version control commands: log, diff, restore."""
+"""Version control commands: log, diff, restore, commit."""
 
 from __future__ import annotations
 
@@ -7,7 +7,8 @@ import click
 from deepcell_cli.errors import APIError
 from deepcell_cli.context import Ctx, pass_ctx
 from deepcell_cli.output import (
-    echo_error, echo_info, echo_success, echo_warning, output, output_mutation, print_plain,
+    echo_error, echo_info, echo_success, echo_validation_map, echo_warning,
+    output, output_mutation, print_plain,
 )
 
 
@@ -443,3 +444,73 @@ def restore(ctx: Ctx, revision: str, filename: str | None, yes: bool) -> None:
             "Recover them from a newer revision (`deepcell log`, then "
             "`deepcell download <file> --revision <sha>`)."
         )
+
+
+# -- commit (finalize what another actor staged server-side) -------------------
+
+
+@click.command()
+@click.option("-m", "--message", default=None, help="Commit message.")
+@pass_ctx
+def commit(ctx: Ctx, message: str | None) -> None:
+    """Commit changes staged on the server by something other than you.
+
+    You almost certainly do not need this. `defs`, `edit`, `write` and
+    `reasoning` each commit their own change with their own `-m` — there is no
+    staging area they queue into. This commits what a *different* actor left
+    pending on the server, such as files created by an agent session.
+
+    Nothing staged is a no-op, not an error.
+    """
+    # Addressed by workspace, like everything else in this module. It used to
+    # live in `sync.py` and call `_require_sync_root`, which reads
+    # `.deepcell/sync.json` — for nothing but the slug, because the work is
+    # entirely server-side: `POST /workspaces/{slug}/versions/commit` stages
+    # nothing locally and reads no local file.
+    #
+    # That invented clone requirement cost the command the callers it exists
+    # for. It raised "Not inside a synced workspace" for anyone standing
+    # anywhere else, and it was blocked over MCP as `local_checkout` — a reason
+    # untrue of it. An agent, which is precisely who leaves changes staged,
+    # could not finalize them from any transport.
+    slug = ctx.require_workspace()
+
+    # `-m` is no longer `required=True`, so this reaches the server even when
+    # the caller gave no message. The server checks "is anything staged"
+    # first and answers the no-op; a commit that will actually write still
+    # 422s without a message, and that is re-raised below as a usage error.
+    #
+    # It used to be rejected by Click during parsing, so a worker whose defs
+    # ops had each already committed and who reasonably tried to finalize got
+    # "Missing option '-m' / '--message'" — an argument-syntax error for a
+    # command with nothing to do. That is what the 2026-08-02 CLI eval hit.
+    data = ctx.client.post(
+        f"/workspaces/{slug}/versions/commit",
+        json={"message": message or ""},
+    )
+
+    # A commit with nothing staged is a benign no-op (the endpoint answers
+    # 200 with committed=false, sha=null) — report it instead of slicing a
+    # null sha.
+    if isinstance(data, dict) and data.get("committed") is False:
+        echo_info(
+            "Nothing to commit — no pending changes. `defs`, `edit`, `write` "
+            "and `reasoning` each commit their own change, so there is "
+            "normally nothing here to finalize."
+        )
+        return
+
+    sha = (data.get("sha") or "")[:8] if isinstance(data, dict) else ""
+    # Staged content is committed either way (the server persists invalid
+    # .deepcell on purpose), so report the errors rather than letting a clean
+    # "Committed" line stand in for them — parity with write/push.
+    invalid = echo_validation_map(
+        data.get("validation") if isinstance(data, dict) else None
+    )
+    if invalid:
+        echo_warning(
+            f"Committed ({sha}), but {len(invalid)} file(s) have validation "
+            f"error(s): {', '.join(invalid)} — fix the errors above"
+        )
+        raise click.exceptions.Exit(1)
+    echo_success(f"Committed ({sha}): {message}")

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/src/deepcell_cli/config.py

@@ -19,7 +19,7 @@ _CREDS_FILE = _DIR / "credentials.json"
 
