dh-cli 0.8.4__tar.gz → 0.8.6__tar.gz

{dh_cli-0.8.4 → dh_cli-0.8.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dh-cli
-Version: 0.8.4
+Version: 0.8.6
 Summary: Dayhoff Labs developer CLI
 Author-email: Dayhoff Labs <dev@dayhofflabs.com>
 License: # PolyForm Noncommercial License 1.0.0

{dh_cli-0.8.4 → dh_cli-0.8.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "dh-cli"
-version = "0.8.4"
+version = "0.8.6"
 description = "Dayhoff Labs developer CLI"
 requires-python = ">=3.11"
 readme = "README.md"

{dh_cli-0.8.4 → dh_cli-0.8.6}/src/dh_cli/bedrock/commands.py

@@ -80,7 +80,11 @@ def _resolve_handle_from_sts() -> str:
         )
 
     principal = cr.classify_arn(arn)
-    if principal.principal_type in ("claude-code", "cursor"):
+    # Accept any AWSReservedSSO_* session: DeveloperAccess,
+    # DevAdminAccess, SecurityAdministrator, etc. all carry the
+    # IdC username as the role-session-name, which is what we want
+    # as the developer handle.
+    if principal.principal_type in ("claude-code", "claude-code-other", "cursor"):
         return principal.principal_name
     raise click.ClickException(
         f"Couldn't infer a developer handle from your identity ({arn}). Pass --handle explicitly."

{dh_cli-0.8.4 → dh_cli-0.8.6}/src/dh_cli/github_commands.py

@@ -169,8 +169,9 @@ def _access_denied_diagnosis(session, requested_handle: str) -> None:
         typer.echo(
             RED
             + "Access denied reading the GitHub PAT secret. "
-            + "Most likely your SSO MFA is >1h old. "
-            + "Run `awslogin dev-devaccess` and retry."
+            + "Check that you're on the dev-devaccess profile with "
+            + "a live SSO session: `dh aws status`. If the session "
+            + "is expired, run `awslogin dev-devaccess` and retry."
             + NC,
             err=True,
         )
@@ -690,9 +691,10 @@ def gh_rotate(
         if code == "AccessDeniedException":
             typer.echo(
                 RED
-                + f"Access denied writing `{secret_id}`. Most likely "
-                + "your SSO MFA is >1h old. Run `awslogin "
-                + "dev-devaccess` and retry."
+                + f"Access denied writing `{secret_id}`. Check that "
+                + "you're on the dev-devaccess profile with a live "
+                + "SSO session: `dh aws status`. If the session is "
+                + "expired, run `awslogin dev-devaccess` and retry."
                 + NC,
                 err=True,
             )

{dh_cli-0.8.4 → dh_cli-0.8.6}/tests/batch/test_image_override.py

@@ -57,8 +57,7 @@ class TestImageValidation:
         [
             "123456789012.dkr.ecr.us-east-1.amazonaws.com/dayhoff-generic:abc123",
             "123456789012.dkr.ecr.us-west-2.amazonaws.com/foo/bar:latest",
-            "123456789012.dkr.ecr.us-east-1.amazonaws.com/x@sha256:"
-            + "a" * 64,
+            "123456789012.dkr.ecr.us-east-1.amazonaws.com/x@sha256:" + "a" * 64,
         ],
     )
     def test_accepts_ecr_url(self, good_image):

{dh_cli-0.8.4 → dh_cli-0.8.6}/tests/batch/test_submit_image_validation.py

@@ -63,9 +63,7 @@ class TestCliImageValidation:
                 }
             )
         )
-        result, _, mock_batch_cls = _invoke(
-            cli_runner, ["-f", str(config_path)], tmp_path
-        )
+        result, _, mock_batch_cls = _invoke(cli_runner, ["-f", str(config_path)], tmp_path)
         assert result.exit_code != 0
         assert "fully-qualified ECR URL" in result.output
         mock_batch_cls.assert_not_called()
@@ -82,9 +80,7 @@ class TestCliImageValidation:
         assert call_kwargs["image_override"] == good
 
     def test_no_image_skips_validation(self, cli_runner, tmp_path):
-        result, mock_client, _ = _invoke(
-            cli_runner, ["--command", "echo hi"], tmp_path
-        )
+        result, mock_client, _ = _invoke(cli_runner, ["--command", "echo hi"], tmp_path)
         assert result.exit_code == 0, result.output
         call_kwargs = mock_client.submit_job.call_args[1]
         assert call_kwargs.get("image_override") is None

{dh_cli-0.8.4 → dh_cli-0.8.6}/tests/bedrock/test_key_command.py

@@ -110,3 +110,18 @@ def test_key_unrecognised_caller_arn_exits_with_hint():
         result = _invoke([])
     assert result.exit_code != 0
     assert "--handle" in result.output
+
+
+def test_key_resolves_handle_from_dev_admin_access_session():
+    """DevAdminAccess (and any other AWSReservedSSO_* role) must resolve
+    to the session-name as the developer handle. Regression: earlier the
+    gate only accepted DeveloperAccess sessions, which broke `dh bedrock
+    key` for anyone running under an admin profile."""
+    sts = _build_sts_stub(
+        "arn:aws:sts::074735440724:assumed-role/AWSReservedSSO_DevAdminAccess_2506d659c73583cc/dma"
+    )
+    sm = _build_sm_stub()
+    with _patch_boto3(sts=sts, sm=sm):
+        result = _invoke([])
+    assert result.exit_code == 0, result.output
+    sm.get_secret_value.assert_called_once_with(SecretId="cursor-bedrock/dma")