dotagents-cli 0.6.1__tar.gz → 0.6.2__tar.gz

{dotagents_cli-0.6.1 → dotagents_cli-0.6.2}/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.6.2] - 2026-09-28
+
+### Added
+
+- With the `duho` floor bump, every `dotagents` invocation now checks
+  `DOTAGENTS_MCP=stdio` and serves its full command tree as an MCP server
+  over stdio when set. `env` opts itself out of that tool surface
+  (`_mcp_ = False`): its whole point is printing resolved, possibly secret
+  values, which should never be a callable MCP tool. Every other command is
+  unaffected, and `env` still works normally on the CLI.
+
+### Changed
+
+- The `duho` floor moves to `>=0.6.0,<0.7` (from `>=0.5.0,<0.6`); the vendored
+  `.pyz` pin (`build-pyz --duho-version`) moves with it, per the repo's own
+  rule that the two must always agree. No other source change was needed.
+
 ## [0.6.1] - 2026-09-27
 
 ### Fixed
@@ -1291,7 +1308,8 @@ Patch release: the PATH/POSIX-conversion fix above (the only change since 0.3.0)
   affected module sources (`dotagents.cli`, `duho.presets`) to extracted temp files
   before dispatch; a no-op for a plain install.
 
-[Unreleased]: https://github.com/jose-pr/dotagents/compare/v0.6.1...HEAD
+[Unreleased]: https://github.com/jose-pr/dotagents/compare/v0.6.2...HEAD
+[0.6.2]: https://github.com/jose-pr/dotagents/compare/v0.6.1...v0.6.2
 [0.6.1]: https://github.com/jose-pr/dotagents/compare/v0.6.0...v0.6.1
 [0.6.0]: https://github.com/jose-pr/dotagents/compare/v0.5.1...v0.6.0
 [0.5.1]: https://github.com/jose-pr/dotagents/compare/v0.5.0...v0.5.1

{dotagents_cli-0.6.1 → dotagents_cli-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: dotagents-cli
-Version: 0.6.1
+Version: 0.6.2
 Summary: The dotagents CLI: install and manage a portable ~/.agents config for AI coding agents
 Project-URL: Homepage, https://github.com/jose-pr/dotagents/
 Project-URL: Repository, https://github.com/jose-pr/dotagents
@@ -23,7 +23,7 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Typing :: Typed
 Requires-Python: >=3.9
-Requires-Dist: duho<0.6,>=0.5.0
+Requires-Dist: duho<0.7,>=0.6.0
 Requires-Dist: pathlib-next<0.10,>=0.9.0
 Requires-Dist: tomli>=1.1.0; python_version < '3.11'
 Provides-Extra: dev

{dotagents_cli-0.6.1 → dotagents_cli-0.6.2}/pyproject.toml

@@ -35,7 +35,7 @@ classifiers = [
 # `build-pyz` vendors the floor of each of these (src/dotagents/cli/build_pyz.py);
 # raise a floor and move its pin there in the same change.
 dependencies = [
-    "duho>=0.5.0,<0.6",
+    "duho>=0.6.0,<0.7",
     "pathlib_next>=0.9.0,<0.10",
     # overlay.toml manifests and TOML registries; tomllib is stdlib from 3.11.
     'tomli>=1.1.0; python_version < "3.11"',

{dotagents_cli-0.6.1 → dotagents_cli-0.6.2}/src/dotagents/__init__.py

@@ -1,3 +1,3 @@
 """dotagents: installable CLI for the dotagents agent-config payload."""
 
-__version__ = "0.6.1"
+__version__ = "0.6.2"

{dotagents_cli-0.6.1 → dotagents_cli-0.6.2}/src/dotagents/cli/__init__.py

@@ -217,9 +217,15 @@ def _discover_modules(directory: Path) -> "list":
     not an Exception. A command that imports but cannot build its parser is
     skipped the same way (`_buildable`). Falls back to duho's own
     per-directory unit, with a warning, if a duho release moves these
-    helpers."""
+    helpers.
+
+    Uses duho's PUBLIC `import_from_path` (duho >= 0.6.0) for the file
+    import; `_commands_in_module` has no public counterpart yet, so it stays
+    a private import (see `duho.discovery.import_from_path`'s own docstring:
+    it is the public counterpart of the `_unique_module_name` +
+    `_import_from_path` pair this module used to call directly)."""
     try:
-        from duho.discovery import _commands_in_module, _import_from_path, _unique_module_name
+        from duho.discovery import _commands_in_module, import_from_path
     except ImportError:  # pragma: no cover -- a later duho without these internals
         from duho.discovery import discover_commands
 
@@ -234,7 +240,7 @@ def _discover_modules(directory: Path) -> "list":
         if file.name.startswith("_"):
             continue
         try:
-            module = _import_from_path(_unique_module_name("duho._discovered." + file.stem), file)
+            module = import_from_path("duho._discovered." + file.stem, file)
             found = _commands_in_module(module, stem=file.stem)
         except (Exception, SystemExit) as exc:  # noqa: BLE001 -- see docstring
             _LOGGER.warning("skipping command module %s: %s", file, _describe(exc))

{dotagents_cli-0.6.1 → dotagents_cli-0.6.2}/src/dotagents/cli/build_pyz.py

@@ -73,7 +73,7 @@ class BuildPyz(LoggingArgs, Cmd):
     # stale pin here ships an artifact `pip install dotagents-cli` would refuse.
     # Pin the FLOOR of each declared range, not the latest patch -- the .pyz then
     # exercises the minimum the metadata promises.
-    duho_version: str = "0.5.0"
+    duho_version: str = "0.6.0"
     "Pinned duho version to vendor."
     ("--duho-version",)
 