 # ── Defaults ────────────────────────────────────────────────
 
-DEFAULT_API_URL = "https://beta.deepcell.net/api/jingwei"
+DEFAULT_API_URL = "https://deepcell.net/api/jingwei"
 DEFAULT_FORMAT = "plain"
 
 # ── Environment overrides ───────────────────────────────────

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/src/deepcell_cli/main.py

@@ -442,11 +442,11 @@ from deepcell_cli.commands.impact import impact  # noqa: E402
 from deepcell_cli.commands.export_docx import to_docx  # noqa: E402
 from deepcell_cli.commands.export_pdf import to_pdf  # noqa: E402
 from deepcell_cli.commands.export_pptx import to_pptx  # noqa: E402
-from deepcell_cli.commands.version import log, diff, restore  # noqa: E402
+from deepcell_cli.commands.version import log, diff, restore, commit  # noqa: E402
 from deepcell_cli.commands.changes import changes  # noqa: E402
 from deepcell_cli.commands.variant import variant  # noqa: E402
 from deepcell_cli.commands.grep import grep  # noqa: E402
-from deepcell_cli.commands.sync import clone, pull, push, sync_status, commit  # noqa: E402
+from deepcell_cli.commands.sync import clone, pull, push, sync_status  # noqa: E402
 from deepcell_cli.commands.merge import merge  # noqa: E402
 from deepcell_cli.commands.import_cmd import import_cmd  # noqa: E402
 from deepcell_cli.commands.ingest import ingest  # noqa: E402
@@ -499,13 +499,34 @@ cli.add_command(log)
 cli.add_command(diff)
 cli.add_command(restore)
 cli.add_command(changes)
-cli.add_command(variant)
 cli.add_command(grep)
+cli.add_command(commit)
+
+# Local sync and variants: registered, working, and HIDDEN. Both are a person's
+# workflow at a terminal with a clone, and neither is discoverable any more —
+# `surface.py`, `main`'s own help and `docs/cli-commands.md`'s coverage test all
+# skip hidden commands, so they produce no help row and no entry in any
+# generated surface. Muscle memory and existing scripts keep working, and
+# `deepcell help <name>` still answers for each.
+#
+# Sync moves BYTES while every read addresses the project on the server, so a
+# clone is a working copy the read path cannot see. Variants branch the whole
+# file set, and no write command takes a variant, so a branch is only reachable
+# by checking it out onto disk. Both are therefore clone-shaped all the way
+# down, which is precisely what the agent surfaces do not have.
+#
+# The cost is deliberate and was weighed: the `variants` and `merge` domains
+# leave `docs/backend-cli-semantic-contracts.yaml`, because a hidden command is
+# absent from the capability contract the domain resolves through. Those two
+# backend domains now have no taught CLI command.
+for _person_only in (variant, clone, pull, push, sync_status, merge):
+    _person_only.hidden = True
+
+cli.add_command(variant)
 cli.add_command(clone)
 cli.add_command(pull)
 cli.add_command(push)
 cli.add_command(sync_status, "status")
-cli.add_command(commit)
 cli.add_command(merge)
 cli.add_command(import_cmd, "import")
 cli.add_command(ingest)

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/src/deepcell_cli/mcp_server.py

@@ -24,6 +24,7 @@ from click.testing import CliRunner
 from mcp.server.fastmcp import FastMCP
 
 from deepcell_cli.capabilities import (
+    MCP_ALIAS_COMMANDS,
     MCP_ALLOWED_COMMANDS,
     MCP_BLOCKED_COMMANDS as MCP_BLOCK_POLICY,
     blocked_mcp_commands,
@@ -48,7 +49,7 @@ AUTO_CONFIRM: dict[str, list[str]] = {
 # Top-level commands documented in TOOL_DESCRIPTION. Must stay equal to the
 # registered Click commands minus BLOCKED_COMMANDS — tests/test_mcp_server.py
 # cross-checks both directions so the catalog can't silently drift.
-DOCUMENTED_COMMANDS = frozenset(MCP_ALLOWED_COMMANDS)
+DOCUMENTED_COMMANDS = frozenset(MCP_ALLOWED_COMMANDS) - MCP_ALIAS_COMMANDS
 
 TOOL_DESCRIPTION = """\
 Run a DeepCell CLI command. Structured results are JSON; `cat` prints raw XML
@@ -136,9 +137,6 @@ Available commands:
     replace <file> <old> <new>
                                 String-replace in XML (last resort — prefer defs;
                                 `edit --replace` is a deprecated alias)
-    variant list                List variants
-    variant create <name>       Create a variant
-                                (Note: variant checkout/diff/merge need a LOCAL clone — blocked here)
     rm <file>                   Delete a file (auto-confirmed)
     log [--file F] [-n N]       Show version history
     diff <rev_a> [rev_b]        Diff between revisions
@@ -147,6 +145,9 @@ Available commands:
     changes diff <base> [head]  What one change did, semantically
     changes revert <base> <head>
                                 Undo one change as a new commit (auto-confirmed)
+    commit [-m MSG]             Finalize changes another actor left staged
+                                (Rare: every writer commits its own change.
+                                Nothing staged is a no-op, not an error.)
 
   VERIFY — change one thing, see everything it affects
     relationships <file>        Show relationship graph
@@ -182,7 +183,8 @@ Available commands:
 
   SYNC — local <-> cloud
     download <file> -o <path>   Download file to local path
-                                (the rest of sync is blocked here — see below)
+                                (Sync proper is blocked here — it needs a clone.
+                                Note `commit` is NOT sync: see REVISE.)
 
   LEARN — the five reference surfaces
     help [command]              Every command, flag, exit code and example.
@@ -385,7 +387,7 @@ def _config_path_for_token(token: str) -> str:
     base config's ``api_url`` on creation: ``get_api_url()`` falls back to
     DEFAULT_API_URL (the public beta) when the config it reads has no
     ``api_url``, so handing a caller an empty config silently repointed a
-    self-hosted deployment at beta.deepcell.net. ``active_workspace`` is
+    self-hosted deployment at deepcell.net. ``active_workspace`` is
     deliberately NOT inherited — isolating it is the whole point of this file.
     """
     import hashlib

{deepcell_cli-0.6.1 → deepcell_cli-0.6.3}/src/deepcell_cli/oauth_provider.py

@@ -275,7 +275,9 @@ class DeepCellOAuthProvider(
         Returns ``None`` when the code is unknown, expired, or still pending.
         """
         try:
-            async with httpx.AsyncClient(timeout=10, headers=client_headers("mcp")) as client:
+            async with httpx.AsyncClient(
+                timeout=10, headers=client_headers("mcp"), follow_redirects=True
+            ) as client:
                 resp = await client.post(
                     f"{self.api_url}/auth/device/token",
                     json={"device_code": device_code},
@@ -436,7 +438,9 @@ class DeepCellOAuthProvider(
             headers["Authorization"] = f"Bearer {jingwei_api_key}"
 
         try:
-            async with httpx.AsyncClient(timeout=10, headers=client_headers("mcp")) as client:
+            async with httpx.AsyncClient(
+                timeout=10, headers=client_headers("mcp"), follow_redirects=True
+            ) as client:
                 resp = await client.post(
                     f"{self.api_url}/auth/api-keys/verify",
                     json={"key": token},
@@ -514,7 +518,9 @@ class DeepCellOAuthProvider(
         # so they simply expire (15 min).
         if isinstance(token, DeepCellRefreshToken):
             try:
-                async with httpx.AsyncClient(timeout=10, headers=client_headers("mcp")) as client:
+                async with httpx.AsyncClient(
+                    timeout=10, headers=client_headers("mcp"), follow_redirects=True
+                ) as client:
                     await client.post(
                         f"{self.api_url}/auth/revoke-token",
                         json={"refresh_token": token.token},
@@ -547,7 +553,9 @@ class DeepCellOAuthProvider(
                 grant may still be valid, so the client should retry and keep it.
         """
         try:
-            async with httpx.AsyncClient(timeout=10, headers=client_headers("mcp")) as client:
+            async with httpx.AsyncClient(
+                timeout=10, headers=client_headers("mcp"), follow_redirects=True
+            ) as client:
                 resp = await client.post(
                     f"{self.api_url}/auth/refresh",
                     json={"refresh_token": raw_refresh_token},