{dotagents_cli-0.6.1 → dotagents_cli-0.6.2}/src/dotagents/cli/env.py

@@ -539,6 +539,15 @@ class Env(DotAgentsArgs):
 
     _parsername_ = "env"
 
+    # Opt out of the MCP tool surface (duho >= 0.6.0): this command's whole
+    # point is to print resolved, possibly secret values (see the class
+    # docstring's "Output is sensitive" note) -- exactly what an MCP client
+    # should never be handed as a callable tool. `_mcp_ = False` on a
+    # non-root command class hides it (and any subtree) from `tools/list`
+    # and refuses `tools/call` the same way an unknown name would; the CLI
+    # itself is unaffected.
+    _mcp_ = False
+
     format: str = "auto"
     (
         "Output format. Default 'auto' detects the calling shell. Shell forms: "

{dotagents_cli-0.6.1 → dotagents_cli-0.6.2}/tests/test_fix_cli.py

@@ -220,10 +220,13 @@ def test_moved_duho_internals_are_reported_not_silent(monkeypatch, tmp_path, cap
     real_import = builtins.__import__
 
     def renamed(name, globals=None, locals=None, fromlist=(), level=0):
-        # What a duho release that renamed its private helpers looks like to
-        # `from duho.discovery import _import_from_path, ...` -- and only to it.
-        if name == "duho.discovery" and "_import_from_path" in (fromlist or ()):
-            raise ImportError("cannot import name '_import_from_path'")
+        # What a duho release that renamed its remaining private helper looks
+        # like to `from duho.discovery import _commands_in_module, ...` --
+        # and only to it. `import_from_path` is duho's public counterpart
+        # (duho >= 0.6.0) and stays importable; `_commands_in_module` has no
+        # public counterpart yet, so it is the one still exposed to this risk.
+        if name == "duho.discovery" and "_commands_in_module" in (fromlist or ()):
+            raise ImportError("cannot import name '_commands_in_module'")
         return real_import(name, globals, locals, fromlist, level)
 
     monkeypatch.setattr(builtins, "__import__", renamed)

dotagents_cli-0.6.2/tests/test_mcp.py

@@ -0,0 +1,60 @@
+"""`env`'s MCP opt-out (duho >= 0.6.0).
+
+`env` prints resolved, possibly secret values (its own docstring's "Output is
+sensitive" note) -- exactly what an MCP client should never be handed as a
+callable tool. It is a compiled, module-level command CLASS (`Env`, one of
+`dotagents.cli._BUILTIN_COMMANDS`, dispatched via `duho.app`'s `commands=`),
+not a discovered `.py` module command, so the opt-out is the class-attribute
+form: `_mcp_ = False` set directly on `Env` (`dotagents/cli/env.py`) -- NOT a
+module-level `_mcp_ = False` in a `cmds/` file, which is the form for a
+discovered module command instead.
+
+`test_env_command_is_hidden_from_mcp_tools` drives a REAL
+`DOTAGENTS_MCP=stdio` session (the env-var trigger duho.app checks before
+parsing argv) in a subprocess, under the suite's autouse isolated
+HOME/AGENTS_* (tests/conftest.py) -- never the real `~/.agents`. It asserts
+`dotagents.env` is absent from `tools/list` while `dotagents.about` (an
+ordinary built-in) is still present, then that `env` still works as a normal
+CLI command -- the opt-out only removes it from the MCP surface.
+"""
+
+import json
+import os
+import subprocess
+import sys
+
+from dotagents.cli.env import Env
+
+
+def test_env_command_is_hidden_from_mcp_tools():
+    request = json.dumps({"jsonrpc": "2.0", "id": 1, "method": "tools/list"})
+    env = dict(os.environ)
+    env["DOTAGENTS_MCP"] = "stdio"
+
+    proc = subprocess.run(
+        [sys.executable, "-m", "dotagents"],
+        input=request + "\n",
+        capture_output=True,
+        text=True,
+        env=env,
+        timeout=30,
+    )
+    assert proc.returncode == 0, proc.stderr
+
+    lines = [line for line in proc.stdout.splitlines() if line.strip()]
+    assert len(lines) == 1, proc.stdout
+    response = json.loads(lines[0])
+    names = {tool["name"] for tool in response["result"]["tools"]}
+
+    assert "dotagents.about" in names, names
+    assert "dotagents.env" not in names, names
+    assert not any(name.startswith("dotagents.env.") for name in names), names
+
+
+def test_env_still_works_on_the_cli(capsys):
+    """The MCP opt-out is MCP-only: `env` dispatches normally on the CLI."""
+    command = Env()
+    command.format = "json"
+
+    assert command() == 0
+    assert isinstance(json.loads(capsys.readouterr().out), dict)

{dotagents_cli-0.6.1 → dotagents_cli-0.6.2}/tools/pyz_smoke.sh

@@ -76,7 +76,7 @@ has_re "$h" "$(flag --agents)"
 # modules, findings and launch. Matched on the command-list line, since
 # `overlays`' own description mentions its `sync` subcommand.
 h=$(pyz --help)
-has "$h" "{init,build-pyz,context,env,path,overlays,about,findings,launch}"
+has "$h" "{about,build-pyz,context,env,findings,init,launch,overlays,path}"
 lacks "$h" "link-project"
 lacks "$h" "sync-project"
 lacks "$h" "audit"